The Snowden documents show how foreign intelligence staff follow a step-by-step process to access the GCSB's South Pacific intelligence, including the metadata and communications of New Zealanders living, holidaying and interacting in that region.Pretty obviously, they wouldn't need to check those rules if the material wasn't there. So, the natural conclusion is that material collected at Waihopai isn't screened. Which is a problem, because the s14(2) of the GCSB Act says that any "incidentally obtained intelligence"
A British agency guide shows that there are two databases on "Ironsand" (Waihopai)-intercepted communications they can access. "To query the data on these sites," the guide says, "you must first have a briefing on NZSID7, the law that governs what the GCSB can and can't do." The foreign staff were instructed to read a written briefing and then, before accessing the New Zealand intelligence, take an online test on the GCSB rules.
The NZSID7 (New Zealand Signals Intelligence Directive 7) contains the rules for when the other Five Eyes agencies can look at intelligence about New Zealanders.
must not be retained or disclosed except in accordance with sections 23 and 25.[Emphasis added]
Those exceptions cover direct threats to human life or national security or when information "relates directly or indirectly" to one of the GCSB's functions. Those functions include "the national security of New Zealand" and "the international relations and well-being of New Zealand", and I suppose the GCSB could argue that providing such information unscreened is "the price of the club" and therefore advances those functions. But I really don't think the public would buy that as a blank cheque for mass-surveillance.
The GCSB owes us some answers on this. And it speaks volumes that instead of giving them, their spy-Minister is instead spouting nonsense about terrorists.