New Zealand DEFENCE FORC Headquarters +64 (0)4 496 0999 Freyberg Budding, +54 (0)4 495 0869 Private Bag 3999?, Wellington 6011, New Zealand go July 2018 Nicholas Jones Investigations, NZ Herald Nicholas.Jones@nzherald.co.nz Dear Mr Jones I refer to your email of 18 June 2018 requesting, under the Official Information Act 1982 (OIA), the following: A list of incidents since January 1 2016 that your organisation is aware of and in which documents, reports or other materials have been mistakenly left unaccompanied in public (such as a staff member leaving a folder of material in a cafe or taxi). For each of the above incidents please provide the following details: what material was involved and whether this included any information about members of the public and an overview of such details (i.e people?s names, addresses, photographs), the date of the incident, where the material was left, whether it was recovered and how, and what actions took place as a result. For each of the incidents, please provide copies of any summary reports, documents or correspondence. One case was identified within scope of your request. The relevant Security Incident Report is enclosed. This provides all relevant information available. Where indicated, personal information has been withheld in accordance with section of the CIA. Public interest considerations do not outweigh the need to protect this privacy. You have the right, under section 28(3) of the CIA, to ask an Ombudsman to review my response to your request. Yours sincerely G.R. SMITH Commodore, RNZN Chief of Staff Enclosure: 1. Security incident Report prepared 08 September 2016 A FORCE FOR NEW ZEALAND . . Directorate of Defence Security Security Incident Report Subject: Service Number: Occupation: 1.0 Summary of Information 1.1 (R) On _2016, was movin out of his flat in The apartment complex is located at . placed two black rubbish bags into his vehicle which was parked on the same street as the apartment. The vehicle was left unlocked while he re- entered the apartment. 1.2 One of the black rubbish bags contained a mixture of RESTRICTED and UNCLASSIFIED documentation, the other bag contained personal items. Both bags were removed from the vehicle by persons unknown. 1.3 (R) A search of the local vicinity by_identified the contents from the two bags. Both bags had been searched and the contents discarded. 1.4 (R)_cannot confirm that all items have since been recovered. 1.5 (R) A breach of DFO 51(1) has occurred. NZDF RESTRICTED document has been compromised through poor security control measures displayed by_ncluding storing the documentation in a non secure device i.e a ?black plastic rubbish bag' and not locking his vehicle. 2.0 Evidence (R) An email dated-2016 was sent by_to_eam leader stating what had occurred on-2016. This document :5 the property of DireCtorate of Defence Security and is classified as RESTRICTED. No dupiication or transmission ofthe document's contents is permitted Without the authority of the author. This docun?ent must be handled, stored and disseminated in actordance with the security procedures applicable to DH) 51 3.0 3.1 33 3-4 3-5 3.6 3-7 3.8 Findings (R)_currently holds _his clearance was issued 0? and exams?I (Ri?has been employed? (R)?informed the?of the incident on-2o16 by phone. A New Zealand Police report was filed about the theft ex car on the same day. (R) This is the first security incident regarding?that has been brought to attention. (R) The unauthorised disclosure or compromise of RESTRICTED information and or material which is likely to damage national interests, is defined as ADVERSE. (R) Compromise of RESTRICTED material may: a) Affect diplomatic relations adversely. b) Hinder the operational effectiveness or security of New Zealand or friendly forces. c) Affect the internal stability or economic well being of New Zealand or friendly countries adversely. (R) The documents that were in_possession at the time they were stolen from his vehicle, and subsequently recovered were the; a) NZDF PDP Manager Training Handbook (Unclassified) b) Department of Prime Minister and Cabinet - Protective Security Governance Requirements DRAFT 2014 (Unclassified) c) NZCF Policy and Administration Manual- Chapter13 Firearms (Unclassified) d) USO Exam le Document - NZDF Performance Management Plan, Develop, Perform for- e) Classified Document Handling Summative Assessment Part One (Restricted) f) Commanders Security Check List DFO 51 (1) Annex (Restricted) 9) Contents of Unit Security Standing Orders DEC 51 (1) Annex 6 (Restricted) h) Powerpoint presentation Security Principles and Responsibilities 04/08/2014 1-5 (Restricted) i) Powerpoint presentation Security Breach Reporting Procedures 04/08/2014 1-9 (Restricted) j) Powerpoint presentation Security investigation Procedures 04/08/2014 1-9 (Restricted) (R) DFO 51 (1), chapter 6 (Security of Information), paragraph 6.30 states that "Any document, item of equipment or information is to be considered compromised immediately it is know or suspected that it may, in whole, or in part, have become known to an unauthorised a. Loss ofthe document or equipment. This document is the property of Drectorate of Defence Security and is classified as RESTRICTED. No duplication or transmission ofthe document?s contents is permitted without the authority of the author. This document must be handled, stored and d'sseminated in accordance with the security procedures applicable l0 its security classification, as set out in DFO 51(1). (R) The NZDF standard for the protection of official information in DFO 51 (1) Chapter 7 states that the 3-9 physical storage requirements for RESTRICTED information is a ?room or cabinet locked with an approved key system?. 3.10 (R_has been issued with a NZDF laptop and iron-key. These items were not compromised as they had not been removed from the apartment room. 3.11 (R) stated that he uses RESTRICTED reference documents and technical notes for meetings when he is travelling or working from home. 4.0 Assessment 4.1 (R) NZDF RESTRICTED document has been compromised through poor security control measures displayed by_ including storing the documentation in a non secure device i.e a ?black plastic rubbish bag' and not locking his vehicle. 4.2 (R) Although RESTRICTED documentation is commonly used for work related purposes outside of the office environment, the security of NZDF and third party classified material must be maintained at all times IAW with defence policies and regulations. 50 Conclusion 5.1 (R) NZDF documentation that was in_s possession was not appropriately secured to avoid it being removed from his vehicle nor being able to be viewed by person/s unknown. 5.2 (R) A breach of DEC 51 (1) has occurred. 6.0 Recommendation 6.1 (R) That this incident be recorded on?Professional Development Record (PDR). 6.2 (R) A coaching conversation takes place with his Team Leader confirming the expectations regarding the handling ofclassified information. Written by- 08 September 2016 Distribution List: Dsy AD PerSy AD Sy Compliance This document is the property of Directorate of Defence Security and is classr'ied as RESTRICTED, No duplication or transmission of the document?s contents is permitted without the authority of the author This dostiment must be handled, stcred and dissen?inaied in accordance with the security procedures applicable to its security classification(1).