1 Human Rights Foundation of Aotearoa New Zealand P O Box 106 343 Auckland humanrightsfoundation@xtra.co.nz www.humanrightsfoundation.wordpress.com Submission to Intelligence and Security Committee on the Government Communications Security Bureau and Related Legislation Amendment Bill 2013 1. This submission is made on behalf of the Human Rights Foundation of Aotearoa New Zealand Inc. 2. The Human Rights Foundation is a non-governmental organisation, established in December 2001, to promote and defend human rights through research-based education and advocacy. We have made submissions on many proposed laws with human rights implications. We also monitor compliance and implementation of New Zealand’s international obligations in accordance with the requirements of the international conventions which New Zealand has signed, and have prepared parallel reports for relevant United Nations treaty bodies to be considered alongside official reports. Though the primary focus of the Foundation is on human rights in New Zealand, we recognise the universality of human rights and have an interest in human rights in the Pacific and beyond. 3. We understand that our submission may be publicly available if submissions are requested under the Official Information Act 1982. 4. We wish to be heard in support of our submission, and ask that, if possible, the Committee sit in Auckland for the purpose of hearing Auckland-based submitters. In the past, video and phone links have proved problematic and inadequate for effective discussion. 2 Introductory remarks 5. Under the bill the GCSB will be entitled, among other things, to keep under surveillance New Zealand citizens and permanent residents in certain circumstances that are not legally permitted at present. This represents yet another extension of State surveillance, something which in our view requires a compelling justification. 6. This is because surveillance is of its very nature potentially highlyintrusive of the privacy of the individual. The individual’s right to privacy is a fundamental human right recognised in the United Nations International Covenant on Civil and Political Rights 1966 (Article 17); which the NZ Government ratified in 1978. The High Court has recently held that the tort of intrusion upon seclusion is a part of NZ law (C v Holland [2012] NZHC 2155). 7. A key component of the individual’s right to privacy is the right to be free from unwanted surveillance. In its study paper, Privacy Concepts and Issues (January 2008), the NZ Law Commission concludes that ‘surveillance raises core privacy issues’ (para 8.114). The Commission highlights the risk of “surveillance creep” and how individuals adjust their ‘privacy expectations as [surveillance] technologies become ubiquitous’ (paras 6.57-8). These concerns are highly relevant to the consideration of any legislative proposal that would permit increased surveillance. 8. Surveillance of individuals affects not only their right to privacy. It also may have a chilling effect on their exercise of other fundamental rights and freedoms, for example, the rights to freedom of expression, peaceful assembly, and association. These rights and freedoms are recognised both under international human rights law (ICCPR) and in the NZ Bill of Rights Act 1990. 9. We are very concerned that this is the third time that a NZ intelligence agency, after the discovery of illegal activities by it, has had its empowering statute amended to make that particular type of activity lawful in the future. The previous two occasions involved the NZ Security 3 Intelligence Service, and led to Amendments in 1977 and 1999 to the NZ Security Intelligence Service Act 1969. New Zealanders are entitled to expect that intelligence agencies will act within the law at all times, and that when they act unlawfully, those affected to their detriment will be compensated appropriately. Comments on specific clauses in the bill Clause 4 Purpose: The 2003 Act makes it clear that the GCSB’s focus is ‘foreign’ communications. The bill removes that limitation. This is of real concern to us. Clause 5 We welcome the new definition of ‘incidentally obtained intelligence’, provided the obligations it places on the GCSB are strictly-adhered to in practice (ie, under the new s14(2)). In our submission, ensuring this occurs should be one of the priorities for both GCSB internal compliance and external oversight. The new definition of ‘information infrastructure’ appears to be allencompassing. This concerns us, especially the significance of this definition when considering the proposed changes in the bill to the GCSB’s objective and functions (clause 6). That definition is also of significance when the provisions of this bill are considered together with those in the Telecommunications (Interception Capability and Security) Bill 2013. The vastly-enlarged scope of the interception capability and security regime provided for in that bill is also of considerable concern to us. 4 Clause 6 New section 7: We note that the GCSB’s ‘objective’ is proposed to be enlarged considerably from the current focus on ‘foreign intelligence’, ‘foreign organisations’ and ‘foreign persons’. In our submission, the material made public to support this major change is less than compelling. New sections 8-8D: We are concerned that under these provisions, the GCSB’s ‘functions’ have been extended significantly. New s8A – ‘information assurance and cybersecurity’: We recognise that cybersecurity is a rapidly-increasing area of concern at all levels in our society. However, we are concerned that the GCSB will now be able to provide ‘advice and assistance to ‘any other entity authorised by the Minister’? What is meant by ‘any other entity’ in this context? Will the ‘authorisation’ be time-limited, or might it be ongoing (eg, in the case of an ‘entity’ like Fonterra)? New s8B – ‘information gathering and analysis’: As currently worded, this function appears not to be limited to ‘foreign persons and foreign organisations’ (ie, by the use of the word ‘and’, together with the fact that (b) and (c) do not include the word ‘foreign’). As a result, the GCSB may engage in domestic intelligence gathering in relation to ‘information infrastructures’; a situation in which the prohibition on the interception of the communications of NZ citizens and permanent residents (s14) apparently does not apply. We base our interpretation on the Explanatory Note to the bill where it is stated that this prohibition ‘only applies to the foreign intelligence function’ (p 4, para 5). If so, we find this of real concern. We appreciate that any GCSB activity under either sections 8A or 8B, involving the interception of the ‘communications of New Zealanders’, will require the joint authorisation of both the Minister and the Commissioner of Security Warrants (s15B). We note that the Commissioner’s role has recently been clarified by the NZ Security Intelligence Service Amendment Act 2011. 5 While the Commissioner’s formal involvement in the granting of authorisations is clearly an important safeguard, we have no way of knowing how effective it is likely to be in practice in regard to GCSB activities. New section 8B(1)(c)(ii): Given the sensitivity of the intelligence information that may be communicated by the GCSB we are concerned that it may extend to ‘any person or office holder (whether in NZ or overseas) authorised by the Minister ...’. We are also concerned that clause 6 of the bill does not prevent the GCSB from providing information known as ‘metadata’ relating to the communications of New Zealand citizens and residents. With regard to ‘intelligence gathering and analysis’ in section 8B we submit that this needs to be clarified. For example, it is not clear that 8(1)(b) and (c) also only apply to the activities of foreign persons and foreign organisations (as mentioned in 8(1)(a)). In our view, this can be clarified by restructuring the section so that (b) and (c) are clearly subordinate to (a). In its present wording, section 8B indicates that it is to be a function of the GCSB to analyse intelligence about ‘information infrastructures’ etc of New Zealand citizens and residents. This means that at least with respect to ‘metadata’, the New Zealand taxpayer is to fund a specialised intelligence gathering organisation to analyse its own citizen’s communications, even where this is not part of the analysis of the capabilities, intentions and activities of foreign persons and foreign organisations. We would have thought that transforms the GCSB into a hybrid version of the SIS. In our submission, s8B(1)(b) and (c) should not apply to New Zealand citizens and residents, and should be clarified accordingly. If it is intended that the ‘metadata’ of all New Zealand citizens and residents should be available for the scrutiny of the GCSB and that this is an objective, then this is a major breach of privacy and/or transforms the GCSB into a second internal intelligence agency. We oppose that transformation in principle. 6 New s 8C –How far does this function of ‘co-operation’ extend? It needs to be more tightly defined. What is the possible justification for including the NZ Defence Force? We note that the ‘co-operation’ function can now extend to ‘any department’ following an Order-in-Council made on the Minister’s recommendation. Theoretically any department can be added without any parliamentary scrutiny. We do not support this bypassing of parliamentary scrutiny. In our view, there should be detailed annual reporting of the number of times the GCSB ‘co-operates’ with any other agency. We are concerned that unless this is required, there is likely to be a considerable increase in GCSB assistance to other agencies, and that no-one will be accountable for it. Clause 7 New sections 9-9D: We welcome changes that hopefully will prevent a repetition of the unsatisfactory appointment process of the current director (New s9A). Clause 9 Amended section 12 (Annual report): We would be concerned if the change from ‘without delay’ to ‘as soon as practicable’ in section 12(2) was to result in the Intelligence and Security Committee being less effective in its potentially important oversight role. Clause 11 New section 13: This section makes it clear that the GCSB’s intrusive powers are now able to be utilised much more widely in relation to intercepting communications and accessing information infrastructures. As indicated earlier in our submission, we question the justification for a potentially large expansion of the Bureau’s role. 7 We welcome, however, the formal recognition in new section 13(b) of the need to place ‘restrictions and limitations’ on both the ‘interception of communications’ and ‘accessing of information infrastructures’; and on the ‘retention and use of information’ obtained as a result. It is essential that the enhanced forms of internal compliance (ie, as recommended in the Kitteridge Report); together with the enlarged forms of external oversight contained in this bill ensure that this happens in practice. Clause 12 New section 14: At the time the GCSB was belatedly placed on a statutory basis (2003), the current section 14 was regarded as critical for reassuring concerned New Zealanders that GCSB was not permitted to place them under surveillance (ie, unless they were considered to be an agent or representative of a ‘foreign person’). Under the new section 14 the ‘basic premise underpinning GCSB’s operations ...’that it is not to spy on New Zealanders unless they are considered to be an agent or representative of a foreign person, now ‘only applies to the foreign intelligence function’ (Explanatory Note, p 4, paras 4, 5). Confusion resulting from the term “permanent resident”: We submit that the term “permanent resident” in clause 12 (ie, new section 14), is likely to cause confusion. A person who is residing indefinitely in New Zealand is now under the Immigration Act 2009 first given the status of a “temporary resident”. This can, upon application two years later, provided certain criteria are met, be transformed into the status now known as that of a “permanent resident”. The definition of “permanent resident” in the 2003 GCSB Act now incorporates both a temporary resident and a permanent resident by deeming in section 4 the term “permanent resident” for the purposes of the GCSB Act to be “resident class visa under the Immigration Act 2009”. That amendment in section 4 was made in 2009 but the use of the term “permanent resident” in the text is confusing because any reader of the Act might ordinarily 8 think it does not encompass both types of residence status. Not everyone will think of looking at section 4. Because of this confusion therefore it would be preferable to, delete the words “permanent resident” and instead, given that the bill is amending section 14 anyway, to substitute the words now used in the Immigration Act 2009 to cover both temporary residence (allowed to remain indefinitely) and permanent residence (allowed to remain indefinitely no matter how long they spend out of the country). We submit that the term that should now be used is the one used in the section 4 definition of the GCSB Act 2003, that is, holder of a resident class visa (and to delete the words “a permanent resident of New Zealand”). An alternative would be to delete the word “permanent” and just use the word “resident”. The definition in section 4 can then read what the term is now understood to be: “Resident” means the holder of both types of residence class visas: temporary and permanent. Impact on legal privilege: It is not clear whether section 14(1) overrides legal professional privilege. Lawyers often represent foreign persons or foreign organisations. In the course of discharging their professional legal duties they may have communications with foreign organisations or persons as an agent or representative. The importance of the independence of the legal profession and the preservation of accessibility to legal advice, is a cornerstone of our democratic society, and of the independence of the judiciary (whose members are chosen from the legal profession).Without that independence, society becomes controlled by the executive and the legislature. The independence of the legal profession is at the heart of our notion of the separation of powers. 9 If the communications of legal advisers are affected or are at risk of being intercepted then it will have a chilling impact on the willingness of persons to obtain legal advice. Of course, we recognise that the privilege may be lost (eg, where there is any criminality). To clarify this issue, we submit that a new subsection (3) should be added to section 14: (3) For the avoidance of doubt, subsection (1) does not override legal professional privilege. Clause 14 New sections 15A and 15B As a result of the change of wording to section 14, together with new sections 15A and 15B, New Zealand citizens and permanent residents will now be able to be under GCSB surveillance (eg, the interception of their communications), in potentially a very wide range of situations not permitted at present. This represents a major change to an important safeguard in the 2003 Act, which we submit is not justified. As indicated earlier, we recognise, however, that the involvement of the Commissioner of Security Warrants in relation to the GCSB’s activities under new sections 8A and 8B may be an important safeguard (new s15B). In our submission, the Commissioner of Security Warrants should also be involved when the GCSB is exercising its new function under section 8C. The fact that the ‘other entity’ to which the GCSB is providing ‘assistance’ may be acting within its lawful functions and powers, should not mean that the Commissioner is not involved in an authorisation process of some nature, as a prerequisite for GCSB ‘assistance’. 10 Additional safeguards required when foreign intelligence agencies are involved: The legislation needs to clarify that an interception warrant is also required where the GCSB instruct other allied intelligence interception agencies in any country to intercept etc the communications of a NZ citizen or resident. For the avoidance of doubt, where the GCSB instructs an agent to collect information that would otherwise be prohibited, an interception warrant is required for the interception to occur. The legislation also needs to put in place a mechanism or policy that prohibits the onward use of information obtained by foreign intelligence/ interception agencies and provided to their New Zealand counterparts, perhaps routinely, the GCSB, where that information arises from communications to or from NZ citizens or residents, or involves the analysis of their communications, internet use etc. Summarising both: For the avoidance of doubt the GCSB should neither be the agent for receiving information intercepted by other agencies otherwise prohibited, nor should it instruct other agencies to intercept such communications without the required interception warrant. Clause 15 Section 16 amended: We support new section 16(1A)(b), as a clear statement that the GCSB’s authority to undertake ‘certain interceptions ... without interception warrant’ does not extend to the ‘private communications of a NZ citizen or permanent resident of NZ’. Clause 18 New s19: We welcome the provision for a register of interception warrants and access authorisations. New section 19A: We submit that the Commissioner of Security Warrants should part of the ‘urgent issue’ process, unless unavailable. 11 Clause 24 New section 25: Given the potentially broad scope of the new s25(1)(a),(b) justifying retention of ‘incidentally obtained intelligence’, and in particular, its communication to ‘specified’ others; we are most concerned that the GCSB will now be entitled to communicate such information to ‘any employee’ of the police; ‘any member’ of the NZ defence force; and especially ‘any other person that the Director thinks fit to receive the information’. New section 25A: We welcome the provision for a policy on personal information. This is long overdue. The formal involvement of the Privacy Commissioner in both the formulation and ongoing review of the policy is potentially an important form of external oversight. There should, however, be specific provision for the Privacy Commissioner to be permitted to conduct ‘unscheduled audits’ of how well the policy on personal information is working in practice. New section 25B: We welcome the insertion of key aspects of the Information Privacy Principles (IPPs) in the Privacy Act 1993. Amendments to the Inspector-General of Intelligence and Security Act 1996 Clause 29 We welcome the provision for the appointment of a Deputy Inspector-General. We submit that the both the Inspector-General and the Deputy InspectorGeneral should be officers of parliament (cf, the Controller and AuditorGeneral; and the Parliamentary Commissioner for the Environment): and should be appointed in accordance with the protocols and procedures pertaining to such appointments. If the ‘systems guardians’ of our public finances and of our environment are officers of parliament, why not the ‘systems guardian’ of our intelligence services? 12 Clause 31 Functions of Inspector-General: We welcome the provision for an enhanced role for the Inspector-General. The new power ‘to conduct unscheduled audits of the procedures and compliance systems’ is especially important. We assume that the recommendations contained in the Kitteridge report in relation to how the Inspector-General should operate will be implemented as a matter of urgency. Clause 32 Section 12 amended (Consultation): We support the Inspector-General’s expanded consultation entitlement (amended s12(2),(3)). Perhaps that entitlement could extend to the Health and Disability Commissioner? Clause 34 Amended section 25 (Reports in relation to inquiries): We support the obligation on the Minister contained in amended s25(6)(a). We are of the view that the same obligation should apply in relation to the Minister’s reporting to the Intelligence and Security Committee in amended s25(6)(b). That is, ‘the word ‘may’ should be replaced by ‘must’. Clause 35 New section 25A: We submit that the Inspector-General’s entitlement to publish should be broader and that the restrictions on non-publication should be more limited. Amendments to the Intelligence and Security Committee Act 1996 Clauses 37-40: The proposed changes seem very modest to us. If the observations of the Leader of the Opposition during the first reading debate on 13 the bill (8 May 2013) are indicative of how the committee has operated in recent years, then changes of a more fundamental nature are required to ensure a more effective level of parliamentary oversight. Summary of our position regarding the proposed enhancement of external oversight mechanisms: We welcome them but remained concerned whether they will make a difference. Will they individually and/or collectively be sufficient to ensure that serious compliance shortcomings highlighted in the Kitteridge report (ie, the version released publicly), do not recur? Why not use this opportunity to establish mechanisms that will be regarded internationally as ‘best practice’ for both internal compliance and external oversight of intelligence services? That is, use this opportunity for New Zealand to become a world-leader in attempting to resolve the sensitive interrelationship between security imperatives and human rights obligations (cf, the reputation NZ gained as a world leader in other aspects of human rights when the then National government enacted the Human Rights Act 1993 and the Privacy Act 1993). We are very appreciative of the opportunity to present a submission on this bill. 19 June 2013 Contact person Tim McBride timmcbride@xtra.co.nz 027-289-4127 14