DEPARTMENT of the PRIME MINISTER and CABINET

DEPARTMENT of the PRIME MINISTER and CABINET 16 August 2013 Hon Christopher Finlayson QC Chairperson Privileges Committee Parliament Buildings WELLINGTON Dear Mr Finlayson Submission on the inquiry into a question of privilege regarding use of intrusive powers within the parliamentary precinct This submission is provided to the Committee to assist it with its initial consideration of the question of privilege regarding the use of intrusive powers within the parliamentary precinct. In particular, it provides information which addresses the first matter set out in your letter of 31 July 2013, namely: The circumstances which led to the release of information from parliamentary information and security systems to authors of the Inquiry into the unauthorised release of information relating to the GCSB compliance review report There has been a substantial amount of discussion in response to this matter. This submission addresses many of the concerns that have been raised, and attempts to provide a chronology of events leading up to the release of information, and the events that took place after its release from the perspective of the DPMC. A detailed timeline of events for the Henry Inquiry is attached in Appendix 1 for the Committee's information. In light of some of the public commentary about DPMC, I would like to state that I have every confidence in my staff, and their integrity and professionalism. We take our responsibilities as public servants and adherence with the state sector code of conduct very seriously. Background Establishment of the Henry Inquiry In October 2012 ian Fletcher, Director GCSB and I commissioned the Cabinet Secretary Rebecca Kitteridge to undertake a compliance review of the GCSB (the Kitteridge Report). There was an unauthorised disclosure of the Kitteridge Report to the media which was reported on 9 April 2013. As one of the commissioners of the compliance review, I had a Executive Wing, Parliament Buildings, Wellington 6011, New Zealand W 64 4 817 9700 Facsimile: 64 4 472 3181 www.dpmc.govt.nz

number of discussions with the Prime Minister about how best to respond to the leak, which I regarded as a serious matter. The Prime Minister agreed that DPMC and GCSB should commission an independent inquiry into the leak. DPMC took the lead in developing the terms of reference for an inquiry. Both DPMC and GCSB were possible sources of the leak of the Kitteridge Report, consequently the independence of any inquiry from the two agencies was particularly important. We discussed the appropriate form of the inquiry with the State Services Commission, in particular how best to ensure that it could be completed in a relatively short time frame and for a modest cost. I discussed the nature and form of the inquiry with the Prime Minister and his Chief of Staff, Mr Wayne Eagleson. As a result of those discussions Mr Fletcher and I, in consultation with the Prime Minister, finalised the terms of reference and selected a reviewer. Mr Fletcher and I commissioned David Henry to conduct the inquiry. We settled on Mr Henry because of his previous experience, including his roles as Commissioner of Inland Revenue, the Chief Electoral Officer, and Commissioner on the Pike River Royal Commission. The objectives, methodology and timeframe for the inquiry were set out in a terms of reference (attached in Appendix 2). I wrote to all of the people that had received the Kitteridge Report (Ministers, their staff and departmental staff) informing them that an inquiry had been established, that David Henry had been appointed as the inquirer, and asking them to meet with Mr Henry. The Henry Inquiry, unlike a formal Commission of Inquiry, did not have any powers to compel people to provide information. The expectation was that if Mr Henry considered that he needed further powers to access information relevant to the inquiry that would be considered as and when required. Support for the Henry Inquiry As noted above, both DPMC and GCSB were possible sources of the leak of the Kitteridge Report, consequently the independence of the Henry Inquiry from the two agencies was particularly important. As chief executive of DPMC I took the primary responsibility of managing the provision of administrative support to the Henry Inquiry. This included the secondment of a staff member to assist Mr Henry and the provision of office accommodation, ICT support, and other. logistical support. The staff member seconded to assist the Henry Inquiry reported to Mr Henry, and was accountable to Mr Henry for the duration of the inquiry. The staff member was independent of DPMC in relation to their work on the Henry Inquiry. The electronic records and papers of the inquiry were stored on the DPMC system, however they were segregated from other DPMC files and access to those records and papers was restricted to Mr Henry and the staff member assisting Mr Henry during the conduct of the inquiry. Mr Henry concluded his work and presented his final report to Mr Fletcher and me on 5 June 2013. Once the inquiry was completed DPMC assumed responsibility for the administration of the Henry Inquiry records. Access to the records is strictly limited.

Interactions between the Henry Inquiry and DPMC I was the designated contact point for the Henry Inquiry regarding any questions about the terms of reference (including matters of process and timetable) or support requirements. In this role I met with Mr Henry on a regular basis. I was not involved in, or briefed about, the day to day work of the Henry Inquiry, other than in a very general way. As the end of May approached Mr Henry raised with me the timetable for reporting. We agreed to extend the deadline from the end of May to the following week. Mr Henry made me aware that a minister had declined to release certain information relevant to the inquiry to him. Mr Henry advised me that the inability to access those emails meant he was unable to conclude his review of the contacts between the minister and the journalist Ms Andrea Vance. Communication with the Prime Minister and the Office of the Prime Minister I subsequently discussed with Mr Eagleson on 28 May 2013 that Mr Dunne had not complied with all of the requests that had been made, in particular Mr Dunne declined to provide access to the content of emails between himself and Ms Vance. I discussed with Mr Eagleson the desirability of an approach being made to Mr Dunne to reconsider his decision to not release the information requested. I informed Mr Henry that I had discussed the matter with Mr Eagleson and that Mr Eagleson would be approaching Mr Dunne's Chief of Staff. I understand that Mr Eagleson raised the matter with Mr Dunne's Chief of Staff. Release of information from parliamentary information and security systems to the Henry Inquiry Events in relation to the release of information to the Henry Inquiry between April- 5 June 2013 The interactions between Mr Henry and the staff member supporting him were separate and independent of DPMC. Consequently I do not have any direct knowledge of those matters. However, the timeline attached in Appendix 1 sets out the relevant events, as determined from the electronic records of the Henry Inquiry, leading up to the release of information to the conclusion of the inquiry. I understand that Mr Henry has been requested to attend the hearing of evidence on Wednesday, 21 August 2013. Mr Henry is best placed to provide you with further information about the interaction between the Henry Inquiry and the Parliamentary Service. Events in relation to the release of information to the Henry Inquiry after 5 June 2013 The remainder of this section sets out the events that occurred once I was advised that the following information was provided in error to the Henry Inquiry:

phone logs of Ms Andrea Vance (not requested but provided to the Henry Inquiry on 31 May 2013), and email correspondence between Hon Peter Dunne and Ms Vance (provided to the Henry Inquiry on 22 May, but not viewed. Parliamentary Service realised their error and recalled the message). I was informed by the DPMC staff administering the records of the Henry Inquiry on 5 July 2013 of the release in error of the information above. I was informed that: The Henry Inquiry had advised Parliamentary Service that the inquiry had not requested Ms Vance's phone logs and did not want them. I was advised that the Henry Inquiry did not view the information contained in the phone logs. The Henry Inquiry was sent copies of the email correspondence between Mr Dunne and Ms Vance. I was advised that the Henry Inquiry did not attempt to view this information as the Parliamentary Service recalled the email and requested it be deleted. The Henry Inquiry deleted the email and attachment as requested. While the Henry Inquiry did not make any attempt to open the files containing the email correspondence, the information contained in the same file format sent by Parliamentary Service in relation to other Ministers' staff could not be opened by the Henry Inquiry because of a technical incompatibility between the parliamentary and DPMC systems. The inability to access those files was not resolved until 30 May when the information was resent in another format. On that basis, I was advised that the Henry Inquiry would not have been able to access the content of the email correspondence -between Mr Dunne and Ms Vance. There has been some media commentary about the inability of the electronic files containing the email correspondence to be opened or viewed on the DPMC ICT system. Some of this commentary has not been accurate, as set out in the last bullet point above. The first action I took in response to this information was to seek confirmation from the staff administering the Henry Inquiry's records and the Central Agency Shared Services (CASS) unit which manages DPMC ICT services that no DPMC staff had viewed the files in question. I received confirmation from both the staff administering the records and CASS that no staff had accessed those records. I also took steps to ensure that the DPMC ICT system did not hold any of the information received in error, and to destroy any copies found on the system. I can assure the committee that no one has accessed those records while they were awaiting destruction. Ms Vance was contacted by the Acting Chief Executive of DPMC on 30 and 31 July 2013 about the status of her telephone records and updating her on the steps to destroy them. I contacted Ms Vance on 2 August 2013 about the Henry Inquiry being sent copies of email correspondence between her and Mr Dunne. I informed her that the information was never viewed and that the files had been removed from the DPMC system. DPMC has not shared the detailed records of the Henry Inquiry with the Prime Minister or his office as they were not involved in the administration of the inquiry.

Concluding statement I welcome the Committee's consideration of this matter. The work of the committee will place us in a more certain position regarding the conduct of such inquiries in the future. I will be attending the Committee's hearing of evidence on 21 August 2013 to speak to this submission and respond to any questions. I remain available to make further submissions and attend future meetings to assist the committee in its consideration of this matter. Chief Executive

Timeline of events for David Henry Inquiry Date Time of Event email 15 April David Henry Inquiry into the unauthorised disclosure of the Kitteridge 2013 report established and Terms of Reference publicly released. 30 April 5.07pm Henry Inquiry Administrator emails Parliamentary Service 2013 requesting: All printing, copy and scan records for all Ministers that had access to the Kitteridge report (10 National Ministers, John Banks and Peter Dunne). All printing, copy and scan records for senior staff in each of the 12 Minister's offices, including SPS's and Press Secretaries. Printing, copy and scan records for three Prime Minister's Office staff members 6 May 8:45am Henry Inquiry Administrator emails Ministerial Services to advise that 2013 Parliamentary Service requires authorisation from Ministerial Services to give printing, copy and scan records. 8 May 10:29am Henry Inquiry Administrator emails Parliamentary Service with 2013 revised request, which had previously been hand delivered to Ministerial Services, asking for email logs for external emails for the 12 Ministers and their staff for the date range 22 March to 9 April. It also advises that Ministerial Services has given authorisation for that 2:51pm request to be processed. Henry Inquiry Administrator requests from Ministerial Services cellphone bi lling records for 12 Ministers and their staff as well as staff from the Prime Minister's office for 25 March to 9 April. 4:41pm Henry Inquiry Administrator emails Parliamentary Service to request printing and copy records for 12. Minisfers and their staff and staff from Prime Minister's office. 4:45pm Parliamentary Service emails Ministerial Services and asks them for written confirmation from each Minister they are happy to make available information relating to staff as it believes Ministers are the employer. 5:15pm Ministerial Services emails Parliamentary Service to advise DIA are the employer of all Ministerial staff and all staff had signed a Code of Conduct so the Inquiry doesn't need written authorisation. However, with respect to Ministers, Parliamentary Service has asked Ministerial Services to provide authorisation for each Minister individually and please hold cellphone records for each Minister in the meantime. 10 May 9:40am Ministerial Services to Henry Inquiry Administrator- now have the 2013 Ministers' cellphone records ready. 2:17pm Henry Inquiry Administrator emails Andrea Vance's landline and cellphone numbers to Parliamentari Service. 14 May 11 :30am Henry Inquiry Administrator to Parliamentary Service- cellphone 2013 phone logs. This is in reference to logs of Ministers and staff. In terms of authorisation granted by Ministerial Services, Henry Inquiry Administrator states he believes all individual Ministers given written approval. 16 May 3:24pm Parliamentary Service emails Henry Inquiry Administrator with 2013 external Ministers' email metadata, including Peter Dunne's. 17 May 10:22am More attachments with Ministers' metadata regarding scans from Timeline of events - public.pdf

2013 photocopiers to 12 Ministers' email addresses. 10:37am Henry Inquiry Administrator emails Parliamentary Service to advise only missinq is mobile phone call loqs for people on the list. 3:39pm Parliamentary Service emails Henry Inquiry Administrator with cellphone call records files for Ministers and staff. Includes Ministerial car phones. Monday 11 :41am Henry Inquiry Administrator emails Parliamentary Service- were 20 May you able to locate remaining 10 or so phone records? On another 2013 matter, how long would it take for you to retrieve the content of em ails if we requested them? If those emails were for Ministers, does that present any issues? 1:32pm Parliamentary Service replies to Henry Inquiry Administrator to say "it can be the same day if it is only a few or less. I believe we have the necessary approval for Ministers." 2:25pm Henry Inquiry Administrator lodges formal request for all emails between Andrea Vance and Peter Dunne between 22 March and 9 April (dates provided in metadata rundown in email on 16 May at 3:24pm). Also emails between Andrea Vance and one staff member from each of Adams, Finlayson, Tolley, PM's offices. 5:53pm Henry Inquiry Administrator emails Parliamentary Service and requests phone records for Ministers and staff extensions for contact to and from two "numbers of interest" (Andrea Vance's landline and mobile). Also states "Please note, we do not want the call logs of the two numbers of interest. That is outside the parameters of our Inquiry." 21 May 9:55am Parliamentary Service forwards email record request to a contractor 2013 allocated to this. Parliamentary Service then emails contractor to get idea of effort and ETA. 22 May 10:50am Parliamentary Service contractor sends email with attachment of emails records for Dunne!Vance and email records between four Ministerial staff/vance to Parliamentary Service at 10:50am. 3:25pm Parliamentary Service sends email records file for Dunne!Vance emails and emails between four staff and Andrea Vance to Inquiry at 3:25pm. At 5:12pm Parliamentary Services em ails Henry Inquiry Administrator with a message to call urgently re email sent today and then sends a recall notice for email at 5:18pm. Email titled "DPMC Info Request". 5:16pm At 5:16pm Parliamentary Service sends revised file with only email records between four Ministerial staff/vance to Inquiry. Email titled: "Last part of info" Thursday Henry Inquiry Administrator deletes email titled "DPMC info 23 May requests" with Dunne!Vance email records from his email without opening file. 8:34am Henry Inquiry Administrator to Parliamentary Service re email title "last part of info" to say "as discussed we can't open.pst documents" 9:30am Henry Inquiry Administrator emails Parliamentary Service saying Mr Henry discussed an issue with Ministerial Services and Prime Minister's Chief of Staff but not Acting Head of Parliamentary Service. The upshot is that Acting Head of Parliamentary Service will be talking with Dunne's office with the aim of getting the Minister's permission to view the emails. Sunday 9:49pm Parliamentary Service emails Henry Inquiry Administrator- "if you 26 May have authorisation sorted, I can send you the files." 2013 Timeline of events- public. pdf

27 May 8:18am Henry Inquiry Administrator emails Parliamentary Service and says 2013 "Just to confirm... we've only got authorisation to see non-minister email, not Dunne's." 10:45am Henry Inquiry Administrator emails Parliamentary Service asking who to contact to access swipe card records into the building. 2:47pm Henry Inquiry Administrator sends formal request to Parliamentary Service for building access logs for two people for 6-8 April. Asks is this data able to be retrieved and what authorisation do you need? 28 May 5:30pm Parliamentary Service emails Henry Inquiry Administrator with two 2013 activity reports as requested for those dates. Authority to release (5:30pm) obtained from Head of Parliamentary Service. Wed29 12:35pm Parliamentary Service emails security policy for Parliamentary May 2013 precinct to Inquiry. 30 May 8:37am Parliamentary Service to Henry Inquiry Administrator attachment 2013 "DPMC infor request extracted". This is emails between four Ministerial staff and Andrea Vance in readable format. 5:27pm Parliamentary Service contractor sends Henry Inquiry Administrator email titled "Phone call information". It says Parliamentary Service has confirmed happy for me to provide you with the information. Could you forward request to me via email. 5:37pm Henry Inquiry Administrator emails Parliamentary Service asks for Minister's landline call logs and Vance's three numbers (extn, land line and cell) for 10 National Ministers. 31 May 9:02am Henry Inquiry Administrator emails Parliamentary Service "should 2013 note not yet sought permission of non-national Party Ministers for their phone logs. Expect to later today." 9:44am Parliamentary Service contactor sends email to Henry Inquiry Administrator with two attachments - call logs for 1 o National Ministers and call logs for Andrea Vance. 11 :19am Henry Inquiry Administrator responds "Let's be clear. We did not request the second report you've attached here i.e. the one showing all calls to and from the numbers of interest. We're not interested in looking at that". 4:00pm Henry Inquiry Administrator emails Mr Dunne's Chief of Staff to say "David Henry tells me Mr Dunne has approved release of information so therefore this is the request we are going to send." 3:53pm Senior Parliamentary Service staff member forwards email from Parliamentary Service contractor to Henry Inquiry Administrator again with two attachments of phone records. 5.15pm Henry Inquiry Administrator replies to Parliamentary Service to say he did get them. 4 June 8:59am Mr Dunne's Chief of Staff confirms to Henry Inquiry Administrator 2013 that Mr Dunne agrees to request to access phone logs of his landline. 1:39pm Parliamentary Service emails Henry Inquiry Administrator requested report (Mr Dunne's landline calls) 10:46am Parliamentary Service emails Henry Inquiry Administrator to say Ministers' private lines potentially not loqqed, will confirm. 5 June 10:59am Henry Inquiry Administrator emails Parliamentary Service to say 2013 deadline tight- answer before 2pm today appreciated. 5 June Henry Inquiry report delivered to Prime Minister. 201 3 7 June Henry Inquiry report released by Prime Minister. 201 3 Timeline of events- public. pdf

Timeline of events - public. pdf

Inquiry into the unauthorised release of information relating to the GCSB compliance review report: Terms of Reference Background In October last year Andrew Kibblewhite, Chief Executive of the Department of the Prime Minister and Cabinet and I an Fletcher, Director of the Government Communications Security Bureau, commissioned Cabinet Secretary Rebecca Kitteridge to undertake a compliance review of the GCSB. Ms Kitteridge delivered her report to the Director GCSB on 22 March 2013. It was marked (on all pages) "Sensitive". The Prime Minister's Office intended to release it in the week beginning 15 April. However, there was an unauthorised disclosure of the Review to the media which was reported on 9 April. As the commissioners of the report, Andrew Kibblewhite and I an Fletcher have appointed David Henry to conduct an inquiry on their behalf. Objectives The objectives of this inquiry are to: Investigate and report the relevant facts concerning the unauthorised disclosure of information; Report any appropriate findings on how this information was released and by whom; Make recommendations (if applicable) on improving the internal information management process, based on any lessons to be drawn from the Inquirer's investigations. Methodology It is envisaged that the inquiry will be conducted in two stages: Stage 1 will include reviewing communications and copying equipment and records, log books and any other material considered relevant of the persons (and/or their offices) who had or were likely to have had access to the compliance review report, and then; Stage 2 will include the conduct of formal interviews if the Inquirer believes these are warranted by the facts and would assist him in meeting the objectives of the inquiry. DPMC and GCSB will each make available a senior official to support David Henry in carrying out this inquiry. All relevant rules of natural justice will be observed in terms of any persons identified in the conduct of this inquiry. Timeframe It is anticipated that David Henry will present his findings and/or recommendations to Andrew Kibblewhite and I an Fletcher by the end of May 2013, for their consideration and response.