Gehan Gunasekara: Danger of 'mission creep' in new GCSB powers

John Key during his media grilling over the appointment of GCSB head Ian Fletcher. Photo / Mark Mitchell

Opinion

With backing from NZ First it now appears likely the Government will be able to enact the bill extending the powers of the GCSB to spy on New Zealanders if requested to do so by agencies such as the police and the SIS.

The extension was prompted by revelations brought to light during the Kim Dotcom case and subsequent inquiry that such unauthorised spying had been undertaken by the GCSB in the past.

Arguments in favour of legitimising such future "agency" requests - that is on New Zealanders at the request of domestic agencies such as the police - appear, on the surface, eminently reasonable. The spying will only take place where the requesting agency has followed proper legal procedures such as obtaining judicial warrants. In the case of the SIS, however, warrants are issued by the Commissioner of Security Warrants and Prime Minister jointly.

The powers will, it is contended, strengthen the abilities of these local agencies as they will be able to draw on the GCSB's formidable international connections and technical abilities.

And here is the rub. It is precisely these overseas links and the potential sharing of information with them that unsettle privacy advocates.

Essentially, the move amounts to outsourcing intelligence-gathering not only to the GCSB but to the foreign powers with whom it interacts. These connections, through such communications interception networks as Echelon, have been fairly well documented.

Information privacy lawyers stress the importance of the information life cycle: this encompasses the manner of collection, storage, access to, use and disclosure as well as disposal of personal information. The safeguards needed must apply to every stage of this process, not just the collection part alone.

Applying this rationale, what safeguards exist as to who the information about New Zealanders will be shared with, how long it will be held and for what purposes? Will individuals be able to access their file where no charges eventuate?

A commonly-invoked argument is that those with nothing to hide have nothing to fear. Privacy advocates, on the other hand, point to weaknesses in this line of reasoning, including the ability of computerised systems to aggregate and analyse data, vulnerabilities that result for individuals (include loss of data and identity theft) and the increased power over individuals that access to information gives agencies. Blackmail is one such danger.

A famous example is the surveillance conducted by the FBI on American civil rights leader Martin Luther King Jnr to ascertain whether he had communist links. No connection was discovered but the surveillance revealed marital infidelities. The information was used to blackmail the civil rights leader, in a move to silence or intimidate him.

From the practical standpoint, giving agencies such as the police access to GCSB capabilities would extend their abilities to spy throughout the globe. Undoubtedly, overseas agencies are able to spy on New Zealanders within their jurisdictions. The ability of the police and other organisations to operate extra-territorially is a whole new ball game. Would most Kiwis be comfortable with all their communications being potentially subject to surveillance from home even when they are overseas?

Finally, there is the danger of "mission-creep". Once selected agencies are empowered to tap into the GCSB network, why not others? How about the Immigration Service (to ferret out scams to bring illegal workers into the country) and the Inland Revenue (after all tax evasion is an international business).

A further tendency is that technologies employed for one purpose end up being used for entirely different ones. Data mining and information matching is one such instance. Safeguards in the new bill need to factor in such concerns.

Gehan Gunasekara is an associate professor in commercial law at the University of Auckland Business School, specialising in information privacy law.

Dialogue: Contributions are welcome and should be 600-800 words. Send your submission to dialogue@nzherald.co.nz. Text may be edited and used in digital formats as well as on paper.