Part 3: How the agencies use information

Border security: Using information to process passengers.

3.1
In this Part, we discuss:

Summary of our findings

3.2
The information individual agencies receive enables them to assess incoming passengers for risk and support an effective border security process. However, improvements are needed to how Customs, MPI, and Immigration New Zealand share information.

3.3
There are some limitations with the systems, tools, and resources used currently, which affects how efficiently information is collected, used, and shared between the agencies.

3.4
Customs and MPI both have processes to ensure that information collected by frontline staff is entered into their respective systems to inform intelligence staff.

3.5
In recent years, individual agencies have improved the way information is collected and used. The agencies are working to further strengthen a collaborative approach, including the way information is shared.

Pre-arrival information is used to identify risks

Integrated Targeting Operations Centre

3.6
ITOC is a multi-agency border sector headquarters that includes staff from Customs, MPI, Immigration New Zealand, Maritime New Zealand, New Zealand Police, New Zealand Security and Intelligence Service, and others. ITOC has two core functions: targeting potential risks and managing the operations centre. Through the targeting function, ITOC maintains the rules used to profile potential threats, acts on intelligence profiles, conducts assessments, makes recommendations, and brings together information and intelligence to identify and target risks. The operations centre is staffed by Customs. With an overall view of the operational activity at the border, the centre supports those operations, and collects and shares lessons from feedback and debriefing activities to inform future operations.

3.7
ITOC has improved co-ordination and sharing of information between the agencies. However, because most of the information ITOC receives relates to risks that directly concern Customs, the agencies consider there to be limitations with its effectiveness for some other agencies involved.

3.8
An external review of ITOC was completed in 2016.8 The purpose of the review was "to identify and report on the operational effectiveness of ITOC and, capitalising on the work done to date, determine what next steps are needed to ensure ITOC remains fit for purpose and of value to the partner agencies".

3.9
One of the recommendations in this review was that a long-term vision and strategy needed to be prepared for the border sector. We agree. We discuss this in more detail in paragraphs 5.11-5.15.

Customs

3.10
Customs has created risk profiles based on trends and known indicators of potential illegal activity, such as the risk profile of a typical drug smuggler. Customs' Passenger Targeting Unit assesses pre-arrival passenger information against these risk profiles and identifies passengers that could pose a risk. This allows Customs to target its frontline resources more effectively.

3.11
Various agencies communicate with, work alongside, and provide information to Customs to help keep our border secure. Customs has agreements with a number of agencies to share information about common interests. For example, Customs and New Zealand Police share information about drugs, weapons, and objectionable material.

3.12
Customs is part of an agreement between New Zealand, Australia, Canada, the United States of America, and the United Kingdom (the Border Five). The Border Five has agreed, in principle and where it is legal to do so, to share information and intelligence, including international trends and intelligence reports for the purpose of border security. The Border Five aims to increase international collaboration through secure and appropriate information sharing. Customs also has agreements to share information with other countries such as France and some Pacific Island nations.

3.13
Customs is also working more extensively to gather intelligence on passengers before they arrive at the border. For example, Customs has appointed a staff member in Hong Kong. A major benefit of the posting is that intelligence can be collected there that could lead to efficiency gains in security at the border.9

3.14
Generally the information that airlines give to Customs is fit for purpose. This is supported by the airline industry having a limited number of passenger booking systems that are used by all commercial airlines around the world. The information Customs receives from airlines comes in two forms: Advance Passenger Information and Passenger Name Record Data. This information contains important passenger details that Customs uses to assess a passenger's risk.

3.15
The Passenger Name Record Data is "a record in an airline's computer reservation system that contains a range of information including the itinerary of a passenger, ticket information, contact details and means of payment".10

3.16
Cruise lines provide Advance Passenger Information to Customs. However, because each cruise line operates its own booking system, there is greater variation in the quality of the passenger information and the format in which Customs receives it. Customs also has to manually enter this information into its systems. This makes profiling cruise ship passengers harder because Customs cannot automatically assess the passenger information against its risk profiles as it does with the airline data.

Ministry for Primary Industries

3.17
MPI's approach differs from Customs in that a lot of its intelligence work is based on generic profiling and trends rather than solely working to identify individual passengers of interest. MPI monitors for specific emerging biosecurity risk events when certain countries or regions pose a higher risk. For example, an outbreak of Queensland fruit fly in Adelaide will result in an emerging risk report for frontline staff and heightened awareness and levels of intervention for passengers arriving from or through Adelaide. This kind of profiling is used to ensure that frontline staff know to pay extra attention to passengers arriving from specific places during high-risk times or after particular events.

3.18
As well as information received from airlines and cruise lines, MPI receives high-level information from a variety of sources, such as international agencies. This information often relates to animal health, fisheries, environmental, or biological issues. For example, it receives information about the prevalence of fruit flies in other countries.

3.19
Through the use of intelligence, MPI can group passengers according to their potential risk, directing resources to matters of higher risk. An example of this is the establishment of the green lane at Auckland International Airport. This lane is currently only for New Zealand and Australian passport holders because information has shown them to be a low-risk group for biosecurity breaches. MPI acknowledges that further work could be done to improve how it gathers intelligence and targets frontline resources.

3.20
MPI has introduced advertising campaigns, such as videos to play on airplanes, to educate incoming passengers about biosecurity risks.

3.21
Because MPI does not assess individual passengers for risk before they arrive at the border, it relies heavily on the passenger's presentation on arrival. Although this is more resource intensive, it is a necessary approach. New Zealand law requires passengers to declare on their passenger arrival card any goods that could be a biosecurity risk, including airline food, or to otherwise dispose of it in the amnesty bins at the border. If a passenger declares goods, a Quarantine officer inspects the items and assesses the level of risk. In our view, MPI manages risk appropriately with this approach.

3.22
The pre-arrival information that MPI receives from cruise lines includes information about the crew, passengers, and ship. Using this information, MPI can assess the level of biosecurity risk the ship presents and the level of inspection that will be required when it arrives at the port. For example, the ship's itinerary may provide information on when and where fresh produce, which could pose a biosecurity risk, has been taken on board. Quarantine officers carry out clearance procedures for any crew or passengers and their accompanied goods when disembarking the ship.

3.23
MPI has worked closely with two major cruise lines to understand its logistics and processes. This has enabled MPI to provide a level of risk-based accreditation to these organisations, and to target resources to higher-risk cruise operators that are not currently accredited.

Immigration New Zealand

3.24
Immigration New Zealand decides whether people who are not New Zealand citizens can enter the country. Where appropriate, this can include preventing individuals from boarding the aircraft. This is more efficient than dealing on arrival with passengers who pose a risk.

3.25
Many of Immigration New Zealand's passenger checks are done through the visa application process. However, there are 59 countries where people do not have to apply for tourist visas to come to New Zealand. This limits Immigration New Zealand's ability to check and exclude passengers who might pose a risk.

3.26
Immigration New Zealand receives advance passenger information from the airlines. This information contains important passenger details that Immigration New Zealand uses to decide on the passenger's risk and their right to enter New Zealand. The Immigration Act 2009 states that it is the responsibility of the airline to ensure that everyone boarding the aircraft has appropriate Immigration New Zealand documentation.11 Airlines that fly to New Zealand must check passenger information using the Advance Passenger Processing system. This is an automated system for checking passengers' visas and identities against watch lists and other databases at check-in. Every traveller gets checked against this system and, because this system uses real-time information (including links to the Interpol lost or stolen travel documentation database), decisions about whether the passenger can board are made. Airlines must also comply with directions from Immigration New Zealand.

3.27
Immigration New Zealand uses the advance information provided by airlines to carry out risk assessments of passengers. If a person is deemed to be a risk, an alert is put into CusMod.

3.28
There are limitations to this process. Because Immigration New Zealand does not have an automated system to assess the information it receives from the airlines, this information is risk assessed manually. This is inefficient and means that only flights carrying passengers who pose the highest risk are assessed.

3.29
There are also limitations with the information that cruise lines give to Immigration New Zealand about cruise ship passengers. Immigration New Zealand does not get advance notice for cruise ship passengers because they are granted a 28-day visa waiver.12 Having incomplete information affects the ability of Immigration New Zealand's intelligence staff to assess these passengers for risk.

3.30
Because Immigration New Zealand has difficulty obtaining all the information it needs from cruise lines, getting further information from the other agencies could improve its capacity to carry out risk assessments.

How Customs and Quarantine officers receive information

Customs and Quarantine officers receive information to effectively process passengers

3.31
Customs and Quarantine officers told us they felt they had the information they needed to effectively process incoming passengers and their goods. They have intelligence briefings before shifts, and receive intelligence, where appropriate, by email or as alerts loaded against particular passengers. Frontline officers can also identify risks based on their knowledge of generic risk profiles.

3.32
In our view, Customs and Quarantine officers have the information they need to effectively process incoming passengers.

Customs and Quarantine officers share information with intelligence staff

3.33
Frontline staff are a major source of information for their agencies. The information they see and collect at the border is important to intelligence staff when updating and refining risk profiles.

3.34
Customs has well-documented procedures to ensure that information gathered by frontline staff is fed back to the intelligence cycle. Customs officers are required to record interactions with passengers through activity reports or intelligence reports, which are entered directly into CusMod. Intelligence staff have access to all of these reports and can use them to refine, inform, and keep the risk profiles up to date.

3.35
Customs is trialling a Liaison officer role at three major ports. The role is intended to bridge the gap between frontline and intelligence staff and improve the quality of intelligence information.

3.36
MPI could improve how it records information from frontline staff. MPI only records interactions where a passenger's goods have been detained and/or directed for treatment or destruction. This means that there are missed opportunities for recording information, especially when a passenger has been detained but then released.

3.37
MPI's process for collecting information from frontline staff is limited by its system. The system, MPI Pax (see Part 4), does not allow frontline staff to enter information directly into it. Instead, external contractors collect handwritten information from frontline staff and enter it into MPI Pax. This is not efficient. Relying on handwritten data means that the quality can be compromised if the spelling and handwriting is unclear or incorrect. There is also no quality assurance process for the data entry. This is a lost opportunity to fully use the intelligence gained at the ports.

3.38
MPI's intelligence staff use the information about passengers who have had goods seized to create profiles of high-risk groups. It is important that these profiles continue to be refined and updated to increase the chances of identifying risk and minimise instances of stopping passengers who do not pose a risk.

Improvements are needed with how some information is shared between the agencies

Limitations with sharing information

3.39
We observed a general willingness from frontline staff to share information with the other agencies when required. However, complex legislation about information sharing can create barriers between agencies.

3.40
Information-sharing legislation can be complex and difficult to understand. Each agency has its own legislation that sets out what can and cannot be shared, and with whom. This can become complex when there are multiple Acts to consider, including the Privacy Act 1993. For Customs, the current legislation is unclear, particularly about what information can be shared and with whom. There are about 50 pieces of legislation that govern the sharing of information between government agencies and some of these conflict with each other. We were told that it can sometimes be easier to share information with international agencies because there are only two pieces of legislation that govern this and they are quite specific.

3.41
The complexity of information sharing means staff can be hesitant to share information with other agencies, which can lead to inefficiencies. For example, we were told that meeting Customs' requests for information from Immigration New Zealand takes up significant amounts of time that Immigration New Zealand could otherwise be spending identifying risks. The current legislative frameworks can slow down the sharing of information, which, in a time-pressured environment, can affect risk profiling and targeting efforts.

3.42
Improvements are needed to how Customs, MPI, and Immigration New Zealand share information. All agencies have expressed an intention to improve how they use and share information.

3.43
Some examples of improvements include legislative changes. The Customs and Excise Act review, which is being considered in 2017, aims to simplify Customs' information sharing arrangements. The current Act has nine different regimes for sharing information. There are four parts to the new regime that clarify and make requesting information more structured. Simplifying arrangements for sharing information should mean that the agencies can more easily understand what can and cannot be shared.

3.44
Limitations to effective information sharing are not unique to the border sector. A 2015 State Services Commission inquiry, Government Inquiry into matters concerning the escape of Phillip John Smith/Traynor, highlighted problems with information sharing in the justice sector.13 In our view, there are lessons from this inquiry that could be applied to how information is shared throughout the border sector, such as better integration of information systems.

8: Integrated Targeting and Operations Centre (ITOC) Review 2016, Simon Murdoch.

9: Additional benefits of this posting include intercepting illicit goods offshore, which will cut down on resources spent on on-shore processing, searching and disposing of goods, and investigations. It could also advance the working relationship with the Hong Kong Customs Service.

10: The use of Passenger Name Record Data for border risk assessment purposes is governed by international standards and recommended practices endorsed by the International Civil Aviation Organisation in consultation with the World Customs Organisation.

11: Immigration New Zealand (2017), Immigration New Zealand Operational Manual – Border entry, Wellington, page 15.

12: This is because the passengers are only transiting through New Zealand. If a passenger who would otherwise require a visa for New Zealand leaves the ship, they will be subject to standard entry immigration processing by a Customs officer.

13: Although some of the border agencies are mentioned in the inquiry, the focus is the justice sector.