Back in 2022, when the government was consulting internally about proactive release of cabinet papers, the SIS opposed it. The basis of their opposition was the "mosaic effect" - people being able to piece together individual pieces of innocuous public information in a way which supposedly harms "national security" (effectively: correlating the contents). DPMC was eventually forced to release further information on the SIS's opposition, in which they offered to brief other government agencies on this risk, and also attempted to weaponise the OIA's outdated eligibility requirement to oppose the entire concept of proactive release. In the process, they made a specific claim that proactive release could result in information being released which "would be of no interest to someone who meets the requestor criteria, but may be of interest to a foreign state."
I was interested in this claim, so I asked the SIS for guidance they have about the "mosaic effect", as well as for evidence of their claim. Their response is here. It includes SIS/GCSB guidance on the use of "neither confirm nor deny" responses under the OIA and Privacy Act, and an internal memo on "The mosaic effect in the context of official information release". The latter is quite interesting, in that its primary evidence is from privacy researchers attacking the concept of "anonymised" data (though they are also agitated about the work of the UK's Undercover Research Group, which helped expose widespread police spying on civil society groups and identify its perpetrators and forced an ongoing public inquiry into police wrongdoing). It also rehearses some rather novel OIA withholding arguments, the use of which is something to keep an eye out for in the future. Along the way they also make a somewhat startling claim that:
some individuals have used information gained through the Privacy Act improperly (i.e. taken information provided to a separate individual, or sought to suborn an individual to make a Privacy Act request under genuine auspices....which sounds like they're annoyed that their past victims and relatives of their past victims have been pooling their information to assemble a pretty damning picture of the SIS's historic wrongdoing.
So, what about the specific claim they make about information being released which is "of no interest to someone who meets the requestor criteria, but... of interest to a foreign state"? What evidence do they have that this is actually a problem (and a problem sufficiently threatening to justify undermining our freedom of information rights under s14 BORA)? The SIS won't say. While they claim this is because of "national security", as in the case of Ahmed Zaoui, the natural suspicion is because whatever "evidence" they think they have would not withstand public scrutiny. What does speak volumes is that while they offered to brief other government agencies on the mosaic effect "threat", they didn't actually give any briefings. Which I think tells us how serious it really is: not at all.