The police, Security Intelligence Service and the Government Communications Security Bureau are pushing for major new surveillance powers including the ability to spy on emails. Nicky Hager investigates.
THE secretary of the anti-free trade group turns on her computer and types in the security password. Her computer holds all the group’s membership lists and meeting minutes so she makes sure no one else knows the password. Their group has been unpopular with the government in the leadup to a major free trade conference and she doesn’t want anyone snooping on their plans.
A little later she dials up the internet to check and reply to her email. Without her knowledge, she is no longer alone. As soon as she is connected to the internet a computer in a surveillance centre in another city_or even another country_detects she is there and the intelligence technician begins his work.
Using techniques dreamed up by school-age hackers, the technician bypasses the computer’s security systems, takes control of the computer operating system and begins searching folder by folder through the directory. Soon he is copying confidential files on to his own computer. No need for politically embarrassing banging on the front door and producing a search warrant these days.
He doesn’t bother copying any email files. All the emails to and from members of the group have been forwarded automatically from the service provider for months. They joke that they often read the letters before the people to whom they are addressed.
Part way through downloading her computer files, and others from networked computers, the target disconnects from the internet and gets on with her other work. No matter. As soon as she is online again, they’ll be back . . .
All of this will soon be possible.
New surveillance laws, devised under a National government and now promoted by cabinet minister Paul Swain, include legalising spying on internet communications, allowing police and intelligence agencies to hack covertly into individuals’ computers and forcing people to hand over computer passwords and encryption keys so that email communications and computer files can be read. The new legislation would also impose “requirements” on internet service providers and telephone companies to co-operate with intelligence agencies and police and install systems to assist spying on their customers.
The proposed legislation has strong similarities to the British Regulation of Investigatory Powers Act (R.I.P Act), passed amid major controversy three months ago, which required internet providers to be connected to a new MI5 email interception centre. However, rather than announcing and debating the planned law changes openly as occurred in Britain, information on the New Zealand plans has been kept secret and it is planned to slip them through in stages as add-ons to unrelated pieces of legislation. The first of these is due to be tabled in parliament in about 10 days.
The similarity to the British legislation is not a coincidence. Officials have told ministers the new powers are needed to meet New Zealand law enforcement requirements. In fact the legislation is a direct result of influence from western countries, particularly the United States, which wants a standardised global system for communications interception to assist its own intelligence operations. The New Zealand government and police have refused to release information on the links between the proposed new powers and secret meetings and agreements between New Zealand officials and western intelligence and police agencies. Officials did not advise ministers of the commitments they had already made to overseas agencies to fall into line with the standardised surveillance.
In the last week of July the first signs of the plans appeared when Associate Justice Minister Swain discussed additions to anti-hacking legislation and raised the idea that it might include allowing police to intercept emails. He justified the plans saying that the target was electronic criminals: “It’s ridiculous to tell police to attack organised crime with one hand behind their backs,” he said. However, the plans had been developed quite separately from the electronic crime and anti-hacking laws.
I first suspected these changes might be coming in New Zealand a year ago after receiving copies of European Union reports uncovered by European researchers. These papers showed that European governments had been secretly agreeing to adopt standardised new spying laws pushed by the US Federal Bureau of Investigation (FBI) on to its closest NATO allies. A series of European Union countries and other US allies, including Australia, have ignored an unwilling public and passed these laws in recent years. It seemed likely that New Zealand was receiving pressure to conform.
The New Zealand officials promoting the new laws have refused to release information about many of the specific new powers sought and their links to the FBI initiative. For months this year, police refused to answer any questions, even after the ombudsman agreed to investigate the case. Finally, under pressure from the ombudsman, assistant police commissioner Paul Fitzharris wrote a week ago claiming no knowledge of collaboration with the FBI-European Union plans and suggesting that, if I wished to discuss these issues further, I could contact the officer in charge, Inspector Peoples, when he returned from leave next year. Details of the planned law changes have been kept under wraps, but can be pieced together from various sources. The first legislation expands the interception powers of the police and GCSB to cover all forms of electronic communications (including email, faxes and text messaging) and, for the SIS as well, to cover hacking into computer systems to view and copy people’s files. (Insiders say the police already have technology to intercept faxes but not for email.)Like the British act, this is to be achieved by amending the Crimes Act to make it illegal to intercept electronic communications or hack into computers_and then exempting all the intelligence and law enforcement agencies (police, customs etc) from the new law. Police interception warrants will then cover all kinds of communications (not just telephones) and search warrants will permit covert access to computers from a remote terminal. According to the police briefing papers to the incoming minister last year, they are also seeking powers to oblige people “to assist the police to access computerised material when executing a search warrant”, forcing people to hand over passwords and encryption keys.
The SIS has already been given powers to deal with encrypted communications. Last year’s amendment to the SIS Act legalised covert entry into buildings and placing of “objects” there. More explicit spy legislation overseas refers to bugs placed inside a computer keyboard to intercept confidential messages before they are encrypted.
The legislation will also allow a new (but unspecified) type of GCSB electronic spying to be conducted from the super-secret agency’s Freyberg Building headquarters in Wellington, and will move the GCSB’s existing powers into the Crimes Act, thereby increasing their status. It will create a new system of authorisation, said to be “similar” to current SIS warrants, to control the new types of GCSB and SIS spying. If the new surveillance authorisations are like SIS warrants, there will be nothing to stop them being issued to target organisations and hence allow general surveillance. Opponents of market economics and free trade, who have been extensively targeted by western intelligence agencies elsewhere, come to mind. The whole emphasis of the new legislation will be that the use of the new powers will be kept secret.
The other half of the plan is changes to the Telecommunications Act, again mirroring the RIP Act. The intelligence agencies and police want amendments that require internet service providers and telephone companies to install equipment and software to make their systems “interceptable”. (Sources say that Telecom has already been paid to make its network “interception capable”.) A controversial side-issue is whether the government or the telecommunications companies should pay for the changes. In Australia’s similar 1997 legislation, the internet and phone companies pay. Network and service providers must also provide “communications data” on request, which in overseas legislation has included IP addresses, logon IDs and passwords, PIN numbers and credit card details. These will probably be available without the requirement for an interception warrant. The telecommunications companies will face heavy prison sentences if they refuse to co-operate or reveal to anyone that the interception is occurring. If they follow overseas laws, they will also be required to hand over encryption codes so that the messages can be read. There may not be an equivalent of the new MI5 surveillance centre, but the effect will be the same. The amendments are being prepared by officials in secret, pushed through cabinet without ministers getting full information and presented to the public only after the government has made its decisions. Similar law changes in other countries have been introduced as specific surveillance legislation. Despite being about four years in the planning, this up-front approach was not adopted in New Zealand. The Crimes Act changes are being included in a Supplementary Order Paper (SOP) on “electronic crime” that will tack the new surveillance provisions on to anti-hacking legislation already before the law and order select committee. Although the select committee will invite public submissions on the SOP, the public will only have a few weeks to digest and debate the changes at the end of several years of secret preparation by officials. Ministers hope to pass the law before the end of this year.
The Telecommunications Act amendments were drafted under the last government but did not get priority on the 1999 election year legislative programme. The manager of the Telecommunications and Postal Policy Group of the Ministry of Economic Development, David King, says they now plan to attach the surveillance provisions to an unrelated bill arising from Hugh Fletcher’s inquiry into the telecommunications industry. It is due to go to cabinet in December.
Although the changes all come from the intelligence agencies and police, they are being pursued as two separate initiatives (the first sponsored by the Justice Department and the second by the Ministry of Economic Development). Although Swain, wearing different ministerial hats, is responsible for both processes, he has never mentioned publicly that they are two halves of the same plan.
The first stage legalises wider surveillance powers while the second provides the technical means to use those powers. Together, they add up to a New Zealand RIP Bill.
Swain disputes this. He says the “driving force for making changes” is the wish to protect privacy. “At the moment a person’s privacy is at risk because there is no legislation that says that wandering into someone’s internal communications system is illegal.”
Exemptions for intelligence and law enforcement agencies came later, he said.
Privacy concerns are the “very foundation, and fundamental reason why I am promoting that people should have the right to be able to communicate, to email one to another, without the fear that someone else is having a go at it.”
The Crimes Act changes were first seen by ministers in the same week as the British RIP Bill got royal assent in July. Two weeks later, on August 14, cabinet approved the officials’ proposals without any changes.
The schedule involved cabinet approving the first legislation before seeing the subsequent telecommunications legislation and with no public debate on the civil liberties issues. It is yet to be seen how long will be allowed for the select committee investigation into the bill.
Victoria University Professor of Public Policy, Jonathan Boston, says that the proposed legislation raises issues of fundamental importance. He hopes sufficient time will be allowed for careful and considered public debate of the proposed laws.
Two main arguments have been proposed by officials and Swain to justify the changes – the same arguments used in Britain and elsewhere.
The first is that the two laws would not “change or extend in any way the existing powers and accountabilities”; that they merely update current powers relating to telephone monitoring to cover new technologies. Ministers were told that the changes were merely maintaining the status quo. This is not true.
The availability of new technologies means that more and more of our personal lives, work, political activities, entertainment and even shopping occur via electronic communications.
Interception of these communications provides unprecedented power for intrusive monitoring, and faster computers and digital communications continuously increase monitoring capabilities. Much more spying is possible with less manpower. There is no comparison between this and telephone bugging of past decades.
In addition, new powers are proposed, including covertly snooping inside home computers. The Privacy Commissioner strongly opposed these powers in a private submission to the government this year. He argued that police search warrant legislation requires the person being searched to be aware of the search and see the warrant. He argued that this new, surreptitious surveillance power raised worrying privacy and accountability issues. Swain recommended to cabinet to put aside these concerns, leaving them for a future review of police search powers, and cabinet accepted this. Likewise there may be new provisions to force people to hand over passwords and encryption keys.
In Europe when this occurred, civil liberties lawyers pointed out that it reverses the fundamental right to be presumed innocent until proven guilty. It would be similar to removing someone’s right to remain silent.
Finally, internet experts argue that email interception will be quite different from old-fashioned telephone interception, where a single line is monitored. Modern networks mix data packets of various origins in a broad stream and so, according to Erich Moechel, an Austrian researcher into the FBI- European Union surveillance plans, “you simply have to analyse at least all their headers [including sender and address] to know which ones to intercept”.
While there is equipment available that could target a single email user, other countries introducing similar new laws have required an “interception interface” to be built into every internet and phone company’s system. For email, this involves specialised software being installed by internet service providers that can be remotely controlled by intelligence and police agencies. This provides capabilities that Moechel describes as “spooks’ heaven”. This is what the New Zealand legislation will permit.
This would not yet mean electronic “trawling” of all email traffic, as the GCSB does. But, as the British Statewatch organisation wrote (about the RIP Bill), “Over the past 10 years secret and clandestine methods of gathering `intelligence’ previously employed in the days of the Cold War by internal security agencies have been permeating policing practice”.
The other argument used by Swain and officials to justify the new laws is that organised criminals are using the internet to avoid police surveillance and that the changes are necessary “to prevent law enforcement capability being seriously eroded”. Officials provided no evidence to substantiate this claim.
Detective Sergeant Cam Stokes, who works with gangs in Auckland, told NZPA earlier this year that he knew of no instances where a crime had been plotted using email and said criminals would be cautious about what they said on-line.
While email tapping might not prove a significant advantage to police, he said, “it would certainly be no disadvantage to us to know who criminals were corresponding with”.
This is the heart of the issue: whether there is a clear and present danger to justify increased police and spy powers. After all, police solved crime statistics are improving and the Cold War is long gone. But it is easy to speak of crime and national security. How do we judge? Swain says the intelligence agencies need updated powers to fight “international criminal activities and international terrorist activities”. And he especially backs the police having these powers so that they can “monitor criminals, particularly gangs”.
He says he agrees there must be a balance between surveillance powers and civil liberties but he “very strongly” supports the police having new powers in “the war against criminal behaviour, particularly in relation to drugs”.
The New Zealand Council for Civil Liberties does not agree. Chair Tony Ellis says the proposed surveillance laws are a major civil liberties concern.
The council wrote to Swain three months ago asking about possible email surveillance laws. On September 21, he replied that he was “confident that the rights of New Zealanders are not being diminished but rather enhanced” by the proposed laws.
Ellis says the council is waiting to see details of the legislation and will be taking it up. “It is a major and disturbing intrusion into civil liberties,” he said.