The GCSB has been found to have acted unlawfully when it spied on foreigners in the FBI-led Megaupload investigation.
In doing so, it has raised the possibility the entire operation was illegal.
The new finding comes out of the High Court damages case taken against the GCSB by the Megaupload-accused and has seen the bureau refuse to put up a defence to claims its surveillance of two foreigners was unlawful.
The finding is significant because it was always assumed Megaupload-accused Finn Batato and Mathias Ortmann were valid surveillance targets because they were not New Zealand citizens or residents.
Batato and Ortmann were among those targeted by the GCSB ahead of the January 2012 raid on Kim Dotcom's mansion and part of a damages claim taken against the spy agency.
The GCSB was drawn into the police assistance for the FBI operation against Megaupload a month before the raid to provide intelligence for the police who were tasked with arresting those involved in the filesharing website.
When the GCSB's role was discovered, it led to admissions it had broken its own law because the spying included Dotcom and Bram van der Kolk who were both New Zealand residents at the time.
The admission led to an intensive review of the GCSB and a finding it didn't understand its own law. The GCSB was found to have unlawfully spied on 88 people, resulting in a change in the law under which it operated and an overhaul of the entire agency.
The damages claim against the GCSB over its surveillance pushed the bureau to prove its surveillance of Batato and Ortmann matched up with its duty to the law.
But it collapsed, its defence claiming explaining its actions would betray "Top Secret" information that would endanger New Zealand.
Lawyer Peter Spring - acting for van der Kolk and Ortmann - released the court documents saying it showed "the whole surveillance operation fell outside the authorisation of the GCSB legislation as it was at the relevant time".
He said "the GCSB has now admitted that its illegal conduct went far further than was previously revealed".
The documents show the GCSB stating "the circumstances of the interceptions of Messrs Ortmann and Batato's communications are Top Secret and it has not proved possible to plead to the allegations the plaintiffs have made without revealing information which would jeopardise the national security of New Zealand".
It meant "the GCSB is deemed to have admitted the allegations" around how the communications of Batato and Ortmann were carried out.
Barrister Grant Illingworth, QC, who has represented van der Kolk and Ortmann in court, said it was the end of the damages case for Ortmann and van der Kolk.
He would not comment on whether a settlement was reached with money paid to those subject to unlawful surveillance.
Illingworth said the legal team had studied the GCSB law at the time and attempted to match up the rules the spy agency had to follow with the action it took against those under surveillance.
It was difficult to do so and so the GCSB had been challenged to provide information showing it had not broken the law.
"The Crown could have denied these allegations and disputed them but they have been admitted.
"So what has been admitted is a deeper form of illegality than what has been admitted previously. The fact there had been illegality irrespective of the residency issue has never before been identified."
Illingworth said it raised the question as to whether Parliament had a full understanding of the GCSB's unlawful actions when the law was changed in 2013.
He said the admission by the GCSB had relevance to the drawn out extradition of Batato, Dotcom, Ortmann and van der Kolk. The possibility had been raised at earlier hearings but had been ruled out by the judge hearing the case.
"If there was illegality in the arrest and search phase and that illegality has not previously been made known in the extradition context then it could be relevant to the extradition."
A spokeswoman for the GCSB said "it was not possible for GCSB to plead to the allegations ... without revealing information which would jeopardise the national security of New Zealand".
She said van der Kolk and Ortmann "settled their claims earlier this year".
The long-running extradition case is in its fifth year with no end in sight. The initial district court ruling that the Megaupload-accused should be extradited was upheld in the High Court and was then appealed to the Court of Appeal.
The four men were targeted by the FBI for their involvement in Megaupload, a filesharing website which consumed 4 per cent of internet traffic at its peak.
The FBI alleged it was the centre of a massive copyright breach with the business earning millions of dollars by allowing the download or streaming of popular movies and music.
The four accused, who deny the claims, face decades in a US prison if extradited and convicted.
