New oversight report critical of spies and highlights legal 'gap' in GCSB practices

Inspector-General of Intelligence and Security Cheryl Gwyn. Photo / Mark Mitchell

Our spies have been pushing the boundaries of a new law meant to provide greater detail and oversight, according to their oversight body.

Concerns include the possibility the powerful electronic spying agency, the Government Communications Security Bureau, is scooping up information including that which belongs to New Zealanders without the proper legal authorisation.

Inspector-General of Intelligence and Security Cheryl Gwyn issued a report today harshly critical in many regards as to how the GCSB and NZ Security Intelligence Service are meeting the demands of the Intelligence and Security Act.

The new law came in last year after a government review of our spies' legislation.

It provided greater powers to some of our agencies - the caveat against the GCSB spying on New Zealanders was dropped - but also demanded greater transparency when the NZSIS or GCSB sought warrants to legally approve surveillance.

A year after the new law was passed, Gwyn was still in the dark over whether she and our electronic spy agency are even talking about the same thing.

Warrants are sought for activities including surveillance on people and places, intercepting private communications, secret searches of places or items and asking foreign governments to undertake activities which would be against the law for the GCSB or NZSIS.

It is part of Gwyn's job to review every warrant issued to the agencies allowing spying to take place. Under the new law, she and the agencies have had to decide what the wording of the legislation means and how it fits with the work they want to do.

Gwyn's latest report covers nine months and 40 warrants and shows the spies have interpreted the demands of the law quite differently to the way their oversight body has done.

Her greatest criticism was reserved for the GCSB, which engages in international intelligence interception and sharing with New Zealand's "Five Eyes" partners - Australia, Canada, the United Kingdom and the United States.

NZSIS Director-General Rebecca Kitteridge says work to bring in the new law is almost complete. Photo / Mark Mitchell

She said there was a level of uncertainty over what the GCSB was doing under the new law which was "unsatisfactory" after a year.

"On some matters there is inherent uncertainty as to the meaning and implications of key legal provisions, but on several matters I am uncertain even as to whether we have the same or a different view of certain specific matters of legal approach.

"The Bureau continues to put forward warrant applications that reflect legal interpretations, policies and drafting practices I have questioned."

Among her concerns was GCSB spying which picked up New Zealanders' information as a byproduct. Her office's report on the GCSB's surveillance of the South Pacific showed New Zealanders' data was scooped up along with those who were targets.

She said the GCSB believed it did not need a warrant to do so while she believe it did.

"In plain terms I think that if the bureau knows it is likely to get New Zealanders' communications along with the foreign communications it wants, and deliberately goes ahead on that basis, it is intentionally doing a 'thing' directly in relation to New Zealanders."

Gwyn said she believed the GCSB's interception of communications which included incidental collection of New Zealanders' data was not covered by the law.

"The bureau's approach creates a gap, in my opinion, in the legal authorisation of its activities."

She said if her view of the law was correct then those authorisations should be at a higher level and require greater levels sign-off beyond simply the agencies' minister, Andrew Little.

Other concerns included the GCSB making broad warrant applications to spy on groups - of "classes" - of targets.

She said the degree of appropriate intrusion varied according to the privacy cost and the value of intelligence which was difficult to measure "if a class of targets was so wide or loose that it was impossible or very hard to tell with any certainty who would and would not fall within it".

Gwyn also had "serious reservations" about the GCSB's practice of cross-referencing one warrant with another, which made it difficult at times to be clear about what was being spied on and why.

Gwyn said she was also concerned about the degree of detail provided by the NZSIS with the agency pitching warrant applications at a broad level for greater intrusion.

The focus of the warrants appeared to be more concerned about "potential adverse impacts on foreign relations and the agencies" if "covert activities were discovered or disclosed" rather than the rights of those subject to spying.

Gwyn said she believed the NZSIS was obliged to provide greater levels of detail in warrant applications for those approving surveillance.

Instead, it produced cookie-cutter applications with "explanations that varied little from one application to another".

She said the NZSIS position was "untenable given the clear legal language on those matters and the express statements of policy intent" behind the new law.

Gwyn said the NZSIS was slow to make changes and showed a "degree of reluctance" on some issues.

Issues arose around the degree of detail included in NZSIS warrants, with Gwyn saying lawmakers specifically intended the agency to be specific about its agents' intent.

Instead of saying what it would do, the NZSIS would describe what it could do, she said.

Pipitea House in Wellington - the base for New Zealand's intelligence agencies. Photo / Mark Mitchell

It posed an issue particularly around visual surveillance which "can raise particularly intense privacy concerns".

Visual surveillance could be "observing private activity with binoculars from a publicly accessible vantage point" to greater intrusions, including "trespassing for close-up photographs to placing a hidden camera".

The difference meant it was important the degree of privacy intrusion was detailed in a warrant application, she said.

Gwyn said the NZSIS believed there was no pressing need to include a level of detail to allow for the difference in intrusion.

In early NZSIS warrants under the new law, Gwyn said the NZSIS was so broad in those it sought to spy on it was difficult to assess the impact surveillance would have and whether it would unreasonably intrude on people other than the immediate target.

NZSIS Director-General Rebecca Kitteridge said there was ongoing work between her organisation and the Inspector-General to "refine the requirements for warrant applications".

"This is a normal process. Statutory interpretation and implementation develop over many years."

She said there had been "heavy workloads" to meet the requirements of the new law, which included guidance from the Inspector-General. "This work is now largely complete."

GCSB Director-General Andrew Hampton said work was ongoing to interpret, apply and implement" the new law.

"Interpreting and applying any new piece of legislation is a complex process that must be carefully thought through."

"We have made a number of changes in response to issues the Inspector-General has raised, which have improved our warrant applications."

On the incidental collection of New Zealanders' information without a warrant, Hampton said the GCSB believed it was operating inside the law.

"As the Inspector-General states in her report, the GCSB's reasoning is carefully thought through and articulated," said Hampton.

He said the GCSB had sought a definitive view from Crown Law, the government's legal advisers, and "will share it with the Inspector-General once it is ready".

David Fisher is a member of a Reference Group set up by the Inspector General of Intelligence and Security to hear views on developments possibly relevant to the work of the oversight office. The group has a one-way function in offering views to the IGIS and receives no classified or special information.