How the GCSB's illegal spying got exposed

Currently, there are new laws before parliament that will allow the GCSB to do what it was previously not allowed to do - to spy on NZers. Below is some background information.  

Operation Debut
When on January 20, 2012 the police operation “Debut” descended on Kim Dotcom’s modest cottage in Coatesville, his communications had been intercepted for some time. The subsequent court hearings revealed that it wasn’t the police who had done the spying, but another, unnamed agency.

In September, it became clear that the GCSB, NZ’s foreign spy agency, had been involved in the spying on Dotcom. His lawyers argued that this had been illegal, because the GCSB Act of 2003 clearly states that the GCSB is not allowed to spy on NZ citizens and residents. Dotcom was a NZ resident at the time, but the GCSB claims that his residence status at the time wasn’t clear.
As a result, John Key – as the Minister in charge – asked the Inspector-General of Security and Intelligence (IGSI), Paul Neazor, to compile a report into the matter. Neazor came to the conclusion that the police and the GCSB had been confused about Dotcom’s residence status and had therefore unwillingly acted illegally. Neazor did not think the GCSB Act was ambiguous, in fact he recommended that the GCSB should be alerted to the fact that “the wording of the provisions of the GCSB Act are controlling”. As a result, Key apologised “to Mr Dotcom, and … to New Zealanders.”

The Kitteridge Report
Also in September, the government commissioned Rebecca Kitteridge to review the GCSB’s handling of the matter. Her report, published in March 2013, is damning. It reveals that since 2003, the GCSB had spied illegally on 88 other NZ residents or citizens, in most cases at the request of the SIS.

The report found that the GCSB has no policies and procedures in place to check if what it does complies with the law. Its part-time legal advisor for 15 years, Hugh Wolfensohn, hardly ever asked for advice from the Crown Law Office. No one ever analysed if the GCSB was affected by other legislation or if the use of new surveillance technology was within the law. There was essentially no record keeping. One of the most worrying aspects is that the GCSB seems to have signed international treaties without the government knowing.


Kitterridge attributes that to an ambiguous law, underfunding, a lack of management structure and a lack of oversight, and she assumes that the GCSB would like nothing more than to change that. This seems a little naïve and it misses a key point. It is quite possible that the GCSB was quite happy with not having the resources to check legal issues. And it is precisely the secretive nature in which the GCSB and the SIS operate that breeds a culture of “we can do what we want”.

Usually, the minister in charge is held responsible for the actions of their department – but not so in this case. John Key, as the Minister for Intelligence and Security, has not accepted responsibility for the GCSB débâcle, nor have Labour or the Greens called for that.


New laws
Instead, the government has responded with the “GCSB and Related Legislation Amendment Bill”, which passed its first reading under urgency on May 8. (The  regulatory impact statement for the Bill was written on 22 March).  Its main change to the GCSB Act consist of removing the word “foreign” from the Act in order to allow precisely what the previous version expressly ruled out: that the GCSB can be used to spy on NZ citizens and residents. One of the roles of the GCSB is to assist the SIS and the Police, the argument being that not doing so would mean that expensive surveillance equipment would have to be duplicated across the agencies and that would be inefficient. Therefore the GCSB should be able to spy on NZers when assisting other agencies. Human rights are compromised in the name of efficiency – an extremely dangerous thing to do.

Other changes in the Bill are that the Inspector-General of Security and Intelligence will get a deputy (until now, the 79-year-old he has been all by himself) and can now conduct random checks with the GCSB. This falls considerably short of the recommendation of the Kitterridge report, which asked for a structure similar to that in Australia, which as 12 staff.

Another planned change is to the Telecommunications Interception Capabilities Act. The definition of a ‘telecommunications provider’ is supposed to be widened to include so-called “over-the-top” services, such as Skype. The government argues that because Skype enables people to have phone conversations, it must be subject to the same rules as other organisations that provide phone services. Consequently the state wants to be able bug Skype conversations in the same way it can bug regular phone calls.