21 May 2025
Peter Ituma
[FYI request #30523 email]
Ref: OIA-2024/25-0845
Dear Peter Ituma
Official Information Act request relating to policies and protocols that apply to the
National Assessments Bureau for the use and security of information technology
Thank you for your Official Information Act 1982 (the Act) request transferred in part to the
Department of the Prime Minister and Cabinet (DPMC) on 28/04/2025. Your request dated
25/03/2025 was made to the Government Communications Security Bureau (GCSB). Part [5]
of your request asked about the National Assessments Bureau (NAB) policies and practices.
NAB is located within DPMC and so Part [5] of your request as it related to the NAB was
transferred to DPMC. Your full request is quoted below with the part transferred to DPMC in
bold and underlined (numbering has been added for ease of reference):
“
Fol owing the story of the US administration’s use of the app Signal I am
interested in learning more about the GCSB’s use of the app and phone
communication in general.
[1] Are there policies in place to regulate the downloading of third party
apps such as Signal?
[2] What security measures are in place to encrypt information that is
sent from one GCSB mobile device to another?
[3] What happens if a GCSB mobile device is lost?
[4] How often are GCSB mobile devices replaced?
[5] Are these the same policies/practices/protocol applied at NZSIS
and NAB?
[6] I expect that communication regularly takes place between the
Director-General of the GCSB and the Director-General of NZSIS.
How many phones calls were made/received so far in 2025?
[7] How many text messages were sent/received? Is it possible to have
the text messages, or to be advised what the subject matter was
about?
[8] I am interested in text messages / iMessages / WhatsApp messages /
Signal messages between the two parties, as well as with Nicky
Haslem, so far in 2025
[9] I am interested in the text messages/ iMessages / WhatApp
messages / Signal messages between the GCSB Director-General
and Minister Collins, so far in 2025.
I understand that for security reasons you may not be able to release all the
information to me. But I appreciate you considering my request.”
We have interpreted Part [5] of your request as it relates to NAB to be asking about the
policies, procedures and protocols for the use and security of information technology
(including mobile phones) by NAB staff.
NAB staff are covered by the same policies for information technology use and security as all
DPMC officials. DPMC does not hold information on the policies, practices or protocols that
5013875
Executive Wing, Parliament Buildings, Wellington, New Zealand 6011
64 4 817 9698 www.dpmc.govt.nz
might apply to GCSB officials. Accordingly, we have interpreted Part [5] of your request, as it
relates to NAB, to be for the relevant information technology policies, practices or protocols
that apply to DPMC officials.
Please find attached the following documents as set out in the table below which we have
identified as being relevant to your request.
Item
Date
Document Title
Decision
Item 1
7/10/2022
IT Code of Conduct
Release in Full
Item 2
23/04/2024 Protective Security Policy
Release in Full
Item 3
31/08/2023 Acceptable Use of Technology Policy
Release in Full
As noted in the table, I have decided to release these three relevant documents to you in full.
These are all DPMC corporate policies that sets out the policies and protocols for all DPMC
staff for use and security of DPMC information technology, including DPMC mobile phones.
Item 1 “IT Code of Conduct” sets out DPMC’s information technology code of conduct and is
taken from DPMC’s internal intranet – where DPMC staff access all DPMC corporate policies
and procedures. The code of conduct sets out the three general principles to help DPMC
staff make judgements about appropriate behaviour when using DPMC’s information and
communications technology. It links into the relevant corporate policies.
Item 2 “Protective Security Policy” is DPMC’s protective security policy and applies to
security for information technology. This policy is also available to all staff via the internal
intranet.
Item 3 “Acceptable Use of Technology Policy” sets out the policy for acceptable use of
DPMC technology which applies to all DPMC staff. This policy has been provided to DPMC
by our information technology provider, Corporate and Shared Services (CSS), which is
based in The Treasury. While this policy references The Treasury, it applies to DPMC staff.
For DPMC, where the document mentions “Treasury”, it should be read as “DPMC”.
You have the right to ask the Ombudsman to investigate and review my decision under
section 28(3) of the Act.
This response wil be published on the Department of the Prime Minister and Cabinet’s
website during our regular publication cycle. Typically, information is released monthly, or as
otherwise determined. Your personal information including name and contact details will be
removed for publication.
Yours sincerely
Bridget White
Executive Director
National Security Group
5013875
2
