13 Dec 2023

Police hide assessment of system for reporting security threats

10:05 am on 13 December 2023
WELLINGTON, NEW ZEALAND - DECEMBER 08: A general view of inquiry documents during a media lock-up ahead of the release of the Royal Commission of Inquiry in relation to the Terrorist Attack on Christchurch Mosques at Parliament on December 08, 2020 in Wellington, New Zealand. The Royal Commission report into the 2019 terrorist attack on Christchurch mosques will be released on Tuesday 8 December.  51 people were killed after a man opened fire at Al Noor Mosque and the Linwood Islamic Centre in Christchurch on Friday, 15 March 2019. The Australian gunman was sentenced to life in prison without parole after being found guilty of 92 charges relating to what was New Zealand's worst mass shooting in history. (Photo by Hagen Hopkins/Getty Images)

Setting up a reporting system was one of the highest priorities in the Royal Commission of Inquiry's report into the terrorist attack on two Christchurch mosques. File photo Photo: Getty Images / Hagen Hopkins

Police have blanked out virtually the entire contents of an assessment of a new public reporting system for security threats.

Police are in charge of building a new system where people can report disturbing behaviour, as an early alarm against terrorism and extremist violence.

Their preliminary privacy impact assessment done in April has been released under the Official Information Act to RNZ.

About a dozen pages of the 17-page report are redacted.

The entire privacy risk analysis which is five pages long, has also been redacted.

It appears to promise more transparency ahead - "there will need to be clear communication with the public about what information they can be report [sic] through the Recommendation 12 reporting system. There will also need to be clear disclaimers when the public makes reports about what will happen with their information" - without the report providing any itself.

The system is being set up in response to Recommendation 12 from the Royal Commission of Inquiry into the mosque attacks in 2019.

While it is unclear how it would work, the system is expected to get 7000 - 40,000 calls a year from the public, or perhaps many more.

One aim was to "address current gaps in how these agencies understand threats and remove information siloes", the newly released assessment said.

Human rights and privacy officials are in the thick of it, advising police on how to navigate the tricky waters of biased reports, or vexatious reports and what the threshold is when behaviour falls below what is concerning or criminal.

Police completed an initial business case in August around how the system might work, but the previous government deferred any decision on it.

New Police Minister Mark Mitchell said he had received initial advice and it would require Cabinet consideration by the previous government.

"I look forward to reviewing the business case with my Cabinet colleagues in due course," he said.

The police's newly released privacy assessment is far too heavily redacted to shed much light on how this might work, what risks are perceived or how they might be tackled.

It assessed the added privacy risks around using, storing and getting rid of personal information in the so-called Recommendation 12 System - but its conclusions have been blanked from public view.

The "purpose" of collecting the information runs to a page and a bit - all redacted.

The section "using currently held information for a new purpose" sounds interesting - but has black lines all through it.

Under information sharing, it states the Royal Commission "identified that while several agencies collect information from the public on concerning behaviours and incidents, this information is not always appropriately shared or shared in a timely way between these agencies".

The report notes the agencies and community groups police have been consulting.

Police have put links online to some of the previous papers about the project.

They said they would do a more detailed privacy impact assessment once the reporting system was designed.