7.1 Overview

1

The Government Communications Security Bureau is New Zealand’s signals intelligence agency.

2

Understanding exactly how signals intelligence works and what skilled practitioners can achieve within a particular authorising environment is not straightforward. Of all the activities in New Zealand’s counter-terrorism effort, signals intelligence is the least understood by those outside of the discipline.

3

In this chapter we:

  1. explain what signals intelligence brings to the counter-terrorism effort;
  2. discuss reviews of the Government Communications Security Bureau, and international approaches to signals intelligence; and
  3. assess the Government Communications Security Bureau’s contribution to the domestic counter-terrorism effort, including its technical capability and capacity, and staffing and leadership.

 

7.2 What signals intelligence brings to the counter-terrorism effort

4

Among its other activities, including cyber security, the Government Communications Security Bureau conducts signals intelligence. This means it identifies, collects and reports on targets’ communications (signals, such as phone calls and emails). It also collects and analyses data about communications (metadata). As well, it enables its New Zealand customers to access signals intelligence produced by its international

5

The value of a signals intelligence agency to a counter-terrorism effort is that it can collect information that no other agency can. Its collection techniques can make physical distance from a target meaningless. Once access and appropriate authorisation are in place, signals intelligence collection is often much faster than other intelligence collection activities. It is also usually far less risky than human intelligence operations in terms of the personal safety of those involved.

 

7.3 Reviews and international approaches to signals intelligence

6

The reputation of the Government Communications Security Bureau was badly affected by the Dotcom controversy and the Snowden revelations (see Part 8, chapter 2). The 2013 review of compliance at the Government Communications Security Bureau found issues with compliance that were a consequence of underlying problems in the Government Communications Security Bureau’s structure, management, capacity and capability.101

7

The 2014 Government Communications Security Bureau Functional Review102 noted that government, Parliament and the public should expect to have a signals intelligence agency that is “highly effective at conducting sophisticated intelligence activities against any legitimate targets, no matter how hard”.

8

The 2014 Performance and Improvement Framework review highlighted several performance challenges for the intelligence and security agencies, including creating a “more seamless collaboration to achieve … products and services that are prized by its key customers”.103 In relation to the Government Communications Security Bureau, the review noted the following:

  1. The increasing importance of the internet and “big data” for the Government Communications Security Bureau. It stated that “given uncertainty as to future threats, [the Government Communications Security Bureau] needs to maintain and develop technology and technical skills in areas of plausible future risk, even if these areas are not currently a priority”.104
  2. The importance of maintaining the tradecraft and skills that the Government Communications Security Bureau analysts develop through prosecuting dynamic, non-institutional counter-terrorism targets and that “the value of signals intelligence in safeguarding New Zealand against violent extremism is in identifying previously unknown threats through analysis of online behaviours”.105 Its capability to identify threats was growing and there was an opportunity to assist the New Zealand Security Intelligence Service and New Zealand Police. This was challenging new ground, given the associated privacy implications.
  3. The importance of the relationship with the New Zealand Security Intelligence Service. It commented that developing a “supportive partnership … between staff [of both agencies] at all levels should be an early priority” and success would come in the form of a “close and cooperative working relationship … with staff in both agencies having an improved understanding and appreciation of each other’s contribution to national security and enjoying bringing their skills to selected joint projects”.106

9

The 2014 Performance and Improvement Framework review of the New Zealand Intelligence Community also suggested:

To help Ministers clarify the priorities for national security and the scope of [the New Zealand Intelligence Community’s] role and how that applies to the [Government Communications Security Bureau], the [Government Communications Security Bureau] needs to provide advice on the likely gains, costs and risks of allocating its collection resources to different priorities, and to help identify possible trade-offs.107

10

We observed that, in other countries, human intelligence and signals intelligence agencies had deep mutual understanding of each other’s capabilities, characteristics and constraints. This was also evident in the relationships between those agencies and police. We heard in other countries that co-location of different agencies can minimise these challenges. Co-location of agencies is a good first step, but the real value has been agencies working together on live operations – not just on Response activities, but also Reduction activities. Joint action on Reduction can generate valuable insight into opportunities for the counter-terrorism effort.

11

In the United States of America, the 9/11 Commission Report commented on joint action, saying that the National Security Agency:

…did not think its job was to research [the identities of potential terrorists]. It saw itself as an agency to support intelligence consumers, such as the Central Intelligence Agency. The [National Security Agency] tried to respond energetically to any request made. But it waited to be asked.108

12

The 9/11 Commission Report argued that cooperation is not the same as joint action:

When agencies cooperate, one defines the problem and seeks help with it. When they act jointly, the problem and options for action are defined differently from the start.109

 

7.4 Contribution to the domestic counter-terrorism effort

13

The Government Communications Security Bureau first established a standing counter-terrorism capability in 2003. From 2003 to 2016, it led an effort to close a recognised gap in the Five Eyes counter-terrorism effort. This also involved international parties outside the Five Eyes partnership. As well, the Government Communications Security Bureau provided some support to New Zealand Police and the New Zealand Security Intelligence Service.

14

From 2016, the Government Communications Security Bureau began to change its counter-terrorism approach to more closely align its efforts with the revised National Intelligence Priorities (see Part 8, chapter 3). It shifted focus to the domestic counter-terrorism effort and explicitly became a customer-led organisation. The Government Communications Security Bureau considered the New Zealand Security Intelligence Service to be the lead agency for domestic counter-terrorism. The New Zealand Security Intelligence Service thus became the Government Communications Security Bureau’s primary customer for counter-terrorism signals intelligence. All other New Zealand agencies’ counter-terrorism tasking occurs through this primary customer.

15

From 2016, all of the Government Communications Security Bureau’s counter-terrorism activities were the result of specific tasking by another agency. This means the Government Communications Security Bureau does not “unilaterally undertake domestic counter-terrorism investigations” and does not “self-task or identify its own intelligence questions” for any counter-terrorism activity, domestic or international:

[The Government Communications Security Bureau]’s counter-terrorism mission does not have any standing capability to unilaterally detect terrorist or potential terrorist activity that has not come to attention by other means. [The Government Communications Security Bureau] responds to intelligence requirements or “leads” provided by a domestic or international agency, which arise from an already instigated intelligence investigation, incidental collection, or through partner reporting. Once a “lead” or subject of investigation is established, [the Government Communications Security Bureau] is able to provide in-depth analysis including discovery of potentially previously unknown relationships.

16

This customer-led model relies on having informed and experienced counter-terrorism customers who understand current signals intelligence capabilities and how they might be used.

17

The New Zealand Security Intelligence Service is still recovering from the significant loss of its own capability and experience (see Part 8, chapter 5). The New Zealand Security Intelligence Service, possibly correctly, does not regard it as appropriate or necessary for its staff to have a full understanding of the Government Communications Security Bureau’s capability. But without an understanding of the Government Communications Security Bureau’s capability, the New Zealand Security Intelligence Service’s ability to maximise contributions from signals intelligence to the counter-terrorism effort is constrained.

18

The working relationship between the Government Communications Security Bureau and New Zealand Police and the border agencies is not particularly close. Staff in these agencies therefore also do not have a good understanding of the capabilities of the Government Communications Security Bureau.

19

We acknowledge the Government Communications Security Bureau’s efforts to enhance its customer service, as recommended by the 2014 Performance and Improvement Framework review.  But whether the Government Communications Security Bureau’s customer-led model remains the appropriate approach for New Zealand’s domestic counter-terrorism effort has not been discussed at a whole-of-system level.

20

In 2016, the Government Communications Security Bureau considered its key contributions to the counter-terrorism effort included lead generation for target discovery purposes (see Part 8, chapter 10), undertaking internet operations and using advanced data collection and analysis techniques. It expected to be able to conduct more comprehensive target discovery once the Intelligence and Security Act 2017 came into force. It identified international coverage and providing technical assistance to the New Zealand Security Intelligence Service operations as other contributions it could make.

21

In June 2017, the Government Communications Security Bureau established a new line of domestic counter-terrorism activity – New Zealand foreign fighters. Any spare capacity was to be directed at a joint effort with a Five Eyes partner on non-New Zealand foreign fighters, in line with New Zealand’s international counter-terrorism effort (in this case to understand the potential problem returning foreign fighters might pose to a particular global region). In the same year, the Government Communications Security Bureau advised the incoming Minister Responsible for the Government Communications Security Bureau, Hon Andrew Little, that it was modernising its counter‑terrorism capability. It also advised that the traditional distinctions between signals intelligence and human intelligence were “becoming less important as the complexity of the threatscape ... continues to rise ... [and] multidisciplinary responses are required to keep pace with those who seek to harm New Zealand”. This echoed the point made in the 2014 Government Communications Security Bureau Functional Review.110

22

The Government Communications Security Bureau counter-terrorism activities include a 24-hour watch service, which can quickly circulate threat intelligence. It also participates in international and domestic forums. For a time, the Government Communications Security Bureau was a participant in a signals intelligence effort with European partners, the benefits of which applied to both the domestic and international aspects of New Zealand’s terrorism intelligence priority.

23

In 2018, the Government Communications Security Bureau’s standing warrants and authorisations enabled it to conduct activity against individual and organisational targets including:

  1. those listed in the United Nations Security Council’s list, maintained pursuant to the United Nations Security Council Resolution 1988, the Dā’ish and Al Qaeda sanctions list and the list established by the New Zealand Government or listed in the Terrorism Suppression Act 2002;
  2. those engaged in terrorist acts or with links to those engaged in terrorist acts; and
  3. extremists and those who advocate for politically or religiously motivated violence.

 

7.5 Technical capability and capacity

Technical capability

24

We discuss in Part 8, chapter 2 some of the key changes in communications and the threatscape that have impacted on counter-terrorism efforts, including the prevalence of end-to-end encryption. Signals intelligence agencies around the world have responded to the latest shifts in the environment in various ways. For example:

  1. They have sought to develop the technical means to exploit modern communications even as communications technology changes over time.111
  2. They are investing in data collection and analysis. Smart analysis of bulk data (see Part 8, chapter 10) can reduce large amounts of information to a point where it can practicably be analysed by signals intelligence professionals.
  3. They have changed their tradecraft through the development of tools and analytical techniques in order to exploit the wide range of communications now available.

25

The Government Communications Security Bureau has had to consider how to respond to the changing operational environment. The 2014 Government Communications Security Bureau Functional Review recommended that it fundamentally shift away from existing capabilities and refocus on two emerging areas of internet operations. The need for change was “urgent and the change required was revolutionary, not evolutionary if the [Government Communications Security Bureau] [was] not to be left without significant capabilities”.112

26

The Government Communications Security Bureau has found it difficult to make this important change quickly. One of the emerging areas of internet operations is of particular interest to us. A 2019 Treasury review of that project considered it was “mission critical” and noted that the Government Communications Security Bureau was five years behind its Five Eyes partners. According to this review, the capability was fundamental to the mission of the entire New Zealand Intelligence Community and an important bridge between human intelligence and signals intelligence:

[W]ithout this capability … the New Zealand intelligence community’s capability to deliver intelligence has fallen, which threatens its ability to keep New Zealanders safe.

 

Staffing and leadership

27

Staff numbers working on domestic counter-terrorism have been limited, because the Government Communications Security Bureau dedicates more resources to other National Security and Intelligence Priorities (see Part 8, chapter 3). It considers its unique technical capabilities are better suited to those other priorities and that counter-terrorism is covered by other agencies.

28

Approximate intelligence staff numbers (including graduates) dedicated to domestic counter-terrorism at the Government Communications Security Bureau113 in recent years were two in 2015, four in 2016 (increased by graduates), two in 2017 and seven in 2018.

29

Leadership is important to the effectiveness and efficiency of an agency. The Government Communications Security Bureau has had seven Directors-General in ten years (six Directors-General between 2010 and 2016, when the current Director-General was appointed) and significant movement at the second tier. This is substantial change for a Public sector agency and has not helped the organisation to recover quickly from the Dotcom and Snowden controversies. Nor has it helped to achieve the transformational change envisaged in various reviews since 2013, including the Strategic Capability and Resourcing Review and the 2018 Performance Improvement Framework follow-up review.114

 

7.6 Concluding comments

30

The Government Communications Security Bureau has the potential to make a key contribution to the counter-terrorism effort because it can collect information that no other Public sector agency can collect. Yet in the years before 15 March 2019 the role it was playing in domestic counter-terrorism was limited.

31

Past reviews signalled the need for transformational change within the Government Communications Security Bureau. This has been difficult to achieve for an organisation still dealing with the adverse effects of the Dotcom and Snowden controversies, which significantly diminished public confidence in it. The absence of stable leadership between 2010 and 2016 made it harder for the Government Communications Security Bureau to recover from these incidents and make the required transformational change.

32

The Government Communications Security Bureau moved to operate as a customer‑led organisation. This means that it engages in domestic counter-terrorism only when tasked by another agency. Its customer focus has limited the ability of the Government Communications Security Bureau to undertake joint action with other Public sector agencies involved in the domestic counter-terrorism effort. Its customers did not always have sufficient understanding of signals intelligence capabilities to know how its contributions could be maximised. This may be unnecessarily limiting the ability of the counter-terrorism effort to get the most out of signals intelligence. The effects of the customer-led model and whether it was the right approach for New Zealand’s counter-terrorism effort have not been considered at the whole-of-system level.

33

The Government Communications Security Bureau has experienced delays in developing the new technical capabilities required to respond to well-understood trends in the communications and the threatscape. This has not been helped by the small numbers of staff working on domestic counter-terrorism. The Government Communications Security Bureau’s unique technical capabilities are such that we think it could and should have a more active role in the domestic counter-terrorism effort.

 

 

101. Rebecca Kitteridge, footnote 39 above.

102. Government Communications Security Bureau Government Communications Security Bureau Functional Review (March 2014).

103. Performance Improvement Framework, footnote 42 above at page 12.

104. Performance Improvement Framework, footnote 42 above at pages 41-42.

105. Performance Improvement Framework, footnote 42 above at page 48.

106. Performance Improvement Framework, footnote 42 above at pages 43-44.

107. Performance Improvement Framework, footnote 42 above at page 42.

108. The 9/11 Commission Report, footnote 81 above at page 353.

109. The 9/11 Commission Report, footnote 81 above at page 400.

110. Government Communications Security Bureau, footnote 102 above.

111. Government Communications Security Bureau, footnote 102 above.

112. Government Communications Security Bureau, footnote 102 above at pages 5 and 10.

113. This number does not include staff in other areas of the Government Communications Security Bureau whose work may contribute in part to its counter-terrorism activity.

114. Performance Improvement Framework, footnote 42 above.