Last week, RNZ had a horrifying story about MBIE hiring a firm of Israeli cyber-mercenaries for intelligence collection, including on people's religion and political beliefs. Today, they have a followup about MBIE's failure to consult the Privacy Commissioner about the spying:
The Ministry of Business, Innovation and Employment (MBIE) would not say why it did not consult over its privacy impact assessment on Cobwebs.Which shows the problems of our current "good chap" model of oversight: what if the agency isn't a "good chap", and doesn't do what it is expected to?It also refused to say what details it was now giving the Privacy Commissioner, who last week belatedly asked for assurances the spying is lawful.
The ministry did not respond about how, during the two years in which its use of Cobwebs has been secret, people could have exercised their right under privacy law to ask what data is being gathered on them.
But this isn't just a problem with MBIE. Both MPI and Customs have internal intelligence agencies, and there are no doubt others. And none of them have any specific oversight. Formal spy agencies are covered by the Inspector-General of Intelligence and Security; Police have the Independent Police Conduct Authority (for what that's worth). But other agencies doing intelligence work are completely unregulated, even if they are doing exactly the same things as the GCSB, SIS or police. And they are doing exactly the same things: MBIE is spying on people's communications and collecting vast quantities of personal information; Customs runs human intelligence operations to investigate smuggling; MPI does covert operations against paua poachers. And while they're all subject to Te Kawa Mataaho / Public Service Commission, the Ombudsman, and the Privacy Commissioner, none of them really have the specialist expertise required to oversee them.
This isn't good enough. These agencies are spying, so they need to be regulated like the spies. And that means strong, proactive, specialised oversight. If IGIS is unwilling to do the job - and there are reasons why "national security" oversight should not be muddled with that for law enforcement - then we need an equivalent body with equivalent powers to manage the proliferation of agency spies. Otherwise its only a matter of time before one of them blows up in another messy scandal which destroys the reputation of and public trust in the public service.
