Removing, transporting, or receiving information

On this page

 

Security measures and policy for physically removing, transferring, or receiving classified information.

The security measures required to protect classified information during physical moves depend on:

  • the protective markings
  • where it is going from and to
  • the method used for transferring the information.

The intended recipient must have the appropriate ‘need-to-know’ and the required level of security clearance before the information is transferred.

Your agency should develop a policy based on the minimum measures, as well as policy for information and material too large for the ‘double barrier’ principle.

Removing protectively-marked information from your premises

Understand how to protect government information with protective markings when you take it away from your premises.

These requirements apply to all government information (with or without security classifications).

Follow these requirements to ensure your agency complies with the Protective Security Requirements for information security.

Putting policies and processes in place

If your agency wants to take (remove) protectively-marked information from your premises, you must have policies and processes in place to ensure it’s protected. You might want to take protected information to another agency or workplace for a meeting or to work from home.

However, protected information should only be removed from your premises when:

  • there is a definite need
  • the right level of protection can be maintained en route and at the destination.

Policy for ‘TOP SECRET’ information

You must not remove TOP SECRET information for short-term work at home without approval from the New Zealand Security Intelligence Service (NZSIS) and the originating agency (if not your agency).

Removing protected information within New Zealand

Before anyone in your agency takes protectively-marked information from secure or authorised work areas, they must have approval.

Authorising removals

Your agency decides who can authorise removals. However, it should be the manager or equivalent person responsible for the information who gives approval.

The approver must:

  • be satisfied that a genuine need exists
  • brief the person removing the information on the risks involved
  • be satisfied that there are adequate arrangements for the safe custody of the information
  • be prepared to accept responsibility for the safe custody of the information.

Make sure you keep a record of all removals at TOP SECRET and SECRET levels.

Carrying protectively-marked information securely — briefcases and satchels

Your agency should use NZSIS approved briefcases and satchels that are suitable for carrying protectively-marked information. Please contact the PSR team for details.

When protectively-marked information is transported outside your agency in an approved briefcase or satchel, you must place it in an opaque envelope within the briefcase.

The briefcase or satchel must be:

  • locked at all times
  • kept under the personal protection of the custodian.

To prevent keys being copied or locks being manipulated:

  • do not leave the keys in the lock when left in unsecured areas
  • lock the briefcase or satchel, even when it is empty.

Protecting electronic media

You must protect electronic media, such as laptops, CDs, and USBs, used to process protectively-marked information to the same degree as paper-based materials.

The level of protection must be equivalent to the highest level of protectively-marked information ever placed on the media until it is sanitised.

Working away from the office or off-site

For regular and long-term arrangements for people working away from the office:

Sometimes you might need arrange for information to be transferred to a regional or branch office rather than allowing it to be taken to a place where you can’t guarantee its security. For example, keeping protected information in a hotel room overnight might not be secure enough in some cases.

Taking protected information outside New Zealand

Take special care when your agency plans to take protectively-marked information overseas. It can be exposed to far greater risks, so more security measures are necessary.

Read Travel Advice for Government Official Travelling Overseas on Business(external link) before you authorise any of your people to transmit or handle protectively-marked information outside New Zealand.

Checking with the Ministry of Foreign Affairs and Trade

The international Diplomatic Safe Hand Courier Service is administered on behalf of the New Zealand Government by the Ministry of Foreign Affairs and Trade (MFAT) under Articles 27 and 40 of the Vienna Convention of Diplomatic Relations (1961) for the secure transportation of official material classified CONFIDENTIAL or above. The MFAT diplomatic courier network facilitates the secure, routine delivery of classified consignments worldwide. This is the preferred means of transporting all classified information outside of New Zealand. MFAT can provide additional details to any agencies wishing to utilise the Diplomatic Safe Hand Courier Service.

If using the Diplomatic Safe Hand Courier Service is not practical, your Chief Security Officer should contact MFAT to discuss alternative arrangements.

Preparing protectively-marked information for transport

You must use security measures to protect marked information when it is in transit.

Measures can include:

  • using NZSIS-approved briefcases, satchels, seals, pouches, or transit bags
  • using special enveloping procedures
  • transporting information by hand between people with the appropriate security clearance or by authorised messengers.

Security methods can be used together to create tighter security. For instance:

  • using an inner and outer envelope — double enveloping
  • combining an inner barrier with an outer barrier — the ‘double barrier’ method.

Whichever combination you use, the inner barrier must be tamper evident and the outer barrier must obscure the nature of the information being transferred.

Addressing information correctly

Address protectively-marked information to a specific position, appointment, or named individual.

Make sure the addressee and alternative have the required level of security clearance.

Specify the intended recipient’s name, designation, and full street address.

Do not send protectively-marked information to a post office box.

For TOP SECRET information, you must provide an alternative individual or appointment. You should also do that for protectively-marked information classified below TOP SECRET.

Transporting information within your office

You can transport protectively-marked information within a single location without any coverings, such as envelopes, when:

  • the information is transported directly between staff who have the appropriate level of clearance to access it and the need-to-know
  • there is no opportunity for unauthorised people to view the information.

If there is a risk that an unauthorised person could view the information, it must be covered.

Double enveloping

You must use a double barrier to transport protectively-marked documents securely outside your agency.

Double enveloping is used to help protect the need-to-know principle when you transportprotectively-marked information and ACCOUNTABLE MATERIAL.

Double enveloping provides evidence of tampering. As the name suggests, double enveloping consists of placing protectively-marked information in two sealed envelopes.

Your agency must use double enveloping for all information classified as CONFIDENTIAL, SECRET and TOP SECRET when delivering by hand or using an NZSIS-endorsed courier.

Use double enveloping at your discretion for information classified as IN-CONFIDENCE, SENSITIVE or RESTRICTED. Use your security risk management plan to inform decisions.

SENSITIVE and RESTRICTED information or material must be double enveloped when it is sent by post or commercial courier.

Including receipts

Double enveloping must be used along with receipts that:

  • are enclosed with the protectively-marked documents
  • identify the date and time of dispatch, and the dispatching officer’s name
  • have a unique identifying number.

Getting the outer envelope right

Use the outer envelope in a similar way to normal mail envelopes. It gives protection to the inner envelope.

The outer envelope must not:

  • display the protective markings of the document
  • use tamper-evident seals.

The outer envelope must display:

  • the physical address of the recipient
  • a distinct reference number (this may be the receipt number if the envelopes are not individually numbered)
  • the name and signature of the dispatching officer
  • the date of dispatch.

Getting the inner envelope right

The inner envelope is used to give evidence of tampering.

The inner envelope should:

  • display the protective markings at the top and bottom, and front and back of the envelope
  • be sealed with an NZSIS-approved tamper-evident seal in such a way that covert entry to the envelope is countered.

Using other envelope methods

Some single-use envelopes have been approved by the NZSIS for use:

  • as an inner envelope
  • as an outer envelope when used to enclose several inner envelopes where initial delivery will be to a registry or similar.

Multi-use satchels may also be used in some circumstances. Please contact the Protective Security Requirements team for details, as the Approved Products List is classified information.

Methods for transporting protected information

Your agency should choose the transport method that best achieves the safe transport of protected information.

Using the ‘Safe hand’ method

The ‘safe hand’ method is when information with protective markings is despatched to the addressee in the care of an authorised officer, or succession of authorised officers, who are responsible for its carriage and safekeeping.

At each handover, a receipt is obtained showing at least:

  • the identification number of the package
  • the time and date of the handover
  • the name and signature of the recipient.

The purpose of sending an article using safe hand is to establish an audit trail that allows the sender to receive confirmation that the addressee received the information.

To send information using the safe hand method:

  • enclose it in a double barrier (double envelope it)
  • give it a unique identification number (usually the receipt number)
  • place a two-part receipt in the inner envelope with the information — the addressee keeps one portion and signs it and then returns the other portion to the sender
  • ensure some form of record or receipt system accompanies the package, so that every handover is documented
  • transport the information in an approved briefcase or mailbag
  • ensure the information is not be left unattended, except when placed in the cargo compartment of an aircraft.

Using commercial couriers or postal services

Your agency can send material classified up to and including RESTRICTED by post or commercial courier within New Zealand.

Items classified SENSITIVE or RESTRICTED must be double enveloped.

When no authorised messenger or safe-hand courier service exists, your agency can allow material classified CONFIDENTIAL to be carried by signature-required commercial courier or registered post within New Zealand. This method can be used when:

  • delivery by safe hand can’t be done within 15 minutes (by foot or vehicle)
  • the sending and receiving agencies have an agreement on the use of commercial couriers for the carriage of CONFIDENTIAL material
  • arrangements have been made to ensure the receiving agency is able to accept the information at the expected delivery time.

Only commercial couriers that have been approved by the NZSIS must be used to carry SECRET material. Your CSO can request details on the requirements and approval process from the NZSIS.

General guidelines

Receipts: All CONFIDENTIAL or SECRET information sent via commercial courier or postal agency must be accompanied by a receipt. The receipt must be signed by the receiving agency and returned to the sending agency.

Packaging: For carriage by commercial courier, the courier satchel itself when opaque can stand as the outer envelope. Envelopes and wrappings need to be robust to stand up to the wear and tear of transit.

Dispatch and delivery: Do not leave protectively-marked information unattended while awaiting pick-up by courier.

Don’t dispatch protectively-marked information before weekends or public holidays unless the addressee is able to receive it the following day and secure it appropriately.

Check your delivery documentation to ensure items arrive within expected timeframes.

If there has been an undue delay or there is any sign of tampering, both the sending and receiving CSOs should be notified.

When you can’t use a courier or postal agency

TOP SECRET material and material with a compartmented marking must not be carried by a commercial courier or postal agency.

Special handling requirements that apply to information carrying endorsement markings may also preclude the use of a commercial courier.

Information marked with the New Zealand Eyes Only (NZEO) endorsement marking must be transported according to its level of security classification.

The requirements for other endorsement markings are established by the controlling agency.

Dealing with bulky material

Generally, when the size and weight of material means it can’t be moved using the safe hand method or commercial couriers, you need to take special precautions to ensure the material is not compromised, lost, or damaged in transit.

Seek advice from your CSO. Your CSO may, in turn, get advice from the NZSIS.

Dealing with high-risk unclassified material

If you need to transport valuable material, such as artwork or money, to another agency, you can use commercial courier services.

However, take care to assess the courier service first. Make sure it is legitimate, reliable, and can offer the right level of protection for the risks you’ve identified.

You also need to meet any legislative requirements that apply to your material.

Whenever possible, avoid drawing attention to the specific nature of the material being moved.

Extra security steps might be necessary in some circumstances. Steps such as:

  • sealing the material
  • security clearing the employees of the courier service
  • arranging a security or police escort.

Receiving hard copies

Before you allow anyone in your agency to receive hard copies of protectively-marked information, make sure they are aware of their responsibilities and, when necessary, hold the appropriate security clearance.

Protectively-marked documents should only be opened by the addressee or the alternative addressee. However, your agency head may authorise a specified person or area to open all mail and perform the related information or security management functions.

When someone other than the intended addressee is charged with its opening, adopt the normal practice of opening the outer envelope only. The inner envelope should only be opened in the presence of the addressee.

The recipient of a package containing protectively-marked documents must verify that the:

  • information was transported by the appropriate means
  • seals and packaging are still intact.

Report any breakages, signs of tampering, or inappropriate transport methods to your CSO and the CSO of the sending agency. If the package was delivered by an NZSIS-endorsed courier, you must advise the NZSIS.

The recipient must check that the contents and their integrity are preserved. For example, check the pages and table of contents, and sign and return any receipt accompanying the information.

If your agency keeps a register for protectively-marked documents, make sure the information is registered.