International co-operation in internet surveillance
The police, Security Intelligence Service and the Government Communications Security Bureau of New Zealand are pushing for major new surveillance powers including the ability to spy on emails
All of this will soon be possible. New surveillance laws, devised under a National Government and now promoted by Cabinet minister Paul Swain, include legalising spying on Internet communications, allowing Police and intelligence agencies to "hack" covertly into individuals' computers and forcing people to hand over computer passwords and encyption keys so that e-mail communications and computer files can be read. The new legislation would also impose "requirements" on Internet service providers and telephone companies to co-operate with intelligence agencies and police and install systems to assist spying on their customers.
The proposed legislation has strong similarities to the British Regulation of Investigatory Powers Act (R.I.P. Act), passed amidst major controversy three months ago, which required internet providers to be connected to a new MI5 e-mail interception centre. However, rather than announcing and debating the planned law changes openly as occurred in Britain, information on the New Zealand plans has been kept secret and it is planned to slip them through in stages as add-ons to unrelated pieces of legislation. The first of these is due to be tabled in Parliament about 10 days from now.
The similarity to the British legislation is not a coincidence. Officials have told Ministers that the new powers are needed in order to meet New Zealand law enforcement requirements. In fact the legislation is a direct result of influence from western countries, particularly the United States, which wants a standardised global system for communications interception to assist its own intelligence operations. The New Zealand government and Police have refused to release information on the links between the proposed new powers and secret meetings and agreements between New Zealand officials and western intelligence and police agencies. Officials did not advise Ministers of the commitments they had already made to overseas agencies to fall into line with the standardised surveillance.
In the last week of July the first signs of the new plans appeared when Associate Justice Minister Paul Swain discussed additions to anti-hacking legislation and raised the idea that it might include allowing Police to intercept e-mails. He justified the plans saying that the target was electronic criminals: "It's ridiculous to tell police to attack organised crime with one hand behind their backs", he said. However, the plans had been developed quite separately from the electronic crime and anti-hacking laws.
I first suspected these changes might be coming in New Zealand a year ago after receiving copies of European Union reports uncovered by European researchers. These papers showed that European governments had been secretly agreeing to adopt standardised new spying laws pushed by the US Federal Bureau of Investigation (FBI) onto its closest NATO allies. A series of European Union countries and other US allies, including Australia, have ignored unwilling publics and passed these laws in recent years. It seemed likely that New Zealand was receiving pressure to conform.
The New Zealand officials promoting the new laws have refused to release information about many of the specific new powers sought and their links to the FBI initiative. For months this year, Police refused to answer any questions, even after the Ombudsman agreed to investigate the case. Finally, under pressure from the Ombudsman, Assistant Police Commissioner Paul Fitzharris wrote a week ago claiming no knowledge of collaboration with the FBI- European Union plans and suggesting that, if I wished to discuss these issues further, I could contact the officer in charge, Inspector Peoples, when he returned from leave next year.
Details of the planned law changes have been kept under wraps, but can be pieced together from various sources. The first legislation expands the interception powers of the Police and GCSB to cover all forms of electronic communications (including e-mail, faxes and text messaging) and, for the SIS as well, to cover hacking into computer systems to view and copy people's files. (Insiders say that the police already have technology to intercept faxes but not currently for e-mail.)
Like the British RIP Act, this is to be achieved by amending the Crimes Act to make it illegal to intercept electronic communications or hack into computers - and then exempting all the intelligence and law enforcement agencies (police, customs etc) from the new law. Police interception warrants will then cover all kinds of communications (not just telephones) and search warrants will permit covert access to computers from a remote terminal. According to the Police briefing papers to the incoming Minister last year, they are also seeking powers to oblige people "to assist the police to access computerised material when executing a search warrant"; forcing people to hand over passwords and encryption keys.
The SIS has already been given powers to deal with encrypted communications. Last year's amendment to the SIS Act legalised covert entry into buildings and placing of "objects" there. More explicit spy legislation overseas refers to bugs placed inside a computer keyboard to intercept confidential messages before they are encrypted.
The legislation will also allow a whole new (but unspecified) type of GCSB electronic spying to be conducted from the super-secret agency's Freyberg Building headquarters in Wellington, and will move the GCSB's existing powers into the Crimes Act, thereby increasing their status. It will create a new system of authorisation, said to be "similar" to current SIS warrants, to control the new types of GCSB and SIS spying.
If the new surveillance authorisations are like SIS warrants, there will be nothing to stop them being issued to target organisations and hence allow general surveillance. Opponents of market economics and free trade, who have been extensively targeted by western intelligence agencies elsewhere, come to mind. The whole emphasis of the new legislation will be that the use of the new powers will be kept secret.
The other half of the plan is changes to the Telecommunications Act, again mirroring the RIP Act. The intelligence agencies and police want amendments that require Internet service providers and telephone companies to install equipment and software to make their systems "interceptable". (Sources say that Telecom New Zealand has already been paid to make its network "interception capable".) A controversial side-issue is whether the government or the telecommunications companies should pay for the changes. In Australia's similar 1997 legislation, it is the Internet and phone companies that pay.
Network and service providers must also provide "communications data" on request, which in overseas legislation has included IP addresses, logon IDs and passwords, PIN numbers and credit card details. These will probably be available without the requirement for an interception warrant. The telecommunications companies will face heavy prison sentences if they refuse to co-operate or reveal to anyone that the interception is occurring. If they follow overseas laws, they will also be required to hand over encryption codes so that the messages can be read. There may not be an equivalent of the new MI5 surveillance centre, but the effect will be the same.
The decision-making process for these changes is a model of bad government: the amendments are being prepared by officials in secret, pushed through Cabinet quickly without Ministers getting full information and only presented to the public after the government has made its decisions. Similar law changes in other countries have been introduced as specific surveillance legislation. Despite being about four years in the planning, this up-front approach was not adopted in New Zealand.
The Crimes Act changes are being included in a Supplementary Order Paper (SOP) on "electronic crime" that will tack the new surveillance provisions onto anti-hacking legislation already before the Law and Order select committee. Although the select committee will invite public submissions on the SOP, the public will only have a few weeks to digest and debate the changes at the end of several years of secret preparation by officials. Ministers hope to pass the law before the end of this year. The Telecommunications Act amendments were drafted under the last government but did not get priority on the 1999 election year legislative programme. The manager of the Telecommunications and Postal Policy Group of the Ministry of Economic Development, David King, says that they now plan to attach the surveillance provisions to an unrelated bill arising from Hugh Fletcher's inquiry into the telecommunications industry. It is due to go to Cabinet, all going well, in December.
This is not open and transparent law making. Although the changes all come from the intelligence agencies and police, they are being pursued as two separate initiatives (the first sponsored by the Justice Department and the second by the Ministry of Economic Development). Although Paul Swain, wearing different Ministerial hats, is responsible for both processes, he has never mentioned publicly that they are two halves of the same plan. The first stage legalises wider surveillance powers while the second provides the technical means to use those powers. Together, they add up to a New Zealand RIP Bill.
Paul Swain disputes this. He says the "driving force for making changes" is the wish to protect privacy. "At the moment a person's privacy is at risk because there is no legislation that says that wandering into someone's internal communications system is illegal." He said that exemptions for the police and syp agencies came later. However, privacy was "the very foundation, and fundamental reason why I am promoting that people should have the right to able to communicate, to e-mail one to another, without the fear that someone else is having a go at it."
The Crimes Act changes were first seen by Ministers in the same week as the RIP Bill got royal assent around the end of July. Two weeks later, on August 14, Cabinet approved the officials' proposals without any changes. The schedule involved Cabinet approving the first legislation before seeing the subsequent telecommunications legislation and with no public debate on the civil liberties issues. It is yet to be seen how long will be allowed for the select committee investigation into the bill.
Victoria University Professor of Public Policy, Jonathon Boston, says that the proposed legislation raises issues of fundamental importance. He hopes sufficient time will be allowed for careful and considered public debate of the proposed laws.
Two main arguments have been proposed by officials and Paul Swain to justify the changes - exactly the same arguments that were used in Britain and elsewhere. The first is that the two laws would not "change or extend in any way the existing powers and accountabilities"; that they merely update current powers relating to telephone monitoring to cover new technologies. Ministers were told that the changes were merely maintaining the status quo. This is not true.
The availability of new technologies means that more and more of people's personal lives, work, political activities, entertainment and even shopping occur via electronic communications. Interception of these communications provides unprecedented power for intrusive monitoring, and faster computers and digital communications continuously increase monitoring capabilities. Much more spying is possible with less manpower. There is no comparison between this and telephone bugging of past decades.
In addition, totally new powers are proposed, including covertly snooping inside people's computers. The Privacy Commissioner strongly opposed these powers in a private submission to the government this year. He argued that police search warrant legislation requires the person being searched to be aware of the search and see the warrant. He argued that this new, surreptitious surveillance power raised worrying privacy and accountability issues. Paul Swain recommended to Cabinet to put aside these concerns, leaving them for a future review of police search powers, and Cabinet accepted this.
Likewise there may be new provisions to force people to hand over passwords and encryption keys. In Europe when this occurred, civil liberties lawyers pointed out that it reverses the fundamental right to be presumed innocent until proven guilty. It would be similar to removing someone's right to remain silent.
Finally, Internet experts argue that e-mail interception will be quite different from old-fashioned telephone interception, where a single line is monitored. Modern networks mix data packets of various origins in a broad stream and so, according to Erich Moechel, an Austrian researcher into the FBI- European Union surveillance plans, "you simply have to analyse at least all their headers [including sender and address] to know which ones to intercept."
While there is equipment available that could target a single e-mail user, other countries introducing similar new laws have required an "interception interface" to be built into every Internet and phone company's system. For e-mail, this involves specialised software being installed by Internet service providers that can be remotely controlled by intelligence and police agencies. This provides capabilities that Moechel describes as "spooks' heaven". This is what the New Zealand legislation will permit.
This would not yet mean electronic "trawling" of all e-mail traffic, as the GCSB does. But, as the British Statewatch organisation wrote (about the RIP Bill), "Over the past ten years secret and clandestine methods of gathering 'intelligence' previously employed in the days of the Cold War by internal security agencies have been permeating policing practice."
The other argument used by Paul Swain and officials to justify the new laws is that organised criminals are using the Internet to avoid Police surveillance and that the changes are necessary "to prevent law enforcement capability being seriously eroded". Officials provided no evidence to substantiate this claim.
Detective Sergeant Cam Stokes, who works with gangs in Auckland, told NZPA earlier this year that he knew of no instances where a crime had been plotted using email and said criminals would be cautious about what they said on-line. While e-mail tapping might not prove a significant advantage to Police, he said, "it would certainly be no disadvantage to us to know who criminals were corresponding with."
This is heart of the issue: whether there is a clear and present danger to justify increased police and spy powers. After all, police solved crime statistics are improving, not getting worse; and the Cold War is long gone. But it is easy to speak of crime and national secrutiy. How do we judge? Paul Swain says the intelligence agencies need updated powers to fight "international criminal activities and international terrorist activities". And he especially backs the police having these powers so that they can "monitor criminals, particularly gangs".
He says he agrees there must be a balance between surveillance powers and civil liberties but he "very strongly" supports the police having new powers in "the war against criminal behaviour, particularly in relation to drugs".
The New Zealand Council for Civil Liberties does not agree. Chair Tony Ellis says the proposed surveillance laws are a major civil liberties concern. The council wrote to Mr Swain three months ago asking about possible e-mail surveillance laws. On 21 September he replied that he was "confident that the rights of New Zealanders are not being diminished but rather enhanced" by the proposed laws. Ellis says the council is waiting to see details of the legislation and will be taking it up. "It is a major and disturbing intrusion into civil liberties", he said.
Background
The new surveillance laws being proposed are not a New Zealand initiative. They can be traced back directly to FBI plans.
The FBI began campaigning for new surveillance laws in the US in 1991. Its 1992 report, "Law enforcement REQUIREMENTS for surveillance of electronic communications", expressed concern that new communications systems and a proliferation of networks made interception much harder than previously. An updated version of these "Requirements", which were to be imposed on telecommunications companies to make their networks easier to intercept, was issued in 1994 and became the basis of new surveillance legislation signed into law by Bill Clinton in October that year. US civil liberties groups have fought this legislation ever since. The FBI "Requirements" are virtually word for word the same as the 24-point so-called "International User Requirements" that New Zealand officals later secretly agreed to implement in New Zealand. They are the basis of the current moves.
At the same time as seeking US legislation, the FBI began pushing other countries to adopt the requirements. This is because the US intelligence agencies wanted allied countries to have standardised spy systems that they could use to ensure interception of increasingly mobile telephone and e-mail. For instance, US intelligence agencies might want to monitor someone from one country using a mobile phone in another country, that is routed through the phone system of a third country. Thus, as a 1995 European Union police report noted, the need "to create new regulations for international co-operation so that the necessary surveillance will be able to operate."
In 1993, the FBI arranged a meeting to promote the Requirements at its headquarters in Quantico, south of Washington DC. Confidential European Union (EU) papers record that the meeting included EU representatives plus Canada, Norway, Hong Kong, Australia and New Zealand. In January 1995, the 15 EU governments secretly agreed to the requirements without any reference to their national parliaments. Since then, there has been controversy as the legislation was pushed through in each country.
The next move was a "Memorandum of Understanding" drawn up to extend the US-EU system to the non-EU countries. The key group for promoting this co-operation in internal surveillance has the innocuous title, the International Law Enforcement Telecommunications Seminar (ILETS). Founded by the FBI in 1993, its membership is the same 20 countries that met in Quantico that year. (SPECIAL INVESTIGATION: ILETS AND THE ENFOPOL 98 AFFAIR)
The core of ILETS is the five "UKUSA" intelligence allies: the US, Britain, Canada, Australia and New Zealand. There are thus two global surveillance systems involving those five countries: the US-led Echelon system for international spying (including New Zealand's GCSB), and the ILETS co-operation for co-ordinated internal spying on the people within each member country. New Zealand has been represented at ILETS meetings by GCSB and police staff, including meetings in Canberra in November 1995 and Ottawa in May 1998.
Other European Union documents reveal that by October 1996 Australia and Canada had formally supported the International User Requirements and New Zealand and Hong Kong were "considering the means by which they could support the 'Requirements'". New Zealand officials began work on legislation to enforce the International User Requirements in this country the following year.
Both the police and Paul Swain have, in letters to me, denied that the new legislation has links to the FBI plans. However Assistant Commissioner Paul Fitzharris did admit in writing last week that "discussions have occurred" and the "proposed legislative changes would bring New Zealand into conformity with most, if not all, of the International User Requirements".