Text: Henry Report into Leak of Kitteridge GCSB Report

Friday, 7 June 2013, 3:52 pm
Article: The Scoop Team

The following is an automated scan to text of David Henry's report into the Kitteridge report into the GCSB's legal compliance (PDF).

It contains multiple character errors and lacks the formatting of the released document. Please refer to the original PDF.

Inquiry into the unauthorised release of information relating to the GCSB compliance review report

The leak of the Kitteridge report

David Henry, 5 June 2013

lan Fletcher

Director, Government Communications Security Bureau

Wellington

Andrew Kibblewhite

Chief Executive, Department ofthe Prime Minister and Cabinet

Wellington

5 June 2013

Gentlemen

Inquiry into the leak of the Kitteridge report

Overview

Publication

On 9 April 2013 the Dominion Post newspaper published an article headed: “Secret report unveils extensive illegal spying”.

The article contained details from a report prepared by Rebecca Kitteridge (the “Kitteridge report”)_ The report reviewed the compliance systems and processes of the Government Communications and Security Bureau (the “GCSB").

At that time the Kitteridge report had not been released to the public.

Security

The report was classified as “sensitive". Prior to 9 April the production, dissemination and security of the report was tightly controlled within government.

Thirty-five hard copies of the final report were produced and disseminated prior to 9 April. Highly classified appendices were handled on an even more restricted basis.

Version leaked

The Dominion Post newspaper reporter who wrote the article of 9 April (‘the reporter’) was given access to the final version of the report dated 22 March 2013. lt is highly unlikely that the reporter was given access to earlier drafts of the report or to the classified appendices to the report.

Time of leak

6 The reporter gained access to the Kltteridge report sometime between 22 March and 8 April 2013 (inclusive), most likely on Monday 8 April.

This inquiry

7. This inquiry had no powers to compel people to provide information. Extensive information was provided voluntarily. Had compulsion been necessary to obtain further information in relation to public servants I would have asked for an appropriate delegation from the State Services Commissioner under the State Sector Act 1988. I did not find it necessary to do so.

8. Ministers are not public servants but with the support of the Prime Minister any information I required relating to cabinet ministers was provided to me. In the context of this inquiry that related to eleven cabinet ministers. The information I obtained from their ministerial offices and from communication records meant that it was unnecessary to interview those ministers.

Persons established as having access and contact with the reporter

9. I identified three people who had access to the Kitteridge report prior to 9 April and who had contact with the reporter. Two were public sen/ants and one was the leader of a political party suppoiting the National-led government.

10. In relation to the two public S9I'\/BUYS I have obtained all the information I required, including the content of emails exchanged with the reporter over the period 22 March to 9 April (inclusive). I have established those contacts were entirely commensurate with their official duties.

11.The third person identified was the leader of the United Future political party- the Hon Peter Dune MP. Mr Dunne had a copy of the Kitteridge report from 27 March 2013 onwards. He is a minister outside cabinet.

12.l have not obtained all the information I required from Mr Dunne. I advised him that I considered it necessary for the purpose of this inquiry to have access to the full text of 86 email exchanges between him and the reporter during the period 27 March to 9 April. Mr Dunne has declined to allow me to read those emails.

13.However, Mr Dunne has shown me an edited text of most ofthe 44 emails that he sent to the reporter during the period. That text shows that GCSB issues, including the Kitteridge report, were prominent in the email exchanges. Mr Dunne was to meet the reporter on the morning of Monday 8 April but states that he did not do so. I remain of the view that I need to have full access to all 86 emails. In the absence of permission I cannot take this matter any further.

Lessons for the future- some issues to consider

14.There are no significant lessons directly connected to this leak but there are some aspects of security mentioned in the report for you to consider, including the need for regular reinforcement of the rules on handling classified documents and, importantly, the reasons for those rules.

Introduction

15.0n the morning of Tuesday 9 April 2013 the Dominion Post newspaper published details of a review of compliance systems and processes at the GCSB. The review had been conducted by Rebecca Kitteridge, the Secretary of the Cabinet, and was summarised in a report prepared by her (the “Kitteridge report”).

16.The Kitteridge report was completed on Friday 22 March 2013 and was classified as “sensitive”. (The government’s classification system is described in Appendix 1.)

17.The report had not been publicly released at 9 April but preparations were being made to release it, together with the government’s response, in the week commencing 15 April.

18.You asked me to inquire into the unauthorised release (“the leak”) of the Kitteridge report and my inquiry was publicly announced on Monday 15 April. l was required to report by 31 May 2013.

The terms of reference

19.The terms of reference are at Appendix 2. In essence they required me to answer three questions What are the relevant facts concerning the leak?

How was the information leaked and by whom?

Are there any lessons for the future?

Preliminary evaluation

Introductory comment

20. ln order to leak the Kitteridge report the leaker must, obviously, have had access to the report. Access could have been authorized or illicit. The leaker must also have had a motive for so acting but l have not spent much time trying to identify it. The literature suggests motivation may be a complex matter.

21. I understand that in many leaks the leaker and the journalist know each other’s identity and the leaked material passes directly between them.

Which version of the report was leaked?

22.l am confident that it was the final version of 22 March 2013. Last minute changes made by Ms Kitteridge on that day are effectively reflected in the newspaper article.

23.The news article quoted extensively from the Kitteridge report. Detailed analysis shows that the reporter had access to the final version, rather than to parts of it or to earlier versions. This follows from

a. the extent to which the text is followed, and

b. a comparison of the article with both the final version and with the earlier versions of the report.

Were the cIassified appendices leaked?

24. I think not. Some of the appendices were classified as ‘secret’ and were handled separately on a very restricted basis. Had the reporter accessed them I would have expected to see the information reflected in some way in the article. There is no such reflection.

Timing of the leak

25.The news article was printed early on Tuesday 9 April and occupied the front page. Writing the article, and preparing the accompanying graphics, would have taken some hours and would have had to have been completed by the evening of 8 April. As a major scoop I think that both the writing and publication would have been given priority. On that basis I think that the reporter gained access to the report on Sunday 7 April or Monday 8 April, with the Monday being the most likely.

How it was leaked

26. It is not possible to be definitive but it is likely that the report was provided directly to the reporter by the leaker. The report could have been copied by the leaker and the copy provided to the reporter, or it could have been ‘lent’ to the reporter and returned later.

Information on the governments response

27. In addition to information culled from the Kitteridge report the newspaper article of 9 April stated: “lt is understood new legislation will be introduced to Parliament soon after the report’s release." (Emphasis added). This information was not publicly available.

Limiting the scope of the Inquiry

28. Once I had concluded that the reporter had accessed the final version of the Kitteridge report I was able to narrow my inquiries, in the main, to those people who had access to the final version of the Kitteridge report. I therefore excluded those I could establish had had access only to earlier drafts, unless there were special reasons otherwise.

29. Further references to the Kitteridge report are to the final version of 22 March 2013 (excluding the highly classified appendices).

Production and distribution of the Kitteridge report

Completion of the report

30.The Kitteridge report was completed and signed by Ms Kitteridge on Friday 22 March 2013. lt was classified as “sensitive” and held in a highly restricted electronic system at GCSB. Electronic copies were not distributed.

Friday 22 March: Initial delivery- 6 copies

31.Six hard copies were delivered by hand to the Director of the GCSB (one copy), the Chief Executive of the Department of the Prime Minister and Cabinet (DPMC, one copy), and the Prime Ministers Office (PMO, three copies, including one for the Prime Minister). Ms Kitteridge retained one copy.

Monday 25 March.' Delivery to the Cabinet Ofrice- 12 copies. Distribution to ministerial offices

32. On the morning of 25 March, twelve copies were delivered by Ms Kitteridge to the Cabinet Office so that they could be included in the papers for the next day’s meeting of the Ad Hoc Cabinet Committee on Domestic and External Security Coordination (“DES”).

33.ln the afternoon, the Cabinet Office distributed the DES papers to ministerial offices in sealed double envelopes addressed to ten minsters who were members of DES and to one other minister who had been consulted on the DES papers.

34.The envelopes were marked ‘secret’. A DES package was also delivered by mistake to a senior official in DPMC, who immediately returned it to the Cabinet Office.

Monday 25 March: Delivery to the Ofiicials Advisory Group-5 copies

35. ln the afternoon of 25 March five copies of the Kitteridge report were distributed by hand to five senior officials. Those officials were members of an ad hoc advisory group which Ms Kitteridge had convened to provide her with quality assurance as the report was drafted.

Monday 25 March: Limited distribution to officials-9 copies

36.Nine copies of the Kitteridge report were provided to nine officials in the GCSB, the Security Intelligence Sen/ice (SIS) and the PMO, the majority being provided by 27 March. Those officials were working on the government’s proposed response to the report, including preparations for the public release of the report by the Prime Minister.

37.The release was expected to take place during the week commencing 15 April, following the Prime Minister’s return from China and following a briefing of the parliamentary Intelligence and Security Committee.

Tuesday 26 March: The DES meeting

38.The meeting of DES ministers was held at noon on 26 March and was chaired by the Prime Minister. Eight ministers, including the Prime Minister, were present.

Also present were officials from GCSB, SIS, DPMC, PMO, and the Cabinet Office. Appendices to the Kitteridge report, classified as ‘secret’, were distributed at the meeting but were returned to the Cabinet Office officials at the end of the meeting.

Wednesday 27 March: Briefing of support parties - 2 copies

39.Two copies were produced, without the highly classified appendices. Separate meetings were held by officials from PMO and DPMC with the leaders of two parties supporting the National-led government: the Hon John Banks MP and the Hon Peter Dunne MP. The leaders were also ministers outside cabinet. They were briefed on the Kitteridge report and on the content and timing of the government’s proposed legislative response. Mr Banks’ copy was returned to the officials at the meeting. Mr Dunne retained his copy.

Total number of hard copies – 35

40.Therefore, prior to 9 April, thirty-four hard copies of the report had been produced and distributed to officials and ministers. In addition one hard copy - used as the master copy for photocopying - was held at GCSB, making thirty-five in total.

41.l requested the return of all copies. All but two have been recovered. I was advised that the two missing copies had been shredded: One copy had been returned to the Cabinet Office by a DPMC officer and shredded. The other had been held by a cabinet minister whose staff tell me had not accessed the report prior to the leak.

Numbering of copies

42.A system for numbering copies was used at GCSB but was incomplete and somewhat confusing. Not all copies were numbered and the number series included numbers allocated to earlier drafts. Copies distributed on 22 March 2013 were not included in the number series and nor were the copies provided to the Cabinet Office on 25 March 2013.

Maintaining security of the report

43.There is of course no perfect system which could guarantee security of the Kitteridge report. But, despite the numbering issue identified, I was struck by the care with which security of the report was maintained before 9 April.

44.There was no electronic distribution of the Kitteridge report before then. The electronic version was held in a secure restricted database within GCSB. It is highly unlikely that anyone could access that data base and print an unauthorised copy.

45. It is possible that one of the hard copies or the master copy was illicitly copied or scanned. Records from government photocopy machines were extensively examined. All systems record details of scanned documents. Some systems record the identity of the person making photocopies together with statistical information on the document, but not its title or contents. Others do not record the identity of the user.

46. My review was necessarily limited to the use of government facilities, such as photocopy machines, so copying done elsewhere cannot be reviewed. In that context there are rarely any inward and outward bag checks done which might deter someone from improperly removing a document from the relevant government facilities.

Security procedures in offices

47. A review of the security procedures adopted by the offices through which the report passed shows the following.

G CSB and SIS

48.High standards were maintained, including rigorous physical security, enforced clear desk policies, and widespread use of safes to store classified documents, although safes are sometimes shared between officials. Records were available of printing, copying and scanning activities including identifying who had undeitaken them. Photocopy machines could only be accessed by the use of personal swipe cards.

49.Checks of the records available disclosed no unexplained activities.

Cabinet Office

50.High standards are maintained similar to those described above, except for the lack of identification of those who have copied documents.

51.Checks of the records available disclosed no unexplained activities.

DPMC

52.Reasonable standards were maintained including good physical security and some use of safes and locked cabinets. Clean desk policies were not universally applied. Photocopy machines could only be accessed through the use of swipe cards. The system identifies a person scanning but not the identity of a person copying.

53.Checks ofthe records available disclosed no unexplained activities.

Ministerial offices

54.Reasonable standards were maintained. There was some variance between offices, reflecting both the nature of the portfolios administered and arrangements between ministers and their senior private secretaries.

55.Physical security was generally good, especially in controlling access to the offices. Safes were used more extensively in some offices than others, again in part because of the nature ofthe portfolios. There was sometimes undue reliance on the use of locked cabinets when the location of the keys was known or could be ascertained. A clear desk policy was not universally adopted. Access to photocopy machines was not controlled by swipe cards and the identity of those copying cannot be determined.

56. Checks of the records available disclosed no unexplained activities.

Government e-mail logs and telephone bills

Records obtained

57.Logs of emails on government systems were obtained. The logs were for the crucial period 22 March to 9 April 2013, being the period between the finalisation of the Kitteridge report and the publication of the leak. They included email logs of eleven cabinet ministers and their staff, and two support ministers and their staff. The logs showed the sender and recipient, date, time, and subject title (if any).

58.0f'ficial telephone billing records (land lines and mobiles) relating to the same people were also obtained for the crucial period although inevitably some calls outside that exact period appeared in those billing records. The telephone bills identified the call made, the number called and the duration. Calls made between parliamentary complex extensions are not logged. Building access records were also examined where necessary.

59.For completeness I record that I had no access, nor did I seek any access, to private email providers or private telephones.

Analysis

6O.The records obtained were then analysed and contacts of interest identified for further analysis. After extensive checks the only contacts that required further explanation were those with the reporter.

Contacts with the Dominion Post reporter

61 .The analysis identified three people who:

a. had access to the final version ofthe Kitteridge report, and

b. had a copy of the report in their possession, and

c. had been in contact with the reporter through official telephone or email systems during the period 22 March to 9 April.

62.These people were:

a. An officer in GCSB.

b. An officer in the PMO.

c. A leader of a support party.

An officer in GCSB

63.The officer had a numbered copy of the report from 25 March onwards. The report was kept in a safe at GCSB when not being used.

64.The officer reported to the director of the GCSB and was heavily involved in preparation for the official release of the report planned for the week commencing 15 April, including the preparation of a communications plan normal to such events.

65. The contacts between the officer and the reporter were examined, including the content of emails. There were six emails between them prior to publication of the leak.

66. The contacts were found to be entirely commensurate with the officer’s official duties.

An officer in the PMO

67.The officer had a numbered copy of the report from 27 March onwards. The officer was heavily involved in preparation for the official release of the report.

68.As part of that preparation the officer had the report at home over the weekend of 6 and 7 April. The report was not kept in a safe or locked cabinet at the home but the officer states that it remained in the officer’s possession at all times.

69.The officer’s contacts with the reporter were examined, including the content of emails. There was only one email prior to publication ofthe leak.

70.The contacts were found to be entirely commensurate with the officer’s official duties.

The leader of a support party

Background

71.The Hon Peter Dunne MP heads a political party that has a confidence and supply agreement with the National-led government. He is a minister outside cabinet.

72.0n the afternoon of 27 March Mr Dunne was given a numbered copy of the Kitteridge report (but not the classified appendices) as part of a briefing on the content and timing of the government’s proposed legislative response. The briefing was carried out by the Chief Executive of the DPMC and the Deputy Chief of Staff of the PMO.

Sequence of events

73. Mr Dunne advised me that, after receiving the report at the briefing on the afternoon of 27 March, the sequence of events was as follows:

a. On the evening of 27 March he had taken the report home in his briefcase, which is secured by a combination lock.

b. On 28 March he had brought the report back to his office and given it to his chief of staff to read. It was returned to him by the chief of staff after several hours.

c. Mr Dunne states that he then kept the report in his locked briefcase. He went on holiday overseas on Easter Saturday, 30 March, and returned on Sunday, 7 April. During his absence overseas the report was in his locked briefcase at his residence. The residence has a monitored alarm system.

He is confident that the briefcase and report were not accessed whilst he was away.

d. Mr Dunne states that the report remained at his residence in his locked briefcase until he brought it back to his Bowen House office on Wednesday 10 April.

Security

74.The report was never kept in the safe in the ministerial office. The senior private secretary saw the report for the first time on or after 22 April, when she picked up the report from Mr Dunne’s out tray, and returned it to the Cabinet Office as had been requested by this inquiry.

Email exchanges

75.There were eighty-six email exchanges between Mr Dunne and the Dominion Post reporter in the period 27 March to 9 April. Of that total forty-four were sent by him and forty-two were received by him. Details are:

[see original PDF for chart ]

76. Mr Dunne has advised me that he has frequent contact with the reporter including communications by telephone, text, email and in person. That contact has continued during the period 27 March to 9 April.

77.l have advised Mr Dunne that I consider it necessary for the purpose of this inquiry to have access to the full text of the eighty-six email exchanges between him and the reporter during the period 27 March to 9 April. Because he was not a public servant l would need his permission to examine the content. I advised him that the Prime Minister had requested cabinet ministers to cooperate by providing me with any information I required including access to the content of emails. Mr Dunne is a minister outside cabinet, 78. Mr Dunne has declined to allow me to read those eighty-six emails.

79.Mr Dunne has shown me an edited text prepared by him relating to forty-one of the forty-four emails that he sent to the reporter during the period. Of those emails fourteen have been partly deleted and four have been completely deleted.

I see from the edited text that the subjects covered fall into two main areas (1) making arrangements to meet and (2) issues connected to GCSB, including the appointment controversy and the proposed official release of the Kitteridge report. He had advised the reporter by email on 27 March that he was going to be briefed on the Kitteridge report.

80. Mr Dunne’s edited text does not include any of the forty-two emails received from the reporter. I have advised Mr Dunne that he is entitled to give me full access to those emails.

81.According to the email log the subject line of one of the emails from the reporter shows that at 11.38 am on Monday 8 April the reporter was waiting to meet Mr Dunne for coffee. lVlr Dunne left Bowen House at approximately 11.35am and returned at approximateIy12.27pm_ He advises me that he did not in fact meet the reporter that day. He has also advised me that he did not give the reporter access to the Kitteridge report.

82.l remain of the view that I need to have full access to all eighty-six emails.

Without lVlr Dunne’s permission I cannot take the matter any further.

Conclusions

83. Extensive checks across the relevant government agencies and ministerial offices, including emails sent and received by public sen/ants and ministers, have identified three people who had access and possession of the report prior to the leak and contacts with the reporter.

84.Two of those three people were public servants I am satisfied that their contacts were entirely commensurate with their official duties.

85.The third person is the leader of a political party supporting the National-led government - the Hon Peter Dunne I\/IP. He had access to the report prior to 9 April and had frequent contact with the reporter on GCSB - related issues, including the Kitteridge report. I am unable to obtain all the information I require from him and cannot take the matter any further. IVlr Dunne has advised me that he did not provide the reporter with access to the Kitteridge report.

Natural justice

86. Mr Dunne has been provided with relevant extracts from drafts of this report and his comments have been taken into account.

Lessons for the future

87. In the course of the inquiry I noted some instances where security procedures for managing the report could be improved but these were minor enough to be irrelevant to the leaking of the report and I have passed them on directly to the officers concerned.

88. On the other hand there are some issues for you to consider.

a. There is the need to regularly reinforce good security practices with everyone involved in handling government information, from ministers downwards. This is not just something to be done at induction. Good practice cannot eliminate leaking but can make it more difficult.

b. It is essential that there are adequate secure storage facilities so that clear desk policies can be followed. This is especially important in today’s open plan offices. If it is necessary to take sensitive documents home for work purposes there should be appropriate approved secure storage at the home.

c. A person making photocopies should be identifiable by the information system and the activity should be recorded.

d. Nluch of the information at cabinet and cabinet committee level is distributed and handled in hard copy. The current project to handle such information electronically should significantly improve security because it is very difficult to provide access to unauthorised people without leaving an electronic trace, I understand that once the current project is implemented it would be possible, with minor changes, to include documents such as the Kitteridge report.

e. Finally, New Zealanders are generally a trusting people. During the course of the inquiry it was clear that people, quite rightly, had a high degree of trust in their colleagues. What needs to be understood though is that good security procedures do not just protect information. They also protect people from suspicion if a breach occurs.

Acknowledgements

89.l thank the many people who helped by agreeing to be interviewed, often at short notice, or by providing information in a timely fashion. l wish to particularly thank Isaac Holliss of the DPMC who was seconded for 6 weeks to help me.

David Henry

Appendix One: Classification system for documents

What is the classification system?

1. Documents are given a classification in order to limit access to that information and to specify how that information must be handled and protected.

2. There are two categories of classifications:

a. National security c/assizications, where compromise would damage the security, defence or international relations of New Zealand and/or friendly governments; and

b. Policy and pnvacy classifications, where compromise would damage government functions or cause loss (of privacy, safety, or commercial) to a person.

3. Within the two categories of classifications, there are varying levels:

National security: Policy and privacy:

Top Secret

Secret

Conndential

Restricted Sensitive

In-Conndence

4. The rules surrounding documents become increasingly stringent the higher the classification. Endorsements can also be added to policy and privacy classifications, for instance "budget", or “staff’. The rules relating to the handling of “sensitive” and “restricted” documents are essentially the same.

The classification of the Kitteridge report

5. The final version of the Kitteridge report before it was publicly released was classified as “Sensitive", without endorsements.

6. Storage. Documents classed as “Sensitive” must be stored in a lockable cabinet, or a storage area protected by controlled access. These documents should not be taken home and stored, unless the person has been authorised to do so and uses approved storage.

7. Access. Because it was classified as “Sensitive", the final version of the Kitteridge report was accessible only by staff that are cleared by their respective departments to view such information. Knowingly passing such a document on to someone who does not hold that clearance would violate security practice. It would also, in many cases, violate a government agency’s code of conduct in relation to its employees.

Appendix Two: Terms of Reference: Inquiry into the unauthorised release of information relating to the GCSB compliance review report:

Background

In October last year Andrew Kibblewhite, Chief Executive of the Department of the Prime Minister and Cabinet and lan Fletcher, Director of the Government Communications Security Bureau, commissioned Cabinet Secretary Rebecca Kitteridge to undertake a compliance review of the GCSB.

Ms Kitteridge delivered her report to the Director GCSB on 22 March 2013. It was marked (on all pages) “Sensitive"_ The Prime Minister’s Office intended to release it in the week beginning 15 April. However, there was an unauthorised disclosure of the Review to the media which was reported on 9 April.

As the commissioners of the report, Andrew Kibblewhite and lan Fletcher have appointed David Henry to conduct an inquiry on their behalf.

Objectives

The objectives of this inquiry are to:

» Investigate and report the relevant facts concerning the unauthorised disclosure of information;

» Report any appropriate findings on how this information was released and by whom;

- Make recommendations (if applicable) on improving the internal information management process, based on any lessons to be drawn from the lnquirer‘s investigations.

Methodology

It is envisaged that the inquiry will be conducted in two stages:

» Stage 1 will include reviewing communications and copying equipment and records, log books and any other material considered relevant of the persons (and/or their offices) who had or were likely to have had access to the compliance review report, and then;

~ Stage 2 will include the conduct of formal inten/iews if the Inquirer believes these are warranted by the facts and would assist him in meeting the objectives of the inquiry.

DPMC and GCSB will each make available a senior official to support David Henry in carrying out this inquiry, All relevant rules of natural justice will be observed in terms of any persons identified in the conduct of this inquiry.

Timeframe

lt is anticipated that David Henry will present his findings andlor recommendations to Andrew Kibblewhite and lan Fletcher by the end of May 2013, for their consideration and response.

Appendix Three: Processes used in the Inquiry

Overview

1 The lnquiry was conducted in three phases:

a. Preliminary interviews and the collection of basic records.

b. Analysis and elimination.

c. Follow-up interviews and the collection of more detailed records.

The Inquiry was led by David Henry. Isaac Holliss, from DPMC, was seconded for six weeks to assist him. Substantial assistance, particularly in the gathering of records, was also provided by staff at G-CSB, the Parliamentary Service, Ministerial Services, and DPMC.

Phase one: Preliminary interviews and the collection of basic records

Throughout, the Inquiry comprised two complementary tracks: interviews, and technical records analysis. The interviews, of 55 people, helped to inform which records were collected. The records then highlighted questions which needed addressing through interviews. All interviews were conducted informally - that is, without statutory power to compel witnesses to attend - and were not “on oath".

This enabled rapid progress to be made. Notes of interviews were prepared in all cases.

What records were requested?

For every person of interest to the lnquiry, the records requested consisted of logs showing print, photocopy, scan activity, and logs showing emails sent and received from their work email addresses, outgoing mobile calls from work mobile phones, and landline calls to specific numbers of interest.

The inquiry requested all those who received a hard copy of the report to return them.

Technical records for 74 people were collected and analysed during the course of the Inquiry. Those 74 comprised:

a. DES Ministers and Ministers’ senior staff: their chief of staff, senior private secretary, and press secretaries.

b. Two support party ministers, who were given copies of the Kitteridge report, as well as their senior staff.

c. Public servants who were recipients of the final version of the Kitteridge report, or who may have had access to a hard copy of the report.

What records were received?

7 The Inquiry received nearly every record it requested. There were some exceptions. Logs showing photocopying activity are not captured by DPMC or Ministerial Services; DPl\/IC staff must ‘swipe’ to use a photocopying machine, but photocopying activity is not logged. Ministers’ offices do not ‘swipe‘ to use printing devices, and so no attributable record is made when a document is photocopied.

8. The Inquiry was also unable - for technical reasons - to retrieve landline call logs made between parliamentary complex extensions. We were able to identify calls made from the parliamentary complex to external landlines and mobiles.

Phase two: Analysis and elimination

9. The Inquiry used the records, along with the information gained from interviews, to narrow the list of individuals that we intended to look at in more detail. We identified those individuals who:

a. Had access to the final version of the report.

b. Had possession of a hard copy ofthe report at the time of the leak.

c. Had been in contact with the reporter through official telephone or email systems during the period 22 ll/larch to 9 April.

1O.The records were also analysed for other potentially irregular contact which might reveal avenues for further questioning. As part of this process the Inquiry examined records for any sign of discussion related to the Kitteridge report leak, and contact with past employees of the GCSB.

11.This process of elimination allowed the investigation to focus on three individuals.

Phase three: Follow-up interviews and the collection of more detailed records

12. Subsequent to the analysis and elimination, the Inquiry focussed on three individuals of interest. Additional records were requested in order to build a better picture of individuals’ contacts with the reporter. These records included the content of specific emails, and in some cases building access records. These access records show a person’s entry and exit into the Parliamentary complex, including Bowen House.

13. For two of the three individuals, we were granted access to view the content of the emails. The other individual, a support party leader, declined to provide the Inquiry with full access to the content of the emails between them and the reporter.

14. Where necessary, additional interviews were conducted.

Natural justice

15.The Inquiry applied the principles of natural justice throughout. Where necessary, relevant extracts from the draft report were provided to individuals and their comments were invited. These comments were considered and taken into account.

© Scoop Media

Scoop

Scoop Independent News

Scoop is NZ's largest independent news source; respected widely in media, political, business and academic circles for being the place on the internet for publishing "what was really said", and for the quality of its analysis of issues.

Contact Scoop

• Editorial - editor@scoop.co.nz
• Twitter - @ScoopNZ
• Facebook
• YouTube
• Services - services@scoop.co.nz
• Phone - 04 910 1844