The surveillance State

Rodney Harrison: Wholesale spy power is precisely what GCSB bill means for Kiwis

Rodney Harrison QC

NZ Herald

17 August, 2013

The PM's reassurances are flawed and unconvincing

On television this week Prime Minister John Key tried to assure the public it was "totally incorrect" that "the Government effectively through GCSB will be able to wholesale spy on New Zealanders".

Those who contend otherwise are, he says, plain wrong. That Mr Key has at last seen fit to engage in public debate about the effect of the GCSB bill demonstrates how critical his denial of the "wholesale spying" claim is, as far as the rest of us are concerned.

The last thing that many will want to read is yet another opinion piece on the GCSB bill. But this issue really is the centre of controversy over the undemocratic way this bill is being rammed through, despite legitimate public concerns about the rampant interception of communications occurring here and overseas.

In order to understand what the GCSB bill would do and whether it goes too far, it is necessary to compare its provisions with those of the existing GCSB Act 2003. That is necessary to refute Mr Key's claims that nothing much is changing.

We need first to identify the three kinds of information or data at stake. First, there is the content of our communications, electronic and otherwise. Secondly, there is the "metadata", the transactional record generated when we communicate electronically (such as email), other than content. Thirdly, there are the "keystrokes": the record of our online activities, such as the websites we visit. Each of these, collected over time and potentially stored forever, will disclose a great deal about us. Combined, they have the potential to create an extraordinarily revealing portrait of each of us and our associations and interests.

In a nutshell, the reason why Mr Key is wrong as a matter of law in claiming that New Zealanders have nothing to fear from the GCSB bill is that his limited analysis of the three new functions to be conferred on the GCSB totally overlooks the point that the statutory intelligence-gathering powers of the GCSB are also being considerably expanded, at the same time as its functions are. When the totality of the changes is considered, we have a major increase in the overall role and powers of the GCSB. That, in some instances, the Prime Minister's authority is required for the GCSB to proceed cannot alter this.

The present GCSB Act limits the GCSB to gathering and analysis of "foreign intelligence", defined to mean "information about the capabilities, intentions, or activities of a foreign organisation or a foreign person". That is, it is prohibited from spying to obtain intelligence on New Zealanders and equally, on New Zealand entities and businesses.

The GCSB bill abolishes the restraint on GCSB activities to "foreign intelligence", and instead confers three considerably expanded functions. When Mr Key stated on television that the first of the three things the GCSB would be empowered to do is "foreign intelligence-gathering - nothing to do with New Zealanders", he was in error. The new 8B function discussed below covers both foreign and domestic intelligence-gathering.

The bill would give the GCSB under 8A a much wider cybersecurity protection function. Intelligence-gathering by the GCSB is empowered under that function, but significantly the limited protection conferred by proposed section 14 in relation to the "personal communications" of New Zealand citizens and permanent residents ("New Zealanders", for short) would not apply to the GCSB when operating under 8A.

Secondly, a new intelligence-gathering and analysis function is to be conferred on the GCSB under 8B. This function is very broadly worded. In particular it permits the gathering of intelligence about "information infrastructures". That is defined widely enough to cover all types of electronic data systems (phones, computers, ISPs and telecommunications networks) and their content.

These two new intelligence-gathering functions are not in any way restricted solely to targeted intelligence-gathering and collection of data (as against "wholesale spying"), from New Zealanders or indeed from others. By contrast with the present act, the GCSB bill both substantially expands the scope of the existing "interception warrants", and introduces a new information-gathering tool, the "access authorisation". Under proposed 15A(1), an interception warrant can be granted to intercept the communications of one or more persons or classes of persons or of "places" (for example, the location of an ISP), or all or any communications sent from or to a nominated overseas country. An access authorisation can also be granted authorising the accessing of one or more specified "information infrastructures" or classes of infrastructure. These are very broad "wholesale" powers.

Furthermore, if the bill becomes law the GCSB, when it asks the Prime Minister for a warrant or authorisation, does not have to make out any particular threat to national security in relation to particular individuals, or even a generalised threat to security. That is by distinct contrast to our other spy agency the NZSIS, which must do so. The GCSB merely has to identify a hoped-for outcome which sufficiently justifies the interception or access which it is proposing. That is a very low threshold. Thus the bill will provide the GCSB with tools which will enable it to engage in "wholesale spying".

The GCSB bill does draw a distinction between New Zealanders and others. Under section 14 the GCSB when performing its 8B intelligence-gathering function is forbidden from deliberately targeting New Zealanders for the purpose of intercepting their "private communications". However, that definitely does not mean the communications of all in New Zealand are safe from "wholesale spying" by the GCSB, let alone by New Zealand's security partners.

The section 14 protection relates only to private communications, defined in such a way as to exclude metadata and also any communication "occurring in circumstances in which any party ought reasonably to expect that the communication may be intercepted by" a third party. And because the section 14 prohibition on targeting relates only to the "intercepting" of private communications, it would appear to relate only to interception warrants as such, and not the new and highly potent "access authorisation". The section 14 protection is strictly limited to New Zealanders. It will not protect the "private communications" of New Zealand legal entities such as NGOs or businesses.

Mr Key is careful to limit his concession - announced on Thursday - to the GCSB's cyber-security function. There is no such concession regarding not accessing New Zealanders' content in the first instance under the 8B function. But that is the main area of expanded power, and of concern. Thus the concession falls far short of an adequate assurance.

The third new function proposed (under 8C) is one of co-operation with other agencies to facilitate their functions. Here the bill as reported back has improved the drafting. But it remains a significantly expanded function compared with the present act. And Mr Key refuses outright to identify precisely what activities by the GCSB would be authorised to carry out under the guise of providing co-operation, advice and assistance to the Police, the Defence Force and the NZSIS. That is unacceptable.

The Prime Minister's attempt to reassure New Zealanders we are not sleepwalking into a total surveillance society is, unfortunately, flawed in its legal analysis and fails to convince.

• Dr Rodney Harrison, QC, has been active in the public debate challenging the GCSB legislation.