14. The Intelligence and Security Act 2017

14.1 Overview

1

The Intelligence and Security Act 2017 was enacted following the 2016 Cullen-Reddy Report and gives effect to many of its recommendations.¹⁸² The Act governs the operations of the New Zealand Security Intelligence Service (see Part 8, chapter 5) and the Government Communications Security Bureau (see Part 8, chapter 7), which are defined in the Act as the “intelligence and security agencies”.¹⁸³

2

In this chapter, we review the way the Intelligence and Security Act operates in respect of the counter-terrorism effort. The purpose of this exercise is to identify the legal boundaries within which the intelligence and security agencies must operate. We do this by reference to:

1. the objectives and functions of the agencies;
2. oversight of the agencies;
3. the overarching constraints on the agencies;
4. the provisions of the Act dealing with the collection of intelligence;
5. the limited statutory mandate of the Department of the Prime Minister and Cabinet;
6. the extent to which the Act contemplates bulk collection and acquisition of data; and
7. the relationships between the Inspector-General of Intelligence and Security and the agencies.

3

We conclude the chapter with a discussion of other issues, including difficulties and uncertainties with the operation of the Act.

14.2 Objectives and functions of the agencies

4

The objectives of the intelligence and security agencies are provided for by section 9:

5

Countering terrorism falls naturally within the section 9(a) objective.

6

The functions of the agencies are identified in sections 10 to 15 and include:

7

The statutory objectives and functions of the agencies are the same, despite their very different capabilities.

8

Government priorities for intelligence and security are set out primarily in the National Security and Intelligence Priorities (see Part 8, chapter 3). For the purposes of section 10(1)(a) they specify the topics on which the agencies may collect and analyse intelligence. It remains open to the government to identify priorities (and thus authorise collection and analysis) in other ways. What is important is that the agencies are not entitled to self-task. They may only collect and analyse intelligence to the extent authorised by priorities set by the government.

9

Section 13(1) and (2) authorise cooperation between the agencies. It also provides for cooperation between the agencies and the New Zealand Defence Force and New Zealand Police.

10

The Act also sets out functions that do not fall within the agencies’ mandate. In particular, section 16 provides that it “is not the function of [the agencies] to enforce measures for national security” except in very limited circumstances. So, it is open to the agencies to collect and analyse intelligence in accordance with priorities set by the government, but they cannot use this intelligence for enforcement purposes. Where enforcement is appropriate, this must be carried out by another Public sector agency, such as New Zealand Police (see Part 8, chapters 6 and 12).

14.3 Oversight of the agencies

11

Oversight of the intelligence and security agencies and their activities is provided for in a number of ways:

1. They are subject to ministerial oversight. The minister responsible for the intelligence and security agencies has functions in relation to the issue of warrants, the approval of business records directions and permission to access restricted information (see 14.6 The provisions of the Act dealing with the collection of intelligence). As well, the agencies are required to have regard to Ministerial Policy Statements issued under section 206 (see 14.5 Overarching constraints on the agencies).
2. The approval of a Commissioner of Intelligence Warrants (who must previously have held office as a High Court judge) and the relevant minister is required for the issue of business records directions and certain warrants. Permission from the Chief Commissioner of Intelligence Warrants is also required for access to certain restricted information.
3. The Intelligence and Security Committee is a statutorily recognised (by section 192) Parliamentary committee that has oversight functions provided for in section 193.
4. There is an Inspector-General of Intelligence and Security who has extensive oversight functions.
5. The agencies are subject to judicial supervision through court proceedings.¹⁸⁴
6. The agencies are subject to Privacy Commissioner and Ombudsman oversight.

12

In this chapter, we focus on the roles of the Intelligence and Security Committee and the Inspector‑General of Intelligence and Security.

The role of the Parliamentary Intelligence and Security Committee

13

The functions and membership of the Parliamentary Intelligence and Security Committee are provided for in the Act. Its members must be drawn from the parties in government and those in opposition.

14

Under section 193, the Intelligence and Security Committee’s functions include examining the policy, administration and expenditure of the agencies, receiving their annual reports and conducting annual reviews. There are, however, constraints. While the Intelligence and Security Committee can consider any matter with intelligence or security implications referred to the committee by the prime minister, this does not extend to matters “relating directly to activities of an” agency.¹⁸⁵ As well, section 193(2)(b) provides that the functions do not include:

15

Sections 202–205 and 224 address the provision of “sensitive information” to the Intelligence and Security Committee and how such information is to be dealt with if provided. Sensitive information is information that, if disclosed, would be likely to prejudice national security, prejudice the maintenance of the law or endanger anyone. Under section 203(1)–(3), whether sensitive information is disclosed depends on the assessment of the Director-General of the relevant agency or the direction of the prime minister.

16

There is an Intelligence and Security Committee of the United Kingdom Parliament. It can, and does, inquire into the operations and activities of the intelligence and security agencies in the United Kingdom.

17

A more extensive and public role for the New Zealand’s Intelligence and Security Committee would be desirable. It would provide further transparency and general assurance to the public as to the activities of the agencies and thus improve their social licence. Such a role for the Intelligence and Security Committee would require reasonably high levels of cross-party political consensus and trust. In the current environment, we would like to think that such consensus and trust can be achieved. 

The role of the Inspector-General of Intelligence and Security

18

The functions of the Inspector-General of Intelligence and Security are specified in section 158. They include:

1. conducting inquiries into:
   1. an agency’s compliance with the law;
   2. whether a New Zealander has been adversely affected by an agency’s action, omission, policy or procedure; and
   3. the propriety (appropriateness) of an agency’s actions;
2. dealing with complaints made under section 171 of the Act, which provides for complaints by employees of the agencies or any New Zealander who claims to have been “adversely affected” by an agency’s actions, inaction, policies or procedures; and
3. conducting annual reviews and unscheduled audits on warrants (including their issue), compliance systems and the carrying out of any authorised activity.

19

The last two Inspectors-General of Intelligence and Security made a practice of reviewing every warrant obtained by the agencies (see 14.6 The provisions of the Act dealing with the collection of intelligence). At the time the Act was under consideration by Parliament, this scrutiny was described as a component – along with requirements for approval of warrants by the responsible minister and a Commissioner of Intelligence Warrants – of the “triple-lock” protection for New Zealanders from surveillance.

20

Section 163 provides that a conclusion by the Inspector-General of Intelligence and Security that the issue of a warrant or conduct carried out under the warrant was irregular does not invalidate the warrant or render the activity illegal.

14.5 Overarching constraints on the agencies

21

The agencies have a duty to act in accordance with New Zealand law and “all human rights obligations recognised in New Zealand law”. They must also act independently and impartially, with integrity and professionalism, and in a manner that facilitates democratic supervision.¹⁸⁶

22

The obligation of the agencies to act appropriately is reinforced by the section 158(1)(c) power of the Inspector-General of Intelligence and Security to conduct an “inquiry into the propriety of particular activities of an intelligence and security agency”.

23

There may be scope for debate as to what is unlawful and thus would be a breach of the agencies’ obligation to act in accordance with New Zealand law. Unlawful activities must include the commission of criminal offences (whether under the Crimes Act 1961 or otherwise) and behaviour that is contrary to statute (for example, the Privacy Act 1993 and the New Zealand Bill of Rights Act 1990). But whether it also encompasses civil wrongs (for example, trespass or a breach of contract) is unclear. Activities that would otherwise be unlawful can be authorised by warrant (see 14.6 The provisions of the Act dealing with the collection of intelligence).

24

In performing their functions, agencies are required by section 209 “to have regard to Ministerial Policy Statements” issued under section 206. These cover a wide range of lawful activities, including the collection of information, conducting surveillance in public places, obtaining and using publicly available information and requesting information from third parties. The Ministerial Policy Statements impose requirements on the agencies to act only in ways that are both necessary for the agency to pursue its functions and proportionate to the national security purpose on which the agencies rely. They also impose associated restrictions (such as using the least intrusive mechanism possible) and reinforce restrictions imposed by the Act and other statutes.

25

The summary at the start of the Ministerial Policy Statement on obtaining and using publicly available information provides an indication of its contents and how Ministerial Policy Statements generally are expressed:

It is lawful for the Government Communications Security Bureau (GCSB) and the New Zealand Security Intelligence Service (NZSIS) to obtain and use publicly available information. This ministerial policy statement (MPS) provides guidance on the conduct of this activity. In making decisions related to obtaining and using publicly available information, GCSB and NZSIS must have regard to the following principles: respect for privacy, necessity, proportionality, least intrusive means, respect for freedom of expression, including the right to advocate, protest or dissent, legality and oversight. This MPS also specifies certain matters to be included in internal policies and procedures.¹⁸⁷

26

Under section 18(b) of the Act, there is a requirement to ensure that.

27

The practical implications of this section are fleshed out in a Ministerial Policy Statement.

28

Under section 19, the exercise of the right of freedom of expression (including “the right to advocate, protest or dissent”) “does not of itself justify an intelligence and security agency taking any action”. A broadly similar version of the provision was first introduced in the New Zealand Security Intelligence Service Act 1969 in 1977.¹⁸⁸ The scope and meaning of the provision has never been subject to judicial explanation.¹⁸⁹ We discuss the implication of this section in relation to target discovery below (see 14.10 Other issues, difficulties and uncertainties with the Act).

29

Subject to these constraints, the agencies can carry out any lawful activity, providing it is carried out in the performance or exercise of any function, duty or power.¹⁹⁰

14.6 The provisions of the Act dealing with the collection of intelligence

30

As discussed above, the Intelligence and Security Act imposes a number of limitations on agencies’ activities that are not illegal. It also, however, confers powers on agencies which are specific to them, in particular:

1. the use of assumed identities;
2. requests for information;
3. direct access to certain databases held by other Public sector agencies;
4. access to restricted information;
5. business records directions; and
6. collection of intelligence as authorised by warrant.

The use of assumed identities

31

Sections 21–45 authorise and regulate the adoption of assumed identities by agency employees¹⁹¹ and the use of entities to enable an agency to conduct transactions while maintaining secrecy.¹⁹²

Requests for information

32

Section 121 provides for requests for information by the Directors-General of the intelligence and security agencies to “any other agency”.¹⁹³ Such a request can be made where the Director-General of one of the agencies believes, on reasonable grounds, that the information is necessary to perform its functions.

33

Section 122 applies to the agency that holds the information requested. An agency can provide the information requested if it chooses to and it believes, on reasonable grounds, that the disclosure of the information is necessary for the intelligence and security agency to perform its functions. To assist with the requested agency’s decision, the Director-General of an intelligence and security agency can certify that the disclosure of the information is necessary for the agency to perform its functions.¹⁹⁴

34

A request and certificate do not override any legal impediment to disclosure (such as contractual obligation).¹⁹⁵ And compliance with these requests is voluntary. So even in the absence of a legal impediment, the requested agency is not legally required to provide information to an intelligence and security agency.

Data access

35

Sections 124–133 deal with the provision of direct access to databases storing “specified public sector information”. Schedule 2 of the Act sets out which of the two intelligence and security agencies can negotiate direct access agreements with identified holding agencies.

Table 13: Direct access agreements provided for by the Intelligence and Security Act

36

Direct access agreements are made between the ministers of the relevant intelligence and security agency and the agency that holds the information. Consultation with the Privacy Commissioner and Inspector-General of Intelligence and Security is required (see Part 8, chapter 9). Limited progress has been made in finalising the direct access agreements envisaged in the Act (see 14.10 Other issues, difficulties and uncertainties with the Act).

Access to restricted information

37

Restricted information encompasses confidential tax information, information about national student numbers, adoption information and photographic images used for driver’s licences.¹⁹⁷

38

The Director-General of an intelligence and security agency seeking access to restricted information must have the permission of the responsible minister and the Chief Commissioner of Warrants if the person concerned is a New Zealand citizen or permanent resident. If the person is not a New Zealand citizen or permanent resident, the responsible minister’s permission is required.¹⁹⁸ If permission is granted, the agency holding the restricted information must provide it to the relevant Director-General.¹⁹⁹

Business records directions

39

Sections 143–155 provide for the intelligence and security agencies to obtain business records of telecommunications network operators and financial service providers. Business records include all information generated or received in the course of the organisation’s business but excludes the content of communications.²⁰⁰

40

Once the Director-General of an agency is granted approval²⁰¹ from the responsible minister and a Commissioner of Intelligence Warrants to obtain business records, they can issue a business records direction. A direction issued under section 150 is restricted to specified business records (or a specified class of business records relating to an identifiable person or thing). For these purposes, “thing” includes an address (for example, an IP address).²⁰² There is a statutory obligation to comply with a business records direction.

Warrants

41

Under section 49(1), an intelligence and security agency needs a warrant to carry out any activity that would otherwise be unlawful, that is, it would be unlawful but for the authorisation.²⁰³ There is a similar requirement that applies if a New Zealand intelligence and security agency asks an international partner to carry out activity outside New Zealand that would be unlawful if it was carried out in New Zealand.²⁰⁴ This applies even if the activity is lawful in the international partner country’s jurisdiction.

42

Section 49 complements section 17, which imposes a general obligation on the agencies to act lawfully. An activity that is authorised under the Act is lawful even if it is contrary to other legislation.²⁰⁵

43

The Act provides for different types of warrants.²⁰⁶ The most relevant type are intelligence warrants, which are provided for by sections 52–78 of the Act.²⁰⁷ Sections 53 and 54 provide for two types of intelligence warrant – Type 1 and Type 2:

44

Type 1 warrants apply to New Zealand citizens and permanent residents. Type 2 warrants apply to people who are not New Zealand citizens or permanent residents. The difference between the two types of warrant was inherited from the Government Communications Security Bureau Act 2003, which was replaced by the Intelligence and Security Act. Section 14 of the Government Communications Security Bureau Act placed restrictions on the interception of communications of New Zealand citizens and permanent residents.

45

Type 1 warrants are considered and issued by the responsible minister (or ministers) and a Commissioner of Intelligence Warrants. Type 2 warrants are considered by the responsible minister alone.²⁰⁸ And, as noted above, the current practice of the Inspector-General of Intelligence and Security is to review every warrant obtained by the agencies. This creates “triple-lock” protection for Type 1 warrants and “double-lock” protection for Type 2 warrants.

46

The preconditions to the issue of warrants are provided for in sections 58 and 59 (for Type 1 warrants) and section 60 (for Type 2 warrants). As well, section 61 (for Type 1 and Type 2 warrants) provides:

47

Section 61, amongst other things, thus creates a necessary and proportionate test that must be satisfied before a warrant can be issued. This test is not detailed further in the statute.

48

Where a Type 1 warrant is sought for counter-terrorism purposes, the agency must establish that the activity “is necessary to contribute to the protection of national security” and “identifies, enables the assessment of, or protects against … terrorism or violent extremism”.²⁰⁹

49

The preconditions for the issue of a Type 2 warrant appear less exacting. Where such a warrant is sought for counter-terrorism purposes, the applicant need only show that the activity for which authorisation is sought “is necessary to contribute to national security” and the activity is not in respect of a person (or class of persons) for which a Type 1 warrant is required. There is no explicit requirement to show that the activity “identifies, enables the assessment of, or protects against … terrorism or violent extremism”.

50

This may be a distinction without a practical difference in the context of counter-terrorism. The need to show that the activity is “necessary to contribute to the protection of national security”²¹⁰ and the necessary and proportionate requirement under section 61 mean that the information required to support an application for a Type 2 warrant is practically the same as for a Type 1 warrant. In respect of counter-terrorism, it is open to question whether there is a continuing need for, or utility in, the distinction between the two types of warrant, at least as to the criteria to be applied.

51

Section 56 provides for the Directors-General of both agencies to apply for a joint intelligence warrant. No such application has ever been made. That said, the agencies cooperate to some extent, using each other’s warrants (under section 51 requests to assist) and sharing intelligence.

52

Section 67(1) sets out the actions that can be authorised under an intelligence warrant:

53

Sections 68 and 69 provide for the actions that the agencies can carry out to give effect to an intelligence warrant. They confer powers to:

1. enter any place, vehicle or thing as authorised by the warrant along with associated powers of search;
2. install, use and maintain visual surveillance, tracking and interception devices;
3. access information infrastructures; and
4. conceal activities associated with the exercise of a warrant.

Unauthorised, irrelevant and incidentally obtained information

54

Sections 102–104 deal how information can be used if that information was obtained:

1. outside the scope of an authorisation or authorised activity (called “unauthorised information”); or
2. within the scope of an authorised activity but which is not, or is no longer, required by the agency for the purposes of its functions (called “irrelevant information”).

55

Unauthorised information should be destroyed unless a warrant is obtained authorising the collection of the information or the information can be disclosed under section 104 to New Zealand Police, the New Zealand Defence Force or another public authority (in New Zealand or overseas).²¹¹ Information can be disclosed under section 104 to prevent or detect serious crime or mitigate threats to life or the security or defence of New Zealand or any other country.²¹²

56

Irrelevant information should be destroyed (see 14.10 Other issues, difficulties and uncertainties with the Act).²¹³

14.7 The limited statutory mandate of the Department of the Prime Minister and Cabinet

57

Sections 233 and 234 set out the functions of the Chief Executive of the Department of the Prime Minister and Cabinet in respect of intelligence collection, analysis and assessment. Relevantly, section 233(1) and (2) provide:

58

This section provides the legislative underpinning for the operation of the National Assessments Bureau (see Part 8, chapter 4) and the role of the Department of the Prime Minister and Cabinet in the development of National Security and Intelligence Priorities.

59

In relation to the functions prescribed by section 233, the Act imposes a duty under section 234 on the Chief Executive of the Department of the Prime Minister and Cabinet to act independently.

14.8 The extent to which the Act authorises bulk collection and acquisition of data

What is bulk collection and acquisition?

60

In the aftermath of the Snowden revelations (see Part 8, chapter 2), there has been substantial debate, in New Zealand and elsewhere, about the appropriateness of intelligence and security agencies being able to collect directly (“collection”) or obtain from third parties (“acquisition”) large quantities of data (which may include, but is not confined to, communications). In this context, “bulk” is usually used in contrast to "targeted".

61

The key feature of bulk collection and acquisition is that a large proportion of the data gathered relates to people who are not intelligence targets and is of no intelligence value. At its most narrow, targeted collection and acquisition may be directed at a single individual, but it may also extend to groups of people or organisations who share a common purpose. Such collection and acquisition is sometimes referred to as “thematic”.

62

The language of all of this is very imprecise. Thematic collection and acquisition may occur on a scale that results in the capture of data that is predominantly of no or limited intelligence value. Even with far more targeted collection and acquisition there is often a possibility of acquiring irrelevant data. And likewise, bulk collection will always be targeted to some extent.

63

These concepts are discussed in detail by Lord Anderson of Ipswich KBE QC in the 2016 Report of the Bulk Powers Review and, in the New Zealand context, in a 2018 report by the Inspector-General of Intelligence and Security, Complaints arising from reports of the Government Communications Security Bureau intelligence activity in relation to the South Pacific, 2009–2015.²¹⁴ As the latter report indicates, the Government Communications Security Bureau does not use the expression “bulk collection”. It is likewise a concept that is not referred to specifically in the Act.

64

Bulk data can play an important part in identifying, understanding and averting threats. Where alternative methods exist, they are often less effective, more dangerous, more resource-intensive, more intrusive or slower. The Report of the Bulk Powers Review notes:

[W]hile intelligence agencies in the UK and elsewhere have access to more communications data than ever before, by using focused queries and data filters, intelligence analysts only need to retrieve and analyse a small fraction of the overall dataset. As with Google, having more data improves the quality of your results. Intelligence analysts can get the data they need comparatively quickly and efficiently.²¹⁵

65

This was not to reject the importance of targeted collection. On the contrary, “analysis of bulk communications data and focused data collection on ‘targets of interest’ serve different but complementary purposes”.²¹⁶

66

Bulk collection may involve, but is not confined to, interception of all communications (including associated metadata) as they pass between certain communication links (or bearers). The communications collected will be filtered so as to remove communications that are unlikely to be of intelligence value, with what is left subject to queries (selectors) producing a body of data which is able to be examined (with the balance discarded). Collection of this kind, in which the data obtained is stored before being filtered, has been referred to within the Government Communications Security Bureau as “full take”. A variant of this process involves the use of selectors at the point of, and just after, interception but before storage.

67

Other countries rely heavily on this method of intelligence collection. In the United Kingdom just under half of all Government Communications Headquarters intelligence reporting is based on data obtained under bulk interception warrants. For counter-terrorism intelligence reporting, this figure rises to over half.²¹⁷

68

Intelligence and security agencies may wish to acquire data that has been collected or generated by other agencies, financial service providers and telecommunication network operators. Such acquisition may be in bulk or alternatively targeted at a particular individual or group of individuals.

The Cullen-Reddy Report

69

The 2016 Cullen-Reddy Report recommended the introduction of “purpose-based warrants”:

While we recommend providing for purpose-based authorisations in appropriate circumstances, the legislation should contain a presumption in favour of targeted authorisations. The Attorney-General, and the judicial commissioner in the case of tier 1 authorisations, would only be able to issue a purpose-based authorisation where satisfied it is necessary and proportionate in the circumstances, and that the outcome sought could not reasonably be achieved through the use of targeted authorisations. The Attorney-General could also impose restrictions and conditions on authorisations. This would help to avoid the proliferation of overly broad authorisations, while still allowing the Agencies sufficient flexibility to perform their functions effectively.²¹⁸

70

Given the context of the part of the Report in which this recommendation was made (including mention of then proposed United Kingdom legislation providing for bulk collection), this recommendation appears to have contemplated authorisation of similar collection by New Zealand agencies.

The Intelligence and Security Bill (158-1)

71

Clause 64 of the Intelligence and Security Bill (158-1) provided for purpose-based warrants – that is, warrants “for a purpose specified in the warrant and for reasons specified in the warrant” that did not describe “the persons in respect of whom, or the places at which, the activities will be undertaken”. This clause, however, did not survive the Parliamentary process. The advice of the Department of the Prime Minister and Cabinet on this clause was in these terms:

[The Department of the Prime Minister and Cabinet] has worked with the [Government Communications Security Bureau] and the [New Zealand Security Intelligence Service] to test operational examples. The agencies are of the view that, as the Bill is framed, they can achieve the operational ends sought through regular class-based warrants. As such, there is no operational justification for retaining provision for purpose-based warrants.

We note also the submissions which allege purpose-based warrants were a means to “mass surveillance.” We remain of the view that purpose-based warrants could not authorise mass surveillance – purpose-based warrants were included on the same basis they were recommended by the independent reviewers.²¹⁹

72

The rationale for dropping clause 64, as explained by the Select Committee, was:

We received advice from officials that Type 1 and Type 2 warrants can meet the agencies’ operational needs without the need for purpose-based warrants. The regular warrants also provide more safeguards, greater legal certainty, and more effective oversight. Therefore, we see no operational justification for retaining the provision for purpose-based warrants, and we recommend deleting clause 64.²²⁰

Bulk collection under the Act

73

Activities that, under section 67, can be authorised by an intelligence warrant include collection focused on “persons or classes of person”, “places or classes of places” and “things or classes of things”. If construed literally, this language is sufficiently broad to cover bulk collection. Indeed, one of the reasons why the purpose-based warrant proposal did not proceed was the availability of class warrants.

74

The primary constraint on obtaining warrants authorising bulk collection is the necessary and proportionate requirement, which must be applied in the context of the Act. This context encompasses the absence of explicit bulk collection powers – in contrast to those provided for in the Investigatory Powers Act 2016 (United Kingdom) – and the legislative history that indicates a distinct unwillingness to contemplate anything smacking of mass surveillance. And, as we will explain, the Inspector-General of Intelligence and Security’s position has been that “general warrants” are not appropriate.

75

The application of the necessary and proportionate requirement will depend on the intelligence purpose on which the agencies rely. If the purpose is broad, for example to enable an intelligence and security agency to obtain an understanding of a new phenomenon, collection on a broad basis may be necessary and proportionate. If, on the other hand, the purpose is to identify potential terrorists and thus link data and communications to identifiable individuals, broad collection may be more difficult to justify.

Bulk acquisition under the Act

76

On the face of it, the direct access sharing provisions (sections 124–133) appear to contemplate bulk data acquisition. However, the Government Communications Security Bureau uses the direct access agreements primarily to ascertain whether a person is a New Zealander. For the New Zealand Security Intelligence Service, direct access agreements are used to obtain useful information, but not in the form of bulk data acquisition. So, in practice, the direct access agreements do not provide a mechanism for the agencies to engage in bulk acquisition.

77

The business records direction regime under sections 143–155 does not provide for bulk acquisition as a business records direction must relate to an identifiable person or thing. Likewise, sections 121–122, which provide for intelligence and security agencies to request other agencies to provide information, do not contemplate bulk collection. That this is so is apparent from the report of the Inspector-General of Intelligence and Security titled 2016–17 Review of NZSIS requests made without warrants to financial service providers: Report.²²¹

14.9 The relationships between the Inspector-General of Intelligence and Security and the agencies

78

We heard that the intelligence and security agencies have cultures of compliance. For instance, an internal operational review of the New Zealand Security Intelligence Service that was substantially completed, but not finalised, before 15 March 2019 noted a “widespread perception” amongst operational staff that “leadership messaging was dominated by the importance of compliance (and the perils of non-compliance), to the exclusion of operational ambition”. The report noted that this perception had been tempered by a speech made by the Director-General of Security in February 2019, but went on to say:

Operational teams were not confident in their judgements on procedure (or policy, or principles), as they believed that they had reassured oversight on certain compliance matters, but subsequent written reports had painted a bleaker picture of their compliance.

These conclusions had been accepted, and not contested by, [the New Zealand Security Intelligence Service], thereby emphasising the sense of uncertainty among operational decision-makers.

79

It would not have been a productive use of our time to investigate all areas of dispute between the agencies and the Inspector-General of Intelligence and Security with a view to determining whether the leadership teams of the agencies had appropriately pushed back against any adverse views. They certainly did on some occasions. And some issues of contention were referred to the Solicitor-General for determination.

80

The Inspector-General of Intelligence and Security’s views are not presumptively authoritative, and the agencies are not obliged to act in accordance with findings and recommendations. The agencies are, however, acutely aware of their limited social licence and take adverse reports (which might detract from that social licence) very seriously.

81

The Inspector-General of Intelligence and Security is the primary oversight body of the agencies. A degree of tension is, therefore, both expected and necessary. The independence of the Inspector-General of Intelligence and Security from the agencies is critical to the social licence (limited as it is) that the agencies currently have. This independence might be compromised by close and proactive engagement with agencies.

82

All of that said, our discussion with the agencies and the current Inspector-General of Intelligence and Security suggests that there are issues – for instance in relation to warrants for target discovery purposes – where misconceptions have arisen that could be resolved by closer engagement. Such engagement would enable points on which there is substantial agreement to be resolved. It would also facilitate issues on which there is disagreement to be identified quickly, rather than more painfully in after-the-fact adverse reports. If necessary, disputes as to such issues could be settled authoritatively and promptly by the Solicitor-General.

14.10 Other issues, difficulties and uncertainties with the Act

83

We have identified further issues with the Act as it affects the counter-terrorism effort:

1. A lack of congruence between the Act and the structure and operation of the New Zealand Intelligence Community.
2. The application of the necessary and proportionate test to actions that do not require authorisation.
3. Direct access agreements having not been put in place as contemplated by Parliament.
4. Specificity requirements for warrants.
5. Type 2 warrants and the incidental collection of information about New Zealand citizens and permanent residents.
6. Absence of a legal requirement to enable activity authorised by a warrant.
7. Searches of existing holdings.
8. Accessing existing holdings of partner agencies.
9. The possible effect of section 19 in limiting target discovery in respect of right-wing extremism.
10. The operation of section 103.
11. The definition of “employee”.

A lack of congruence between the Act and the structure and operation of the New Zealand Intelligence Community

84

The Act operates primarily to regulate and authorise the activities of the agencies and a more accurate short title might have been “The Intelligence and Security Agencies Act”. It says very little about the Department of the Prime Minister and Cabinet. There is, for instance, no explicit mention of the National Assessments Bureau (albeit that function is covered by section 233(1)(a)) and no substantial underpinning in the Act of the leadership and coordination role of the Department of the Prime and Cabinet (see Part 8, chapter 3).

85

The result of the lack of legislative guidance is that there is a dissonance between the role the Department of the Prime Minister and Cabinet has in the counter-terrorism effort and the very limited role identified in the Act.

The application of the necessary and proportionate test to actions that do not require an authorisation

86

As we have explained, a necessary and proportionate test applies to the issue of warrants. This test is applied when a warrant application is considered and thus ahead of any action taken. Agencies can, therefore, take comfort in the fact that the conduct has already been deemed to be necessary and proportionate. In turn, agencies are not required to turn their minds to this test again (unless they wish to engage in activities that fall outside the scope of the original warrant).

87

By way of contrast, there is no prior approval mechanism for activities that are lawful. Therefore, an operation that relies on (or largely relies on) lawful activities will need to be assessed for necessity and proportionality as it progresses. This is because actions that an agency wishes to carry out which are lawful are practically required to be confined to what may later have to be justified to the Inspector-General of Intelligence and Security as necessary and proportionate. Such a process may prove to be cumbersome, particularly if there are time constraints.

88

We discussed with staff of the counter-terrorism agencies whether and how they would have investigated the Facebook posts made by the individual under the username Barry Harry Tarry, if they had come to their attention (see Part 6, chapter 4). An issue was raised whether inquiries at the individual’s gym would have met the necessary and proportionate test. Such inquiries may have resulted in the gym manager and/or other gym members learning that a particular member was a person of national security interest. There were concerns whether, on the material assumed to have been at hand, that consequence could have been justified as proportionate.

Direct access agreements having not been put in place as contemplated by Parliament

89

The New Zealand Security Intelligence Service has entered into only a limited number of the types of direct access agreements that are permitted under the Act.

90

There are considerations of principle and practicability that mean that an agreement between the relevant intelligence and security agency and the other agency is a practical prerequisite to an effective data sharing arrangement. So it is difficult to see any alternative to a structure broadly along the lines of that presently provided for in the Act. That said, progress towards the finalisation of direct access agreements has been limited. There are currently no mechanisms to encourage other agencies to enter into such agreements.

91

Adding a statutory requirement to report on progress might assist with speeding up these processes.

Specificity requirements for warrants

92

The rationale of intelligence warrants is to enable the collection of information that is of utility to the agencies in the performance of their functions under the Intelligence and Security Act. Associated with this, the activities that may be authorised by an intelligence warrant are expressed in section 67 in general terms, for instance surveillance on “persons or classes or persons”, “places or classes of places” and “things or classes of things”.

93

There is no evidential threshold in the Act comparable to the criminal law concepts of reasonable grounds to suspect or believe, provided for in the Search and Surveillance Act 2012.²²² These usually apply to the investigation of offending that has been, or is being, committed. Instead, under the Intelligence and Security Act, agencies must show that:

1. the activity “necessary to contribute to the protection of national security” (for Type 1 and 2 warrants);
2. the activity “identifies, enables the assessment of, or protects against ... terrorism or violent extremism” (for Type 1 warrants); and
3. the necessary and proportionate test is satisfied.

94

Although some intelligence warrants are about the activity of identified individuals and specific suspicions about their activities (and in these respects have some similarities to warrants under the Search and Surveillance Act), others are thematic in character.

95

The Inspector-General of Intelligence and Security has taken the view that, when a warrant proposes to target a class of people, it “must be tolerably clear who will fall within the class and who will not”.²²³ What this means in practice is that where a Government Communications Security Bureau warrant authorises an activity that targets a class of people that is “so wide or loose” that it is “impossible to tell with any certainty who falls within it”, the Inspector-General of Intelligence and Security will likely find the warrant to be irregular.²²⁴ The Government Communications Security Bureau now sets out in warrant applications, with as much specificity as possible, those who fall within the scope of the proposed activity and therefore can be targeted.²²⁵

96

There has also been dispute between the Government Communications Security Bureau and the Inspector-General of Intelligence and Security about what approach should be taken to whether a warrant authorising activity directed towards a class of persons authorises collection activity against a particular target. The Government Communications Security Bureau has taken the view that where a warrant authorises activity against a person or class of people, it may target an individual if it reasonably suspects that the individual is a member of that class.²²⁶ The Inspector-General of Intelligence and Security is of the view that, in those circumstances, the Government Communications Security Bureau must have a reasonable belief that those intended to be targeted are within the class.²²⁷ In individual instances, this dispute must be determined against the definition of the target class in the warrant. And, as the Inspector-General of Intelligence and Security has recognised, a warrant could define a class by reference to reasonable suspicion, that is “persons reasonably suspected of x”.

97

In practice, the approach has largely followed the interpretation of the Inspector-General of Intelligence and Security. That is, the targeting of individuals (whether specifically or as members of a class) requires reasonable grounds to believe that they are engaging in relevant conduct (such as terrorism) or – but only if the warrant is expressed so as to allow this specifically – at least reasonable cause to suspect that they are.

98

Despite this issue being largely resolved, another issue has emerged. The agencies told us that the Inspector-General of Intelligence and Security is of the view that – at least for Type 1 warrants issued under section 58 – there is a “strict” necessity threshold requiring positive grounds for suspecting a New Zealander’s association with the listed harms, below which the agencies cannot obtain a warrant. The agencies told us that they disagreed with this view. In their opinion, section 58 contemplates an activity that “identifies, enables the assessment of, or protects against” any of the listed harms. That threshold, they said, is all that the Intelligence and Security Act requires in terms of authorising target discovery activities (see Part 8, chapter 10).

99

Our impression is that either the agencies have misunderstood the position of the Inspector-General of Intelligence and Security or it has not been conveyed to them clearly. The Inspector-General of Intelligence and Security accepts that, providing agencies meet the statutory requirements in section 58, there is no impediment to the authorisation of target discovery activities. Misunderstandings would be less likely if there was more direct and proactive engagement – particularly involving operational staff from the agencies – along the lines we have earlier indicated.

Type 2 warrants and the incidental collection of information about New Zealand citizens and permanent residents

100

There is scope for argument about whether a Type 1 warrant is required where the purpose of a proposed activity is not directed at New Zealand citizens or permanent residents but the collection of information about New Zealand citizens or permanent residents is a likely, probable, or inevitable consequence of carrying out the activity.²²⁸

101

The distinction between Type 1 and Type 2 warrants, in some instances, complicates online intelligence gathering where nationality can be difficult to determine or where the scale of collection makes it inevitable that New Zealanders’ information will be collected.

102

One option is for the agencies to apply for a Type 1 warrant where there is a likelihood of information about a New Zealander being collected. Another option is to apply for a Type 2 warrant and, where information is collected about a New Zealander, subsequently apply for a Type 1 warrant. Additionally, in some circumstances, given the different requirements of sections 58–60, agencies may be required to apply for three different warrants to cover the same investigation. Requiring the agencies to apply for multiple different warrants for the same investigation imposes considerable administrative burdens.

103

The current distinction between Type 1 and Type 2 warrants rests on the view that New Zealanders should be afforded greater protection from surveillance by New Zealand agencies than foreign nationals. This is why a Commissioner of Intelligence Warrants must approve Type 1 warrants rather than just the responsible minister (thereby providing an additional “lock”). It does not, however, explain why the criteria for the issue of warrants for counter-terrorism purposes should be differently expressed. Given the practical difficulties that the distinction causes, it may be more straightforward to provide for a single category of warrant, at least for counter-terrorism.

Absence of a legal requirement to enable activity authorised by a warrant

104

Although section 51 provides for an intelligence and security agency to request the assistance of New Zealand Police (or other people) to give effect to an authorisation, there is no legal duty on those affected by a warrant to comply with it (unless the requested agency is a network operator or service provider as they have a duty to assist the agencies under section 24 of the Telecommunications (Interception Capability and Security) Act 2013).

105

This is of limited practical effect when the activity authorised is to be carried out in a covert way. It can, however, be of considerable significance where the activity cannot be carried out without the cooperation of a third party.

Searches of existing holdings

106

Where information has been collected under a Type 2 warrant, current practice is that it will not be searched for information relating to a New Zealand citizen or permanent resident without a Type 1 warrant being held or obtained.

Accessing existing holdings of partner agencies

107

Section 49(2) provides that an intelligence and security agency requires an authorisation before asking a partner agency to carry out an activity that would be unlawful if carried out directly by the New Zealand agency. What is not clear is whether a warrant is required to access information already collected by a partner agency.

108

It is at least arguable that a warrant is required in these circumstances. A request to a partner agency to search its existing holdings may amount to a search for the purposes of section 21 of the New Zealand Bill of Rights Act 1990.

The possible effect of section 19 in limiting target discovery in respect of right-wing extremism

109

As we noted earlier, section 19 is based on a provision first introduced in 1977 into the New Zealand Security Intelligence Service Act 1969. Clause 22 of the New Zealand Intelligence and Security Bill (158-1) was intended to replicate the gist of this part of the 1969 Act:

110

The Inspector-General of Intelligence and Security submitted on clause 22 in this way:

Section 2(2) of [the New Zealand Security Intelligence Service Act 1969] provides that the [New Zealand Security Intelligence Service] is not justified in “instituting surveillance”, while clause 22 states that the intelligence and security agencies will not be justified in “collecting intelligence”. The [Inspector-General of Intelligence and Security] is concerned the protection in clause 22 is narrower because “collecting intelligence” could be construed as being limited to collection of intelligence pursuant to an intelligence warrant, whereas “instituting surveillance” could encompass observation undertaken legally without a warrant. The [Inspector-General of Intelligence and Security] considers that lawful advocacy, protest and dissent do not in themselves justify the agencies taking any action at all, and that the Bill should be reworded to capture this.

111

The Department of the Prime Minister and Cabinet agreed with the Inspector-General of Intelligence and Security’s submission and recommended that the words “collecting intelligence” be replaced with “taking any action”. As will be apparent, this change is reflected in the wording of section 19.

112

The wording of section 19 gives rise to some difficulties in terms of target discovery. We can illustrate these difficulties by reference to the possible monitoring of far right websites and forums. Bearing on the appropriateness of such monitoring are the fact that:

1. a number of people, including those on the far right, use websites and online forums to spread (or receive) divisive hateful rhetoric; and
2. some of those people may be potential terrorists and analysis of what is said on those websites and forums might enable them to be identified; but
3. very little of what is found on such websites and forums (including the divisive and hateful rhetoric) is contrary to the law.

113

Collection and analysis of what is said on those websites and forums can be regarded as involving agency action directed at a group of people targeted because of their exercise of the right to freedom of expression. It is at least open to argument that such collection and analysis would be in breach of section 19. If so, we would not see the problem as able to be resolved by obtaining a warrant, given what we consider to be the purpose of section 19, its legislative history and the effect of other provisions in the Act.

114

A practical example of the issues that may arise is provided by the IP address lead discussed in Part 6: What Public sector agencies knew about the terrorist. A major reason why the lead was generated and pursued is that the person using the internet address had accessed extremist material. It is far from clear that, in doing so, that person committed an offence. If accessing the material did not amount to an offence, it follows that such access was within the scope of the right to freedom of expression (which encompasses seeking out the opinions of others). There were other elements to the internet activity (relating to firearms) that were material to the decision to open and pursue the lead. This probably means that the exercise of the right to freedom of expression – that is, accessing extremist material – was not “of itself” the basis for the action that was taken. On the other hand, upstream collection of intelligence about who is accessing what internet material is an activity in itself and one that could engage section 19.

115

There should be proactive engagement between the agencies and the Inspector-General of Intelligence and Security as to the implications of section 19 on target discovery. But such engagement, while likely to be useful, will not authoritatively resolve the potential for major problems with section 19 in the current environment. Difficult though the issues around section 19 will be to resolve legislatively, we see them as warranting urgent consideration by Parliament.

The operation of section 103

116

Section 103(1) and (2) provides:

117

Section 103 assumes that relevance and irrelevance are binary concepts – that intelligence is either relevant to the performance of the agencies’ functions (in which case it may be retained) or that is irrelevant (in which case it must be deleted). It also assumes that the agencies are in a position to continuously monitor the relevance of information that they hold. Neither assumption is correct. Relevance is a relative concept. The agencies do not have the practical ability to operate a continuous review of the relevance of all information that they hold. And, even if they did, devoting the limited resources of the agencies to such a task may impact their ability to carry out more important functions, such as identifying potential terrorists.

118

Section 103 should be reviewed.

The definition of “employee”

119

The powers of the agencies to give effect to intelligence warrants may be exercised by authorised employees (see sections 68 and 69). The section 4 definition of “employee” does not encompass officials from other agencies seconded to the agencies (including from another intelligence agency). There are number such persons who, in a practical sense, work for the agencies. There is a work-around (involving the use of section 51) but it would be preferable if the definition of “employee” reflected the way in which the agencies are, in practice, staffed.

^{182. Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM, footnote 38 above.}

^{183. Intelligence and Security Act 2017, section 4.}

^{184. Intelligence and Security Act 2017, section 162.}

^{185. Intelligence and Security Act 2017, section 193(1)(f).}

_{186. Intelligence and Security Act 2017, sections 17(a)–(d).}

_{187. Christopher Finlayson Obtaining and using publicly available information (September 2017) at page 1.}

_{188. See the New Zealand Security Intelligence Service Amendment Act 1977, section 3.}

_{189. Section 3 of the 1977 Act was mentioned in Choudry v Attorney-General HC Christchurch CP15/98, 19 August 1998 at page 31.  See also Andrew Geddis and Elana Geddis “Addressing terrorism in New Zealand’s low threatscape” in I Cram (ed) Extremism, Free Speech and Counter-Terrorism Law and Policy (Routledge, Abindgon: UK, 2019) 190 at page 204, which was finalised before 15 March 2019.}

_{190. Intelligence and Security Act 2017, section 48.}

_{191. Intelligence and Security Act 2017, sections 21–32.}

_{192. Intelligence and Security Act 2017, sections 33–44.}

_{193. Agency means “any person, whether in the public sector or the private sector” and “includes a department and an interdepartmental venture”. See Intelligence and Security Act 2017, section 118.}

_{194. Intelligence and Security Act 2017, section 122(3).}

_{195. Intelligence and Security Act 2017, section 122(4).}

_{196. Under its direct access agreement with the Ministry of Business, Innovation and Employment, the New Zealand Security Intelligence Service has access to Advanced Passenger Processing information.  The information allowed to be shared under the Intelligence and Security Act is broader than this.}

_{197. Intelligence and Security Act 2017, section 135.}

_{198. Intelligence and Security Act 2017, section 136.}

_{199. Intelligence and Security Act 2017, section 141.}

_{200. See the definition of “business records” in section 144.}

_{201. An application for approval is made under section 145 and approval is made under section 147.}

_{202. Intelligence and Security Act 2017, section 150(4)(b).}

_{203. Intelligence and Security Act 2017, section 49(1).}

_{204. Intelligence and Security Act 2017, section 49(2).}

_{205. Intelligence and Security Act 2017, section 49(3).}

_{206. See the definition of “authorisation” in section 47.}

_{207. Sections 71–76 provide for the urgent issue of warrants and section 78 provides for very urgent authorisations to be granted where there is insufficient time to obtain a warrant.}

_{208. Intelligence and Security Act 2017, section 60.}

_{209. Intelligence and Security Act 2017, section 58(1)(a)(i), (ii) and (2)(a).}

_{210. Intelligence and Security Act 2017, section 60(3)(a)(i).}

_{211. Intelligence and Security Act 2017, section 102(2).}

_{212. Intelligence and Security Act 2017, section 104(3).}

_{213. Intelligence and Security Act 2017, section 103.}

_{214. David Anderson Report of the Bulk Powers Review (August 2016); Office of the Inspector-General of Intelligence and Security Complaints arising from reports of Government Communications Security Bureau intelligence activity in relation to the South Pacific, 2009–2015 (July 2018).}

_{215. David Anderson, footnote 214 above at paragraph 3.75, page 67.}

_{216. David Anderson, footnote 214 above at paragraph 3.75, page 67.}

_{217. David Anderson, footnote 214 above at paragraph 5.9, page 82.}

_{218. Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM, footnote 38 above at page 107.}

_{219. Department of the Prime Minister and Cabinet New Zealand Intelligence and Security Bill: Departmental Report to the Foreign Affairs, Defence and Trade Committee from Department of the Prime Minister and Cabinet (December 2016) at pages 568–569.}

_{220. Intelligence and Security Bill 2016 (158-2) (select committee report) at page 6.}

_{221. Office of the Inspector-General of Intelligence and Security 2016–17 Review of NZSIS requests made without warrants to financial service providers: Report (November 2018).}

_{222. A “reasonable grounds to suspect” criterion does feature in section 59(2) of the Act in relation to warrants relating to the “economic well-being” of New Zealand.}

_{223. Office of the Inspector-General of Intelligence and Security Warrants Issued under the Intelligence and Security Act 2017: Report (December 2018) at page 109.}

_{224. Office of the Inspector-General of Intelligence and Security, footnote 223 above at page 115.}

_{225. Office of the Inspector-General of Intelligence and Security, footnote 223 above at pages 117 and 119.}

_{226. Office of the Inspector-General of Intelligence and Security, footnote 223 above at page 144.}

_{227. Office of the Inspector-General of Intelligence and Security, footnote 223 above at pages 145.}

_{228. See Office of the Inspector-General of Intelligence and Security, footnote 223 above at pages 136–142.}