A "secret" that wasn't

Back in 2018, Aotearoa was in the midst of the Operation Burnham inquiry. During this, it emerged that key evidence was subject to a US veto under an obscure and secret treaty. Part of the Five Eyes arrangement, this treaty was referred to by a number of different names in different documents, but seemed to be the "Security of Information Agreement between the New Zealand Minister of Defence and the United States Secretary of Defense of September 2 1952", with amending exchanges of notes in November 1961 and in 1982.

I was curious about this treaty and especially about its impact on the handling of OIA requests, so I asked MFAT for a copy. They refused, claiming it was a) secret; and b) American, and therefore couldn't be released. So I went to the Ombudsman, pointing out that the equivalent treaties for all other Five Eyes had been released and were likely to be substantially similar (so it wasn't really secret after all), and that if MFAT wanted to hide behind the Americans, it should at least have to actually ask them if they objected to release. The Ombudsman agreed on the latter point at least, and so MFAT agreed to reconsider its decision and ask the US. And then they just... didn't. back to the Ombudsman, and MFAT agreed that it would make its own assessment of the treaty and consult the US about that, and released a summary. back to the Ombudsman for a full-on challenge to the idea that this is secret or foreign in any way, and MFAT agreed to formally talk to the US to gain US declassification. And then they just... didn't (again). And its currently before the Ombudsman again, with more MFAT promises to talk to the US.

So you can imagine how pissed off I am to find out that a key part of the information I requested - the 1961 exchange of notes - was declassified and released by the US State Department in January 2018, before I even made my request, and that MFAT has simply been dicking me around for seven years. You can read the full thing here, thanks to the Unredacted Five Eyes archive.

As for what it says, it echoes the other, similar (and public) agreements that we already knew about. Which invites the question: why the secrecy? What is the supposed harm in release here? What was the point of MFAT's "consultation" if it didn't result in them learning that this had already been declassified? And why is the New Zealand government still resisting transparency after all these years?

Inquiring too well

Stephen Lawrence was murdered thirty years ago in a racist attack in London. The murder and the resulting police non-investigation has been the focus of multiple inquiries over the intervening three decades, resulting in official findings of institutional racism against the UK police and multiple corruption investigations. The "Spycops" scandal subsequently revealed that undercover police officers had infiltrated the Lawrence family's campaign for justice, in an effort to dig up dirt and smear them. Those actions were the subject yesterday of the Undercover Policing Inquiry - when it all went horribly off-script:

Asked if undercover police were gathering “intelligence with which to smear the Lawrence family”, [former undercover police officer Trevor] Morris told the Undercover Policing Inquiry on Thursday that that was not his job. Instead, he said it was for MI5 – the Security Service – to do.

Morris said: “I heard this subsequently, and I thought that was … nonsense. That's not what we’re about. We're about gathering intelligence, not smearing individuals.

“That's a Security Service job. Let them do that. We're bothered about gathering intelligence. That's what we were doing.”

Morris then said: “Sorry I shouldn’t say that. Let’s scrap that last bit. I’m not saying that.”

The interrogating lawyer asked: “Are you or are you not in a position to say whether or not the Security Service was seeking to smear …”

At this point the live feed of the Undercover Policing Inquiry was suspended.

Which is all just a bit Orwellian. I guess the inquiry was inquiring too well, and uncovering things the British establishment really didn't want the public to know. But no amount of Orwellian censorship can disguise the truth here: that the British state is rotten to the core.

The SIS turns Parliament into liars again

When Parliament passed the Intelligence and security Act in 2017, they assured us all that it was full of safeguards. Any intrusive surveillance of New Zealanders would be subject to a "triple lock", requiring the approval of the Minister and (supposedly independent) Commissioner of Intelligence Warrants, as well as post-facto review by the Inspector-General of Security and Intelligence. But according to the latest report from the Inspector-General, the SIS has turned them all into liars.

The problem is that the SIS has switched from using individual warrants to "class-based" ones when collecting intelligence on potential terrorism and violent extremism. So rather than having to convince the Minister and Commissioner of the need to spy on a particular person, as they were required to do in the past, they have instead switched to convincing the Minister and the Commissioner that they need to spy on classes of people, broadly and apparently subjectively defined - meaning that the actual decisions about who gets spied on and how are left entirely to them. This is clearly envisioned by the Act, but at the same time also clearly evades all those safeguards we were told about. And in the specific case, the Inspector-General argues persuasively that it is a "general warrant" (one which does not specify exactly what can be done under it) - a thing which has been unlawful since forever. And interestingly, once you strip away the tortured language designed to hide the admission, it seems that Crown Law agreed:

The Service disagreed with me that the warrants were general warrants at common law, provided the class definitions were tightened, and this was a view supported by Crown Law.

[Emphasis added]

The SIS subsequently did that. But the "improved" warrant still lets them decide "what ideologies are considered terrorism or violent extremism, who is a valid target, and what intrusive activities would be carried out, up to the maximum level of intrusiveness that the law allows." It may no longer be illegal, but it is absolutely improper.

That question of propriety is the real and underlying issue here. The IGIS is clear that while class-based warrants may legally be available, using them for intrusive surveillance "undermines the spirit of the warranting regime" and betrays the promises made to us about safeguards:

The authorising framework in the ISA provides for a process to give the public confidence in the justification for the agencies’ actions, by requiring external authorisation for the use of highly intrusive powers. Prior authorisation is a safeguard against agency overreach. It helps to ensure that breaches of protected rights in the interests of national security are justified and according to law. In the development of the ISA, this was described as a “triple-lock” of protection for individuals, with the three locks being control from the Minister, the Commissioner of Intelligence Warrants, and post-facto review by the IGIS. The effective delegation to NZSIS, under these warrants, of decisions on who to target for counter-terrorism or violent extremism purposes, by what means and for how long, and to undertake the most intrusive activities available, effectively leaves the scrutiny of individual cases to my office alone, after the fact. That is not what the public was led to expect.

Bluntly, the ISA was meant to stop the spies from doing whatever the fuck they want. This is a deliberate circumvention of all those safeguards. It is absolutely unacceptable. Further, it betrays that the culture of lawlessness and unaccountability the ISA was meant to stamp out continues to exist, in the SIS at least. And if that's the case, you really have to ask why we tolerate their continued existence.

IGIS will now be putting the SIS's improperly-delegated targeting decisions under the microscope, giving them the scrutiny the Minister and Commissioner should have. But while that's better than nothing, its not enough. And you really have to ask whether the Minister and Commissioner of Intelligence Warrants were doing their jobs properly when they signed off on this. The then-Minister, Andrew Little, is gone, so there's nothing we can do about him other than make sure he's not let within a mile of the position in future. As for the Commissioner, this seems to be a strong case for removal for neglect of duty.

Institutional traitors

One of the strongest narratives about "our" spy agencies is that they are basically institutional traitors, working for foreign powers (or just themselves), without any control or oversight by the elected government. And today, we have yet another report from the Inspector-General of Intelligence and Security which explicitly confirms this.

The short version: the GCSB hosted a signals intelligence system controlled by a foreign spy agency for years. But despite this system being able to be used to support military operations - which reading between the lines, means "drone murders" - they never told the Minister or sought Ministerial approval, despite the obvious human rights and foreign policy implications. On top of that, having agreed to host it, they then apparently forgot they were doing so, thanks to the usual recipe of secrecy, deliberately poor record-keeping, and incompetence. They only noticed again when it broke - at which time they did the right thing, turned it off, and contacted the Inspector-General.

The IGIS finds that while the hosting, data-sharing, and required collection were (mostly) authorised and lawful under the "manifestly inadequate" authorisations of the day, the failure to tell the Minister was utterly improper, violating the (then) statutory requirement of Ministerial control as well as the "no-surprises" policy.

It gets worse. Because despite the agreement with their foreign "partners" saying that the GCSB would have full visibility and would exercise due diligence over the system, they just didn't. They kept no records, weren't told what it was being used for, didn't bother asking, and of course never did any audits or reviews. They were so shit that after the agreement was signed and the system was installed, the knowledge was not passed on to new directors or senior leaders - meaning they had no idea of what they were doing (I am wondering how much of this was due to the switch from the old Defence-MFAT mafia to civilian leadership). Which means that if it was used for drone-murders, in likely violation of both New Zealand law and our foreign policy, they had no fucking idea. Which leads to this bit from the IGIS:

I have one further observation to make. There is one scenario contemplated by the MOU that I have no doubt would have been outside the scope of the various collection authorisations and, therefore unlawful and improper. Action from GCSB on a request from the partner operating the capability to collect signals not already tasked by GCSB, for the purpose of supporting a military operation, would have been outside the scope of the stated purposes of the authorisations. I would hope this never happened but, given the inadequacies in the GCSB’s monitoring and record keeping of the capability in action, I have no comfort that it did not.

We deserve something more than"hope" that "our" spies didn't break the law. Unfortunately, apparently that is all they and their oversight mechanisms can give us.

The good news is that the Inspector-General thinks that this is unlikely to happen again. I'd like to believe that, and it certainly looks like the culture and acceptance of oversight at GCSB has changed. Unfortunately, given their level of secrecy and the prohibition on the Parliamentary Intelligence and security Committee from inquiring into "operational matters", we will never know. Unless we see another report like this in a decade's time.

The SIS is evading oversight again

The Inspector-General of Intelligence and Security released their annual report today. And it contains some rather worrying revelations about the SIS and their efforts to circumvent the restrictions on their use of intelligence warrants. When the government rams through new spy powers (typically under urgency, with no public input), it tells us that they are subject to oversight and therefore cannot be abused. But it turns out that the SIS is systematically evading that oversight. Which invites the natural conclusion that they are engaging in systematic abuse - otherwise, why bother to evade?

And this isn't over little things - its about intelligence warrants, the core of their legal powers. An intelligence warrant allows a spy agency to do something illegal to collect intelligence. Typically that's intercepting phone calls or internet traffic, or burgling somewhere to plant bugs or copy or steal documents. And when they do something like that which might affect a kiwi, they need to ask other people: both the Minister (who is a rubberstamp) and the Commissioner of Intelligence Warrants. These warrants are also reviewed after the fact by the inspector-General, who tends to be a lot more critical in their assessments than either of the other two.

Or at least, that's how it used to work. But John Key's spy law, passed in 2017, fundamentally changed the warrant system. Previously, SIS warrants had to be about a particular individual, and required particularised suspicion. Now, they can be about a "class" of people, and require only a generalised suspicion. Whether a particular person falls into the target class is up to the agency, and there's no external review of that. So of course the SIS is doing everything under class warrants, despite the fact that they are almost always targeting particular individuals:

NZSIS investigations are often focused on particular individuals. Over many years of producing individual warrant applications the agency became proficient at putting together ‘intelligence cases’ in warrant applications for intrusive surveillance of specific targets. Such applications are now disappearing. They are being replaced by applications for warrants against classes of persons defined in terms of the NZSIS having assessed them as threatening national security. It has become apparent that a class warrant can be drafted to cover any NZSIS investigation, no matter how closely it might be focused on a particular person. With a relatively small set of class warrants in place, an individual coming to the attention of the Service may be assessed as coming within an authorised target class (a class possibly approved months beforehand). That person may then be put under surveillance, potentially up to the maximum possible level of intrusion (if that is what the warrant allows), without their existence or any intelligence on them having been presented to anyone outside the NZSIS. That is obviously convenient for the agency. I seriously question whether it is consistent with the concept of a warrant as a safeguard for the rights of anyone prospectively in the sights of a state security agency.

Translation: the SIS's use of class warrants is undermining the entire oversight regime, and the entire concept of warrants as a safeguard.

The Inspector-General apparently has a report in the works about a particular class warrant, questioning whether it was lawful or proper. It will be interesting to see what comes of that, and whether the supposed safeguards in the law mean anything, or whether everything our politicians tell us about restrictions on the spies is just lies, and that the entire legal regime is designed to hide the fact that there are no effective restrictions on their activities. Meanwhile, people might want to consider whether an agency which systematically and repeatedly attempts to circumvent and undermine its own legal oversight regimes can ever be trusted, and whether it should be allowed to exist at all.

SIS shows it cannot be trusted - again

One of the few legitimate functions of the SIS is security vatting: making sure the public servants we trust with sensitive information are in fact trustworthy. But, as in everything else, the SIS do a terrible job at this: in 2016 the Inspector-General of Intelligence and Security exposed them as incompetent, trust-abusing muppets who failed to properly safeguard this information, failed to properly record or control access, and (of course) used it for other purposes. The SIS of course solemnly promised they would fix all of this. But seven years later, the IGIS is back, with another report exposing continued illegal use of this information for other purposes.

Section 220 of the Intelligence and Security Act 2017 explicitly bans use of vetting information for any purpose other than security clearance assessment and counter-intelligence. The purpose of the ban is to ensure people can give honest answers to vetting questions without e.g worrying that if they disclose minor past criminal behaviour, the SIS will rat them out to police. But despite this clear legal prohibition, the SIS has been using it for counter-terrorism investigations, and sharing it with law-enforcement. On one occasion, this was apparently done without any legal assessment whatsoever. On another, they relied on a tendentious legal interpretation from their pet lawyers that "disclosure" was not "use", so s220 did not apply (this was stomped on by Crown Law, but only after the information had illegally been disclosed). But most worryingly, they have used intelligence warrants - which allow spies to carry out "an otherwise unlawful activity" - to over-ride the protection of s220. Which effectively renders all the "protections" of the Act a simple nullity. The IGIS recommends this practice stop immediately. Whether it has or not is something we won't know until their next report.

(As an aside, the IGIS also notes that disclosure of vetting information to police may be a crime. But of course no-one will ever be prosecuted for it, because both the spies and police are above the law).

Another report showing that the SIS remains a pervasively criminal agency which is constantly trying to evade the legal limits imposed on it by Parliament is bad enough. But the most worrying aspect of this is the use of intelligence warrants to bypass legal prohibitions on disclosure. The IGIS says that this is unlawful for vetting information because a warrant cannot over-ride the Intelligence and Security Act itself:

Section 49(3) ISA provides that an authorised activity may lawfully be carried out “despite anything to the contrary in any other enactment” [my emphasis]. In my view, if the intent of Parliament was to enable an authorisation to override anything in the ISA itself, the section would state ‘in this or any other enactment’, or words to that effect.

But the upshot of that is that it can be used to over-ride promises of secrecy or confidentiality in other enactments. For example, in the Data and Statistics Act 2022 (allowing them to access your personal dossier in the Integrated Data Infrastructure), or in the COVID-19 Public Health Response Act 2020 (allowing them to access your contact-tracing information). Parliament makes these promises for the same reasons as for s220 ISA: to encourage honesty where information is crucial. But it turns out that none of them are binding. Whether the spies are in fact pissing all over Parliament's solemn promises in this way is something we will likely never know (again, unless there is an IGIS report). But the fact that it is a possibility will inevitably affect the quality of the answers the government gets, and is a standing threat to both good government and trust in government in this country.

Spies spreading like cancer

We thought things were bad enough with two government spy agencies sniffing people's underwear while resolutely looking the other way on Nazis. But apparently MBIE has created a new one practically overnight:

Newly released Official Information Act documents show the Ministry of Business, Innovation and Employment's (MBIE) intelligence wing, MI, has expanded in the past 12 months beyond immigration to cover the entire sprawling ministry, taking charge of intelligence and operations if there is a national security threat.

Its budget has doubled in one year to $11 million - almost quadruple what it was in 2017 - and its staff has grown to 115.

Its focus is on "national security and intelligence" through a "National Security Intelligence Team", even though the New Zealand Security Intelligence Service (SIS), Government Communications Security Bureau (GCSB) and National Assessment Bureau already do this. Unlike MI, those spy agencies all have outside scrutiny from an independent watchdog; MI has none, only an internal monitoring group.

Immigration has had its own intelligence shop for a while, focusing on "people traffickers" (refugees) and pushing Australian paranoia about "mass arrivals" (which haven't happened in Aotearoa since 1840). But expanding it to cover other business units is new. MBIE is huge, and covers things like workplace relations, research, science and technology, outer space, energy, crown minerals, commerce, and broadcasting. And while you might be able to see a case for immigration to have spies, the rest looks downright dangerous. As a reminder, NZPAM - part of MBIE - was caught in 2018 using private spies Thompson & Clark to spy on the climate change movement, resulting in a government inquiry and a formal ban on such outsourcing. It seems that they've responded to that ban by taking that spying in-house. Meanwhile, their actual enforcement duties - like stopping the exploitation of migrants - seem to have been grossly neglected. Because apparently there's more prestige in empire-building and hob-nobbing with intelligence agencies and "overseas partners" than in doing your fucking job.

This agency needs to be shut down immediately, and its Minister and chief executive hauled over the coals by parliament and forced to explain what the fuck they were thinking. We have too many spies in Aotearoa already. We do not need more.

How convenient

Visa processing times have gone through the roof, and the holdup appears to be SIS security checks. But the SIS now refuses to release basic performance data on whether it is doing the job properly because "national security":

The SIS has refused to reveal its average processing time but said the timeframes were being formalised in a service level agreement with Immigration New Zealand (INZ).

[...]

Director-General of Security Andrew Hampton said to reveal the number of security checks (NSC) and how long they took may prejudice the security or defence of New Zealand or international relations.

How convenient that suddenly basic accountability information is suddenly a state secret. I'm sure that will help ensure SIS does their job properly. Even more convenient: if they've actually classified the statistics, its a crime punishable by 5 years imprisonment to leak them. So there's not even the usual check on underperformance.

The supposed "justification" for this is that unnamed "adversaries" could "exploit the border screening system" if given time-series data on processing times. How? By knowing whether SIS was doing its job quickly and efficiently? And do they think that those supposed "adversaries" don't know that already?

This is a perfect example of how "national security" is used to hide embarrassing information and evidence of underperformance. And the only interest it serves is that of an agency which is too busy chasing imaginary enemies to perform its basic functions.

Some sensible suggestions on reining in the spies

In 2022 the government announced a periodic review of the Intelligence and Security Act, the legislation governing New Zealand's spies. Yesterday the review presented its report, Taumaru: Protecting Aotearoa New Zealand as a Free, Open and Democratic Society. Its a chunky read, and I'm not finished yet, but from the bits I've read, its not the usual spy-agency power grab, but rather, the complete opposite, presenting ideas to increase oversight and rein in the power of the spies.

Stuff has a good summary of the key recommendations. The big three are:

• Strengthening the Intelligence and Security Committee, making it actually independent by kicking Ministers off it, and giving it power to investigate the effectiveness of the agencies, as well as oversight of other intelligence bodies (of which we have a disturbingly large number). The spy agencies absolutely hate this idea, so that's a strong reason to do it.
• Removing the distinction between type 1 and type 2 warrants for "national security" purposes - a bit technical, but basicly type 1 warrants are required to spy on kiwis, type 2 are for foreigners and have lower oversight. The recommendation is that everything would use the higher standard. This apparently happens anyway because of the risk of incidentally spying on kiwis, but it will mean a legislated improvement in oversight.
• Defining "national security" in the Act - this is an important definition, and defining it will potentially limit what the intelligence agencies can do. When the ISA was introduced to parliament, the Bill originally included a definition, but this was removed by the select committee because it "would require the intelligence and security agencies to make difficult judgements about when the definition applied, and when their powers could be invoked" - that is, it might stop them from doing whatever they wanted. IIRC the definition also attracted opposition from the public, because it included "economic security" and "international relations" - protecting the rich and silencing criticism of NZ's so-called "friends" - which do not enjoy social licence as a basis for spying. The review's proposal doesn't include any of that bullshit, focusing strictly on territorial integrity, safety, democracy, and social diversity. There is a mention of "essential interests", but that's nailed down by talking about "critical infrastructure and governmental operations", so it might not be the open slather it seems like. Overall, I think this is a good move, because it will limit the spies.

One of the other recommendations is legislative consistency for all the other intelligence groups (such as NZDF, police, customs, MBIE, MPI... apparently everyone's got one now). Insofar as these bodies are operating on an unclear legal basis and without statutory constraints (NZDF appeals to the royal prerogative, FFS), this seems like a bloody good idea. The Search and Surveillance Act should have done this, and it is highly disturbing that some bodies apparently fell through the cracks (and that the recommendations of the Law Commission around requiring warrants for undercover operations have been ignored). And it seems especially necessary now that the legal consensus on what constitutes a "search" has shifted to mean interference with "a reasonable expectation of privacy". Under this new consensus, these bodies are likely engaging in widespread illegal searches (the review unwittingly gives an example of the SIS using a fake identity to monitor a private chatroom. That's a search, and should need a warrant). It would be better for Parliament to legislate properly to give certainty about what they can and can't do, rather than for them to ram through "fuck you" empowering legislation when one of these agencies is caught and made to pay damages by the courts.

Again, I haven't finished reading the whole thing yet. But so far, this seems like a sensible review. So now we'll no doubt get to see the spies either bin it, or pervert it into giving them even more powers and less accountability.

More bad faith from the spies

In November last year, the SIS agreed to pay journalist Nicky Hager $66,000 for illegally spying on him. As part of the settlement, they agreed to publish an agreed statement about the settlement on their website. But two weeks later, it was gone. The New Zealand Council for Civil Liberties used FYI, the public OIA request site, in an effort to find out why. The reason? The SIS's general counsel - who had presumably defended the SIS's indefensible actions and negotiated the settlement when it was clear that they would lose - asked for it to be removed "as that story has passed".

This is not the action of an agency which accepts and owns its mistakes and wants to do better. Instead, it is the action of an agency which refuses to accept it has done anything wrong, and seeks to bury the evidence of its misbehaviour. Its a sign that the SIS has no intention of changing its practices. That they are perpetual recidivists who cannot ever be reformed. Which means that if we want our democracy to be safe from them, we have to destroy them: defund them, disband them, reduce them to a rump protective security / security clearance agency.

Meanwhile, I guess the lesson for the future is that you should always take the SIS to trial. Because any "settlement" from them will simply be an exercise in bad faith.

A significant loophole

In case you hadn't noticed, FYI, the public OIA request site, has been used to conduct a significant excavation into New Zealand's intelligence agencies, with requests made for assorted policies and procedures. Yesterday in response to one of these requests the GCSB released its policy on New Zealand Purpose and Nationality - basicly what it does to ensure that it complies with the requirement that it obtain a Type 1 intelligence warrant before spying on New Zealanders. The policy itself seems reasonably robust - if it is unclear whether someone is a New Zealander, they seem to apply a "reasonable grounds to suspect" standard, which at face value seems appropriately cautious. But there's a twist:

This is due to the way s53 of the Intelligence and Security Act is phrased, referring only to NZ citizens and permanent residents (that is, natural rather than legal persons). But it seems to be a loophole, resulting in a lower standard of oversight for spying on organisations (basicly, they only need approval from the (captive) Minister, rather than from the independent Commissioner of security warrants). And the fact that it is being explicitly pointed out in the policy suggests that the spies encourage its use.

What sorts of spying might be covered by this loophole? Spying on NGOs, unions, political parties, and companies. Tracking ships and aircraft, if the purpose isn't to spy on a specific, known New Zealander. Depending on how creative the GCSB's lawyers are - and in the absence of outside scrutiny, they can be very creative indeed - it may even extend to tracking cars. And while some forms of spying on an organisation may be difficult to do without also spying on a person, there are forms which seem eminently do-able. Spying on financial transactions. Hacking its computers and looting its files. Classic black-bag jobs. If the SIS wants to, say, steal Te Pāti Māori's membership list, the law doesn't seem to require a Type 1 warrant. And that seems... dangerous. Because one of the reasons we require external, independent oversight of spying on kiwis (rather than just the rubberstamp of a captive Minister) is to protect our political and democratic rights. But those rights are not just exercised individually, but also collectively, through groups like NGOs, unions, and political parties. And spying on those organisations can be just as dangerous to our democratic rights as spying on individuals.

More generally, we have a two-tier system where spying on New Zealanders requires a higher degree of oversight than spying on foreign governments and terrorist organisations. And it just doesn't seem appropriate that NZ-based organisations are lumped in the second category rather than the first. Not does it seem appropriate to effectively allow the Minister to authorise spying on their political opponents with no independent oversight.

Fortunately, there's an easy fix for this: add a reference to New Zealand organisations (with an appropriate definition) to s53 of the Intelligence and Security Act 2017. And if the spies or the government doesn't want to do that, well, we can draw our own conclusions about what they've been up to.

The SIS: spying on the government's political critics

The big worry about the SIS and GCSB is that they will be used to spy on the government's political critics. Whenever this worry is expressed, the spies and their Ministers say that of course that would never happen. The problem? It has:

Journalist Nicky Hager will receive $66,000 from the Security Intelligence Agency after his phone records were unlawfully spied on.

[...]

The SIS sought Hager’s phone records after the journalist published a book, Other People's Wars, in September 2011. The book contained details of New Zealand's involvement in both the Afghanistan and Iraq wars, obtained from confidential sources.

A particular Defence Force officer was suspected of being Hager's source, but sufficient evidence could not be found and the Defence Force asked the SIS to assist. It gathered metadata from the officer's home phone and cell phone, and tried to link it with two months of metadata from Hager's home phone.

This was unsuccessful, and both the SIS and the Defence Force pursued the investigation no further.

Acting Inspector-General of Intelligence and Security Madeleine Laracy later determined the SIS had no lawful power to investigate.

"I have been unable to find that the [SIS] showed the kind of caution I consider proper, for an intelligence agency in a free and democratic society, about launching any investigation into a journalist's sources," she said.

This was an outright case of the state spying on a journalists who had criticised it. And while this happened in 2011, the current SIS director, Rebecca Kitteridge, defended it to the hilt. Which shows that all their promises of "reform" are lies. They're the same bad old organisation they always were, a threat to our democracy rather than its defender. And it is long past time we disbanded them, or nobbled them so they can never threaten us again.

Interestingly, when I submitted on the Protection of Journalists’ Sources Bill arguing that it needed to be expanded to cover intelligence agencies, DPMC said that it would never be a problem because the purpose of the Intelligence and Security Act's was to "protect New Zealand as a free, open, and democratic society". It turns out they were lying, and that while they were saying this the SIS was covering up exactly the sort of spying on journalists the bill was intended to address. Which tells us that we should never believe anything the government tells us about "national security". Its just self-serving lies from spies.

A problem of oversight

Last week, RNZ had a horrifying story about MBIE hiring a firm of Israeli cyber-mercenaries for intelligence collection, including on people's religion and political beliefs. Today, they have a followup about MBIE's failure to consult the Privacy Commissioner about the spying:

The Ministry of Business, Innovation and Employment (MBIE) would not say why it did not consult over its privacy impact assessment on Cobwebs.

It also refused to say what details it was now giving the Privacy Commissioner, who last week belatedly asked for assurances the spying is lawful.

The ministry did not respond about how, during the two years in which its use of Cobwebs has been secret, people could have exercised their right under privacy law to ask what data is being gathered on them.

Which shows the problems of our current "good chap" model of oversight: what if the agency isn't a "good chap", and doesn't do what it is expected to?

But this isn't just a problem with MBIE. Both MPI and Customs have internal intelligence agencies, and there are no doubt others. And none of them have any specific oversight. Formal spy agencies are covered by the Inspector-General of Intelligence and Security; Police have the Independent Police Conduct Authority (for what that's worth). But other agencies doing intelligence work are completely unregulated, even if they are doing exactly the same things as the GCSB, SIS or police. And they are doing exactly the same things: MBIE is spying on people's communications and collecting vast quantities of personal information; Customs runs human intelligence operations to investigate smuggling; MPI does covert operations against paua poachers. And while they're all subject to Te Kawa Mataaho / Public Service Commission, the Ombudsman, and the Privacy Commissioner, none of them really have the specialist expertise required to oversee them.

This isn't good enough. These agencies are spying, so they need to be regulated like the spies. And that means strong, proactive, specialised oversight. If IGIS is unwilling to do the job - and there are reasons why "national security" oversight should not be muddled with that for law enforcement - then we need an equivalent body with equivalent powers to manage the proliferation of agency spies. Otherwise its only a matter of time before one of them blows up in another messy scandal which destroys the reputation of and public trust in the public service.

Nothing to hide, nothing to fear?

In the past there's been a few interesting data points about the New Zealand Intelligence Community's desire to covertly manipulate public opinion through media and academic mouthpieces. In 2015 the Council for Civil Liberties revealed the existence of an NZIC "Strategic Communications Group" tasked with persuading the public that spying was necessary and that the spies could be trusted. And earlier this year, a briefing on data ethics - all about the need to build "social licence" for stuff the SIS wanted to do (or was already doing) with our data - talked about the SIS being provided with the contact details of "good external thinkers" who could be used to "amplify certain messages we would like to get out". Which again sounds like covert domestic political propaganda, rather than anything acceptable in a democracy.

Today we have another data point: someone used FYI - the public OIA request site - to request emails between the SIS and various media outlets, as well as "University of Waikato Law Professor Alexander Gillespie" (who has provided pro-SIS commentary in a number of media outlets). Today, the SIS finally responded. While they released (non-OIA-related) communications with journalists (which are as boring as you would expect), they refused to release anything about Professor Gillespie, and indeed refused to confirm or deny that such communications had taken place:

In respect of your request for emails between the NZSIS and Professor Alexander Gillespie, as provided for by section 10 of the OIA, I can neither confirm nor deny whether we hold this information. To do so would be likely to prejudice the interests protected by section 6(a) of the OIA, namely the security or defence of New Zealand.

You should not infer this to mean that we have any correspondence with Professor Gillespie. While correspondence between media and our organisation holds a public interest, this is not translated to private citizens.

Which is... interesting. If this was simply a matter of privacy (as suggested by the second paragraph), they would simply withhold under that clause. But hiding behind "national security" suggests something else. As noted above, Professor Gillespie has provided pro-SIS comment in a number of media outlets (for example. Or this). In the past, I've said that where the spies are confirmed, a refusal to confirm or deny is effectively an admission of guilt, and the same applies here. The allegation of covert propaganda is so damaging to the spies that they would deny it if they possibly could. The fact that they are conspicuously refusing to do so therefore tells us something, and something that is potentially very smelly indeed. In 1999 politicians and the public were outraged to find SOE Timberlands was covertly manipulating public opinion using lobbyists and PR companies. For the SIS to be doing so would be far, far worse.

Some light in Australia

Back in 2013, a former ASIS agent blew the whistle on how the Australian government had illegally bugged the leaders of East Timor in order to listen in on their negotiating position over oil and gas rights in the Timor Sea. When the issue was raised in the International Court of Justice, the Australian government raided the homes of both the whsitleblower and East Timor's Australian lawyer, then charged them with revealing classified information. But today, at least part of that persecution has been ended, with the Australian government dropping against lawyer Bernard Collaery:

Attorney-General Mark Dreyfus has ordered the Commonwealth to drop the prosecution of lawyer Bernard Collaery, four years after he was charged with conspiring to release classified information about an alleged spying operation in East Timor

Mr Collaery was charged in 2018 for allegedly helping his client, an ex-spy known only as Witness K, to reveal details of the classified ASIS mission.

This is good, but its not enough - Collaery was persecuted for five years, essentially for representing a whistleblower. His client, "Witness K", was forced to plead guilty and convicted. They should be pardoned, and both should be compensated. The people who orchestrated that persecution need to be fired. But most importantly, Australia's "national security" laws need to be repealed to protect the public interest in leaking, so this can never happen again.

Whose law did they think they were subject to?

During the war on terror, the US ran a program of extraordinary rendition, in which alleged terrorists were kidnapped, taken to foreign countries, and tortured for information. The British government colluded in this, both directly by assisting in kidnappings, and indirectly by providing questions for their torturing proxies to ask the victims. Now, their victims are suing. The British government's "defence" has been to claim that its spies weren't subject to British law when performing their official duties. The UK Court of Appeal's response? yeah, right:

UK intelligence services who allegedly asked the CIA to put questions to a detainee who was being tortured in “black sites” were subject to the law of England and Wales and not that of the countries in which he was being held, the court of appeal has ruled.

The three appeal judges were asked to decide whether Abu Zubaydah, who was subjected to extreme mistreatment and torture at secret CIA “black sites” in six different countries, has the right to sue the UK government in England.

[...]

In [Justice] Males’s written judgment, he said: “These are strong connections connecting the tortious conduct with England and Wales. They reflect also the parties’ reasonable expectations. While it is true that the claimant himself had no connection with this country, he could reasonably have expected, if he had thought about it during the 20 years in which he has been detained, that the conduct of any country’s security services having to do with him would be governed by the law of the country concerned. As for the services, they would reasonably have expected that their conduct here would be subject to English law.”

Which is obvious the moment you think about it. For a government to claim it is not bound by its own laws is simply absurd. But apparently nothing is too absurd when the British establishment is attempting to justify and excuse torture.

The path is now open for Abu Zubaydah to sue. And hopefully he will force the British government to admit its crimes and extract compensation for them. But the spies who colluded in torture and the Ministers who authorised that collusion shouldn't just be facing a civil suit - they should be facing criminal prosecution. And if the British government refuses to prosecute its own, well, there's a court in The Hague for that.

Utterly reprehensible

Declassified Australia has published a new piece by Nicky Hager on New Zealand and Australia's spying on the Pacific. Most of it is a summary of past revelations from the Snowden leaks, but there is something new: the New Zealand navy spies during aid missions:

The surveillance includes “COMINT [communications intelligence] operators on navy ships, locked away in a two-man room just behind the bridge”. They eavesdrop on South Pacific countries during regular port calls.

The officer described how all military staff on aid, disaster relief and training deployments are also sent with “intelligence collection tasks”. They are debriefed by intelligence officers on their return “to find out what they’d learned and what we could turn into intelligence”.

“They told us it was for humanitarian aid missions. But why do we need to know how many weapons they have, and what are the routine guard patrols, and how high are the fences?” This intelligence collection activity described by the contact also includes “Tonga, Tuvalu, Niue, not the Cook Islands. Fiji – Fiji they’re always very interested in.”

This is utterly reprehensible, akin to hiding an intelligence operation under the guise of a medical facility in wartime (which would be a war crime). Its made worse by the fact that the victims are our Pacific whanau, countries who are our closest friends. And it obviously has consequences, in that governments may be less willing to accept New Zealand disaster relief if it comes at the cost of spying.

The New Zealand government needs to stop this practice immediately, and destroy all the data it has collected. Anything less is an abuse of our friendship with these countries.

The secret treaty we're not allowed to see

A few years ago someone told me about Security of Information agreements (SOIs) - treaties between governments about how they handle each others' classified information. Normally this involves promising not to disclose it to anyone or to use it for purposes other than the ones it was provided for. Which is fairly normal, but also has consequences for freedom of information, as this effectively prohibits release in a way inconsistent with the harm-based approach taken by most freedom of information regimes (including the OIA).

New Zealand is publicly a party to a few SOIs - searching New Zealand Treaties Online turns up agreements with Australia, France, Korea, Spain, and NATO. We also have one with the USA. It's mentioned in a few public treaties - the 1994 NAVSTAR treaty (article 4.1), 2010 Science and Technology Cooperation Agreement (definitions) and the 2016 Space Technology Safeguards Agreement (Article V.4). The Treaties all use different names, but the best one seems to be in the science and technology agreement, which calls it the:

Security of Information Agreement between the New Zealand Minister of Defence and the United States Secretary of Defense of September 2 1952, as amended by the Exchange of Notes between the Government of New Zealand and the Government of the United States of America concerning the safe-guarding of classified information of 1961 and the Exchange of Notes constituting an Understanding adding to the Annex of General Security Procedures contained in the Exchange of Notes November 17, 1961; of 1982.

I was interested in the terms of this agreement and in whether it might impact the OIA, so in November 2018 I asked MFAT for a copy. They refused. I complained to the Ombudsman, on the grounds that if they were going to say "the Americans won't let us", they had an obligation to at least ask them. MFAT dragged things out for a year, then made the complaint go away by promising to do actually consult, then didn't do it and refused again. I went back to the Ombudsman, who was Not Impressed with MFAT's deceit, and extracted a commitment from them to make their own assessment under the OIA, then advise the US of it and ask for comments. That was in June 2021. In December MFAT was still dragging its feet. This week, they finally replied, blaming the delay on the pandemic and saying that the US had agreed to release an unclassified summary. Which looks fairly comprehensive for the original 1952 agreement, but is entirely uninformative for the 1961 and 1982 amendments which expanded and replaced it.

Naturally this will be going back to the Ombudsman, as I have some strong arguments for release. And one of these is that despite all the secrecy, we can pretty much guess the exact wording of the 1961 agreement, because the US's equivalent agreements with Canada and the UK from that era have been made public and are essentially identical. I would expect the New Zealand-USA agreement covering the same subject from the same period and approved at the same level and in the same format to be the same, barring the names and diplomatic flourishes. As for the 1982 amendments requiring "investigative and monitoring steps" to provide confidence, the US signed an SOI with Israel in 1982 which included a clause (clause 6) requiring periodic visits to assess security. The 2002 Australia-USA SOI - released as part of its government's treaty series - also includes a "security visits" clause (12) as well as one requiring each party to provide information about security procedures on request (13). Given the closer relationship between NZ and the USA, I'd expect the NZ agreement to include both clauses from the Australian one, but the exact language is likely to be similar to that of the 1982 US-Israel SOI.

(The biggest reason for release is of course that democracies shouldn't make secret treaties, as they have no democratic legitimacy. But that's an argument for the politicians, not the Ombudsman).

Does the agreement actually undermine the OIA? The summary, publicly available equivalent agreements, and MFAT's behaviour all suggest this. But we're not actually allowed to know. Because it is a secret.

The SIS has received intelligence from torturers

One of the many horrors of America's "war on terror" is the way it has degraded human rights around the world, even in countries like ours. Quite apart from the direct crimes committed by America and its allies (Iraq, Guantanamo, the extraordinary rendition program, mass surveillance), there's also been the sight of intelligence agencies from countries with strong domestic human rights protection colluding with regimes which use torture. Dirty foreign regimes do the torture, and western agencies get the intelligence while keeping their hands "clean" (until they end up being investigated by police)

The SIS received "intelligence" the Americans had tortured out of people in the early 2000s, but that's meant to be all in the past. The post-Dotcom reforms were meant to fundamentally change our intelligence agencies and put them on a sound legal footing. The Intelligence and Security Act 2017 gave spy agencies an explicit legal duty to act in accordance with New Zealand law and international human rights obligations. A system of "ministerial policy statements" is meant to provide clear, public guidance for agencies and let the public know what they are and aren't allowed to do. For example, there is an MPS on Cooperating with overseas public authorities, and it's pretty explicit in outlawing cooperation with torturers:

GCSB and NZSIS must not request or use intelligence where they know, or assess there is a real risk the intelligence was obtained through a serious human rights breach – such as torture, or cruel, inhuman or degrading treatment.

This is backed up by an SIS/GCSB Joint Policy Statement on Human rights risk management which sets out how they're meant to assess the risk that cooperation will result in human rights abuses, and who signs off on that assessment. The policy uses five risk categories, with differing level of severity and scrutiny. So for example category 5 is where there is "negligible likelihood of any human rights breach", and can be signed off by any manager. Category 1 is where there is a "substantial likelihood of torture or similar mistreatment (mitigated or unmitigated)", and must be signed off by the Minister. "Proposed actions" by an intelligence agency - for example, providing intelligence or assistance to a foreign agency, or entering a long-term relationship with them - require a human rights approval. Receiving intelligence requires a human rights review.

When I first saw this policy on FYI, I was curious, so I asked GCSB and SIS for some basic statistics about the numbers of approvals and reviews sought and approved in each category. GCSB's response was reassuring: a lot of low-level approvals, but they clearly weren't providing information to enable people to be tortured (OTOH, the lack of reviews shows they don't think there's any human rights issue with mass-surveillance or with where their information comes from). SIS's response - extended because of the crapness and disorganisation of their internal record-keeping - showed the same pattern in approvals. On reviews, it is a different story. Since JPS-006 was approved in 2017, the SIS has sought and received Ministerial approval for two category-1 human rights risk reviews. That means they have twice received intelligence where there was "substantial likelihood of torture or similar mistreatment", in contravention of both the Ministerial Policy Statement and Aotearoa's obligations under the United Nations Convention Against Torture.

The policy was approved in late September 2017, when Chris Finlayson was Minister. A month later Andrew Little became Minister, and has held the role ever since, so its almost certainly him who signed off on this. And I think he owes us some serious answers about exactly what he signed off on, and how he manages to look at himself in the mirror every morning having done so. This also seems to warrant an immediate investigation by the Inspector-General of Intelligence and Security, and by the Ombudsman (who is our main National Preventative Mechanism under OPCAT). Because this was not what we were promised in the post-Dotcom intelligence "reforms". Instead it seems to be the same old dirty spies, up to their same old dirty tricks, and letting people be abused in our name.

The annual litany of lawlessness

The Inspector-General of Intelligence and Security has published their 2021 Annual Report, and its the usual litany of lawlessness and failure from the spy agencies. There are the usual examples of the SIS and GSCB simply failing to comply with statutory requirements and adopting self-serving legal interpretations 9whcih the IGIS disagrees with). And then there's this:

Section 220 of the ISA specifies that information obtained by or disclosed to the Service for a security clearance assessment may be used only for the purposes of that assessment, another clearance assessment, or counter-intelligence. Counter-intelligence is defined as intelligence activities carried out to identify and counteract the threat, or potential threat, of unauthorised disclosure of official information by a person who holds or has held a security clearance.

[...]

In the past year the Service was confronted with the question of whether a candidate’s disclosure of information about criminal behaviour was serious enough to be reported to the Police, despite the rule in the ISA. In a particular case the Service decided quickly in favour of sharing the information. On learning of this I was not persuaded, on the facts, that it had been necessary for the Service to report it before receiving advice from Crown Law on the scope for doing so. The Service subsequently proposed an interpretation of s 220 ISA that would allow disclosure to the Police, in the particular circumstances and more generally. I did not agree with that reading; nor, ultimately, did the Solicitor-General.

[Link added]

Or, to put it another way: the SIS knowingly and deliberately broke the law, basicly because they felt like it. As usual there are no criminal penalties for doing so, so there are no real consequences for them other than having it mentioned in an annual report. Which raises the obvious question: if they would so casually violate the clear legal prohibition of s220 (and it is a clear legal prohibition, with no room for interpretation in the direction they wanted), what does that say about their approach to other equally clear legal prohibitions in the Intelligence and security Act, or elsewhere in the law?