Former Deputy Police Commissioner Jevon McSkimming. Photo: Getty Images
An investigation into the former deputy police commissioner led to concerns that staff could bypass internal controls and "exploit vulnerabilities to access inappropriate content," documents reveal.
The concerns prompted the Police Commissioner to order a "rapid review" of police's information security (INFOSEC) controls.
Former deputy commissioner Jevon McSkimming resigned as the country's second most powerful cop last month amid a four-month investigation by the Independent Police Conduct Authority and police.
His resignation came after Police Minister Mark Mitchell said he was recently informed of allegations of a "very serious nature", separate to the investigation that led to him being suspended.
RNZ earlier revealed pornography found on McSkimming's work computer is being investigated as alleged objectionable material. He declined to comment on the allegations through his lawyer. A High Court judge earlier reserved her decision on whether the media should be allowed to report the nature of the allegedly objectionable material found.
Do you know more? Email sam.sherwood@rnz.co.nz
Police Commissioner Richard Chambers earlier announced he ordered a review on the day of McSkimming's resignation to ensure police had sufficiently strong controls to prevent or detect the misuse of police technology and equipment for non-work-related purposes.
: Police Commissioner Richard Chambers Photo: RNZ / Nick Monro
RNZ was released a copy of the terms of reference of the rapid review under the Official Information Act.
The document said there were "clear expectations" that all users of Police IT systems and devices must do so appropriately. INFOSEC controls were configured to block visits to certain sites or online content which there was "generally no legitimate work-related reason to be accessing".
"Recent concerns have arisen that INFOSEC controls applying to Police systems and devices could be bypassed by individuals who are able to exploit vulnerabilities to access inappropriate content, in breach of Police's acceptable use policy and our Code of Conduct.
"Urgent reassurance is required that Police has sufficiently strong controls in place to prevent misuse of Police technology and equipment for non-work related purposes."
Chambers had asked for a "rapid, independent assessment" of the strength of police's INFOSEC controls to "prevent police systems and devices being used to access inappropriate content".
The document lists three objectives of the review, including assessing the strength and vulnerabilities of the current INFOSEC controls, identify opportunities for "new or enhanced controls", and providing advice on how to implement proactive scanning of police systems to detect potential misuse.
The review would include desktop analysis of specific INFOSEC controls, control testing to identify potential "work arounds" or other weaknesses, and discussions with counterparts in other agencies such as the New Zealand Security Intelligence Service and Public Service Commission.
"Although it has been commissioned against the backdrop of recent concerns prompted by an ongoing investigation, the rapid review will be conducted as a self-contained exercise and *will not* require the sharing of information about any specifics relating to the ongoing investigation."
The review work would be independently conducted by a "suitably qualified and experienced provider".
The rapid review was expected to be completed within two weeks with an expected 10-15 page report to be classified restricted, with a shorter 2-3 unclassified summary document also produced.
Chambers told RNZ police's Executive Leadership Team (ELT) considered the findings of the rapid review at their meeting on Monday 16 June.
"One of the decisions made by ELT was to task Police's Chief Information Officer to develop an action plan to respond to the review's findings, and to bring that back to ELT for further consideration. It is expected the action plan will be completed within the next month.
"Police intend to make a summary of the review's findings publicly available once there has been an opportunity to brief key stakeholders."
In announcing McSkimming's resignation, Police Minister Mark Mitchell said McSkimming resigned before he could be dismissed.
He did not say what the allegations were. Mitchell said the Policing Act was "very clear".
"A deputy commissioner of police must be a 'fit and proper' person. They are rightly held to the highest standards of conduct and this new information called into serious question Mr McSkimming's fitness for office.
"When Mr McSkimming was invited to respond to these allegations he chose to resign. Mr McSkimming's resignation has confirmed my view that his continuation in the role was untenable."
