2 December 2016
Reference numbers
FOI Request FA 16/11/00189
File Number ADF2016/65920
Mr Ben Fairless
Sent via email: xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Freedom of Information request – decision on request
Dear Mr Fairless,
This letter refers to your request received on 2 November 2016 seeking access under the
Freedom of Information Act 1982 (the FOI Act) to the following documents:
1) A copy of the most current configuration settings for janusSEAL. This is an off the
shelf product being used by DIBP to classify emails. janusSEAL allows the
department to correctly classify emails in line with the Australian Government security
classification system.
2) A copy of any correspondence in the last 3 years sent to all DIBP staff in relation to
janusSEAL. This may not reference the product by name, but may be a notification
sent across the agency or training piece on how to correctly classify emails, or, for
example, what will happen if you try to send an email classified as FOUO,
PROTECTED or SECRET to a non .gov.au email address.
Decision
The Department’s decision is to release the documents in part. Please see the attached
Decision Record, which explains the reasons for decision as required under s.26 of the FOI
Act.
Review rights Internal review
If you disagree with the decision, you have the right to apply for an internal review by the
Department. Any request for internal review must be provided to the Department within 30
days of you being notified of the decision. Where possible please attach reasons why you
believe review is necessary. The internal review will be carried out by an officer other than
the original decision-maker and the Department must make a review decision within 30 days.
6 Chan Street Belconnen ACT 2617
PO Box 25 BELCONNEN ACT 2616 • Telephone: 02 6264 1111 • Fax: 02 6225 6970 • www.border.gov.au
- 2 -
Applications for review should be sent to:
Freedom of Information
Department of Immigration and Border Protection
PO Box 25
BELCONNEN ACT 2617
Or by email to: xxx.xxxxxxx@xxxxxx.xxx.xx
Review by the Office of the Australian Information Commissioner
You may apply directly to the Office of the Australian Information Commissioner (OAIC) for a
review of the decision. You must apply in writing within 60 days of this notice. For further
information about review rights and how to submit a review request to the OAIC, please see
FOI fact sheet 12 ‘
Freedom of information – Your review rights’, available online
at www.oaic.gov.au .
How to make a complaint about the handling of this FOI request
You may complain to the Australian Information Commissioner if you have concerns about
how the department has handled your request under the FOI Act. Information about how to
submit a complaint is available at www.oaic.gov.au
Contacting the FOI Section If you wish to discuss this matter, I can be contacted using the details provided below.
Yours sincerely,
Brad Collins
Freedom of Information Officer
Information Management Branch
Department of Immigration and Border Protection
xxx@xxxxxx.xxx.xx
Attachments
• Attachment A – Decision Record
• Attachment B – Schedule of Documents
• Attachment C – Extract of relevant legislation
• Attachment D – Documents released under the FOI Act
Attachment A
DECISION RECORD
Request Details FOI Request FA 16/11/00189
File Number ADF2016/65920
Scope of request
1. On 20 June 2016 you requested:
1) A copy of the most current configuration settings for janusSEAL. This is an off the
shelf product being used by DIBP to classify emails. janusSEAL allows the
department to correctly classify emails in line with the Australian Government security
classification system.
2) A copy of any correspondence in the last 3 years sent to all DIBP staff in relation to
janusSEAL. This may not reference the product by name, but may be a notification
sent across the agency or training piece on how to correctly classify emails, or, for
example, what will happen if you try to send an email classified as FOUO,
PROTECTED or SECRET to a non .gov.au email address.
Authority to make decision
2. I am an officer authorised under section 23 of the FOI Act to make decisions in respect of
requests to access documents or to amend or annotate Departmental records.
Information considered
3. In reaching my decision, I have considered the following:
• the terms of your request
• the
Freedom of Information Act 1982
• the Australian Information Commissioner’s guidelines relating to access to documents
held by government
• Departmental documents, identified in the Schedule of Documents
• consultations with relevant business areas.
Decision
4. Section 22(2) of the FOI Act provides that, where an agency reaches the view that a
document contains exempt information or material that is irrelevant to the request and it
is possible for the agency to prepare an edited copy of the document with the irrelevant
or exempt material deleted, then the agency must prepare such a copy.
6 Chan Street Belconnen ACT 2617
PO Box 25 BELCONNEN ACT 2616 • Telephone: 02 6264 1111 • Fax: 02 6225 6970 • www.border.gov.au
- 4 -
5. This edited copy must be provided to the applicant. Further, the decision maker must
advise the applicant in writing that the edited copy of the document has been prepared
and of the reasons(s) for each of the deletions in the document (s.22(3) of the FOI Act).
6. The Schedule of Documents (Attachment B) and the documents released detail the
exemptions that have been applied. Exemptions were applied on the following grounds:
Section 47E(d) – have a substantial adverse effect on the proper and efficient conduct
of the operations of an agency
7. Section 47E(d) provides that a document is conditionally exempt if its disclosure under
the Act would, or could reasonably be expected to, have a substantial adverse effect on
the proper and efficient conduct of the operations of an agency.
8. The document relating to Part 1 of your request (the configuration file) contains IT
security settings for the Department’s email systems.
9. Releasing this file would effectively create a map for part of the Department’s IT security
settings for anyone who wish to infiltrate the Department’s IT systems. While there are
systems in place to detect and prevent this from occurring, meaning the risk is relatively
low, the consequences for such an incursion would be significant if it did occur.
10. On this basis, I am satisfied that information contained in the document could reasonably
be expected to adversely affect the Department's operations in respect of maintaining
network security. I find this adverse effect to be serious and not insubstantial. Therefore, I
am satisfied that the material in issue is conditionally exempt under s.47E(d) of the Act.
11. I note that while some parts of this file could likely be released without harm, due to the
technical nature of the material, it would be virtually impossible to be certain that a
partially redacted document contained no information that would be harmful to the
Department. I therefore consider it prudent in this case to exempt the document in full.
12. One of the emails relating to Part 2 of your request contains internal methods of
communication (email addresses and telephone numbers). These are made available to
employees of the Department so that they can seek advice on security issues, in order
for the Department to fulfil its function in a proper and efficient manner.
13. While these contact methods are made available to employees, they are not made
publicly available. I have considered the effect that publicly releasing these contact
channels would have, and it would be to create alternate and unsuitable methods for
members of the public to contact the Department. This would have the dual effect of
creating unnecessary work for Departmental employees while they redirect enquiries, as
well as causing unnecessary delays for clients who should be utilising established
channels of communications.
14. On this basis, I am satisfied that information contained in the documents could
reasonably be expected to cause unnecessary work for Departmental employees, taking
them away from their required duties, and decreasing the Department’s ability to function
properly and efficiently. Therefore, I am satisfied that the material in issue is conditionally
exempt under s.47E(d) of the Act.
Application of the ‘public interest’ test
15. Although I have found that the information contained in the document you requested is
conditionally exempt from release under s.47E(d), the FOI Act requires me to disclose
- 5 -
the information unless access at this time would, on balance, be contrary to the public
interest. I will now consider whether disclosure would be contrary to the public interest.
16. The factors favouring access to information are provided at s.11B of the FOI Act:
Factors favouring access
(3) Factors favouring access to the document in the public interest include
whether access to the document would do any of the following:
(a) promote the objects of this Act (including all the matters set out in
sections 3 and 3A);
(b) inform debate on a matter of public importance;
(c) promote effective oversight of public expenditure;
(d) allow a person to access his or her own personal information.
17. I acknowledge that release of the document without the exemptions made under s.47E(d)
would promote the objects of the FOI Act, through facilitating and promoting public
access to information.
18. However, I consider that the release of the information would make a negligible further
contribution to public debate, would not promote effective oversight of public expenditure
or allow a person to gain access to his or her own personal information.
19. In contrast, I consider that the ability for the Department to safeguard client and
operational information contained on its IT systems to be strongly in the public interest.
20. I further consider that the ability for the Department to maintain effective and efficient
communication channels, particularly when compromising these channels would have
negative flow-on effects for clients,
21. Taking into account the above matters, on balance, I consider that disclosure of the
information in the documents exempted under s.47E(d) to be contrary to the public
interest. Accordingly, I have decided that the documents are exempt in part under
s.47E(d) of the FOI Act. The exemptions have therefore been applied to the documents
released.
Brad Collins
Authorised decision maker
Department of Immigration and Border Protection
Email: xxx@xxxxxx.xxx.xx
2 December 2016
- 7 -
Attachment C – Extract of relevant legislation
22 Access to edited copies with exempt or irrelevant matter deleted
Scope
(1) This section applies if:
(a) an agency or Minister decides:
(i) to refuse to give access to an exempt document; or
(ii) that to give access to a document would disclose information that
would reasonably be regarded as irrelevant to the request for access;
and
(b) it is possible for the agency or Minister to prepare a copy (an
edited copy)
of the document, modified by deletions, ensuring that:
(i) access to the edited copy would be required to be given under
section 11A (access to documents on request); and
(ii) the edited copy would not disclose any information that would
reasonably be regarded as irrelevant to the request; and
(c) it is reasonably practicable for the agency or Minister to prepare the edited
copy, having regard to:
(i) the nature and extent of the modification; and
(ii) the resources available to modify the document; and
(d) it is not apparent (from the request or from consultation with the applicant)
that the applicant would decline access to the edited copy.
Access to edited copy
(2) The agency or Minister must:
(a) prepare the edited copy as mentioned in paragraph (1)(b); and
(b) give the applicant access to the edited copy.
Notice to applicant
(3) The agency or Minister must give the applicant notice in writing:
(a) that the edited copy has been prepared; and
(b) of the grounds for the deletions; and
(c) if any matter deleted is exempt matter—that the matter deleted is exempt
matter because of a specified provision of this Act.
(4) Section 26 (reasons for decision) does not apply to the decision to refuse access
to the whole document unless the applicant requests the agency or Minister to
give the applicant a notice in writing in accordance with that section.
47E Public interest conditional exemptions—certain operations of agencies
A document is conditionally exempt if its disclosure under this Act would, or could reasonably
be expected to, do any of the following:
(a)
prejudice the effectiveness of procedures or methods for the conduct of tests,
examinations or audits by an agency;
- 8 -
(b)
prejudice the attainment of the objects of particular tests, examinations or
audits conducted or to be conducted by an agency;
(c)
have a substantial adverse effect on the management or assessment of
personnel by the Commonwealth, by Norfolk Island or by an agency;
(d)
have a substantial adverse effect on the proper and efficient conduct of the
operations of an agency.
Note:
Access must generally be given to a conditionally exempt document
unless it would be contrary to the public interest (see section 11A).
11B Public interest exemptions—factors
(1) This section applies for the purposes of working out whether access to a
conditionally exempt document would, on balance, be contrary to the public interest
under subsection 11A(5).
(2) This section does not limit subsection 11A(5).
Factors favouring access
(3) Factors favouring access to the document in the public interest include whether
access to the document would do any of the following:
(a) promote the objects of this Act (including all the matters set out in sections
3 and 3A);
(b) inform debate on a matter of public importance;
(c) promote effective oversight of public expenditure;
(d) allow a person to access his or her own personal information.
Irrelevant factors
(4) The following factors must not be taken into account in deciding whether access
to the document would, on balance, be contrary to the public interest:
(a) access to the document could result in embarrassment to the
Commonwealth Government, or cause a loss of confidence in the
Commonwealth Government;
(aa) access to the document could result in embarrassment to the
Government of Norfolk Island or cause a loss of confidence in the
Government of Norfolk Island;
(b) access to the document could result in any person misinterpreting or
misunderstanding the document;
(c) the author of the document was (or is) of high seniority in the agency to
which the request for access to the document was made;
(d) access to the document could result in confusion or unnecessary debate.
Guidelines
- 9 -
(5) In working out whether access to the document would, on balance, be contrary to
the public interest, an agency or Minister must have regard to any guidelines issued
by the Information Commissioner for the purposes of this subsection under section
93A.
Document 1
Brad COLLINS
From:
All Staff Message [CO]
Sent:
Friday, 13 March 2015 11:50 AM
To:
[ All ACBPS Staff]
Subject:
All staff message—Outlook Autofill changes [DLM=For-Official-Use-Only]
Attachments:
image001.jpg
Integrity, Security and Assurance Division
Outlook Autofill changes
Colleagues,
Over the weekend of 14 and 15 March the Outlook address autofill function on the DIBP and ACBPS
email systems will be permanently turned off.
Some staff have accidentally sent email to the wrong people and disabling this function will help to stop this
from happening again.
After the change you will need to manually add recipients to any new email you create. This change won’t
affect
the ‘reply’ or ‘reply all’ functions, so please check that you don’t accidentally add email recipients who
shouldn’t be
included.
When you create a new email, you can still select an internal address from the internal address book, but
external
email addresses will need to be entered manually. Group mailboxes and individuals can still develop their
own
contact lists to manage commonly used email addresses.
Overseas staff when logging in through Citrix will also find the Outlook autofill function disabled. No change
is being
made to the DFAT email system.
If you are sending email to overseas posts please select the email address with the suffix (DFAT).
This will ensure they will receive the email and reply to you promptly.
Think about the content of the emails you create. Protective markings are an important part of protecting
our information.
We are all responsible for preventing people who don’t have a need to know, or the appropriate security
clearance from
accidentally receiving information.
For further information contact:
Telephone: s. 47E(d)
1
Document 2
domain, the outgoing protected email policy warning will either remove the invalid address from the email,
or force you to return to the message to correct the address list.
Authorised for transmission by
Glenn Peisley
Assistant Secretary Security
Integrity, Security and Assurance Division
2
