Government Communications Security Bureau

G.56

101011011010111010101101110011010010110001101100001011101000110100101101111011011

100111001100100000010100110111001010110001101110101011100100110100101110100011110

010010000001000010011101010111001001100101011000010111010101000111011011110111011

001100101011100100110111001101101011001010110111001110100001000000100001101101111

011011101011011010111010101101110011010010110001101100001011101000110100101101111

011011100111001100100000010100110111001010110001101110101011100100110100101110100

011110010010000001000010011101010111001001100101011000010111010110100011101101111

011101100110010101110010011011100110110101100101011011100111010000100000010000110

110111101101100101011000110111010101110010011010010111010001111001001000000100001

001110101011100100110010101100001011101011010001110110111101110110011001010111001

001101110011011010110010101101110011101000010000001000011011011110110101010110110

101110101011011100110100101100011011000010111010001101001011011110110111001110011

001000000101001101010010101100011011101010111001001101001011101000111100100100000

010000100111010101110010011001010110010101101101011101010110111001101001011000110

110000101110100011010010110111101101110011100110010000001010011011100101011000110

111010101110010011010010111010001111001001000000100001001110101011100100110010101

100001011101010100011101101111011101100110010101110010011011100110110101100101011

011100111010000100000010000110110111101101110101101101011101010110111001101001011

000110110000101110100011010010110111101101110011100110010000001010011011001010110

001101110101011100100110100101110100011110010010000001000010011101010111001001100

101011000010111010101000111011011110111011001100101011100100110111001101101011001

010110111001110100001000000100001101101111011011010110110101110101011011100110100

101100011011000010111010001101001011011110110111001110011001000000101001101100101

011000110111010101110010011010010111010001111001001000000100001001110101011100100

110010101100001011101010100011101101111011101100110010101110010011011100110110101

100101011011100111010000100000010000110110111101101101011011010111010101101110011

010010110001101100001011101000110100101101111011011100111001100100000010100110101

000111011011110111011001100101011100100110111001101101011001010110111001110100001

000000100001101101111011011010110110101110101011011100110100101100011011000010111

010001101001011011110110111001110011001000000101001101110010101100011011101010111

001001101001011101000111100100100000010000100111010101110010011001010110000101110

101 10101101101011101010110111001101001011000110110000101110100011010010110111101

101110011100110010000001010011011100101011000110111010101110010011010010111010001

111001001000000100001001110101011100100110010101100001011101010100011101101111011

101100110010101110010011011100110110101100101011011100111010000100000010000110110

111101101110101101101011101010110111001101001011000110110000101110100011010010110

111101101110011100110010000001010011011100101011000110111010101110010011010010111

Annual Report

Government Communications Security Bureau

for the year ended 30 June 2009

GCSB Annual Report

for the Year Ended 30 June 2009

Presented to the House of Representatives

pursuant to Section 12 of the

Government Communications Security Bureau Act 2003

ISSN 1176-4686 (Print)

ISSN 1178-0789 (Online)

1010110110101110101011011100110100101100011011000010111010

0011010010110111101101110011100110010000001010011011100101

0110001101110101011100100110100101110100011110010010000001

0000100111010101110010011001010110000101110101010001110110

1111011101100110010101110010011011100110110101100101011011

1001110100001000000100001101101111011011101011011010111010

1011011100110100101100011011000010111010001101001011011110

1101110011100110010000001010011011100101011000110111010101

1100100110100101110100011110010010000001000010011101010111

0010011001010110000101110101101000111011011110111011001100

1010111001001101110011011010110010101101110011101000010000

0010000110110111101101100101011000110111010101110010011010

0101110100011110010010000001000010011101010111001001100101

0110000101110101101000111011011110111011001100101011100100

1101110011011010110010101101110011101000010000001000011011

0111101101010101101101011101010110111001101001011000110110

0001011101000110100101101111011011100111001100100000010100

1101010010101100011011101010111001001101001011101000111100

1001000000100001001110101011100100110010101100101011011010

1110101011011100110100101100011011000010111010001101001011

0111101101110011100110010000001010011011100101011000110111

0101011100100110100101110100011110010010000001000010011101

0101110010011001010110000101110101010001110110111101110110

0110010101110010011011100110110101100101011011100111010000

1000000100001101101111011011101011011010111010101101110011

0100101100011011000010111010001101001011011110110111001110

0110010000001010011011001010110001101110101011100100110100

1011101000111100100100000010000100111010101110010011001010

1100001011101010100011101101111011101100110010101110010011

0111001101101011001010110111001110100001000000100001101101

1110110110101101101011101010110111001101001011000110110000

1011101000110100101101111011011100111001100100000010100110

1100101011000110111010101110010011010010111010001111001001

0000001000010011101010111001001100101011000010111010101000

1110110111101110110011001010111001001101110011011010110010

1011011100111010000100000010000110110111101101101011011010

1110101011011100110100101100011011000010111010001101001011

0111101101110011100110010000001010011010100011101101111011

1011001100101011100100110111001101101011001010110111001110

1000010000001000011011011110110110101101101011101010110111

0011010010110001101100001011101000110100101101111011011100

1110011001000000101001101110010101100011011101010111001001

1010010111010001111001001000000100001001110101011100100110

01010110000101110101 1010110110101110101011011100110100101

1000110110000101110100011010010110111101101110011100110010

0000010100110111001010110001101110101011100100110100101110

1000111100100100000010000100111010101110010011001010110000

1011101010100011101101111011101100110010101110010011011100

1101101011001010110111001110100001000000100001101101111011

0111010110110101110101011011100110100101100011011000010111

0100011010010110111101101110011100110010000001010011011100

1010110001101110101011100100110100101110100011110010010000

0010000100111010101110010011001010110000101110101101000111

0110111101110110011001010111001001101110011011010110010101

1011100111010000100000010000110110111101101100101011000110

1110101011100100110100101110100011110010010000001000010011

1010101110010011001010110000101110101101000111011011110111

0110011001010111001001101110011011010110010101101110011101

0000100000010000110110111101101010101101101011101010110111

0011010010110001101100001011101000110100101101111011011100

1110011001000000101001101010010101100011011101010111001001

1010010111010001111001001000000100001001110101011100100110

0101011001010110110101110101011011100110100101100011011000

0101110100011010010110111101101110011100110010000001010011

0111001010110001101110101011100100110100101110100011110010

0100000010000100111010101110010011001010110000101110101010

0011101101111011101100110010101110010011011100110110101100

1010110111001110100001000000100001101101111011011101011011

0101110101011011100110100101100011011000010111010001101001

0110111101101110011100110010000001010011011001010110001101

1101010111001001101001011101000111100100100000010000100111

for the

Mastery

Cyberspace

Security

New Zealand

ANNUAL REPORT 2008/09 | GCSB

New Zealand’s security environment over this last year has

changed signicantly, becoming increasingly more complex

and unpredictable. The prime focus for the Bureau remains the

development and maintenance of a technological capability

that is exible, responsive and above all relevant. The investment

required to achieve this is signicant, and the nancial constraints

placed upon the Bureau over this last year have only made the

challenges more daunting.

During this period the Bureau continued to provide unique

intelligence creating a decision-making advantage for the New

Zealand Government, bringing a wide range of skills, products and

services to bear on this goal.

Great benet also continued to be obtained from the Bureau’s

international partnerships. The Bureau continues to place a high

priority on the maintenance and enhancement of its membership

of the international intelligence and security community. By

leveraging these relationships, proactively engaging with

customers and honing its organisational capability, the Bureau is

still well positioned to provide optimum value for New Zealand’s

intelligence and security investment.

The progress outlined in this report indicates that the GCSB has

managed the changing environment well, and continues to make

high value contributions to New Zealand’s national security.

Sir Bruce Ferguson

Director

Director’s Overview

GCSB | ANNUAL REPORT 2008/09

Table of Contents

Director’s Overview ..............................................................................................................A

Part 1: Statement of Purpose .............................................................................................1

Vision .......................................................................................................................................................................1

Mission ....................................................................................................................................................................1

Outcomes ...............................................................................................................................................................2

Part 2: The Year in Review ...................................................................................................3

Output Class 1: Signals Intelligence .............................................................................................................3

Output Class 2: Information Assurance .......................................................................................................4

Other Matters .......................................................................................................................................................4

Corporate Capability ..........................................................................................................................................5

Part 3: Financial Reporting .................................................................................................7

Statement of Responsibility ............................................................................................................................7

Statement of Expenditure and Appropriation ..........................................................................................8

Audit Report ..........................................................................................................................................................9

Table of Contents

ANNUAL REPORT 2008/09 | GCSB

Vision

Mastery of Cyberspace for the Security of New Zealand

Mission

The mission of the GCSB is to inform and enhance the decision-making processes of the New

Zealand Government in the areas of national security, foreign policy, support to law enforcement,

and information assurance:

providing foreign intelligence to support and inform Government decision making;



providing an all-hours intelligence watch and warning service to Government; 

ensuring the integrity, availability and condentiality of ocial information through 

information assurance services to Government; and

improving the protection of the critical national infrastructure from cyber threats.



Statement of Purpose

Part One

GCSB | ANNUAL REPORT 2008/09

Part One

Outcomes

The Government obtains services from the Bureau which contributes towards the ve sector

outcomes:

Increased National Security



Prevention of Terrorism and Major Criminal Activity 

Increased International Security and Global Order

Improved Government Decision Making and Planning 

Improved Economic Performance

The relationship between the GCSB’s outcomes and its agreed outputs is shown in Figure 1:

GOVERNMENT GOAL PROTECT AND ADVANCE THE SECURITY OF NEW ZEALAND

OUTCOMES

A better informed

Government

A Government

alerted to any

external threats

New Zealand’s

international

standing is

enhanced

Ocial

information is

protected

Critical National

Infrastructure is

protected

OUTPUT CLASSES

1. Signals Intelligence 2. Information Assurance

OUTPUT

1.1

SIGINT Reports

1.2

Intelligence

Alerts and

Warnings

1.3

SIGINT Policy

and Support

2.1

Information

Assurance

Policy and

Support

2.2

Information

Assurance

Security

Services

2.3

Critical

Infrastructure

Protection

Services

Figure 1 - GCSB Outcomes and Outputs

ANNUAL REPORT 2008/09 | GCSB

Output Class 1: Signals Intelligence

A Better Informed Government

The GCSB provides foreign intelligence reporting in response

to the requirements and priorities of New Zealand government

departments and agencies. This process is driven by the New

Zealand Government’s Foreign Intelligence Requirements

(FIRs) and all GCSB intelligence production is prioritised

according to these FIRs. During the 2008/09 year the GCSB

wrote 1747 reports against 154 FIRs.

The GCSB is also responsible for the provision of support to

other departments and agencies (particularly the NZDF).

The GCSB has continued to focus throughout the year on

developing partnerships with key stakeholders to ensure tailored intelligence and information

assurance support in meeting their outcomes.

During the year, the GCSB signicantly enhanced its capability by adopting more innovative and

cost-eective solutions to address intelligence collection issues. Signicant investment occurred

in particular at the Bureau’s satellite facility at Waihopai.

A Government Alerted to Any External Threats

The GCSB continues to provide a 24 hour 7 day a week New Zealand SIGINT Operations Centre

(NZSOC) which is in direct contact with operational support or command elements of the NZDF

and New Zealand Police. The NZSOC noties customers when information is received that may

aect the safety and/or security of New Zealanders and New Zealand entities both at home and

overseas.

The Bureau, in concert with integrated NZDF sta where appropriate, provides intelligence and

threat warning support to NZDF military operations, and advice on intelligence matters to the

NZDF and a range of other Government departments and agencies.

The Year in Review

Part Two

Figure 2: GCSB Waihopai

GCSB | ANNUAL REPORT 2008/09

Output Class 2: Information Assurance

Ocial Information is Protected

The GCSB’s capabilities in the Information Assurance (IA) area were enhanced during the year

in collaboration with our international partners. A particular priority during the year was the

ongoing development of the Bureau’s computer network defence operations in support of New

Zealand Government departments and agencies.

The GCSB also contributes to the protection of the critical national infrastructure from cyber

threats through the operations of the Centre for Critical Infrastructure Protection (CCIP). The CCIP

provides a 24 hour 7 day watch-and-warn service, network investigation and analysis services,

and an outreach and training programme. The CCIP participates in a number of national and

international forums.

The Bureau also provides an IA Inspection Programme which aims to deter and detect

unauthorised electronic surveillance of New Zealand government premises or equipment at

home or abroad, and Communications Security (COMSEC) material including cryptographic

devices and keying material. The number of both domestic and overseas inspections increased

again this year.

Demand for the Bureau’s IA education and training services remained high in all areas during

the year. Despite a reduction in the number of courses conducted the total number of students

again increased.

Other Matters

Oversight and Review

The GCSB (in common with the New Zealand Security Intelligence Service) is subject to oversight

by the Inspector-General of Intelligence and Security, Hon Paul Neazor QC. The principal role

of the Inspector-General is to assist the Minister in the oversight and review of New Zealand’s

intelligence and security agencies.

The Inspector-General of Intelligence and Security visited the Bureau during the reporting period

to conduct routine inspections of GCSB warrants and authorisations.

The Intelligence and Security Committee is a statutory committee of Parliamentarians established

by the Intelligence and Security Committee Act 1996. The Intelligence and Security Committee

Part Two

ANNUAL REPORT 2008/09 | GCSB

Part Two

met three times during the year to consider, inter alia, the GCSB’s Annual Report, and other

nancial and performance information.

Internal Audit

The Bureau’s Internal Audit function covers both the assurance of ongoing nancial controls and

the audit of selected performance and eectiveness issues.

PricewaterhouseCoopers (PWC) is contracted by the Bureau to provide internal audit functions.

PWC also conducted six-monthly compliance testing in accordance with the Bureau’s internal

audit and risk management programme.

The Bureau’s Audit Committee, which has been inactive for some time, has been reconstituted

with two independent members.

Legal and Compliance

The Bureau maintains a small team to provide advice on legal and compliance matters. During

the year the team provided advice on the application and interpretation of the GCSB Act and

other legislation relevant to the operations and administration of the Bureau.

Statement on Interception Warrants

A number of Foreign Interception Warrants, issued pursuant to section 17 of the Government

Communications Security Bureau Act 2003, were in force during the year ended 30 June 2009.

Statement on Computer Access Authorisations

A number of Computer Access Authorisations, issued pursuant to section 19 of the Government

Communications Security Bureau Act 2003, were in force during the year ended 30 June 2009.

Corporate Capability

Good Employer Requirements

The Bureau is a department of the Public Service, and operates in accordance with section 56

of the State Sector Act 1988, which requires departments to operate a personnel policy that

complies with the principle of being a ‘good employer’. This requires departments to provide for

the fair and proper treatment of employees in all aspects of their employment.

GCSB | ANNUAL REPORT 2008/09

People Strategy

Work continued during the year on the development of the GCSB People Strategy, which is

designed to be exible enough to allow the Bureau to be responsive to the quickly changing

operational environment within which it operates. In the 2008/09 year signicant progress was

made on a comprehensive review of the Bureau’s remuneration system and associated individual

performance management processes.

Encouraging Diversity within the GCSB

The Bureau recognises that understanding and knowledge of dierent perspectives enhances

the performance of its employees and hence the organisation. In addition to complying fully with

the Human Rights Act 1993 and the New Zealand Bill of Rights Act 1990, we are endeavouring

to achieve this through:

ensuring that all employees have equal access to employment opportunities;



membership of the EEO Trust; and

fostering of non-discriminatory practices within the GCSB’s recruitment procedures.

Key achievements during the year included:

continued networking and membership of the EEO Trust Employers’ Group; and

participation in an Employee Assistance Programme for all employees who choose to 

access the programme for advice and assistance.

Operational Capacity – Stang Numbers

During the year the Bureau experienced a sta turnover of 8.9%. At the end of this reporting

period the Bureau had 314 full time equivalent sta.

Accommodation

Construction of the new GCSB Head Oce building commenced during

the year. The building is expected to ready for occupation in early 2011. In

the interim, the Bureau has re-consolidated in the Freyberg Building by

occupying two additional oors and relinquishing its lease of two oors

in the adjacent St Paul’s Square Building.

Part Two

Figure 3: New GCSB Head Oce

ANNUAL REPORT 2008/09 | GCSB

Part Three

Statement of Responsibility

In terms of sections 35 and 37 of the Public Finance Act 1989, I am responsible as Chief Executive

of the Government Communications Security Bureau, for the preparation of the Bureau’s nancial

statements and the judgements made in the process of producing those statements.

I have the responsibility of establishing and maintaining, and I have established and maintained,

a system of internal control procedures that provide reasonable assurance as to the integrity and

reliability of nancial reporting.

In my opinion, these nancial statements fairly reect the nancial position and operations of

the Bureau for the year ended 30 June 2009.

Bruce Ferguson

Director GCSB

29 September 2009

Countersigned by

C B G Carson BCA, CA

Chief Financial Ocer

29 September 2009

Financial Reporting

GCSB | ANNUAL REPORT 2008/09

Part Three

Statement of Expenditure and Appropriation

The total appropriation was $49.368 million.

The expenditure out-turn on the Vote was $49.333 million or 0.01% less than the appropriation.

$000

Total appropriation………………………………………………………………… $49.368

Actual Expenditure………………………………………………………………... $49.333

ANNUAL REPORT 2008/09 | GCSB

Part Three

Audit Report

To the readers of the

Government Communications Security Bureau’s

Statement of Expenditure and Appropriation

for the year ended 30 June 2009

The Auditor General is the auditor of the Government Communications Security Bureau (the

Bureau). The Auditor General has appointed me, Stephen Lucy, using the sta and resources of

Audit New Zealand, to carry out the audit. The audit covers the statement of expenditure and

appropriation included in the annual report of the Bureau for the year ended 30 June 2009.

Unqualied Opinion

In our opinion the statement of expenditure and appropriation of the Bureau on page 13 fairly

reects the total of the actual expenses and capital expenditure incurred for the nancial year

ended 30 June 2009 against the Bureau’s appropriation for that nancial year.

The audit was completed on 29 September 2009, and is the date at which our opinion is

expressed.

The basis of our opinion is explained below. In addition, we outline the responsibilities of the

Director and the Auditor, and explain our independence.

Basis of Opinion

We carried out the audit in accordance with the Auditor General’s Auditing Standards, which

incorporate the New Zealand Auditing Standards.

We planned and performed the audit to obtain all the information and explanations we

considered necessary in order to obtain reasonable assurance that the statement of expenditure

and appropriation did not have material misstatements, whether caused by fraud or error.

Material misstatements are dierences or omissions of amounts and disclosures that would

aect a reader’s overall understanding of the statement of expenditure and appropriation. If we

had found material misstatements that were not corrected, we would have referred to them in

our opinion.

GCSB | ANNUAL REPORT 2008/09

Part Three

The audit involved performing procedures to test the information presented in the statement

of expenditure and appropriation. We assessed the results of those procedures in forming our

opinion.

Audit procedures generally include:

determining whether signicant nancial and management controls are working and



can be relied on to produce complete and accurate data;

verifying samples of transactions and account balances;



performing analyses to identify anomalies in the reported data;

reviewing signicant estimates and judgements made by the Director;

conrming year-end balances;

determining whether accounting policies are appropriate and consistently applied; and

determining whether all the statement of expenditure and appropriation disclosures are 

adequate.

We did not examine every transaction, nor do we guarantee complete accuracy of the statement

of expenditure and appropriation.

We evaluated the overall adequacy of the presentation of information in the statement of

expenditure and appropriation. We obtained all the information and explanations we required

to support our opinion above.

Responsibilities of the Director and the Auditor

The Director is responsible for preparing a statement of expenditure and appropriation that

provides a record of the total of the actual expenses and capital expenditure incurred for the

nancial year ended 30 June 2009 against the Bureau’s appropriation for that nancial year.

The Director’s responsibilities arise from sections 45B and 45E of the Public Finance Act 1989.

We are responsible for expressing an independent opinion on the statement of expenditure and

appropriation and reporting that opinion to you. This responsibility arises from section 15 of the

Public Audit Act 2001 and section 45D(2) of the Public Finance Act 1989.

ANNUAL REPORT 2008/09 | GCSB

Independence

When carrying out the audit we followed the independence requirements of the Auditor General,

which incorporate the independence requirements of the Institute of Chartered Accountants of

New Zealand.

Other than the audit, we have no relationship with or interests in the Bureau.

S B Lucy

Audit New Zealand

On behalf of the Auditor-General

Wellington, New Zealand

Part Three

Matters Relating to the Electronic Presentation of the Audited Statement of Expenditure and Appropriation

This audit report relates to the statement of expenditure and appropriation of the Bureau for the year ended 30 June

2009 included on the Bureau’s website. The Director of the Bureau is responsible for the maintenance and integrity of the

Bureau’s website. We have not been engaged to report on the integrity of the Bureau’s website. We accept no responsibility

for any changes that may have occurred to the statement of expenditure and appropriation since it was initially presented

on the website.

The audit report refers only to the statement of expenditure and appropriation named above. It does not provide an opinion

on any other information which may have been hyperlinked to or from the statement of expenditure and appropriation.

If readers of this report are concerned with the inherent risks arising from electronic data communication they should

refer to the published hard copy of the audited statement of expenditure and appropriation and related audit report

dated 29 September 2009 to conrm the information included in the audited statement of expenditure and appropriation

presented on this website.

Legislation in New Zealand governing the preparation and dissemination of nancial information may dier from

legislation in other jurisdictions.