New Zealand's internet economy is at risk of taking a major backwards step if the Government's power to snoop on citizens online is further expanded under changes to the Government Communications Security Bureau and Related Legislation Amendment Bill (GCSB Bill), says online watchdog InternetNZ.
Submissions from the public on proposed changes to the GCSB Bill closed on 13 June and in its comments to the Government, InternetNZ says the lack of checks and balances will negatively impact New Zealand's digital economy. Strong cybersecurity practices are crucial for a healthy network, but InternetNZ says as it stands the changes "ride roughshod" on the privacy of Kiwi web users.
For more on the state of New Zealand's online civil liberties, sign up to the Idealog Tech newsletter
Currently the Government's spy agency has the ability to intercept data from telcos with a warrant. Under the proposed changes, all that would be required to snoop on New Zealand citizen's is ministerial approval.
"InternetNZ does not support those provisions of the Bill that, taken together, empower the Minister to direct the Bureau to intercept communications and access information infrastructures without meaningful, adequate and independent oversight," says the InternetNZ submission.
To prevent a misuse of the technology by government agencies and put citizens' minds at rest, InternetNZ acting chief executive Jordan Carter says there needs to be more oversight.
“More robust checks and balances need to be introduced so that Internet users' privacy is adequately protected from intrusive State action. As it stands, the GCSB Bill lacks sufficient legal safeguards for Internet users' right to privacy," he says.
In its submission, InternetNZ recognises the importance the Government's spy agency has in online security, but this security needs to be balanced with privacy intrusions.
"This is a question of balance between the important objectives of the GCSB and peoples’ fundamental rights. InternetNZ does not consider the Bill to have adequately struck that balance. Further, while the governments’ capability to intercept communications has advanced under the Internet, it appears that the development and application of human rights law by governments to this changed environment has not," says Carter.
Unprecedented spying powers revealed in the US and how NZ's GCSB Bill could be far worse
While the world watches the PRISM spying saga, New Zealand is on the verge of giving similar (if not more powerful) privileges to our spy agency – the GCSB.
Over the past 72 hours the extent to which the US Government is spying on its subjects and those overseas has been brought sharply into daylight. PRISM, the code name for a National Security Agency-led initiative, grants the foreign security arm of the US Government unprecedented access to data held by tech giants such as Facebook, Google, Microsoft and Apple (notably, all the companies named in the initial reports by The Guardian and The Washington Post deny giving direct access to PRISM).
The Green Party is probing the New Zealand Government to see how much involvement our own spy agency, Government Communications Security Bureau (GCSB), has had with PRISM.
"The question is to what extent has the New Zealand Government been availing itself of that information intercepted by the NSA with regards to New Zealand citizens?" says co-leader Russel Norman to The New Zealand Herald.
It may be some time before this information comes to hand, but on the horizon is a GCSB with spying powers overshadowing what we're seeing in the US thanks to the GCSB and Related Legislation Amendment Bill and Telecommunications Interception Capability and Security Bill (TICS), currently in front of Parliament.
"The power of the GCSB could far exceed what people are fearing from PRISM," says Thomas Beagle, founder of online civil liberties watchdog Tech Liberty New Zealand.
Beagle points to sections of the new legislation which grant explicit access to online communications made by New Zealanders to the GCSB. Under the current Telecommunications Interception Capability Act of 2004 (TICA), the GCSB already has mandated access to network provider data when accompanied by a warrant. Investigations on foreigners don't require a warrant if an interception device isn't use.
The new GCSB Bill expands this to encompass service providers who offer "goods, services, equipment, and facilities that enable or facilitate telecommunication". Beagle argues this vague description could possibly include anything from emails to Trade Me forums.
The Bill doesn't change the requirement for a warrant, but does give a new Ministerially-approved exception where the GCSB cannot otherwise gain lawful access.
In addition, the GCSB are given a kingmaker role in the New Zealand telco scene, with the power to approve or deny changes to network infrastructure to "protect New Zealand's national security or economic wellbeing".
"In terms of the access this gives the GCSB it's unprecedented. No one has said PRISM has any control on a similar level in the US," he says.
With the recent spotlight thrown on online privacy issues because of PRISM, is it likely New Zealand's own laws will face greater scrutiny?
"It's hard to say. The GCSB have been recorded behaving incompetently and illegally around the Dotcom investigations. The reaction from the Government to the Kitteridge report has been 'Well, in that case we better give the GCSB more powers'," says Beagle.
"This is a massive power grab ... There's nothing to give oversight.
"I strongly believe citizens have a right to know about the data that's been collected about them ... There are some times when we need the Government to collect this kind of information, but it needs to have limits and public oversight."
New Zealanders who oppose this level of Government-level spying should submit against the proposed legislation, says Beagle. The other option is to become proficient in the use of encryption and covert networking.
Mega chief executive Vikram Kumar is one notable figure making a submission on the proposed changes to New Zealand's spy laws. In a recent blog post, Kumar makes no qualms about his feelings for the GCSB, which has played a central role in the Kim Dotcom extradition case which has dramatically played out over the past year and a half.
"Right now the GCSB is like a cockroach, happily operating in hidden spaces, suddenly exposed to sunlight. The agency wants nothing more than to get back to its comfortable hidden spaces as quickly as possible," he writes.
Kumar's key points:
– Remove the ability for Ministerially approved access where it is otherwise unlawful
– Provisions to spy on New Zealanders should be removed all together
– Direct or indirect data collection about New Zealanders should not be allowed (currently the GCSB can collect metadata from sources such as emails without a warrant)
– Ministers should be made aware with haste when a an urgent warrant is granted to the GCSB
– An annual audit should be imposed to make sure the GCSB is complying with the Protected Disclosures Act of 2000 and all staff are adequately informed of what that entails