New Zealand was a pioneer in the codification of its criminal law. The Criminal Code Act was passed in 1893, after a lengthy gestation period. The work owed its origins to law reform activities in India, a tendency spread from India to other British jurisdictions, notably Canada and parts of Australia, but never England. The requirement that common law offences were no longer valid and criminal offences had to be clearly defined in statutes passed by Parliament became accepted orthodoxy here and never questioned. But it is possible, as this article argues, that New Zealand has forgotten the legal implications of its own history of codification. This article argues that s 78AA of the Crimes Act 1961, inserted by the Intelligence and Security Act 2017, is in breach of the codification principle. The vice of the provision is that the content of the Protective Security Requirements is dependent upon the actions of the executive and what it posts on the Internet, not upon law passed by Parliament. It is submitted that the present situation is poor legislative practice and leaves the state of the law in doubt. For security issues to be handled in this fashion is less than satisfactory in a free and open society. The article goes on to analyse the background of New Zealand's criminal law codification and outlines the extensive range of the modern law dealing with the intelligence agencies and how it has expanded in recent years. This history of the agencies is briefly canvassed, including controversial features that have arisen in the past. It concludes that remedial action is necessary and mentions work that is going on within the executive to bring about change. It concludes that issues of legality, human rights and the agencies deserve careful attention and require analysis of the risks to an open society from these developments.