Legalising lawlessness

Back in 2021, RNZ exposed the systematic police practice of coercing "voluntary" photographs from young Māori on the street, leading to a joint IPCA / Privacy Commission report exposing illegality, systematic racism, and widespread ignorance among police officers of the limits on their behaviour, and a formal compliance notice to force them to stop and delete it all (something they still haven't done). This was followed earlier this year with the Supreme Court's ruling in Tamiefuna v R, which upheld the ruling of the Court of Appeal that the police photographing people in public places is a "search" in terms of the BORA (meaning any interference with a reasonable expectation of privacy), and was both unlawful and unreasonable. The police immediately started whining about how it would be impossible for them to do their jobs if they had to actually obey the law, and so predictably the regime ahs announced that they will legalise their lawless behaviour:

Police Minister Mark Mitchell said on Thursday police had been left uncertain about taking people's photos and recording their images in public places.

"Recent court decisions have created uncertainty around police's ability to record images in public places for lawful purposes," he said.

"The proposed amendments will reaffirm the prior common law position, making it clear that police can collect and use images in public spaces, and in places where police are lawfully present, for all lawful policing purposes.

"This includes intelligence gathering and crime prevention and other policing functions and associated activities."

They weren't "uncertain". It was crystal fucking clear that they could not, unless they had a warrant. As the Court of Appeal noted, "there is a reasonable expectation that a person’s photograph will not be deliberately taken and retained for identification purposes by police without a good law enforcement reason", and that seems entirely appropriate. But the police want to be able to spy on us without any restrictions whatsoever, and database us for life, in the absence of any criminal suspicion whatsoever. And that is the attitude of a fascist surveillance state, not the police force of a democratic state which respects privacy and human rights.

Oh, also, the police will be given more powers to "temporarily close areas in response to antisocial behaviour or public safety risks" - which means a blank cheque to shut down protests. So more anti-democratic moves from the regime.

The good news is that "[l]egislation will now be drafted, and the changes will go through a legislative process in due course." Hopefully that process will take as long as possible, so it can be shitcanned by the next government. The regime's cuts to the overworked justice portflio won't help here, and I'd hope that public servants who care about human rights will ensure that it is fully and thoroughly and repeatedly reviewed for BORA compliance. After all, we wouldn't want the regime to get another embarrassing declaration of inconsistency, would we?

Custodes se ipsos non custodient

We give our police significant powers in order to (supposedly) protect the public. But these powers are meant to come with oversight to prevent abuse, either from the judiciary (when issuing warrants), or from parliament and the public (due to annual reporting on their use).

Now capitalism has given them the ability to sidestep that oversight through contracts with private surveillance companies like Auror. And there's significant evidence that police are abusing that capability, and violating their own restrictions on their use. So are the police actually checking? Of course not!

The police say they have not been looking into deliberate misuse of vehicle-spotting cameras by officers despite reports suggesting there had been some, perhaps even tracking, that broke the rules.

Police use of privately-owned automatic number plate recognition (ANPR) systems jumped almost 50 percent in the year to mid-2024, to over 500,000 times.

Over 8000 officers can access the two systems, which when they enter a number plate can return up to 60 days of footage of the vehicle caught on ANPR cameras.

Newly released internal reports showed "significant" use by staff indicating they were putting the same number plate in again and again.

"This may circumvent the platform's normal controls for the use of ANPR in a tracking context," Police's chief assurance officer Mike Webb warned a camera technology assurance committee meeting last November.

Its almost as if they're deliberately looking the other way, to allow circumvention and abuse by their own.

Its a perfect example of why we need greater controls on private surveillance, and the ability of government agencies to access it. Because the police being able to track people in real time and uncover every aspect of your personal life is a very different thing from an advertiser doing it. The latter can only try and sell you shit; the former can assault, arrest, imprison, or even kill you. The best move would be to outlaw such invasive private surveillance, but if we are not going to do that, we should absolutely forbid its use by state agencies without a warrant, a criminalise the "leaking" of data to them. As the above shows, our watchmen aren't going to watch themselves. So its time we did it for them.

The police are out of control

On Friday, RNZ carried a story about the police use of Auror, a private surveillance network. Police use it to track people and vehicles using ANPR, washing their hands of any legal restrictions or privacy obligations because the actual surveillance is being done by a private company. That's bad enough, but it gets worse: in at least one high-profile case, when police couldn't meet even Auror's lax standards to obtain information, they simply created false crime reports in order to get it:

Police falsely reported cars as stolen to gain access to powerful databases that record number plates when hunting for the women whose travel sparked the Northland Covid-19 lockdown last October.

Detectives identified the cars associated with the women then listed the vehicles as stolen which opened access to Automatic Number Plate Recognition systems operated by two private-sector companies with a massive network of CCTV cameras.

[...]

A spokesperson for Police National Headquarters said it was not known whether officers had falsely reported cars as stolen on other occasions so as to access the powerful network of cameras.

The government says they are "concerned", and so they ought to be. Because this smacks of a deep culture in the police of ignoring legal safeguards and telling whatever lies are required to get their man (or woman). We saw that culture on display when they falsely told Martyn Bradbury's bank that he had committed computer fraud in order to access his bank records. Most infamously, we saw it during the stitch-up of Arthur Allen Thomas, when the police simply planted evidence to secure a conviction. And like that latter example, this case was a serious crime. That fake police report was a false document. Merely making it with the intention that it be acted upon as genuine is forgery, punishable by up to three years imprisonment. Actually using it and causing someone to act upon it as if it were genuine is using forged documents, punishable by ten years imprisonment (other offences might also apply if the surveillance data obtained is viewed as a "property, privilege, service [or] benefit"). This is serious criminal behaviour, which is completely unacceptable from the police. But I expect the police will simply refuse to prosecute their own, even if the IPCA recommends it, and corruptly abuse their power to prevent one of the gang from being held to account.

As for Auror, using it to search for someone using ANPR is fairly clearly a "search" in the current legal understanding of the term (in that it clearly interferes with the reasonable expectation of privacy). And its worth noting that the GCSB requires an individualised warrant to search NSA databases for information about New Zealanders. The same rule should apply to police to search systems like Auror. And if that fucks Auror's business model, well, that's too bad. Circumventing warrant requirements should not be allowed to be sold as a service, and is not the sort of "disruption" and "disintermediation" that our society should tolerate.

The police are identity thieves

RNZ this morning had another shocking story of police abusing their power to invade privacy and engage in online identity theft:

Police are trying to assume the online identities of suspects and defendants by taking over their social media and email accounts to gather information.

Defence lawyers concerned about their young and vulnerable clients alerted RNZ to a form the police are using, titled 'Consent to Assume Online Internet Identity'.

The form asks people to sign away their social media and email accounts, allowing the police to "take control of and use my internet online identities".

Those signing the document are asked to provide the passwords so that police can access the accounts and use the information stored on them.

[...]

Those signing the form "relinquish all present and future claims to the use of these accounts" and are told police will change their passwords so they no longer have access.

As with the police's acquisition of private personal information from banks, there's no statutory basis for this. And while they're claiming it is by "consent", the fact that they are focusing on young and vulnerable people to trawl and database their contacts and communications and impersonate them to their friends tells you everything you need to know. We saw exactly these tactics from police when they forced young people to "consent" to having their DNA taken, or to be photographed children for their racist databases, and the "consent" is about as meaningful here as it was then. Given the inherent imbalance of power with someone who can simply stick you in a cell, there can be no legal consent where police are involved unless you have a lawyer present.

I'll be filing an OIA to find out how widespread this tactic is, but I expect that, as with production orders, they conveniently won't know. Because if you don't want something managed, the best way is not to measure it.

Spy cameras literally are

The Inspector-General of Intelligence and Security (IGIS) has released a report today on the SIS's use of closed circuit television. The report beings with the scary revelation that those spy cameras in our cities are literally just that:

As part of this review, I examined a particular example of the Service’s access to a CCTV network (the CCTV network) which has been provided to the Service by the network’s operator (the CCTV network provider). These cameras cover most of a New Zealand city centre. The Service has round-the-clock access to the CCTV network, which is accessed from a secure room within the Service’s premises.

It is unclear if this is the only system the SIS has access to, or whether it is one of many. As for how it obtained access, it was apparently under an MOU with the network's operator. This "agreement" (if there can ever be a valid agreement with a spy agency, given the power imbalances involved) was of course classified, the owner of the system was not allowed to retain a copy, and only three people there even knew about it. Which, given that the operator is almost certainly a local authority (and lets be honest, its almost certainly the Wellington City Council, based on where the spies are and who has cameras), this raises obvious questions of democratic legitimacy and consent. These are of course not considered by IGIS. But the IGIS does raise serious questions about the SIS's legal basis for access, and recommend they seek the advice of Crown Law on it.

There's other problems. The SIS's policy for use of the system is deficient, and downright wrong on expectations of privacy in public spaces (the "reasonable expectation of privacy" standard means that actually following someone's movements on camera for any prolonged period is a search, as is the use of zoom lenses. A search without a warrant or other legal authority is prima facie unreasonable, and a violation of the BORA right to be free from unreasonable search and seizure). Naturally, they never did a privacy impact assessment. And as usual, their record-keeping is a bit shit. The IGIS recommends that all of these problems be corrected. But despite all of that, they conclude that the SIS's use of this system is lawful, responsible, and proper.

But that's not good enough. When local authorities started putting cameras everywhere to manage traffic and ensure "public safety", they never suggested that they would be used by the SIS to spy on people. And if they had, I suspect public attitudes to these cameras would be very different. Its time for our local authorities (and other bodies such as NZTA) to come clean, and confess whether they allow the SIS to access their camera networks in this way. That would allow the people to judge whether it is acceptable, and hold them accountable if they feel it necessary. But I suspect that that prospect is precisely why the SIS has kept this secret for so long.

If police think this is lawful and ethical, why did they try to hide it?

RNZ has a major scoop this morning: the New Zealand Police are trying to set up a live facial recognition system:

Police have been quietly setting up a $9 million facial recognition system that can take a live feed from CCTV cameras and identify people from it.

This would push New Zealand into new territory for tracking citizens.

It will be run by a non-police contractor - US firm Dataworks Plus - and collect 15,000 facial images a year, with that expected to expand up to 10-fold.

[...]

Both said they did not tell the public as these are mere upgrades, and neither did a Privacy Impact Assessment - though Internal Affairs told the Privacy Commissioner about NeoFace, while the police did not.

That last bit is a giant red flag. The Privacy Commisisoner has said explicitly that any use of facial recognition needs a high level of scrutiny, which for a government agency, effectively means their approval. Police deliberately avoided doing that. From the article, they also explicitly lied in earlier OIA responses, saying that the system was only about analysing static images in their database, while redacting information showing that it was intended to work with live video feeds. Why did they do this? The natural conclusion is that despite all their claims to be lawful and ethical, they know that this project is not. So instead they spent $9 million of public money on it, in secret, while lying to us about what they were doing. And that shows us that we have an unethical agency, completely out of control, which has complete contempt for the people it is supposed to serve.

Unmentioned in the article: this sort of use of facial recognition has recently been ruled unlawful in the UK, precisely because the police force using it ignored their privacy obligations and their obligations to not discriminate on the basis of race. And on this point, the New Zealand Police appear to be making exactly the same mistake:

The tender that Dataworks won for police here, does not mention "Māori" or "public" or "privacy" - in relation to specific safeguards on the public's privacy - a single time in scores of pages.

Which I guess is the usual level of care the police show for their legal obligations. As far as they're concerned, laws apply to other people, not to them.

Against facial recognition

Yesterday, we learned that Auckland Transport wanted to turn Auckland into a surveillance state, with an extra 8,000 cameras equipped with facial recognition technology. Today, we learned that the police want to use those cameras:

The new cameras are capable of facial recognition but Auckland Transport (AT) said this function was not used.

However, police are interested in it.

"Police does not currently have the ability to run facial recognition off live CCTV cameras," a police spokesperson said in a statement.

"However, we would always be open to using new and developing technologies in the future, balanced against relevant legislation."

Or, to put it another way: they're open to engaging in mass-surveillance and spying on innocent members of the public going about their daily business, in the hope of catching a few criminals. Except that its a forlorn hope, because facial recognition has false positive rates between 81% and 96%. Meaning that if they try and make an arrest based on a "match", they'll be harassing an innocent person four times out of five, or 24 times out of 25. Which may work fine in a police state like China, but imagine what it does to the police's social licence in New Zealand.

Using facial recognition cameras is mass surveillance. Instead of encouraging Auckland Transport, we should be outlawing this intrusive technology and the tracking it enables and entails.

Why you can't trust American companies

Why can't you trust American companies? Because they'll gleefully everyone's email for the NSA:

Yahoo Inc last year secretly built a custom software program to search all of its customers' incoming emails for specific information provided by U.S. intelligence officials, according to people familiar with the matter.

The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said three former employees and a fourth person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to an intelligence agency's request by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.

This goes well beyond warrants for particular accounts, and into being a tool of the US surveillance state. Its not acceptable, and it treats its customers with contempt.

Meanwhile, if you're an Xtra customer, your privacy might also have been invaded, thanks to Xtra's decision to outsource its email to Yahoo:

Spark is checking with partner Yahoo whether Spark's New Zealand customers may have had their emails snooped on by United States security agencies.

[...]

Spark outsourced about 500,000 Xtra email accounts to Yahoo in 2007 but it is not clear whether they were among the accounts scanned on behalf of US security services.

Hopefully the Privacy Commissioner is looking into this as well. But its a perfect example of the dangers of outsourcing, and the lesson is clear: don't trust America, and don't outsource to American companies.

Meanwhile, my blog email is held with Yahoo - though as its .co.uk I'd already assumed it was being read by GCHQ anyway (because they read everything going into or out of the UK). If you want to actually communicate with me securely, then you can either use my PGP key, or alternatively you can contact me using ProtonMail.

Unaccountable surveillance at WINZ

Speaking of surveillance: last month we learned that WINZ was monitoring beneficiaries' social media in an effort to detect fraud. Its intrusive, invasive snooping, akin to stalking someone in public and peeking through their windows. So what are the rules around this, and how often does it happen? Someone used FYI, the public OIA request system, to ask. The response? Of course not:

The Ministry does not have a formal policy to monitor social media. Your request is refused under section 18(e) of the Official Information Act as this information does not exist.

[...]

The Ministry does not record and report instances where an individual's activity on their social media accounts, blogs or online presence is monitored or checked. As such this part of your request as well as the cost of social media monitoring is refused under section 18(e) of the Official information Act as this information does not exist.

We've seen this attitude before: the police routinely demand highly intrusive information, including social media and text messages, emails, and long-term tracking information - using production orders. And yet they don't bother even to count how often they do it.

Government surveillance needs to be lawful, proportionate and justifiable. And if any government body uses it, they should be required to have a formal policy on its use so that legality and proportionality can be assessed, and track how often it is used, so that we can see if it is over-used. Refusal to do immediately suggests over-use, and a lax attitude towards the public's right to be free of unreasonable search and seizure.

Unlawful surveillance in Christchurch

At the moment, the government is conspiring to extend the GCSB's powers to allow domestic mass-surveillance of all our internet and phone communications. But its not just the spies wanting to snoop on everything. Down in Christchurch, they're spying on people for dog control:

A Christchurch couple were shocked to discover the city council was spying on their dogs using a listening device covertly placed in their garden.

The move has astounded Jenny and Tim Bennett and a human rights lawyer, who said the couple's right to privacy has been breached.

The Christchurch City Council admitted on Tuesday it used the devices and normally sought permission before installing them.

That did not happen in the Bennetts' case.

In legal terms, this is an "interception device" as it is capable of recording private communications, and therefore a "surveillance device". Installing such a device without consent is clearly unlawful. Use of a surveillance device that involves trespass to land requires a surveillance device warrant. Such a warrant can only be issued for an interception device for serious crimes: serious drug or arms offences or crimes carrying a penalty of more than seven years imprisonment. There is no capacity in the Dog Control Act 1996 for the the use of such devices, for obvious reasons: its almost entirely infringement offences. The two imprisonable offences in the Act (mistreating a dog, or owning a dog which causes serious injury) do not remotely reach that threshold.

Unfortunately, its not a criminal offence - that requires both the actual interception of a private communication, and the intent to do so - so the moron in dog control who thought it was a good idea to put a surveillance device in someone's garden without permission and without a warrant will not be going to jail. But its clearly a violation of the right to be free of unreasonable search and seizure, and possibly of the Privacy Act as well. The Bennetts can take the Christchurch City Council to court, and they should - because the only way councils will learn not to pull this shit is if they are sued into the ground whenever they do it.

Meanwhile, it raises the obvious question: what other councils are doing this? What policies and procedures do they have governing this surveillance? And have any others violated the Search and Surveillance Act by engaging in illegal trespass surveillance? Fortunately, we should be able to get some answers using the OIA.

It also raises the question of what other surveillance they are engaging in. In the UK, local councils engage in widespread and intrusive surveillance over petty infringement offences and bylaw breaches. I'd hate to see a culture of that developing in New Zealand.

Are the police spying on our democracy?

The TPP was signed today in Auckland, surrounded by massive protests. I've been watching it over Twitter, and there have been several reports from those protests of the police filming and photographing protesters. While there's obvious merit in filing or photographing people for evidential purposes if they are committing a criminal offence, there police seem to be doing far more than that. Which raises obvious questions about what will happen to those photographs, and about what they are using them for.

Someone has already used FYI, the public OIA request site, to ask some of those questions, but I doubt we'll get real answers. But the obvious suspicion is that they're doing this for intelligence purposes, because they regard all protesters as dangerous, seditious criminals who need to be tracked and monitored (and, occasionally, intimidated).

We've seen this attitude before, in the UK. Police there conducted extensive surveillance of peaceful protesters, databasing them in an intelligence system for years and tracking their names, political affiliations and photographs - and all just for attending a peaceful protest. Our police may be doing the same thing.

In a free and democratic country, police have no business gathering or holding information on anyone not suspected of a criminal offence. And they certainly have no business photographing and potentially databasing people simply for exercising their legally affirmed right to protest. The police owe us some serious answers about what they're doing - and if they won't provide those answers, or if they are insufficient, Parliament should legislate to prevent them from abusing our democratic rights.

GCHQ spies on the UK's devolved assemblies

UK MPs are currently challenging GCHQ mass-surveillance in the Investigatory Powers Tribunal, on the basis that it violates the Wilson doctrine which outlaws spying on MPs. While the case is still being argued, we've already learned something important: GCHQ has recently decided for itself that it is allowed to spy on Members of the Scottish Parliament and other devolved assemblies:

David Cameron is under pressure to justify a secret decision by spy chiefs at GCHQ that authorises eavesdropping on politicians from the devolved legislatures in Scotland, Wales and Northern Ireland.

Nicola Sturgeon, the Scottish first minister, and other Scottish, Welsh and Northern Irish politicians on Friday urged the prime minister to protect the privacy of parliamentarians from the three nations, after it emerged that GCHQ had introduced new internal guidelines to allow the monitoring of communications by members of the legislatures, even though those rules bar the agency from monitoring MPs at Westminster.

In a letter to Cameron, Sturgeon said she accepted spying on MSPs could take place but only in “truly exceptional circumstances involving national security”. In the vast majority of cases “the confidentiality of communications between parliamentarians and their constituents is of the utmost importance”, she told the prime minister.

[...]

Sturgeon said there was no justification for treating MSPs any differently from MPs. She also asked the prime minister to confirm or deny that MSPs had ever been spied on by British agencies. She asked him: “Will you give an assurance that, with respect to the Wilson doctrine, MSPs will in future be treated equally to MPs by all of the intelligence agencies?”

Spying on MPs is an attack on democracy which inhibits their ability to represent their constituents and raises real questions about democratic control and oversight of spy agencies. The potential for such spying to be abused is obvious, and its simply not acceptable for an intelligence agency to do it without serious justification. Its certainly not acceptable for them to decide to do it themselves. That sort of decision is one for elected Ministers, not unelected bureaucrats. But if the English government has decided that its fine to spy on the representatives of the Scottish and Welsh people - effectively that Scotland and Wales are hostile foreign powers - then I suspect the Scottish people at least will want to have a vote on that to make it official.

Rubberstamping surveillance

A couple of stories from overseas about what a poor job the courts are doing of overseeing surveillance. First, from the UK, where 93% of police requests to access phone and email records are granted, and police submit a request for such data every two minutes. Then, in Australia, where a refusal rate in New South Wales of less than 2% has led to the courts being labelled as a "rubberstamp". So what are the equivalent stats for New Zealand? The police are required to publish information about their use of interception warrants under the Search and Surveillance Act (and before that under equivalent provisions in the Crimes and Misuse of Drugs Acts). I've compiled those statutory declarations from their annual reports, and they're pretty horrifying. The headline statistic: in 15 years of data, the New Zealand courts have never refused an application for an interception warrant, they have never refused an application for a tracking warrant, and they have never refused an application for call data. In that 15 years, there is only one actual refusal: an application for an emergency permit in 2009. That's one refusal in 3217 uses, a rejection rate of 0.03 percent.

If 2 percent is a "rubberstamp", I'd hate to think what our courts must be.

The statistics also show that there has been an explosion of warrantless "emergency" searches under the Search and Surveillance Act. The reason for this is simple: previously, emergency searches still required the consent of a judge, while under the Search and Surveillance Act, they don't. The result is predictable: police tapping phones without bothering to ask first. Most of these "emergency" searches last the maximum 48 hours, and there's no reporting on how justified they are or on how many of them are subsequently turned into normal warrants. Which doesn't bode well for the SIS's use of such powers.

Finally, an interesting point: up until 2012, the police were apparently perfectly capable of recording how many applications for call data information they made. Now they can't. Which just makes it seem even more like a self-serving failure to record.

The full NZ police surveillance dataset is here.

Urgent?

Last year, National rammed through a new anti-terror law giving the SIS new warrantless surveillance powers. We were told this was urgent - so urgent that a select committee could only be given a week to look at it, which wasn't enough time to read the submissions. But was it really?

If the law was that urgent, you'd expect those powers to be used immediately. But it turns out they weren't. Yesterday the SIS released their first statutory report on the use of warrantless surveillance, and it speaks for itself:

The ability to issue a section 4ID authorisation came into effect on 12 December 2014.

During the period 12 – 31 December 2014, no authorisations were issued under section 4ID of the NZSIS Act.

So much for the case for urgency.

(See also: Peter Dunne's refusal to say how many times the new passport revocation powers, granted under urgency, have been used. That also speaks for itself. The urgency over the spy bill wasn't because the changes were urgently needed, but because the government wanted to limit debate).

NZ police violated legal privilege

There's a case going through the Supreme Court at the moment where the New Zealand police bugged an accused's conversations with their lawyer in an effort to gain an advantage during prosecution:

A convicted drug baron says police illegally intercepted phone calls he had with his lawyer, giving prosecutors unfair insights into his case.

[...]

The Supreme Court was told today that Beckham was locked up after some 220 hours of phone calls were tapped. His car and cellphone were bugged and he was arrested in December 2008.

He was a high-value target and police spoke publicly of their relief at Beckham being taken "out of circulation" when he was jailed.

Beckham's lawyer Simon Mount told the Supreme Court that phone calls Beckham made to his then-lawyer Murray Gibson were intercepted, giving police insights into discussions that were legally privileged.

Mr Mount said it was "extraordinary" for senior police to authorise or tolerate surveillance of conversations that gave the prosecution a heads-up on the defence strategy.

"We've got material that is clearly subject to litigation privilege."

Some of the interceptions were done by Corrections when Beckham was being held on remand. It is illegal for Corrections to monitor conversations with lawyers, and staff should have ceased recording and destroyed all records the moment they realised the conversation was privileged. While it wasn't illegal at the time for police to violate privilege in this way (it is now), its unquestionably a violation of the right to a fair trial. To point out the obvious, an adversarial justice system simply does not work if one side can bug the other and know their strategy, strengths and weaknesses in advance.

As for the remedy, the police won't learn to obey the law if they're allowed to convict people on the basis of illegally gathered evidence or by violating their fair trial rights. The court should throw out the conviction, and make it clear that it is the police's fault. If the police don't want the guilty to go free, they need to actually obey the law.

GCHQ's mass-surveillance was illegal

Over the wekeend, the UK Investigatory Powers Tribunal dropped a bombshell, ruling that GCHQ's NSA-assisted mass-surveillance programmes had been illegal:

The regime that governs the sharing between Britain and the US of electronic communications intercepted in bulk was unlawful until last year, a secretive UK tribunal has ruled.

The Investigatory Powers Tribunal (IPT) declared on Friday that regulations covering access by Britain’s GCHQ to emails and phone records intercepted by the US National Security Agency (NSA) breached human rights law.

Advocacy groups said the decision raised questions about the legality of intelligence-sharing operations between the UK and the US. The ruling appears to suggest that aspects of the operations were illegal for at least seven years – between 2007, when the Prism intercept programme was introduced, and 2014.

The reason that they're legal now is that this lawsuit forced GCHQ to "disclose" (create) some "safeguards" which supposedly protect UK citizens from having their private communications randomly snooped through. Except that because its all done in secret, we'll never know if those safeguards are actually being followed, or if they've just told the Tribunal what it wanted to hear and kept on doing exactly what they were always doing.

Meanwhile, this raises an obvious question: what would a new Zealand court make of the GCSB's activities/ Sadly, secrecy and state-secrets privilege mean that we'll never know.

The NSA pwns Vodafone

Overnight, The Intercept spilled the beans on AURORAGOLD, the NSA's programme to hack the world's cellphone providers. They spy on cellphone operators to gain knowledge of network architecture and vulnerabilities, and deliberately introduce vulnerabilities into new technology (something which exposes us to hacking not just by them, but by everybody else as well). The article included a classified map (from here, p. 24), which showed their degree of penetration. The interesting bit? New Zealand was on it:



That "43%" is the level of network coverage - basically, what proportion of the total NZ cellphone market they've compromised. The data dates from 2012. So who had about 43% network coverage in 2012? Vodafone:

The Commerce Commission Telecommunications Monitoring Report 2012 showed that our market share by connections was 42% as at 30 June 2012.

And the NSA - our "allies" - pwns them. We're basically the target of a programme of cyberwarfare by the United States, our supposed "allies".

Which raises an obvious question: why isn't the GCSB protecting us from this? It is, after all, their job. They should be helping to secure Vodafone's network, not collaborating with the foreign hackers who want to exploit it.

That map also reveals an interesting fact: the NSA has compromised cellphone networks within all of its Five Eyes partners except Canada - and we are the most compromised of all. Which raises another question: if membership of Five Eyes doesn't protect us from this, why are we a member?

Councils and CCTV

Over the past decades, local authorities have put up hundreds, possibly thousands, of CCTV cameras as part of traffic management and community safety programmes. What gets watched and who has access to the footage varies by council. The result? City council cameras staring into people's homes and bedrooms, with the footage available to any plod who wants it:

The privacy commissioner is to question all councils on how they collect and store CCTV footage, after it was discovered that cameras in Lower Hutt had been able to film inside private homes for years.

Live and recorded footage from Hutt City Council's 29 cameras near the city centre could be viewed by anyone in the Lower Hutt police station, without a secure log-on. About half a dozen of the cameras could be swivelled remotely towards houses.

An audit by Security Risk Management, commissioned by the council, found: "There was an absence of privacy masking, enabling some street surveillance cameras to undertake surveillance inside private homes."

The surveillance risked flouting five principles of the Privacy Act and the Bill of Rights, according to the report.

The council says that no breach occurred, because there's no evidence. But where people's privacy is concerned, that's not good enough, and so they've been forced to install privacy masking, access limits, and warning signs in areas under surveillance. More importantly, the Privacy Commissioner is also investigating every local authority in New Zealand, to see whether they being used in accordance with the Privacy Act. Hopefully it won't turn up any more disasters like this.

Just the beginning

The Key/Kitteridge Countering Terrorist Fighters Legislation Bill isn't even law yet, and the SIS are already planning their next power grab:

The Prime Minister has signalled the Government will look to introduce much tougher security laws after a review next year.

John Key said the Countering Terrorist Fighters Bill, due to be reported back to Parliament today, was just the beginning.

He said a full review of security settings would consider broader changes to intelligence-gathering and counter-terrorism.

Mr Key said it would potentially look much further than the current legislation before Parliament.

You got that? 4824-hour warrantless surveillance and the spies being able to stick cameras in people's bedrooms to gather "intelligence" are "just the beginning".

This is why it is so important for Labour to oppose the bill: to make clear public disquiet and strip Key of his self-proclaimed "moral mandate" for more spying. Instead, they're collaborating in it. And this is why they're useless as an opposition, and will be more useless as a government.

I will not vote for a party which supports spying. Neither should you.

A fatal flaw in the SIS's argument

What's the argument for the SIS's new video surveillance and urgent warrantless search powers? They won't say, but from the comments of the committee, its clear that they've been told in their secret briefing that the powers are to stop terrorism. One of the National MPs (I think it was committee chair Mark Mitchell?) was explicit, asking a submitter about the prospect of a Woolwich-style attack, "a New Zealand serviceman walking along the street, being cut up with meat-cleavers and machetes" (paraphrased). Clearly, they expect the new powers to be used to directly prevent such attacks, with the SIS using urgent warrants and video surveillance to gather the required evidence to prevent it.

But there's a problem: legally, the SIS cannot act to prevent such an attack. The SIS's core function (as laid out in its governing Act) is "obtain, correlate, and evaluate intelligence relevant to security". However, that Act also says that

It is not a function of the Security Intelligence Service to enforce measures for security.

What's "enforc[ing] measures for security"? An IGIS report from earlier this year gives an example. The SIS had delivered a "warning" to a man they (incorrectly) believed was conspiring to assassinate a foreign head of government. The Inspector-General found that this contravened the Act and ordered the SIS to cease the practice until they had received advice from Crown Law on its legality.

And this makes sense. The SIS are not the police. They are there to gather intelligence, while the police are there to protect public safety and prosecute criminals. "Measures to enforce security" - disruping terrorist attacks, arresting spies - fall into the latter category, not the former.

So what should the SIS do if they gain intelligence suggesting a terrorist attack in New Zealand? Turn it over to the police. Section 4H of the SIS Act allows them to provide the police with information on "serious crime" (anything punishable by two years imprisonment, so burglaries and minor assaults apparently qualify), and the police have urgent search powers of their own they can then use. The police can gain all the information the SIS would hope to gain, except with legal oversight and full admissibility in court, allowing would-be terrorists to be prosecuted.

In short: the SIS does not need these powers, and cannot use them for the purpose they're selling them as being useful for. And if they have actually told the committee that they're for stopping terror attacks (rather than, say, gaining blackmail on people they wish to turn into informants), then they've lied to the Committee and need to be prosecuted for breaching Parliamentary Privilege.

(Yes, I have sent in a supplementary submission about this; I didn't realise it until halfway through the hearings)