Dear Ministry of Social Development,

This is a request under the Official Information Act.

In light of the recent breaches of information security at the Ministry, I am requesting information of great public interest for determining how such breaches have come about.

1. I request that you release all reports to the Ministry and to the Ministry's agencies (and any staff member therein) regarding or containing an assessment of the IT security at the Ministry and/or any of its agencies in the last 5 years. This includes but is not limited to:
- A report made by Dimension Data in April last year
- Any internal reports made by staff
- Any reports made by IT contractors while implementing any IT solution operating on an MSD network
Please release the full text of these reports, who they were submitted by, the date they were submitted, who they were submitted to (a full list of people who received a copy of the report), and what actions related to information security were taken as a result (if any).

2. I request that you release all information security plans in place over the last 5 years at the Ministry and all of its agencies, including the full text of such plans, the date at which such plans were adopted, the date at which they were superseded by a newer plan, and the extent to which they comply with the International Standards Organisation Information Security Management Standard (AS/NZS ISO/IEC 27001:2006).

Yours faithfully,
Josh Levent

Dear Ministry of Social Development,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Ministry of Social Development's handling of my FOI request 'Information Security Reports and Plans'.

My complaint relates to the following:
1. I was sent the 26/04/2011 Kiosk Review but not 2 pieces of information relating to this review which I requested, nor a reason why this information was witheld. This information was who the review was made available to at MSD, and what actions were taken as a result.
2. I was refused my request for information security plans operating at MSD, ostensibly on the grounds of sections 6(c) and 9(2)(k) of the Official Information Act, but it is unclear how every aspect of those plans is so sensitive as to "prejudice the maintenance of the law", or provide someone "improper gain or improper advantage". I humbly suggest that at the very least, broad level aspects of such plans would do neither of these and could be released while witholding many specific details in such plans.

A full history of my FOI request and all correspondence is available on the Internet at this address:
http://fyi.org.nz/request/information_se...

Yours faithfully,

Josh Levent

Dear Marc Warner and the Official and Parliamentary Information Team,

Thank you for your response to my OIA request.

I would like to clarify an aspect of the response I received which is that it included only one report regarding information security at MSD. Since I requested all reports containing a review of MSD Information Security in the past five years, am I to conclude that this is the only report relating to information security in the past five years in the entire Ministry?

Yours sincerely,
Josh Levent