2025-03-26 Ituma OIA
PO Box 12209, Wellington 6144
P +64 4 472 6881,
F +64 4 499 3701
www.gcsb.govt.nz
15 May 2025
Peter Ituma
[FYI request #30523 email]
Tēnā koe Peter
Official Information Act request
Thank you for your Official Information Act 1982 (OIA) request of 25 March 2025 to the
Government Communications Security Bureau (GCSB) seeking information about the GCSB’s
app and phone communication.
You were advised on 16 April 2025 that the time limit for responding to your request had
been extended to 9 May 2025 because the consultations necessary to make a decision on
your request were such that a proper response could not reasonably be made within the
original time limit. I understand my staff sent you a decision on this request on 8 May 2025.
Background
Before I respond to your request, it may be useful if I outline the context in which the GCSB
operates. Much of the GCSB’s business relates to classified information. There are well
established policies, processes and technology systems to protect and communicate
classified information, including New Zealand’s Protective Security Requirements and
New Zealand’s Information Security Manual (NZISM). GCSB staff are well aware that
messaging apps and mobile devices are an unclassified tool, and must not be used to store,
handle or transmit classified information.
In addition, I hold the role of the Government Chief Information Security Officer (GCISO). As
GCISO, I am responsible for uplifting information security practices across government,
identifying systemic risks and vulnerabilities, and providing guidance to help manage them.
One of the GCISO responsibilities is establishing minimum information security standards
through the development and maintenance of the NZISM. The GCSB follows best-practice
guidance in the NZISM regarding Distributed Working and Agency-owned Mobile Devices.
You can visit:
https://nzism.gcsb.govt.nz/ for more information.
The GCSB’s National Cyber Security Centre has also published advice which sets out
considerations to assist New Zealand Government agencies in making risk-based decisions
about the use of social media apps on government phones and other devices. This is
available online at:
https://www.ncsc.govt.nz/news/social-media-applications.
Response
In response to your questions, I can advise as follows (numbering added).
1
1. Are there policies in place to regulate the downloading of third-party apps such as Signal?
There are no specific policies in place for GCSB employees to regulate downloading of third-
party apps onto their work, or personal, mobile devices. However, all GCSB employees are
expected to maintain a high degree of security vigilance in all aspects of their professional
and personal lives, and staff can seek tailored advice and guidance from security experts on
best security practices for third-party apps as needed.
2. What security measures are in place to encrypt information that is sent from one GCSB mobile
device to another?
I am refusing this request under section 6(a) of the OIA, as release of this information would
be likely to prejudice the security or defence of New Zealand. As I am sure you can
appreciate, revealing details about our security measures could make GCSB devices more
vulnerable to exploitation.
You can learn more about best-practice requirements for mobile device communications
encryption in the NZISM, and in the Information Security section of the Protective Security
Requirements, available online at:
https://www.protectivesecurity.govt.nz/. 3. What happens if a GCSB mobile device is lost?
Staff must report lost devices to the relevant team, at which point we will assess appropriate
steps to recover the device or mitigate any risks.
4. How often are GCSB mobile devices replaced?
GCSB mobile devices are replaced when they no longer receive security updates or are no
longer fit for purpose.
5. Are these the same policies/practices/protocol applied at NZSIS and NAB?
The GCSB and New Zealand Security Intelligence Service share a number of functions,
including our Security Services Group. I can therefore advise the responses to questions 1 –
4 are the same for the NZSIS as the GCSB.
The GCSB is not responsible for mobile devices or policies at the National Assessments
Bureau, as that is part of the Department of the Prime Minister and Cabinet (DPMC). Your
request was therefore partially transferred to DPMC. You may expect a response from
DPMC regarding this part of your request in due course.
6. I expect that communication regularly takes place between the Director-General of the GCSB
and the Director-General of NZSIS. How many phones cal s were made/received so far in
2025?
7. How many text messages were sent/received? Is it possible to have the text messages, or to be
advised what the subject matter was about?
8. I am interested in text messages / iMessages / WhatsApp messages / Signal messages between
the two parties, as wel as with Nicky Haslem, so far in 2025.
I work closely with the Director-General of the NZSIS, Andrew Hampton, and our Chief
Financial Officer, Nicky Haslam. You may be interested to know that we work together in the
same building, which is a Secure Compartmented Information Facility (or SCIF). Our agencies
share a number of joint enabling functions, including Financial Services. We regularly
communicate using the appropriate channels for classified information, and typically discuss
matters in person together.
2
I have not made any phone calls or sent/received any text messages with Andrew Hampton
in 2025, noting the majority of our engagement takes place in person within a SCIF.
There are no text messages or similar between myself, Andrew Hampton and Nicky Haslam
in 2025.
9. I am interested in the text messages/ iMessages / WhatApp messages / Signal messages
between the GCSB Director-General and Minister Col ins, so far in 2025.
I have exchanged a small number of Signal messages with the Minister Responsible for the
GCSB, Hon Judith Collins KC, in 2025. A transcription of these messages is attached. Certain
information has been withheld in order to protect the privacy of natural persons, under
section 9(2)(a) of the OIA, and to maintain the effective conduct of public affairs through the
free and frank expression of opinions by or between or to Ministers of the Crown or
members of an organisation or officers and employees of any public service agency or
organisation in the course of their duty, under section 9(2)(g)(i) of the OIA.
Where information has been withheld under section 9 of the OIA, I do not consider that the
public interest in the protected information outweighs the need to protect it.
Review
If you would like to discuss this response with us, please feel free to contact
[GCSB request email]. You have the right to seek an investigation and review by the Ombudsman of this decision.
Information about how to make a complaint is available at
www.ombudsman.parliament.nz
or freephone 0800 802 602.
Please note that the GCSB proactively publishes OIA responses in accordance with the
expectations of Te Kawa Mataaho/the Public Service Commission. We may publish this letter
(with your personal information removed) on the GCSB website.
Ngā mihi
Andrew Clark Te Tumu Whakarae mō Te Tira Tiaki
Director-General, GCSB
3
Annex: transcribed messages between GCSB Director-General and Minister
Responsible for the GCSB in 2025
29 January 2025
Minister Responsible for the GCSB (Minister), 6:43pm: ORDER AT FELT.CO.NZ OR
[email address]. Andrew, I heard you asked about my spitfire trench art. It was made by Martin de Ruyter the
Chief Photographer at The Nelson Mail. Above are his details.
From the Spitfire trench art factory spitfiretrenchart.co.nz.
Director-General of GCSB (Director-General), 7:23pm: Thanks for that. It's a classy piece.
[withheld under section 9(2)(a)].
5 February 2025
Director-General, 8:11am: Good morning minister. A heads-up for you that the Chinese Al app DeepSeek has been
prohibited from all federal government devices. Australian news outlets are carrying the
news. We will provide you with advice and lines on it. My sense is that the issue is similar to
TikTok. Andrew
Director-General, 8:12am: *Australian federal government devices
Minister, 8:13am: [withheld under section 9(2)(g)(i)].
Director-General, 8:16am: [withheld under section 9(2)(g)(i)].
Director-General, 6:47pm: Hi Minister - just closing the loop with you on this DeepSeek issue for today. DPMC is calling
a meeting to discuss it further on Monday (from more than just a cyber security perspective).
Your office has today already given one response to a media Q that you are awaiting advice
from officials. If you can tolerate it, I suggest sticking with that line until after DPMC's
meeting early next week.
Minister, 11:04pm: Yes
4
18 February 2025
Minister, 5:57pm:
[withheld under section 9(2)(g)(i)]. Surely, every CE could mandate that for each of their
departments
Director-General, 5:58pm:
Yes, CEs have that power.
Director-General, 9:02pm: [protected under section 9(2)(g)(i)] instead of a proactive media statement, preference is for
you to out the fact that I have issued guidance today by asking the relevant question at the
open session of ISC tomorrow, if you're happy to do so. (Can discuss further if you wish)
Minister, 9:48pm: Sure can
I mean ask a question
5
