Serious Fraud Office Amendment Bill

Thank you, Mr Chair. As prefaced, only moments ago, as we are in urgency, of course, I do have a number of questions. This is a bill which only has one substantive part. One question that comes out of Part 1, by its silence, is the clause 9 question that I asked earlier, because the whole of Part 1 is the substantive part in the bill.

The case that that precipitated this, and it’s in the regulatory impact statement, is the Crown and Pikia. One of the critical parts of that case concerned, is the fact that when the Serious Fraud Office issues a notice under Section 9 of the Serious Fraud Office Act, it’s notice which can require a person to both attend and to produce documents and information. But it had been being used, and I can understand that—well, the whole point of this is that the Serious Fraud Office Act hadn’t kept up and there had been a, kind of, creep as to what information and documents meant. The Serious Fraud Office was proceeding on the basis that they could, essentially, require people to attend and produce the things that contained information and documents such as cellphones, laptops, and other devices.

Now, it does strike me—because you’ve got to remember, in terms of search and surveillance, there’s a principle that you take the least invasive approach. If you’ve got a person who, you know, is not a flight risk, there’s no real risk that they’re going to destroy any evidence, and you could get the information from the bank if you needed it, but you just want to get them in to ask for it; that’s what you should do. You should use the least invasive method possible, and that will be, “Please come along and give us your laptop.” That’s what they should, in fact, have the power to do and require. Of course, they can still say, “If you wouldn’t mind terribly, would you, possibly, hand over your laptop?” But I can tell you that the first thing you do then is call your lawyer and say, “Do I have to?” If it’s a Section 9 notice—and I’ve had these phone calls—you say, “Yes, you do, and you also need me to help you because this has become quite serious.”

But, at the moment, it appears, and even after the bill has been passed, that the Serious Fraud Office still can’t say, “You are required to attend on our office and produce your laptop so that we can extract the documents from it.” It is kind of odd. I suppose, they could say, “Please provide us all emails from date X to date Y, between these two people”, and they happen to be on the laptop, but you might have to go and get them and put them on a USB, but they can’t actually ask for that laptop or that cellphone that might have traffic information on it—because that’s the other thing, of course; it’s not just the emails; it might be information about phone calls: when they were made and who they were made to—or anything of that nature.

So in that point of the least invasive approach, because it seems that if you need the laptop or the cellphone or whatever device it is, you’ve now got to get a search warrant and enter someone’s house, which is much more invasive and serious and—this is the real point, right; this is what we’re talking about—less New Zealand Bill of Rights Act compliant to be free of unreasonable search and seizure than the alternative.

It’s actually quite a big question. I’ve had a good read of the regulatory impact statement, which, interestingly, notes that there was not sufficient consultation prior to the policy decisions being made; that because of the urgency created by this case and the Government moving at speed, again. But it does strike me that this is an issue that does need addressing. I’m hopeful, actually, that I’ve missed something, but it does seem to me that there is a gap and it’s not reflected in the analysis of this, which, basically, says, “Yes, there’s problem. Yes, we should fix it. Yes, we should make it consistent with the Evidence Act”, but it doesn’t actually say how throughout.

I mean, the Serious Fraud Office, any law enforcement agency, can actually just make a request to anyone for information. But the member’s right: unless it’s someone that feels very strongly they have nothing to hide or they want to be cooperative, which sometimes does happen, then, of course, like any law enforcement agency, the Serious Fraud Office (SFO) has to use the powers or the notices available to it.

In the Pikia case, as he referred to, it was quite simply that the Court of Appeal found that the SFO issued a high volume of notices rather than warrants, requiring someone to provide the very information that he’s referring to, and executed several search warrants during its investigation. These were used to obtain a large quantity of information, including cloud data and information from digital services. The court found many of the notices and warrants were unlawful as they were too broad in scope, lacked detail, or lacked relevance to the immediate investigation. The court ruled the evidence inadmissible and the SFO was unable to continue its prosecution.

In response to the court’s findings, the SFO made operational changes, including using more warrants—so they moved away from the notices and started using more warrants, which is almost counterintuitive to what the member was actually bringing forward and speaking about, which I can see why he’s brought that forward.

But they obviously started using warrants to give the judiciary more oversight in terms of what they’re doing, because, obviously, the legislation needed updating. Of course, in reaching its decision, the court highlighted issues with the SFO Act, that contributed to the unlawful exercise of powers. The reforms in the bill will resolve these issues and clarify the scope of the SFO’s search warrant powers.

Minister, I appreciate the analysis that you’ve relied on, and I think this is the problem, because I’ve read the regulatory impact statement and it only identifies half of the case. It alarms me, because you’re right that there was a misuse of section 9 notices, so they went to warrants. But the problems were twofold. The section 9 notice can’t be used to demand a device, and that bit is not fixed. So I get your focus on the warrant issue; I’m focusing on the notice issue. I guess my question is this. It’s a real short one, and then I’m going to sit down. Did the Government look at the issue and decide not to fix it or has it forgotten?

Just very simply, with advice from my officials, there are no changes to section 9. Section 9 was used in the Pikia case because the warrant section wasn’t fit for purpose, and fixing the warrant section creeps over reliance on section 9 notices.

Thank you, Mr Chair. I want to ask a couple of questions on clause 4(1). I just want to say that I really appreciate the Minister in the chair’s engagement so far. The first one is around the definition of “computer system”. I’m particularly looking at paragraph (a)(iii) and (iv). This touches on one of the questions I had in my second reading, which is around what happens if the thing that you’re trying to access, where part of it is here domestically within New Zealand and another half of it is maybe in an overseas jurisdiction—so, for example, when we’re looking at a computer system where any communication links between computers or to remote terminals or another device, and then later on it says between communities or remote terminals or any other device.

So when you are looking at, let’s say, two computers linked within, let’s say, a company’s intranet, one of them is here, and another one is maybe in the office overseas that you may potentially also need to access, what is the jurisdiction for the Serious Fraud Office (SFO) in that instance? Are they able to access both, or is the SFO able to access, with notice or with warrant, the physical object here, the physical computer here, the computer system that is digital or electronic, but cannot access the physical object on the other side because of the fact that it is in an overseas jurisdiction?

Furthermore to that question, it also then comes down to—I’m assuming that even if it’s something that is overseas, provided it’s in the hard drive, which is still technically considered as digital that that can also be accessed. So that’s my first question.

I learnt from the last session: it might be easier just to deal with them individually. On the first one, which was a very good question, to search a laptop, you obviously need to have physical possession of that laptop. A remote access search is for data and storage facilities. You cannot otherwise access and search. If we wanted to search a laptop in another country or another jurisdiction, then that would have to mean cooperation with that country or that jurisdiction to be able to do that.

Thank you so much. Second question is on the definition of “thing”. Now, I know that the Hon Dr Duncan Webb may have questions on here, but the first question I wanted to ask is, when you’re looking at “thing” being an intangible thing, although it specifies email addresses, it doesn’t specify social media accounts or, potentially, apps. Are those things considered “things”, being my first question?

The reason I mention that is there’s been, actually, a couple of cases reported here in New Zealand around the use of WeChat, for example, in some of the issues and particularly when it comes to misuse of legal advice and there’s also been scams and fraud, etc., and other things—so whether that would be considered.

A follow-up question to that is: if “thing” does indeed include things such as apps, does it need to include a specific app with a specific access of information—i.e., a password to that particular app—or could it be a collection of apps? The example I want to give is, let’s say we’re looking at Meta: when you’re looking at Meta, you can access Facebook and you can also access Instagram. Do you need to ensure that you need to have three different, I guess, warrants for those? And then within Facebook, you would divide into Facebook itself, but also Facebook Messenger. Meta also includes WhatsApp. So, in that case, do you need to spell those things out individually?

Picking up on Dr Xu-Nan’s points, I really don’t understand that definition of “thing” and the work it does, because if you think of an intangible thing, it’s often used in terms of, like, property. So a copyright is an intangible thing or information, an email, is an intangible thing. But it seems to be doing this weird work where it’s an email address or access or password. It’s just not a thing at all—it’s just not a thing. So I’d be interested in the Minister in the chair, actually—and I see he’s getting some advice—saying, “Oh, we’ve got to describe ‘thing’ as including an email address for such and such a reason.” You can imagine seizing an email, but seizing an email address doesn’t make sense.

So if you could explain that, that would be really good.

Yeah, thank you, Mr Chair. So to the member in relation to “thing”, could it include a Facebook account? It could include a Facebook account, for an individual issuing officer to determine. If OK, that would have to be specified in the actual application.

In relation to a “thing”, for the Hon Duncan Webb, “thing” is defined in the Search and Surveillance Act.

Thank you, Mr Chair. That is very helpful indeed. I just have one further question. The reason we want to analyse this and be able to clarify some of these is because, as we see with the Crown - Pikia case, one of the issues is that the breadth and also the vagueness of when that case came about and some of the issues around this. So we are kind of asking some potentially hypothetical but quite detailed questions, just so that, in that case, it’s clear and it’s on Hansard, on the record, the ministerial intent. This is also one of the reasons why we are asking quite a few specific questions.

Thank you, Minister, for your response, but I just want to double-check that you do have to specify, but I’m guessing you also need to specify regardless if a particular app has a linked account to another app as well. So, again, I’ll give you an example—that Instagram can be linked to Facebook. When something happens in Instagram, something happens in Facebook as well, which I’m sure many parliamentarians are familiar with. That would also then require two separate ones. I just want to clarify that that is the case.

I’m going to move on to clause 6 now, which is “Section 10 replaced”, noting that my colleagues may have other questions. I know that there were quite a few changes. This is the area where there were the most substantial changes during the select committee stage.

I want to move on just a little bit to clause 6, which inserts new section 10(5). One of the things that this came about is because we’ve heard submitters talking about if this is something that is going to be used as by the SFO in terms of the application for a search warrant, what are some of the safeguards when it comes to, in particular, I believe, the issuing officer. Here I just want to double-check whether the Minister—the select committee obviously added some safeguards here, and particularly when it comes to subclause (5)(c), on the information required is supplied to the issuing officer. But I do want to check with the Minister if the Minister considered if that safeguard is (1) sufficient; and (2) if there are other tools within the SFO that offers additional safeguard in this context?

Thank you, Minister of Police, for your time. Dr Lawrence Xu-Nan is in the same area as me in clause 6, which is replacing section 10 of the principal Act. That’s the application for a search warrant. On one level, that’s fairly procedural, but it’s also an important safeguard because the quality of the information supplied at the application stage largely determines how well the rights of individuals and businesses are actually protected later on.

What interests me within this clause is how these requirements work in the digital environment. For a physical search warrant, it’s usually obvious what’s being searched. It might be an office or warehouse or a filing cabinet. Increasingly, though, fraud investigations involve cloud accounts, digital platforms, and data that may be distributed across multiple servers and jurisdictions. In those situations, the challenge is making sure that the application is sufficiently precise so that an issuing officer understands exactly what access is being sought and why. I suppose my question there, Minister, is, in the case of cloud-based information or a digital platform, what level of specificity does the Minister expect? Excuse me.

CHAIRPERSON (Teanau Tuiono): Take your time. Have some water.

DAN ROSEWARNE: Does the Minister expect an applicant to provide so that an issuing officer can properly assess the scope and proportionality of that proposed search? Thank you.

CHAIRPERSON (Teanau Tuiono): Dr David—oh, sorry. The Hon Mark Mitchell.

Hon Dr Duncan Webb: Always late.

Yeah, sorry. Just very quickly, for Dr Lawrence Xu-Nan, for linked accounts, you would need to specify in the warrant application, so that would have to be specified; and yes, the safeguards are sufficient and it matches the Search and Surveillance Act. Just in relation to issuing officers to authorise Serious Fraud Office (SFO) warrants, the bill allows an issuing officer to authorise an SFO search warrant rather than being limited to a judge. Issuing officers also authorise search warrants for other law enforcement agencies under the Search and Surveillance Act, so that is covered under the Search and Surveillance Act.

I think Mr Dan Rosewarne has just raised this one, as well. A judge can be an issuing officer, but this role can also be performed by justices of the peace, community magistrates, registrars, or deputy registrars who have been authorised by the Attorney-General under section 108 of the Search and Surveillance Act. This allows for more efficient processing of SFO warrant applications than is currently the case.

Thank you. I don’t want to labour this too much, and to put this generally, I think the advice you got from your officials might have been a bit hasty, because “thing” is not defined in the Search and Surveillance Act. The Search and Surveillance Act defines “thing seized”, but it defines it in a negative way, as “not including anything made or generated by a person exercising a search or surveillance power (for example, photographs, drawings” and so on, so that’s not that helpful.

It strikes me that perhaps what we’re meaning by “thing”, including an email address or access information, is actually because the power of a warrant ends up being to search for and remove documents or other thing. It still makes it very odd, because you can remove an email from an email account but you can’t remove an access information such as a password, so I’m still perplexed by that, but I’ll leave it there. I just think that’s a shoddy bit of drafting, perhaps, that we failed in the Justice Committee to pick up.

The other question I have is a short one—a very short one. You note that if a laptop is overseas, you need the assistance of the foreign States. Equally, if you want, for example, access to somebody’s Google Maps, you need the access of the foreign State to access Google’s data in America. If there is a Microsoft cloud storage where all of the emails are stored, and it’s in California, do you need to use a power like the Mutual Assistance in Criminal Matters Act? Or are you saying that, via this piece of legislation, you can execute a search which essentially accesses information in a foreign jurisdiction?

Thank you, Madam Chair.

CHAIRPERSON (Barbara Kuriger): I must admit, all of you are going to have to keep me up to date with the clauses, because this “things” thing is over my head, and I’m glad the Minister of Police and you guys sort of understand it.

Dr LAWRENCE XU-NAN: Just for Madam Chair, the definition of “thing” is clause 4(1).

CHAIRPERSON (Barbara Kuriger): Thank you.

Dr LAWRENCE XU-NAN: We’re just seeking some clarifications, but I am currently on clause 6, replacing section 10, and my previous question was on clause 6(5). I’m now going to just move on to clause 10A, which is a little bit later, but I note that this is an area that the Hon Dr Duncan Webb has expressed a lot of interest in around section 9 of the Search and Surveillance Act (SSA), so I will leave that enjoyment to the Hon Dr Duncan Webb.

What I want to move on to is clause 10A(3), which is around the warrant. Now, one of the things that I think we did touch on—and I think this is something, from memory, that the officials, at least during the Justice Committee, gave some update on—was in terms in terms of consistency with SSA around the search warrant time where the search warrant is limited to 14 days. Indeed, if you are looking at clause 10A(3)(a)(i), it says, “a period specified by the issuing officer not exceeding 14 days”, but for consistency, it allows for a warrant to be authorised up to 30 days. What it doesn’t specify here, as you see in clause 10A(3)(a)(ii), is if the issuing officer is satisfied it is needed, but it doesn’t specify what that particular satisfaction implies. I think my question to the Minister is, how would one, in this case, satisfy the issuing officer that more than 30 days is needed?

The second question is that I do believe that, in clause 10A(3)(b), it says, “the warrant may be executed on more than 1 occasion, the number of times the warrant may be executed” must be contained, but is there a limit to that? I think, in my mind, I want to say six, but I cannot remember if that’s actually part of the SSA. That, I don’t believe, is specified in the bill here that I can see—if there is a limit.

The SFO officials are so good that they’re almost getting ahead of the questions that I’m getting. I just wanted to come back to the Hon Dr Duncan Webb’s question. For clarification, just have a look at section 97, because apparently in the Search and Surveillance Act, it does define “thing”. Maybe just have a look at that. Cloud-based information—a level of specificity is expected for that, and that is set out in new clause 10(2)(b), (c), and (d), and forms in Schedule 2 also set out the required detail.

The bill aligns the SFO powers for digital material with those of other New Zealand law enforcement agencies. This, again, sort of comes back to the question that the Hon Dr Duncan Webb brought forward. The issue of extraterritoriality and digital searches is a legally complex one where case law is still developing both domestically and internationally. In some cases, the courts have allowed for access to evidence stored overseas, particularly where the information was created in New Zealand or was interpreted to form part of a New Zealand computer system. In other cases, law enforcement agencies need to seek formal assistance through the mutual assistance in criminal matters regime.

Thank you, Madam Chair. I just want to turn to aspects of new section 10 and, in particular, the importance of the information given to the issuing officer. I must say, I didn’t actually realise that magistrates could issue warrants, so that’s something I’ve learnt. I also learnt this week that magistrates don’t have to be legally qualified, and, in fact, one of them is a real estate agent, which raises some concerns around the issuing of warrants. In fact, they can’t be lawyers.

I’m looking at the application for a search warrant, and one of the challenges for an issuing officer is, obviously, they’ve got to make an independent judgment that this warrant is necessary and proportionate and that its bounds are appropriate. One of the challenges I see is in subsection (3), which has what I consider to be an odd provision, which says, “The issuing officer … must not … require the Director to disclose the name, address, or any other identifying detail of an informant”.

One of the problems in the justice system generally is the reliability of snitches, right? That’s the pretty pejorative term—but, in particular, people who give information in return for favours within the system. Sometimes it’s favours within the prison system, sometimes it’s immunity from prosecution, or whatever. Now, if you’ve got someone who is being rewarded for cooperation—that’s a better way to put it—then the issuing officer should know, because it goes to the heart of reliability. In fact, if you were in court, there’s an obligation—if you’re fronting a witness who is being given some benefit for being a witness, the prosecution has to disclose the benefit.

Here you’ve got this very odd provision that does say—I want to be fulsome—that, yes, you can disclose if it’s necessary to assist the credibility of the informant and whether there’s a proper basis for issuing the warrant, but the onus is wrong. It should be that you should know the identity of an informant unless it’s necessary or in the interests of justice or for the protection or security of that person to not disclose it. This is actually saying, “Keep the identity of the informant from this quasi-judicial officer unless there are compelling reasons”—that should be flipped on its head. You should be fulsome and give full information unless there’s a very good reason for withholding it, not the other way around. I’d be interested to know—and the Minister may have himself experienced that in his previous life.

To Dr Lawrence Xu-Nan, 30 days might be needed for digital remote access searches which are time-consuming and require more than one entry. The number of entries are not specified in the Search and Surveillance Act; that would be specified in the warrant application itself. The select committee recommended amending the bill to allow for multiple entries and extended time frames to execute a warrant to better achieve the bill’s intent. Currently, the Serious Fraud Office (SFO) warrants can only authorise one entry in 14 days. Enabling the SFO extended time frames and multiple entries for the execution of a warrant is important in the context of digital searches. Searches of digital material are often time-consuming and can require multiple entries to search the data effectively. An issuing officer would need to be satisfied that either is necessary to carry out the relevant search. The SFO must therefore demonstrate the relevant need as part of the application process. These provisions will align the SFO with the warrant conditions other law enforcement agencies are subject to under the Search and Surveillance Act.

Thank you, Madam Chair, and thank you, Minister. I just want to jump on to clause 7 and, in, particular new section 12BA, which is on page 9. That’s “Identifications and notice requirements for remote access search”. I see that as one of the more important safeguards within the bill. Earlier clauses give the Serious Fraud Office (SFO) the ability to conduct remote access searches of digital systems that may never involve officers physically actually turning up at the door. Because those searches can potentially occur without the immediate knowledge of the user, this clause requires the SFO to notify the person once the search has been completed. The SFO must send an electronic message to the email address of the thing being searched and provide a copy of the warrant, record when the search started and finished, identify the person responsible, and provide contact details for inquiries. If the message cannot be delivered, the SFO must take reasonable steps to identify the user and provide the information in another way.

I support the intent. If this bill is going to authorise remote searches that may occur without somebody’s knowledge at the time, then a notification requirement is an important accountability mechanism. But the question I have is whether the safeguard remains effective in the real world. Fraud investigations often involve dormant email accounts, false identities, compromised systems, overseas platforms, or cloud services where the account holder may not be easy to identify. In those situations, the value of the safeguard then depends on whether the notification actually reaches somebody who can understand what has occurred and exercise their rights.

I suppose my question there, Minister, within new section 12BA, inserted by clause 7—it requires notification to be sent to the email address of the thing searched, and, if that fails, requires reasonable steps to identify the user. What does the Minister expect “reasonable steps” to mean in practice, particularly where the account is hosted overseas, uses false identifying information, or is otherwise difficult to attribute to a specific person?

Thank you very much. Just responding to the Hon Dr Duncan Webb: I have covered off—fairly fully—around issuing officers, but issuing officers is the same as the Search and Surveillance Act. Issuing officers are authorised by the Attorney-General. It’s really interesting that you raise the issue around informants, because, yes, you’d know that, actually, protecting the identity of informants is fundamentally quite important, but, as you’ve highlighted in the current legislation, if the authorising officer feels that it’s necessary to have the identity of the informant revealed, then that can be done under the Act. But I think the order is in the right way, and I think the select committee has obviously gone over that and has decided that that was the right thing to do. Informant provisions are contained within the Search and Surveillance Act, section 98(2)(b).

Thank you, Madam Chair. Just still on clause 6 but moving on a bit to new section 10B, which—again, you think it’s an admin clause, but it’s actually not. It’s about the retention of documents. It’s about how long documents have to be retained for. Where a search warrant is issued, they have to be retained for as long as there are proceedings for which the validity of the warrant may be in issue or on foot or, in any other case, two years. If there are no proceedings, you’ve got to keep them for two years, which, when you think this can be electronically stored, is actually quite a short period of time. I honestly don’t know why they are required to have it for two years, because the Serious Fraud Office file or the police file or whatever would last a lot longer than that.

But the one that really gets me is the other one, because if you’ve got a proceeding on foot—and I’m thinking of those cases, and we see them routinely, where you’ve exhausted appeals, and the poor person is in jail, and then five years later someone says, “Oh, that was a jack-up.” You get compelling evidence—and we’ve seen a case go through the courts recently, which was essentially on the basis that compelling evidence—that what was before the court was essentially a fraud in itself. If that’s the case, and you need these documents to show the innocence, or show the chain of events, then it does strike me that as soon as you’ve exhausted your Supreme Court appeal, you shouldn’t be able to put it through the shredder. I’m thinking that the Minister may actually see my point there, especially because in this modern world, it’s not much difficulty to scan a document and file it in a document management system.

I’m just responding to the question put forward by the member Dan Rosewarne in terms of notification requirements. Notification of remote access searches is the same. The requirement is in the Search and Surveillance Act. If unsuccessful, the Serious Fraud Office (SFO) must take steps to identify the person. Steps aren’t specified. In practice, the SFO usually has the access information from the person, so they’ll likely already know.

I’m following on from the Hon Dr Duncan Webb’s question. In addition, as the Minister’s seeking advice on new section 10B, I also just want to check whether the digital infrastructure of the District Court will also be able to be included here to encapsulate this additional power that it will have, and potentially when it comes to electronic written applications. Again, we’re talking about the fact that when we’re looking at the District Court, there’s still continual upgrades with the Te Au Reka programme, which has been delayed a little bit as well. I want to check whether there is the capacity for the District Court to undertake the additional aspect in 10B. My next question is a very short one. It seems clause 7—

Hon Mark Mitchell: Sorry, can I just interrupt the member. Can you just repeat the last part of that question?

Dr LAWRENCE XU-NAN: Oh. The last part is whether the District Court under new section 10B has the infrastructure to be able to undertake what is required in that clause.

For clause 7, section 12A, I want to just make sure I don’t forget this one. This is one of the questions I indicated in my second reading around some of the concerns with the new insertion of “entry” as part of the use of reasonable force. This is new section 12A(1)(c). I did mention quite a few things and had a chat with the Minister as well, so I just want to see if the Minister has any clarifications on that particular part, and I may have further questions for the Minister.

To very quickly come back to the Hon Dr Duncan Webb. Retention of documents is under new section 10B, inserted by clause 6. It’s for the court to retain documents, so records of warrant applications. The same requirement exists in the Search and Surveillance Act. If I cover off very quickly, too, with Dr Lawrence Xu-Nan: the court already must do this for search and surveillance, so the court already has capacity to be able to do this.

I’m just going to shoot back to clause 7, following on from my colleague Dan Rosewarne’s question about the execution of search warrants. This clause replaces section 12 and establishes the operational powers associated with executing warrants. With regard to the scope of that search, I wanted to ask the Minister: how will the Serious Fraud Office manage searches where a device or a cloud account or something along those lines contains very large volumes of what is also personal, privileged, or plainly irrelevant information, along with the information that may be more relevant? Is there any requirement to use search methodologies designed to somehow minimise access to that type of almost inevitably irrelevant material?

Hon Mark Mitchell: Madam Chair.

Hon Dr Duncan Webb: Madam Chair.

CHAIRPERSON (Barbara Kuriger): Honourable Minister.

Hon Dr Duncan Webb: He just wants me to get more exercise.

Hon Mark Mitchell: Ha, ha. I don’t want to get behind that story.

CHAIRPERSON (Barbara Kuriger): It is easier, rather than getting a backlog of questions. I like it this way; it’s the best way to run a committee.

Yes, I agree. Coming back to Dr Lawrence Xu-Nan and the use of force. The Serious Fraud Office (SFO) could already use reasonable force to access a place to search it. This amendment bill does not change the SFO’s powers in that regard. It simply uses the more modern language in the Search and Surveillance Act to grant the SFO the same powers it had before.

Thank you, Madam Chair. I can see my colleague behind me who is leaping up is ready, so thank you for giving it to me.

CHAIRPERSON (Barbara Kuriger): That’s all right. He’ll get a turn.

Hon Dr DUNCAN WEBB: I’m just actually interested—and it’s almost a practical explanation, because throughout the legislation, it refers to in new section 12C(1) “Every person (other than a constable) called on to assist”. I understand that constables, of course, have statutory powers, but I’m interested in these people who are “called on to assist”, and how that fits into the wider framing of the bill. In particular, are these people intended to be employees of the Serious Fraud Office, or perhaps even contractors—it could be, I imagine, those guys from KPMG with little wire-rimmed glasses who are called on to assist. I can understand that, but in terms of the actual search itself—the physical search, not just a forensic, electronic search—is there a power to compel people to assist?

For example, to use the situation I had before, if you’re in a domestic setting and the man of the house is under suspicion, can you call on his spouse to assist? Is that calling on someone to assist? I get that they can’t obstruct, and you can say, “Go and sit over there,” but can you say to someone else in the house, “I require you to assist me. Where are all the cellphones? Where’s the laptop? Where’s the notebook by the phone—the old-fashioned way?” I’m curious to understand how the search works. Who is the person who’s the primary searcher—because it’s all about the director, but having met the director, I don’t think she’s going to be doing it—then you’ve got the person called on to assist. I’d actually be really interested to understand: who’s the person who obtains the warrant and conducts the search, and who are the people who are called on to assist?

I’ll just come back to the member Dr Tracey McLellan’s point, which had been partly covered earlier, but under the current settings, there is legal uncertainty for the Serious Fraud Office (SFO), as to their ability to seize and search digital devices and digital material. This is because the SFO can currently only search a place. In an environment where fraud is almost exclusively carried out digitally, it is important that the SFO can search digital devices, and material effectively.

While I’m up, just coming back to—the officials are probably doing some work on this anyway—but in relation to a warrant that the SFO is executing, obviously that’s going to be in the SFO’s name. They’ve got the warrant. No one can compel anyone to do anything they don’t want to do. Obviously, if they’re the subject of a warrant, and they’re required to provide something, then the expectation is they will, and there are consequences.

Will the SFO take someone who has got, as you’ve just highlighted, expert capability or experience in a certain field, because the area that they operate in is very complex. In fact, the SFO probably operates in the most complex world, in terms of law enforcement and protecting our country, so it’s highly likely that they would need to call on that expertise. What is codified in the legislation is the SFO has got the ability to exclude someone from being at that location while the execution of a warrant is being undertaken.

Thank you, Minister of Police. I just want to stay on clause 7A for a moment, inserting new section 13A, which is at the top of page 2, and that’s the “Disposal of forensic copies”. That deals with something that sounds technical, but it goes directly to public trust in these powers, and it requires the Serious Fraud Office (SFO) to destroy forensic copies if it determines that the data does not contain evidential material. However, if a forensic copy contains a mixture of relevant and irrelevant material, the entire copy may be retained and can continue to be searched. The question there, Minister, is, what safeguards exist to ensure that information, which is clearly unrelated to the investigation, is not unnecessarily retained or repeatedly searched simply because it happens to sit alongside relevant material. Thank you.

Thank you, Madam Chair. Thank you, Minister of Police, for your responses; they’ve been excellent thus far. Also, I believe that the word of the day is “territoriality”, just from what the Minister was saying before.

CHAIRPERSON (Barbara Kuriger): I thought it was “things”.

Dr LAWRENCE XU-NAN: Oh, it could also be “things”.

CHAIRPERSON (Barbara Kuriger): I’m still trying to work out “things”.

Hon Mark Mitchell: What was the word of the day?

CHAIRPERSON (Barbara Kuriger): “Territoriality”.

Dr LAWRENCE XU-NAN: The word of the day is “territoriality”.

Hon Mark Mitchell: Oh, yeah—you did a much better job of it than me.

Dr LAWRENCE XU-NAN: Anyway, in terms of my questions, I just have two quick questions. Thank you for the response to clause 12A(1)(c) regarding “entry and search”. One quick question is on clause 12A(1)(a), when it talks about “enter and search…on the number of occasions and within the period set out in the warrant:”, and I’m assuming, based on the discussion before, that the period can be no more than 30 days, if that’s correct?

My second question is on clause 12BA—this is the bottom of page 9, line 33-ish—and clause 12BA(1) does say that “Every person…who executes a warrant…must, on completion of the search, send an electronic message to the email address of the thing searched”—Madam Chair’s favourite word—and the criteria are clear, but what I don’t know at this stage, if the Minister wouldn’t mind clarifying, is that we talked about social media accounts, but what happens if the thing that is being searched doesn’t have an email address? Or, for example, is it a recovery email address, which many social media accounts—X, etc.—would also contain? Let’s say we’re looking at WeChat or WhatsApp, or other forms of apps, it may not have an email address attached to it. How, then, would the person send an electronic message in those instances? Because email address is kind of specified here in clause 12BA(1).

Just to address the member Dan Rosewarne’s question around admissibility rules for unlawfully obtained evidence: in New Zealand and most other comparable jurisdictions, unlawfully obtained evidence is not automatically excluded from proceedings. Instead, a judge will evaluate whether the evidence should be admissible based on tests set out in legislation and case law.

Currently, the test in the Serious Fraud Office Act requires that the unlawfully obtained evidence must be ruled inadmissible and destroyed unless the court is satisfied that there is no unfairness in obtaining the evidence. The test sets a high bar and is out of step with the more modern test set out in the Evidence Act. The updated approach in the bill uses the test in the Evidence Act, enabling the court to consider a wide range of factors when determining what evidence can be included in a prosecution. The test includes factors as to the quality of the evidence, the seriousness of the offence, and whether urgency or safety was a factor in how the evidence was obtained.

Thank you, Madam Chair. That, actually, is probably one of the most important parts of this legislation, because the Minister of Police just kind of skimmed over the—and I don’t mean in a rude way, Minister—radical change in this piece of legislation, which, in its current form, says that illegally obtained evidence is not admissible. That is, in other jurisdictions, a very normal rule. In the United States, it’s called the fruit of the poisoned tree rule. You can’t use the fruits of the evidence that was poisoned by illegal activities. For quite some time in New Zealand, we’ve had a different rule in most cases. Under the Evidence Act, we’ve got the Steven Joyce rule, which is that you can use it if it’s only a little bit illegal.

CHAIRPERSON (Barbara Kuriger): I think it was “pretty legal”.

Hon Dr DUNCAN WEBB: Yeah, “pretty legal”. Yeah, it’s not quite the Steven Joyce rule, but it is actually a very significant shift, particularly where these cases depend almost entirely on piecing together evidence. The fruit of the poisoned tree doctrine is premised on the fact that we don’t want to have any incentive whatsoever for a breach of the rules, because the fact of the matter is that officers know that if, for example—to use another search example—you pop around to the back door rather than knocking on the front door, you’re much more likely to find incriminating evidence. That’s an illegal search, because you’ve got no right to go round to the back door of someone’s house. Everyone knows you knock on the front door. But because you know it’s a minor infringement and you might find really compelling evidence, you think, “I’ll do it anyway because the evidence will be admissible.” You’re actually giving an incentive to officers to get evidence in a way that is illegal.

Now, the court will take into account if they’re like, “Yeah, I knew the rules, but I thought I’d do it anyway.”; that’s actually a relevant factor in whether or not you accept this. But it is a concern to me that, in this section, it’s kind of anodyne. It just says, “Oh, we can apply section 30 of the Evidence Act.” Well, section 30 of the Evidence Act says that illegally obtained evidence is admissible if its probative effect outweighs the illegality, because it is illegal. It’s not entirely unique to New Zealand, but it’s out of step with most democracies which adhere to the rule of law. I can see all the pragmatists in the room going, “Bloody human rights lawyers, aren’t they a pain in the arse?”, but it is problematic if you have rules which you only have to follow in a kind of “pretty legal” kind of way. I know the Minister entirely recognises that enforcement agencies need to maintain the trust and confidence of both the citizenry and the courts, and it’s a challenge when it’s not uncommon for enforcement agencies to come to court and say, “Yeah, we accept that we broke the rules but we want to use the evidence anyway again.”

If I go back to Dr Lawrence Xu-Nan’s forensic copies and what safeguards exist—in Serious Fraud Office (SFO) operational practice, only relevant material is made available to investigators. Irrelevant material is held separately and needs to be balanced with the need to preserve evidence. On notification requirements on emails: if no email address is available, then they must take reasonable steps to identify one, but these aren’t specified.

Sorry, Madam Chair, I just wanted to come back—

CHAIRPERSON (Barbara Kuriger): I just want people over here to know that we’ve still got a couple of unanswered questions here, so I’m not going to be closing until we get those.

Hon MARK MITCHELL: Hopefully I can help you with that, Madam Chair.

CHAIRPERSON (Barbara Kuriger): I’m sure you can. You’re doing a good job.

Hon MARK MITCHELL: Thank you. Coming back to the Hon Dr Duncan Webb—who’s acknowledging his experience in law as a professor, I think; it’s almost like you’re asking the question to me and then answering it, as well—around the fact that the updated approach in the bill, and I’ll go through this again, uses the test in the Evidence Act, which he has referred to, enabling the court, which is the critical thing, to consider a wider range of factors when determining what evidence can be included in a prosecution. The test includes factors such as the quality of the evidence, the seriousness of the offence, and whether urgency or safety was a factor in how that evidence was obtained.

Thank you, Madam Chair, and I just want to ask a couple of questions, one going back slightly—indulge me, because I didn’t quite get a chance to ask and it’s quite quick—and another one just following up on the Minister’s last response.

Clause 7, the remote access search authorised by warrant issued under Part 2—does that remote access permit the Serious Fraud Office (SFO) to access information that’s stored overseas? I don’t know if you may have answered that—

CHAIRPERSON (Barbara Kuriger): The Minister’s actually just said yes.

Dr TRACEY McLELLAN: Yes, it is. So how does that provision interact, therefore, with some of the terms and conditions of those systems of overseas cloud service providers, and what happens if a remote search inadvertently accessed an account or a data set that falls outside of the warrant? That’s of interest to me.

Then just going back to that last response to the Hon Dr Duncan Webb’s question about section 30, that balancing test for criminal procedures. Whilst that answer was interesting, I’m still not sure it sufficed for the overall question. In doing that, could the Minister provide some sort of example of evidence unlawfully obtained that would currently be excluded but might be admitted under this new test, if that was the case? So those are my two questions.

I think what’s happened is the legislation has updated the way that evidence is held and treated by the Serious Fraud Office (SFO) and the arbiter of that is actually the court. I can’t give you any operational cases because the work they do is—I don’t get briefed on the detail on it, I just know that it’s very complex in terms of the work they do.

I don’t know if the member is in the House; I’m not sure. I will say I don’t know when I went back to the issue, as Dr Lawrence Xu-Nan said, that the word of the day is “territoriality” and digital searches is a legally complex one where case law is still being developed, both domestically and internationally, because of the complexity around it.

Dr Tracey McLellan: I was probably beguiled by the word; I missed that.

Hon MARK MITCHELL: Yeah. As you’ve highlighted, it’s deeply complex. Are you happy with that?

Dr Tracey McLellan: Yep.

Thank you, Madam Chair. I’ve actually got a very short question and it’s around the forensic copies. New section 13A talks about disposal of forensic copies that don’t contain evidence, and then it talks about forensic copies that do contain evidence. My question, in its most simple form, is: how long are you allowed to keep that for? If you have a prosecution—so this is going to be personal information about people’s financial affairs, and if you choose not to prosecute, how long can you keep it for? If you prosecute and are not successful—so you get a not guilty verdict—how long can you keep it for? And if you prosecute and you send them away, presumably you keep it indefinitely.

I’m particularly interested when you get this information and you make a prosecution decision that is “No, we won’t prosecute”. You’re going to get rid of the search warrant in two years—the application for a search warrant. What’s the time limit for holding this information, which is, in fact, information private to the person you’ve seized it from and who isn’t going to be prosecuted?

The officials will probably be able to give us some more clarity, but on first brush on that one—and the member would well know that a decision to prosecute may be delayed dependent on the evidence and dependent on the confidence around the gathering of more evidence that reaches a threshold to actually take the case and prosecute; that would be no different in the case of the Serious Fraud Office, as well.

To clarify, my point is that agencies—any prosecuting agencies have a decision point where they do an evidential threshold test, they run through the elements of the offence, they do a public interest test, and they actually make a call. When they’ve made that call, it’s not a call that they can’t revisit if new evidence comes in, but at that point they’ve made a call not to prosecute, perhaps because they haven’t got enough evidence and they’re still sitting on this pile of private information. I can see you’ve had some advice.

Thank you, Madam Chair. I think the point that I was making is that there may be a decision not to prosecute on this date due to the evidence that’s been assessed as not meeting the threshold that they want to progress with a prosecution, but it doesn’t mean that they may not have some additional evidence in the near future or in the future that they could bring a prosecution. To answer the question, forensic copies that contain evidence could be kept indefinitely, and this is completely compliant and in line with the Search and Surveillance Act.

CHAIRPERSON (Barbara Kuriger): Dr Lawrence Xu-Nan—I know you’ve got a couple of really short, quick questions.

This is my last question for this part, and I specifically want to look at clause 2(1) of Schedule 1. In effect, the clause that the Hon Dr Duncan Webb mentioned around the inadmissibility of evidence applies here when it comes to 2(1). It says that that clause 22(3), subclause (a) applies to anything before commencement. That would include—if no charge has been laid, I would guess section 22 would be applicable, if that’s correct.

The second question is, I would assume this also includes appeals of previous judgment—in that case, if the appeal cannot appeal beyond the basis of inadmissibility of evidence that now under section 22(3) in clause 8, it would actually make something that was previously inadmissible admissible. Would that be a possibility? That would make things quite serious.

CHAIRPERSON (Barbara Kuriger): Minister, have—

Dr Lawrence Xu-Nan: Point of order.

CHAIRPERSON (Barbara Kuriger): The Minister is just telling me that he doesn’t have the information, so we’re just going to take one call from Tracey McLellan while we’re getting the information.

Very quick, yep.

CHAIRPERSON (Barbara Kuriger): Then I will be looking to wind up.

Dr TRACEY McLELLAN: And I can soak up a little bit of time until you get that advice. I just wanted to ask a follow-up question with regard to those forensic copies. In that case, if you can hold information indefinitely, what happens to the material that’s subject to legal professional privilege or other types of protected information that might be contained within that forensic copy? I don’t suppose it’s really that relevant to how long it’s held for, but either way, that privileged information that could be contained in that—how does that get handled in those circumstances?

To Dr Lawrence Xu-Nan: new section 22 will apply to any charges filed after enactment and the appeals are subject to the old test—so it’s the same as the old test. To the member Tracey McLellan: at the end of the day, forensic copies that contain evidence could be kept indefinitely—they can be kept indefinitely. This is the same as in the Search and Surveillance Act.

CHAIRPERSON (Barbara Kuriger): You haven’t answered around the legally privileged question; that’s the only thing I was just waiting for.

Hon MARK MITCHELL: It’s the same.

I move, That debate on this question now close.

A party vote was called for on the question, That the question be agreed to.

Ayes 67

New Zealand National 48; ACT New Zealand 11; New Zealand First 8.

Noes 36

New Zealand Labour 25; Green Party of Aotearoa New Zealand 9; Te Pāti Māori 1; Kapa-Kingi.

Motion agreed to.

CHAIRPERSON (Barbara Kuriger): I will remind people on both sides of the Chamber: we don’t speak during voting.

Part 1 agreed to.

Committee of the whole House

Part 2 Amendments to other enactments, and Schedule 2

CHAIRPERSON (Barbara Kuriger): Members, we come now to Part 2, which is the debate on clauses 10 to 13—“Amendments to other enactments”—and Schedule 2. The question is that Part 2 stand part.