The "Restricted" classification is applied when the compromise of information "would be likely to affect the national interests in an adverse manner". It sits below "Sensitive", "Secret" and "Top Secret".
The staff member looked around the area and found the contents from both bags, which had been searched and the contents discarded. All known items in the bag were recovered after the 2016 theft.
The restricted documents recovered included a commander's security check-list, unit security standing orders, and PowerPoint presentations on security principles and responsibilities, security breach reporting procedures and security investigation procedures.
Defence Force security standards state documents marked restricted must be stored in a room or cabinet locked with an approved key system.
"NZDF restricted document has been compromised through poor security control measures displayed by [name redacted] including storing the document in a non-secure device, i.e a 'black plastic rubbish bag' and not locking his vehicle," a security incident report stated.
Security analyst Paul Buchanan, director of 36th Parallel Assessments, said there was rich irony in losing PowerPoint presentations on security breach reporting. Normal procedure would be to not take classified information home, Buchanan said.
"In this instance it was certainly sloppy. I guess we should be glad the thieves don't have any connections to the Russian or Chinese embassies."
The Herald has asked government organisations to detail cases since 2016 when material had been mistakenly left unaccompanied in public.
Fifteen organisations confirmed over 60 incidents, including an NZSIS staff member leaving a locked bag with sensitive information in a cafe bathroom.