Institutional traitors

One of the strongest narratives about "our" spy agencies is that they are basically institutional traitors, working for foreign powers (or just themselves), without any control or oversight by the elected government. And today, we have yet another report from the Inspector-General of Intelligence and Security which explicitly confirms this.

The short version: the GCSB hosted a signals intelligence system controlled by a foreign spy agency for years. But despite this system being able to be used to support military operations - which reading between the lines, means "drone murders" - they never told the Minister or sought Ministerial approval, despite the obvious human rights and foreign policy implications. On top of that, having agreed to host it, they then apparently forgot they were doing so, thanks to the usual recipe of secrecy, deliberately poor record-keeping, and incompetence. They only noticed again when it broke - at which time they did the right thing, turned it off, and contacted the Inspector-General.

The IGIS finds that while the hosting, data-sharing, and required collection were (mostly) authorised and lawful under the "manifestly inadequate" authorisations of the day, the failure to tell the Minister was utterly improper, violating the (then) statutory requirement of Ministerial control as well as the "no-surprises" policy.

It gets worse. Because despite the agreement with their foreign "partners" saying that the GCSB would have full visibility and would exercise due diligence over the system, they just didn't. They kept no records, weren't told what it was being used for, didn't bother asking, and of course never did any audits or reviews. They were so shit that after the agreement was signed and the system was installed, the knowledge was not passed on to new directors or senior leaders - meaning they had no idea of what they were doing (I am wondering how much of this was due to the switch from the old Defence-MFAT mafia to civilian leadership). Which means that if it was used for drone-murders, in likely violation of both New Zealand law and our foreign policy, they had no fucking idea. Which leads to this bit from the IGIS:

I have one further observation to make. There is one scenario contemplated by the MOU that I have no doubt would have been outside the scope of the various collection authorisations and, therefore unlawful and improper. Action from GCSB on a request from the partner operating the capability to collect signals not already tasked by GCSB, for the purpose of supporting a military operation, would have been outside the scope of the stated purposes of the authorisations. I would hope this never happened but, given the inadequacies in the GCSB’s monitoring and record keeping of the capability in action, I have no comfort that it did not.

We deserve something more than"hope" that "our" spies didn't break the law. Unfortunately, apparently that is all they and their oversight mechanisms can give us.

The good news is that the Inspector-General thinks that this is unlikely to happen again. I'd like to believe that, and it certainly looks like the culture and acceptance of oversight at GCSB has changed. Unfortunately, given their level of secrecy and the prohibition on the Parliamentary Intelligence and security Committee from inquiring into "operational matters", we will never know. Unless we see another report like this in a decade's time.

This could be interesting

The Inspector-General of Intelligence and Security announced their 2023/2024 annual work programme today, and its interesting reading. There's a bunch of spy stuff, including reviews of "Execution of class warrants", "Acquisition and use of bulk personal datasets (NZSIS)", and "A specific form of online intelligence gathering operation (NZSIS)", which will be interesting to see how the spies are violating our privacy and human rights. There's also a review into "New Zealanders and International Terrorist Screening Center Databases (NZSIS)", which covers "no fly" lists. And then there's this:

Assessment of security risk in meeting transparency requirements (GCSB and NZSIS): A review would examine the agencies’ approaches to the assessment of security risk from official publication or disclosure of information on their activities, including in response to requests under the Official Information Act 1982 and the Privacy Act 2020.

Or, to put it another way: are the spies being too paranoid? Obviously, I'm primarily interested in whether they are applying sections 6(a) and 6(b) of the OIA correctly, but the broader issue of public reports - including IGIS reports? - is also important. And with the SIS recently refusing to release basic performance statistics on their processing of immigration security checks, it seems particularly appropriate.

Of course, if they're reviewing it this year, we won't see a report until 2024 or 2025, which of course will not be allowed to include classified material. Which invites the question: if IGIS finds the spies have been too paranoid in censoring information, will they censor it to protect their reputations?

Some sensible suggestions on reining in the spies

In 2022 the government announced a periodic review of the Intelligence and Security Act, the legislation governing New Zealand's spies. Yesterday the review presented its report, Taumaru: Protecting Aotearoa New Zealand as a Free, Open and Democratic Society. Its a chunky read, and I'm not finished yet, but from the bits I've read, its not the usual spy-agency power grab, but rather, the complete opposite, presenting ideas to increase oversight and rein in the power of the spies.

Stuff has a good summary of the key recommendations. The big three are:

• Strengthening the Intelligence and Security Committee, making it actually independent by kicking Ministers off it, and giving it power to investigate the effectiveness of the agencies, as well as oversight of other intelligence bodies (of which we have a disturbingly large number). The spy agencies absolutely hate this idea, so that's a strong reason to do it.
• Removing the distinction between type 1 and type 2 warrants for "national security" purposes - a bit technical, but basicly type 1 warrants are required to spy on kiwis, type 2 are for foreigners and have lower oversight. The recommendation is that everything would use the higher standard. This apparently happens anyway because of the risk of incidentally spying on kiwis, but it will mean a legislated improvement in oversight.
• Defining "national security" in the Act - this is an important definition, and defining it will potentially limit what the intelligence agencies can do. When the ISA was introduced to parliament, the Bill originally included a definition, but this was removed by the select committee because it "would require the intelligence and security agencies to make difficult judgements about when the definition applied, and when their powers could be invoked" - that is, it might stop them from doing whatever they wanted. IIRC the definition also attracted opposition from the public, because it included "economic security" and "international relations" - protecting the rich and silencing criticism of NZ's so-called "friends" - which do not enjoy social licence as a basis for spying. The review's proposal doesn't include any of that bullshit, focusing strictly on territorial integrity, safety, democracy, and social diversity. There is a mention of "essential interests", but that's nailed down by talking about "critical infrastructure and governmental operations", so it might not be the open slather it seems like. Overall, I think this is a good move, because it will limit the spies.

One of the other recommendations is legislative consistency for all the other intelligence groups (such as NZDF, police, customs, MBIE, MPI... apparently everyone's got one now). Insofar as these bodies are operating on an unclear legal basis and without statutory constraints (NZDF appeals to the royal prerogative, FFS), this seems like a bloody good idea. The Search and Surveillance Act should have done this, and it is highly disturbing that some bodies apparently fell through the cracks (and that the recommendations of the Law Commission around requiring warrants for undercover operations have been ignored). And it seems especially necessary now that the legal consensus on what constitutes a "search" has shifted to mean interference with "a reasonable expectation of privacy". Under this new consensus, these bodies are likely engaging in widespread illegal searches (the review unwittingly gives an example of the SIS using a fake identity to monitor a private chatroom. That's a search, and should need a warrant). It would be better for Parliament to legislate properly to give certainty about what they can and can't do, rather than for them to ram through "fuck you" empowering legislation when one of these agencies is caught and made to pay damages by the courts.

Again, I haven't finished reading the whole thing yet. But so far, this seems like a sensible review. So now we'll no doubt get to see the spies either bin it, or pervert it into giving them even more powers and less accountability.

A significant loophole

In case you hadn't noticed, FYI, the public OIA request site, has been used to conduct a significant excavation into New Zealand's intelligence agencies, with requests made for assorted policies and procedures. Yesterday in response to one of these requests the GCSB released its policy on New Zealand Purpose and Nationality - basicly what it does to ensure that it complies with the requirement that it obtain a Type 1 intelligence warrant before spying on New Zealanders. The policy itself seems reasonably robust - if it is unclear whether someone is a New Zealander, they seem to apply a "reasonable grounds to suspect" standard, which at face value seems appropriately cautious. But there's a twist:

This is due to the way s53 of the Intelligence and Security Act is phrased, referring only to NZ citizens and permanent residents (that is, natural rather than legal persons). But it seems to be a loophole, resulting in a lower standard of oversight for spying on organisations (basicly, they only need approval from the (captive) Minister, rather than from the independent Commissioner of security warrants). And the fact that it is being explicitly pointed out in the policy suggests that the spies encourage its use.

What sorts of spying might be covered by this loophole? Spying on NGOs, unions, political parties, and companies. Tracking ships and aircraft, if the purpose isn't to spy on a specific, known New Zealander. Depending on how creative the GCSB's lawyers are - and in the absence of outside scrutiny, they can be very creative indeed - it may even extend to tracking cars. And while some forms of spying on an organisation may be difficult to do without also spying on a person, there are forms which seem eminently do-able. Spying on financial transactions. Hacking its computers and looting its files. Classic black-bag jobs. If the SIS wants to, say, steal Te Pāti Māori's membership list, the law doesn't seem to require a Type 1 warrant. And that seems... dangerous. Because one of the reasons we require external, independent oversight of spying on kiwis (rather than just the rubberstamp of a captive Minister) is to protect our political and democratic rights. But those rights are not just exercised individually, but also collectively, through groups like NGOs, unions, and political parties. And spying on those organisations can be just as dangerous to our democratic rights as spying on individuals.

More generally, we have a two-tier system where spying on New Zealanders requires a higher degree of oversight than spying on foreign governments and terrorist organisations. And it just doesn't seem appropriate that NZ-based organisations are lumped in the second category rather than the first. Not does it seem appropriate to effectively allow the Minister to authorise spying on their political opponents with no independent oversight.

Fortunately, there's an easy fix for this: add a reference to New Zealand organisations (with an appropriate definition) to s53 of the Intelligence and Security Act 2017. And if the spies or the government doesn't want to do that, well, we can draw our own conclusions about what they've been up to.

The annual litany of lawlessness

The Inspector-General of Intelligence and Security has published their 2021 Annual Report, and its the usual litany of lawlessness and failure from the spy agencies. There are the usual examples of the SIS and GSCB simply failing to comply with statutory requirements and adopting self-serving legal interpretations 9whcih the IGIS disagrees with). And then there's this:

Section 220 of the ISA specifies that information obtained by or disclosed to the Service for a security clearance assessment may be used only for the purposes of that assessment, another clearance assessment, or counter-intelligence. Counter-intelligence is defined as intelligence activities carried out to identify and counteract the threat, or potential threat, of unauthorised disclosure of official information by a person who holds or has held a security clearance.

[...]

In the past year the Service was confronted with the question of whether a candidate’s disclosure of information about criminal behaviour was serious enough to be reported to the Police, despite the rule in the ISA. In a particular case the Service decided quickly in favour of sharing the information. On learning of this I was not persuaded, on the facts, that it had been necessary for the Service to report it before receiving advice from Crown Law on the scope for doing so. The Service subsequently proposed an interpretation of s 220 ISA that would allow disclosure to the Police, in the particular circumstances and more generally. I did not agree with that reading; nor, ultimately, did the Solicitor-General.

[Link added]

Or, to put it another way: the SIS knowingly and deliberately broke the law, basicly because they felt like it. As usual there are no criminal penalties for doing so, so there are no real consequences for them other than having it mentioned in an annual report. Which raises the obvious question: if they would so casually violate the clear legal prohibition of s220 (and it is a clear legal prohibition, with no room for interpretation in the direction they wanted), what does that say about their approach to other equally clear legal prohibitions in the Intelligence and security Act, or elsewhere in the law?

NZ spies support torture

The Inspector-General of Intelligence and Security released their annual report today, and in amongst all the usual bureaucracy, there's some rather startling revelations. The first, and most horrifying, is that New Zealand's spy agencies are refusing to accept IGIS recommendations from its Operation Burnham inquiry to adopt a more stringent standard limiting intelligence cooperation where it may contribute to torture and other human rights abuses:

Our second recommendation, that the agencies’ human rights test for information sharing should be more protective, has not been accepted by them at this time. The agencies’ position is that any change to the policy threshold at which they mitigate risks in information sharing should only occur after the current review of the Foreign Cooperation MPS, led by DPMC. However, we think the more precautionary approach could be adopted now.

IGIS has suggested the same standard used by Canada and the UK (aimed at eliminating past practices of outsourcing torture while pretending it was not happening), but the spy agencies are for some reason resisting this. They need to tell us why, because the natural conclusion is that they want that practice to continue, and that they support torture.

Similarly, there's this bit:

The second issue, also being considered in the Foreign Cooperation MPS review, is what obligations, if any, should be imposed on the agencies when they receive information which they reasonably believe may have been obtained from human rights abuses overseas, especially if there is no realistic risk their receipt of the information could contribute to any new or ongoing abuse. New Zealand law does not directly govern this, and the answer is more a question of public policy and propriety.

"No realistic risk [of] new or ongoing abuse" sounds a lot like "torture is OK if you murder the victim afterwards". And that is simply not a position we should accept. Our spy agencies should refuse to accept any information sourced from human rights abuses overseas, whether abuse is ongoing or not. This is the best way to give effect to the Convention Against Torture's obligation that information obtained by torture is not used as evidence (except as evidence that torture was committed). Otherwise we're simply inviting laundering, and by doing so, encouraging torture.

Together, these two sections paint a very troubling picture of the lack of ethics in our spy agencies. Opposition to torture is pretty fundamental to any decent ethical system (not to mention our government's policy), but it is clear that our spies do not share it, and want to quibble. "Can we, can we" is irritating when it comes from children. When it comes from grown adults about torture, it suggests they are amoral psychopaths, who are unfit for any role in an ethical public service.

There's other stuff in there. Two warrants to spy on New Zealanders were found to be "irregular" (that is, illegal), in both cases because the spy agencies basicly made no case for the spying. Which suggests they are still being far to slack in considering whether their activities are necessary and proportionate, and instead just invading people's privacy willy-nilly. On top of that, it appears neither agency is complying with the requirement in the Foreign Cooperation MPS that they refer all new foreign cooperation arrangements to Parliament's Intelligence and Security Committee, which suggests a continued resistance to Parliamentary oversight. Which invites the question of why Parliament is continuing to fund them, when they are refusing to comply with their most basic ethical, legal, and democratic obligations.

Spies, whistleblowers, and oversight

This morning the Inspector-General of Intelligence and Security (IGIS) pointed people at an article on "Playing Hide and Speak: Analyzing the Protected Disclosures Framework of the New Zealand Intelligence Community" by Caitlin Macdonald, Rhys Ball & William James Hoverd. The authors were trying to look at how the whistleblowing framework (set by the Protected Disclosures Act) works for spy agencies, backed by an OIA request for policies and interviews with the two spy agency directors and the IGIS. Its an interesting read, but there's several disturbing points. First, the spy agencies' internal protected disclosure policies mislead employees about their rights, placing an emphasis on internal disclosure to management and downplaying the ability to take issues directly to the Inspector-General. Which is problematic, because the Inspector-General is quoted as saying that internal disclosers can face retaliation:

if you go internally then they think you’re about to leak externally and they do certain things.

It is unclear whether this has actually happened, or whether the IGIS is simply reporting on an institutional mindset, but it doesn't encourage disclosure or reporting of problems (which is perhaps the point). Related to this is that there is no institutional reporting to the Inspector-General of such internal disclosures, and so no monitoring of whether they are properly investigated or whether staff suffer retaliation. Which seems like an excellent subject for an own-motion IGIS inquiry...

But most disturbing is the GCSB Director's claim that "IGIS’s recently established reference group of uncleared and harsh critics of the intelligence community may harm the legitimacy of the IGIS among agency staff". If there is such a perception, then it is something that could be countered by strong leadership from the Director about the role of the reference group, and the importance of oversight and how it builds public legitimacy for the agency. The fact that he is instead spewing this suggests that this is, if not his view, then at the very least tacitly supported by him, and that he is attempting to actively or tacitly delegitimise his primary oversight agency and encourage staff to view it as the enemy. And that is simply not an acceptable approach from a public servant responsible for an agency with hugely intrusive powers.

More crime from the spies

Last year, the Inspector-General of Intelligence and Security reported on significant problems with the intelligence warrant system. While they were unwilling to declare any warrant "irregular" (meaning unlawful) due to the recent law change, they were also not willing to give the system a clean bill of health. Now, they've done a followup report, and while there have been improvements in several areas, they have also for the first time reported that a number of warrants did not meet the statutory criteria under the Intelligence and Security Act 2017:

As noted above (paragraph 10) the Inspector-General reached the view this year that one of the Bureau’s Type 2 warrants was irregular for a lack of sufficient operational detail in the application and a consequently inadequate demonstration of necessity and proportionality. We have since found that another Bureau Type 2 warrant was irregular for deficiency of information on one of the activities for which authorisation was sought. The Bureau is working to address the issues raised by this warrant.

Late last year we formally advised NZSIS that activity under one of its Type 1 warrants was irregular, as it involved a privacy intrusion beyond what was articulated in the warrant application. The Service did not agree...

The Inspector-General says they will be doing more work to bring the agencies into compliance, but shouldn't they be doing more? Because, to point out the obvious, the effect of a lawful warrant is to authorise things like the use of interception devices or the unauthorised access of a computer system, both of which are crimes. If the warrant wasn't lawful, then the activities conducted appear to be criminal. Shouldn't the spies therefore be being prosecuted? Or does the law simply not apply to them like it applies to the rest of us? And shouldn't the agencies be paying damages to the victims of their criminal interference with privacy? Instead, it seems like secrecy will let them just get away with it. With the result that no-one will be held to account, and that there is no incentive not to repeat such behaviour in the future.

This shows the toothlessness of our "watchdog". Yes, they've got quite a bark on them. But like the IPCA, nothing ever results (except perhaps law changes retrospectively legalising the spies' crimes). And that means that their net effect is to provide a veneer of accountability to unaccountable criminal agencies. Until they can prosecute people - and actually do so - they're a sham, and a waste of everyone's time.

Meanwhile, we should remember: spy Minister Andrew little approved these warrants, despite their unlawfulness. Which shows that he is aimply unfit for his position. And it should also cause severe questions about trusting this Minister and these agencies with any more powers, like the control orders they're currently trying to ram through Parliament.

Good little vassals

The Inspector-General of Intelligence and Security has published their report on whether the SIS and GCSB had any complicity in American torture. And its damning. The pull quote is this:

The Inquiry found both agencies, but to a much greater degree, the NZSIS, received many intelligence reports obtained from detainees who, it was subsequently revealed, had been subject to torture. On one occasion the NZSIS provided questions to the CIA to be put to a detainee. While the NZSIS was not aware that detainee interrogations involved torture, it was known that the individual was being held by the CIA in an undisclosed location.

As the report notes, this should have been a red flag for human rights abuse, but it wasn't treated as such (which ought to raise serious questions about the types of people working at SIS). Neither were the widespread public reports that the US was engaged in torture and disappearance, or the fact that partner agencies were launching inquiries into it. Instead, the SIS seems to have culled all mention of those facts from its files of media reports - as if they were deliberately turning a blind eye. The report also notes that the directors of the SIS and GCSB did not inquire with the Americans about the allegations, or seek assurances from them. And it is said explicitly and repeatedly that the reason for that is that those directors did not want to upset the Americans:

...Directors also noted the risk of compromising intelligence flows of vital importance to New Zealanders... if they had challenged their US counterparts...

...there was an unspoken general rule that one did not ask direct questions about the operations of Five Eyes counterparts...

...[the directors] felt constrained not to do anything which would have risked or reduced New Zealand’s role as part of the alliance or to the flow of intelligence...

...they saw other risks, particularly the risk of compromising vital intelligence flows at a vital time, if they asked questions of their partner agencies...

...As one of the former Directors said, it was not realistic to think that New Zealand could have said “please explain” to the United States, the most powerful country in the world. Realistically the response would have been that New Zealand would again have been cut out of the recently resumed intelligence flow, at a time when it most needed it.

Its the same problem we've had all along: it turns out that the people at the top of "our" spy agencies are more loyal to America than they are to us. They're good little vassals to their foreign masters. And we were were paying them for that.

The inspector-General is very clear that the directors had a duty to assess the risks of torture and complicity and raise them with Ministers. They didn't. And that's a dereliction of duty right there. Not raised in the report, because it is outside the Inspector-General's jurisdiction: but equally important: where was the Minister? Because faced with those media reports in 2003, I'd have expected a popular and competent Minister to seek assurances from her agencies that everything was alright and that they were neither complicit in nor contaminated by criminal American behaviour. There's no evidence that she did. Even when interrogation reports of a "senior Al-Qa'ida detainee" were landing on her desk. So perhaps the spies weren't the only ones who were wilfully blind to this.

The report notes that it is "not possible to know" whether the SIS's questions resulted in the detainee - Khalid Sheikh Mohammed - being tortured to extract responses to their questions. But to me, it looks like complicity. The legal framework has changed since then, and you'd hope that this review has made them more aware of the issues and their legal and moral duties. OTOH, given that everything these agencies do is secret, how would we ever know?

Time for some accountability

The Herald (paywalled) reports that the GCSB called the Beehive to try and stop the government from announcing the Budget had been "hacked". Why? Because it was false, and they'd told Treasury Secretary Gabriel Makhlouf so. But instead, he lied to his Minister, and the public, in a pathetic and easily disproven exercise in arse-covering - and in the process caused his Minister to repeat his lies.

Once upon a time, before NeoLiberalism destroyed public service ethics, a chief executive would have offered to resign for this sort of thing. Makhlouf hasn't. That position is looking unsustainable. Ministers may tolerate chief executives lying to the public on their behalf - but lying to them is another matter entirely. Especially when the lies cause the Minister to put their foot in it.

As for what to do about it, the SSC has begun an investigation, but that investigation can have only one credible outcome: Makhlouf must be fired. Anything less and the entire system of accountability between Ministers and the public service breaks down.

And again: we pay public sector chief executives the big bucks because (they tell us) they are accountable and responsible and can be fired when they fuck up. We should get what we paid for. And if the buck doesn't actually stop there, then we shouldn't be giving it to them in the first place.

Little lays down the law to the GCSB

Yesterday we learned from the Inspector-General of Intelligence and Security that the GCSB appeared to be breaking the law, by using Type 2 warrants (which have a lower level of oversight and scrutiny) to illegally scoop up New Zealanders' private communications. Today, Intelligence Minister Andrew Little made it clear that that was unacceptable:

Minister of spies Andrew Little has backed the intelligence agencies' oversight body as it raised questions about the legal basis relied on by the GCSB to carry out electronic surveillance operations which captured New Zealanders' communications.

[...]

Little said he had personally pushed back on "Type 2" warrants to ensure it was the most appropriate form of authorisation. "Part of my role is to probe and question."

"If New Zealanders are going to have their privacy interfered with in more than an incidental way, or there is a possibility New Zealanders are going to be caught up in an area of activity they are going to go after, there would have to be a Type 1 warrant."

Gwyn's report said the GCSB should be seeking a Type 1 warrant when it knew it was likely to incidentally pick up New Zealanders' communications.

Little has also made it clear that in the absence of formal advice from the Solicitor General, spy agencies should defer to the legal interpretation of the Inspector-General. Which should help enormously in bringing these rogue agencies under control.

But this isn't just an abstract legal argument: people's privacy has been invaded, their private communications are likely to have been unlawfully intercepted, snooped through and stored. All of which is likely to constitute an unlawful search under s21 BORA. Will those responsible be held accountable? Will they be prosecuted or fired? I think we all know that the answer to those questions is "no". Which means there's no incentive for the spies not to engage in similar abuses in future.

The GCSB appear to be breaking the law again

When Parliament passed the Intelligence and Security Act 2017, one of the aims was ostensibly to give Ministers greater clarity over the spying activities they were being asked to authorise, so they could properly judge the necessity and proportionality of the breaches of human rights they were being asked to approve. As part of this, warrant applications were required to include greater detail. But are the spy agencies actually meeting those requirements? The Inspector-General of Intelligence and Security has reviewed the first 9 months of warrants under the new Act, and the conclusion is only "maybe".

Obviously there are teething problems when a new law is introduced, in this case compounded by the refusal of spy agencies to cooperate with IGIS beforehand on how it would be interpreted. The good news is that the SIS seems to have got with the programme, taken the IGIS' recommendations on board, and are now complying with the law. The story is different for the GCSB, and the IGIS identifies several major issues:

• Seeking Type 2 warrants (which only authorise actions against foreigners) rather than Type 1 warrants (required for anything targeting a New Zelaander) for activities which they expect to result in the incidental collection of the private communications of New Zealanders. This means they are subject to a lower level of scrutiny, require only the approval of the rubberstamp Minister, and the "incidental intelligence" can be retained and used if they "incidentally" turn up anything interesting.
  
• Using extremely broadly-defined classes of targets, where it is not entirely clear who might be a lawful target and who might not be (in at least one case, anyone who the GCSB had a "reasonable suspicion" that they might have a reasonable suspicion of).
  
• Using tortured definitional games and reference to other warrants (in some cases, forward-looking references to future warrants that have not yet been authorised or even applied for) to obscure exactly who they are targeting and what they are doing, frustrating the goal of clarity and impeding the Minister's ability to assess the necessity of the warrant.
  

The IGIS's overall assessment: "I am unable yet to say that the authorisation of Bureau activities has achieved the expectations raised by the ISA". Which is a polite way of saying "I think they are breaking the law". The Act requires clarity so that Ministers can make an informed decision. GCSB seems to be deliberately impeding that. But as usual, the chances of anyone ever being held accountable for that are nil.

Show us the backdoor

Today the GCSB banned Spark from using Huawei equipment in its planned 5G network. The ban was imposed for "national security" grounds, but naturally there's no details. So we're supposed to believe that Huawei gear is too dangerous to be used in our networks, but we are forbidden from knowing how to fix it.

This is simply bullshit. If Huawei gear is backdoored to e.g. route traffic back to Chinese state security agencies so they can read it (you know, like US stuff is), then the best way of protecting our security is for the details of those problems to be widely publicised, so that they can be fixed. There's no benefit to the public in keeping security flaws secret. The only people that benefits are the people who want to exploit those flaws: hackers, criminals, and spy agencies like the GCSB (or more likely, their foreign masters, the NSA). And if exposing Chinese backdoors causes the NSA's Chinese equivalent to expose American ones, allowing them to be patched, then again, we all benefit.

More generally, exposing and publicising bugs and security flaws makes the world a safer place. An agency genuinely interested in our security would do that. The fact that the GCSB doesn't - well, you can draw your own conclusions about their purpose.

The opposite of security

The GCSB's current motto on its website is "If New Zealand has secrets worth stealing, then they're worth protecting". Now, the GCSB and their Five Eyes masters wants to make it radically easier for people to steal those very secrets they claim to exist to protect. How? By backdooring the encryption which protects our networks, our filesystems, our financial transactions, everything:

Ministers from the Five Eyes grouping of New Zealand, Australia, Canada, the United States and the United Kingdom have agreed to new measures to combat global threats, including seeking access to encrypted data and communications.

[...]

Among them was agreement that there was an urgent need for law enforcement agencies to gain access to encrypted data and communications, subject to conditions.

"The inability of intelligence and law enforcement agencies to lawfully access encrypted data and communications poses challenges to law enforcement agencies' efforts to protect our communities.

"Therefore, we agreed to the urgent need for law enforcement to gain targeted access to data, subject to strict safeguards, legal limitations, and respective domestic consultations.

"We have agreed to a Statement of Principles on Access to Evidence and Encryption that sets out a framework for discussion with industry on resolving the challenges to lawful access posed by encryption, while respecting human rights and fundamental freedoms," the communique said.

But while that statement uses the language of "lawful access" and makes much of judicial oversight, fundamentally such access requires that those systems contain vulnerabilities. But as we've already seen, security agencies don't seem to care much for the law when they can hide behind secrecy, and vulnerabilities don't just get used by the (self-proclaimed) "good guys". There are already cases of security flaws kept secret by spy agencies being exploited by criminals, and that's just an ordinary operating system vulnerability. And secrecy is no defence: there's an entire ecosystem of people out there searching for holes in our systems to use. If a vulnerability exists, they will eventually find it, and when they find it, they will exploit it. And where the vulnerability is in something critical, like say the encryption which protects your online credit card transactions or the algorithm which identifies you as the author of a digital contract and makes it binding, then the consequences could be devastating.

Organisations like GCSB ostensibly exist to protect us from that. Instead, they seem to be more interested in building themselves a global surveillance state. And that is not protecting us. Deliberately introducing security vulnerabilities into critical systems is not "security" - instead its the opposite.

The GCSB spied on the Pacific

The Inspector-General of Intelligence and security has released her report on GCSB spying in the South Pacific. The short version: the GCSB spied (and almost certainly still spies) on our Pacific neighbours, this spying may have illegally captured the private communications of New Zealand citizens, but as they do not appear to have been retained, there's no finding. Its a deeply unsatisfactory report, in that GCSB appears to have been doing something illegal and escaped consequences for it (again), and it spends a lot of space talking about how the law has changed and the protections GCSB has in place, but the fact remains: if they are still spying on the Pacific, then they will still be intercepting the communications of kiwis living or holidaying there. They have legal cover now for such "incidentally obtained intelligence", but that shouldn't be any comfort. We're meant to be a free and democratic society, and free and democratic societies don't spy on their citizens without particularised suspicion and individual judicial authorisation. And yet, the GCSB's methods at least sometimes involve indiscriminate mass surveillance. And all the equivocation in the world over "collection", "selection" and "retention" can't hide that.

Plus of course, there's the discomfort of an official acknowledgement that our government was (and probably still is) spying on our closest neighbours, all of whom we consider to be friendly states. I wonder how that will go down at the Pacific Forum?

Meanwhile, there's an interesting admission in the report: pre-2013, the GCSB considered metadata interception and getting its Five Eyes partners to provide intelligence on kiwis to be entirely legal and not requiring authorisation. So, the entire critique of the GCSB was accurate. Post-2013 both of these activities required legal authorisation, but that might not be any comfort - because when the law changed, the number of access authorisations issued went through the roof, suggesting that Ministers simply signed off on the spying GCSB was doing anyway. And of course, no-one at GCSB was held accountable for its previous, highly dubious and self-serving interpretation of the law.

Key lied about mass-surveillance

Surprise, surprise - it turns out that John Key lied to our faces about the mass-surveillance "speargun" project:

Sir John Key's story of how and why he canned a "mass surveillance" programme are at odds with official papers detailing development of the "Speargun" project.

The issue blew up in the final days of the 2014 election with Key claiming the programme was long-dead and had been replaced by a benign cyber-security system called Cortex.

Key always claimed the Speargun project to tap New Zealand's internet cable was stopped in March 2013.

But new documents show development of Speargun continued after the time he had said he ordered a halt - apparently because the scheme was "too broad".

Instead, they show Speargun wasn't actually stopped until after Key was told in a secret briefing that details were likely to become public because they could be in the trove of secrets taken by NSA whistleblower Edward Snowden.

Key basicly pretended that telling GCSB not to bring the business case to Cabinet for now because it needed legislative approval was the same as cancellation. It wasn't, and work continued right up until the "Moment of Truth" event. Worse, Key's chief-of-staff Wayne Eagleson deliberately hid documents the PM held from an OIA request by transferring it to GCSB. That's not hat-games, its not "pretty legal" withholding, its straight-out lying. The entire basis of the OIA regime relies on officials being honest about what they hold. If they're not going to do that, then we need to start providing strong incentives for them to do so. Incentives like jail time, as they do in Canada.

Meanwhile, new GCSB Minister Andrew Little is refusing to comment. In a situation where the previous government has been conclusively shown to have deceived us about spying, I think he owes us a little more than that.

The GCSB has no control over its systems

That's the natural conclusion of their latest admissions about illegal spying on Kim Dotcom:

The GCSB also told the High Court the "majority of selectors" were removed on January 24, 2012, the Monday following the raid, and a further "small number of selectors" were removed on January 30, 2012.

"They say that all activity by GCSB staff relating to Operation Debut ceased by 30 January, 2012."

But it added: "Limited interception of some communications continued beyond the detasking date without the knowledge of GCSB staff."

The GCSB said it was unaware of continued access of Dotcom through its systems until legal action was filed over the unlawful spying.

How did they not know? There's a tacit admission that the NSA might have been involved, and that the GCSB assisted them to illegally spy on a New Zealand resident, in violation of both New Zealand law and the Five Eyes agreement. There's also a suggestion that the equipment really belongs to and works for the NSA, and that the GCSB don't have control over it. Either way, they seem unable to meet their obligations under New Zealand law, or to find their arse with both hands. And it raises the obvious question: if they can't work their toys properly, why do we let them play with them?

Every time the GCSB comes under any sort of scrutiny, they're found to be incompetent muppets at best, if not criminals working for a foreign power. Its long past time this agency was shut down, its spying functions removed, and its privacy invading equipment and records thrown in a volcano. We need a computer security agency. We do not need foreign spies.

The police actively covered up for the GCSB

When the police issued their report on their investigation into the GCSB's illegal spying on Kim Dotcom, they argued that they could not prosecute because the criminal spies had not known they were breaking the law. That legal test has already been shown to be bullshit, but now we also know that it is false, because the GCSB continued spying for a month after they knew it was illegal. Now it turns out that the police who "investigated" them knew this:

The judgment stated: "The Government Communications Security Bureau (GCSB) has admitted unlawfully intercepting private communications of Kim and Mona Dotcom (the Dotcoms) and Bram van der Kolk during the period from 16 December 2011 to 22 March 2012."

There had been speculation the judge had simply got the date wrong but a police statement that detectives were aware of the dates during the 2012/2013 investigation has put an end to that.

[...]

A spokesman for police said: "We've checked the file and can confirm that the dates you've highlighted were known to the Operation Grey team. They were considered as part of the investigation and decision-making about the outcome."

And yet despite the police knowing that the GCSB knew that the spying was illegal, they concluded that they didn't. Which makes the entire "investigation" look like a shabby cover-up for criminal activity by the government. It also raises serious doubts about the IPCA report on the "investigation", and about whether the police were honest with the IPCA (or whether the IPCA was complicit).

As for what to do: the police have shown that they can not be trusted on this. If we want power to be held to account in this country, there is only one option: a private prosecution of the GCSB staff involved.

The GCSB perjured themselves

Kim Dotcom lost a court case last week over whether he could see the communications the GCSB intercepted from him in order to assess the amount of damages he is owed. But in doing so, we learned something new: that illegal surveillance lasted two months longer than previously admitted, and the GCSB lied about it in court:

The illegal spying which earned Kim Dotcom an apology from former Prime Minister Sir John Key went on two months longer than previously admitted, according to a High Court judgment.

The revelation - if accurate - would open a can of worms over sworn admissions the GCSB has made in the High Court and the Court of Appeal over assistance given to police ahead of the FBI-inspired 2012 raid which saw Dotcom and three others arrested.

It could also raise the possibility of a fresh apology to Dotcom because Key's apology was in the context of spying from December 16, 2011 through to January 20, 2012.

The GCSB had previously given sworn statements on the earlier date in court, so the spies who gave those statements are now on the hook for perjury. But that's not all - because the new date also means that the GCSB continued spying on Dotcom for a full month after they knew it was illegal. Which pushes their spying from "incompetent mistake for which people should lose their jobs" to "knowing illegality for which people should go to jail". Not that that, or a perjury prosecution, will ever happen. Because if we've learned one thing from this whole saga, its that the law simply does not apply to the GCSB. And that makes one of the foundations of consent in the modern state - equal laws, applying to the government as well as the people - a lie.

The GCSB are not just undermining our sovereignty and our international relations. They are also undermining the foundations of our democracy. They are a poison in our body politic. And it is long past time we eliminated them.

"Economic wellbeing" and "national security"

One of the most controversial ideas in New Zealand's national security legislation is the idea that "national security" includes "economic wellbeing". This appears to have been formally introduced for the first time in an amendment to the SIS Act in 1999 (the same one that immunised SIS officers for illegal burglaries), and it was greeted with immediate suspicion. And the reason for that was obvious: because historically, the government and deep state had regarded the left and the environmental movement's demands for higher wages and economic and environmental justice as a threat to the economic wellbeing of the rich.

Now, that controversial clause has just been used to justify the GCSB's spying on our friends and allies in a failed effort to advance the personal career of a government Minister - a move whose discovery upset those friends and allies and clearly undermined our peaceful diplomatic relations.

That "justification" comes from the Inspector-General of Intelligence and Security in her report into the incident. From the summary:

First, the New Zealand government had made a foreign policy decision to support Mr Groser as a candidate. The decision reflected a considered assessment that Mr Groser would, if selected, advance the effective functioning of the WTO (an international, multilateral organisation) and so have a significant impact on New Zealand’s economic well-being.

Second, under the terms of the Government Communications Security Bureau Act 2003 which applied at the time, the GCSB had a statutory responsibility to provide foreign intelligence assistance in support of New Zealand’s foreign policy objectives. In line with the government’s decision and the foreign policy basis for that decision, the GCSB acted lawfully and appropriately in providing its assistance to the campaign.”

And so that's that. The "economic wellbeing" clause and a stated view from MFAT that Groser would behave corruptly in office to advantage New Zealand equals corruptly spying on our allies. And presumably the same logic applies to justify spying on e.g. Greenpeace if MFAT decides that a strong climate change agreement would be bad for farmers. As for the solution, I think its simple: we need to get rid of the economic wellbeing clause, as quickly as possible.

As an aside, the Inspector-General's picture of the GCSB's decision-making process in this case is not exactly flattering. The GCSB director (John key's chum Ian Fletcher) seems to have decided himself that it was a good idea, then asked Groser whether he wanted his career advanced by spying on his rivals. Of course, Groser said "yes". Its telling that the Inspector-General is forced to rely on the GCSB's statutory objectives being "sufficiently broad" to permit this, rather than being able to point to a formal government decision to undermine our diplomatic relations. And there are recommendations about proper documentation of such cases, including consideration of improper personal benefit to Ministers who receive GCSB intelligence.