Crimes Amendment Bill (No 6)

, on behalf of the Minister of Justice: I move, That the House take note of the report of the Law and Order Committee on the Crimes Amendment Bill (No 6). The progress of this bill is very important. The decision was taken to divide the bill. I think that the faster this bill progresses through the House the better.

I understand that this is a commentary on the report of the Law and Order Committee on this legislation, so I thought I might just set the scene by walking members through some of the issues it addresses, to begin with. I understand that Supplementary Order Paper 84 endeavours to strike an appropriate balance between individual privacy and the interests of the State in detecting crime and ensuring security. Of course, that is always the most perplexing issue when we are trying to strike a balance between individual rights and the greater public interest.

In particular, I want to draw members’ attention to the main amendments on the Supplementary Order Paper: those to clause 19 that introduce the new computer offences of intentionally accessing a computer system without authorisation, commonly known as hacking. I want to dwell for some time on that issue, because I think it has extreme significance for us in our everyday lives. I do not think I need to remind members of the House of the importance of computers in everyday life. They regulate, if not everything, then a significant number of things that we take for granted. They probably regulate most buildings—they certainly regulate the electricity system. They regulate credit cards, and they regulate security—in fact, the security and regulation of the very building that we are in at the moment is probably very reliant on our computer systems. If anybody or anything got involved in hacking into those systems, it could be quite disastrous.

The other areas I want to dwell on in terms of hacking are the concerns I have that fit roughly into the categories of terrorism and theft, and particularly credit card theft. The ability for someone to get into other people’s systems, whether they are personal computers, State systems nationally, or, for example, airline systems, could be quite disastrous. We can look at the terrible tragedy that has befallen the good folk of Christchurch and Lincoln, with the plane that crashed coming into Christchurch last Friday evening, and we can just imagine—and I draw no connection between that crash and this issue, by the way—the consequences if it came to pass that that crash was the result of someone hacking into on-board systems. That type of exposure could run through our airline industry more broadly, to the point where people felt totally unsafe to fly.

I see by reading the commentary on the bill that the legislation was first introduced in September 1999, and I think it is incumbent on members of this House to now work towards trying to expedite its passage through the House, because of the significance of this legislation. I want to make it very clear that National’s position is that we support this legislation.

I have already dwelt on the fact that terrorism is something that can be related to computer hacking. The other thing that concerns me is theft. Members can imagine the state of our commerce if people could hack into our systems at will and pick up our credit card numbers, for example. I do not have a high credit limit, so I would not risk a lot of exposure, but I am sure that someone like Rodney Hide or David Carter, who are very wealthy individuals, would feel very exposed.

The importance of computer systems to the New Zealand economy is something that we cannot understate. In fact, I do not think that we can overstate it, either. It is of high importance—even extreme importance—and it is a growth area. Electronics, and particularly e-commerce, are critical if we are to develop and flourish as a nation. I say to members of this House that unless we put some sort of punitive measures in place to deal with people who think they can hack into computer systems at will, then we will have high exposure. If we are to develop e-commerce in this country, people need to feel that it is as secure as real commerce. If we cannot guarantee and demonstrate that to people who are thinking of investing in this country—companies like EDS, for example—then I think we will have great difficulty in attracting those types of people to our businesses and in retaining them. I believe we need to be very cognisant of that type of foreign investment.

The other issue I would like to raise, in particular, is that I notice clause 16A on Supplementary Order Paper 85 amends the definition of private communications, by extending it to emails and faxes. We rely heavily now—and I am sure I am speaking on behalf of most people in this House—on emails, faxes, and pagers, etc. in order to be able to conduct our daily business and, probably, our daily lives. There is a term in the industry called “freeking”—not spelt the way it might sound—which describes the ability to hack into our telephone systems and seize control. In fact, it has the ability to alter control systems, listen into conversations, and gather data at will. Unless we make it very clear that those types of actions will not be tolerated and, as I have said, put some punitive penalties in place, then I do not think that we will be able to conduct our business in the full knowledge that what we are doing is secure. The ability to alter telephone accounts and the ability to gather information at best could be a disturbance, and at worst could be anti-competitive. Members can imagine what would occur if there is the ability to hack into a competitor’s business lines and communications systems. The damage that that would do to this country would be immense.

So I support and recognise the good work that the people on the select committee have done. I understand that Richard Worth, in particular, is to be recognised as having made a very significant contribution to this select committee. I would like to think that the members of this House will work collectively in order to try to ease the passage—in fact, to progress the passage—of this legislation through the House.

One of the things that also disturbs me is an incident that happened overseas last year. Some members in the House might remember that an American spy plane went down over Chinese territory. One of the consequences of that was that emotions ran very high, and it was reported that the Americans became so concerned with that occurrence that people—Americans, primarily—were hacking into Chinese computer systems, changing data, and actually bringing down systems.

💬 John Carter: Yes?

Yes, they were doing that. That type of action cannot be tolerated. Hacking into one another’s computer systems and sites could do immense damage. It would undermine the international confidence in computer systems and networks, and that would do immense harm to the industry.

I have touched on the dangers that hacking into on-board flight systems on aeroplanes could do. Which members would get on an aeroplane and fly if they did not have some confidence that those systems were secure? Which members would get on an aeroplane if they felt that they would fail to arrive safely at their destinations because this Parliament had not taken the opportunity to deal with those types of hackers, put penalties in place, and send out very clear messages that that type of activity would not be tolerated?

I raised the fact that this bill was first introduced in 1999. The world has moved on quickly since then, and, moreover, it moves on more quickly in the area of e-commerce and the computer world than in other areas. As a parting thought, I say that this legislation, which I wholeheartedly support, needs to be frequently reviewed in order to keep pace with the changing nature of the industry. There is no point in dusting this legislation off and thinking that we have done our job as a Parliament, if we do not continually look at it on a regular basis. My experience in the industry suggests that every 2 or 3 years it would be appropriate to do that.

I would like to thank the Law and Order Committee for its consideration of, and its improvements to, this bill. This is an important bill. It amends Part 10 of the Crimes Act, which deals with offences against rights of property, and it includes the addition of some new computer offences. It also amends Parts 9A and 11A of the Crimes Act, to deal with the interception of offences and provisions relating to police interception warrants respectively.

The bill is intended to modernise and update the property offences, and particularly to ensure that they cover property crime involving computer technology adequately. That, as the previous speaker said, is a quickly changing area. Part 10 of the Crimes Act currently contains over 90 different property offences. Many of those offences have not been updated since the Act was passed in 1961—42 years ago. That part now has gaps and areas of uncertainty in its application to computer-related crime. Last year, the Council of Europe approved a convention on cyber-crime, which is the first international agreement on computer crime. Once this bill is enacted, New Zealand will have comparable offences to those set out in the convention.

The amendments relating to police interception warrants will help the police to deal with organised crime, and at this time when the problem of drug trafficking is rife it is essential that we have those extra powers. Currently the police, when acting under an interception warrant, can only intercept oral communication and cannot intercept text messages, emails, or faxes.

Many of the submissions to the Law and Order Committee raised privacy concerns. The committee carefully considered those concerns and concluded that the safeguards provided in the bill, together with the existing statutory safeguards, are adequate to ensure that personal privacy is balanced appropriately with the right of the State to protect its citizens. I believe that this bill will strengthen privacy interests by criminalising some activity that is not currently criminal, such as intercepting non-oral private communications and accessing computers without authorisation. While it exempts certain State agencies from criminal liability in some circumstances, those exemptions relate either to existing powers or to activities that those agencies could presently undertake without specific authorisation. Moreover, the exemptions are placed on a clear statutory footing and are hedged with appropriate safeguards.

I look now at the main changes that the bill makes, firstly in relation to property offences. The bill creates a number of new computer offences relating to theft and fraud committed by use of a computer, damaging the data and software in the computer system or denying service to an authorised user of the system, and selling, distributing, or possessing computer hacking programs. It also creates the offence of accessing a computer system without authorisation. The bill contains another new offence, that of taking, obtaining, or copying trade secrets. The essence of that offence is wrongly acquiring something such as a document, plan, model, or diagram that is of commercial value, with the intention of obtaining financial gain.

A number of changes are being made to existing property offences. In the offence of burglary, the phrase that is well known in the courts of “breaking and entering” is replaced with “entering without authority”. That will remove technical arguments as to what constitutes a “break”. Removing it also means a separate unlawful entry offence will no longer be needed. The offence of blackmail broadens the current offence of extortion by certain threats. The new offence will apply to any threat of disclosure. At present, the threatened disclosure must relate to sexual or criminal conduct. The scope of the threat has also been widened to cover a threat to cause serious damage to property or to endanger the safety of any person. That addition will capture certain types of industrial blackmail, such as a threat to contaminate a product unless a company does what the blackmailer wants. Regrettably, there has been a trend towards that form of criminal activity across the world.

The offence of obtaining by deception, or causing loss by deception, replaces the current offence of false pretences. That will cover a broader range of financial benefits than the current offence, and the element of causing loss is also new. A number of offences have also been broadened so as to include liability for reckless, as well as intentional, conduct—for example, obtaining by deception or causing loss by deception, a false statement by a promoter, receiving, and money laundering.

There have been a number of changes to the interception offences and police interception warrants. Currently, it is an offence to intentionally intercept any private communication by means of a listening device. The definition of “private communication”, however, limits that offence to oral communication. The main amendment the bill makes is to extend that definition to any form of private communication. The offence will then cover, for example, unlawfully intercepting emails and faxes. The police’s interception warrant provisions are similarly amended, so that the police will be able to intercept emails and faxes as well as oral communications when acting under an interception warrant.

I would like to emphasise that all the existing conditions of obtaining an interception warrant must still be complied with. In fact, the committee added further safeguards to police interception warrants. A definition of “facility”, to allay concerns that that word would have allowed the police to intercept an entire Internet service provider’s communications, is the first example of those safeguards. That was never the intention, but the amendment makes it clear that the definition of “facility” is to allow the police to specify an email address or mobile phone number, for example.

Two additional requirements are added to the information that the police must include in their annual report to Parliament concerning interception. The first is any use of their emergency powers to intercept communication, and the second is the number of interception warrants that do not result in any charges being laid within 90 days following expiry of the warrant.

The select committee has also added further safeguards to the exemption from the interception offence for telecommunications operators and Internet service providers. An offence of unlawful disclosure has been added to back up those safeguards. The recently enacted Government Communications Security Bureau Act included an exemption from the interception offence for a bureau employee acting under the authority of, and in accordance with, the Act. That Act also revoked the previous exemption, which was by regulation. The passage of that Act means that a number of provisions in this bill can now be omitted.

I refer the House to Supplementary Order Paper 193 and its replacement, Supplementary Order Paper 84. Supplementary Order Paper 193 was issued on 2 October 2001 to make some refinements to the definitions of “intercept” and “deception”, and to the requirements that communication providers must meet regarding interception. That Supplementary Order Paper was replaced on 6 May this year by Supplementary Order Paper 84. Many of the amendments on that Supplementary Order Paper are stylistic or are needed to take into account the passage of other legislation. I could use as examples the Telecommunications Act, the Sentencing Act, the Crimes Amendment Act 2002, and the Government Communications Security Bureau Act. There are, however, a few amendments of substance, and I will finish by mentioning them briefly.

With regard to the interception offences, the definition of “intercept” has been refined. Some words about the parties to the communication have been omitted. They are not necessary as they are already covered in the principal Act. Some rationalisation has been made to the exemptions from the interception offences. Currently the bill has exemptions for telecommunications network operators, and for Internet and other communications providers. The latter exemption is broad enough to cover telecommunications providers, so there is no need to retain two separate exemptions. The select committee inserted a new offence prohibiting the disclosure of the existence of an interception warrant. As a result of concerns expressed that that offence was too broad, the Supplementary Order Paper narrows it.

Finally, amendments have been made to three property offences. As a result of further consideration, some rationalisation has occurred in the fraud offence of obtaining or causing loss by deception. As a result of public concerns, amendments have been made to two computer offences in order to clarify the criminal intent required. Those are the offence of damaging or interfering with a computer system, and the offence of making, selling, distributing or possessing software for committing crime.

I commend the bill to the House.

This bill does contain some good updating of the criminal law, but the exemptions from the interception offences—the exemptions for the police and intelligence agencies—do authorise a huge State intrusion into our privacy. Privacy is not something that is abstract. We rightly feel violated when someone intrudes into our private life, whether it be by peering into our home, going through our personal things, or, in this case, reading our private emails or hacking into what we might have on our computers. Catching criminals does involve some intrusions on our privacy, but any extension of police powers in this area must be governed by the proportionality principle: that any new intrusion on privacy must be proportional to the additional community benefit derived from it. We should generally favour the alternative least intrusive means of catching criminals. I sat on the Law and Order Committee when it was discussing the bill, and there was simply no data, statistical or anecdotal, provided to the committee on how many additional criminals might be caught by giving these extra powers to the police and the intelligence services.

This new power is much more dangerous than the interception powers previously granted to the police and the intelligence agencies to intercept mail or telephone calls, because we use email and computers so much now. The volume of the communications that we send and receive has multiplied tremendously. The technology of email interception is so cost-efficient compared with opening mail, for example, that it can be done in a massive way, particularly when less tolerant and less democratic-minded Governments are in power. It also catches many third parties, other than the people who were specifically targeted. Every month there are hundreds or thousands of people who send emails to each of us, and whose privacy would be compromised if we were targeted.

That combines with another problem identified by the Privacy Commissioner of Canada, George Radwanski, that “The more information Government compiles on us the more of it will be wrong. That is simply a fact of life.” There are many ways that information can be mistaken or wrongly interpreted. It can simply be the result of errors, loose language, or the way in which we might use irony in our emails. It may be that, as the Canadian privacy commissioner states: “You are passing time browsing on the Internet and you are idly curious about what kind of propaganda in favour of al-Qaeda various extremists might be putting out. But could visiting such websites get you identified as a potential terrorist yourself?” Anyone can accidentally get caught up in the surveillance net. As the Canadian privacy commissioner also states: “The bottom line is this. If we have to live our lives weighing every action, every communication, every human contact wondering what agents of the state might find out about it, analyse it, judge it, possibly misconstrue it, and somehow use it to our detriment, we are not truly free.”

We should also knock on the head the silly argument we often hear that if we have nothing to hide, we have nothing to fear. The Canadian commissioner correctly states: “The truth is that we all do have something to hide, not because it is criminal or even shameful, but simply because it is private.” He goes on to state that “the right not to be known against our will, indeed, the right to be anonymous except when we choose to identify ourselves, is at the very core of human dignity, autonomy, and freedom.”

So using the proportionality principle, I say there is a huge downside to granting these extra powers to the police, the SIS, and the Government Communications Security Bureau. What is the upside? Yes, we may catch some extra criminals. There may be a few; we just do not know how many. But we do know that the really big fish will generally avoid email detection through sophisticated means such as using anonymisers, cyber-cafes, hotmail addresses, code words, impossible to break encryption, or throwaway cellphones.

We could even say that in some respects the new concentration on electronic surveillance could weaken policing. What seems to be happening in places like the United States is that the spook agencies are increasingly relying on electronic intelligence, to the detriment of real work on the ground. The United States National Security Agency has a huge budget, but it does not seem to know very much about what is going on in the United States or in other countries. In places like Iraq, it seemed to be pretty poor in its intelligence concerning the war.

Also, when I was on the Law and Order Committee I offered some suggestions about constraints on the powers of the intelligence agencies and the police. For instance, I said they should adopt some of the best-practice constraints from overseas. But the committee threw out, for example, a suggestion for auditing email interception warrants based on the procedures of the Commonwealth Ombudsmen’s office in Australia. At least we could have had those constraints. The committee also turned down my amendment to inform those suspects against whom no charges were later laid that their communications had been intercepted, in case those interceptions had some subsequent impact on their lives and they could track back where that impact came from. The FBI in the United States does have such a notification procedure.

The committee also tossed out the Privacy Commissioner’s suggestion, which I supported, that the police do not need the power to hack into people’s computers—the remote-access power—because they already have the power to search properties under warrants and to look at computers, and have done so frequently in the past. So the police do not need this new power. It is quite spooky to think that an agency could access a person’s computer remotely under this exemption for the police and intelligence agencies, without the person even knowing it. Indeed, Australia has a provision for its intelligence service to change people’s files so as to hide its entry. The problem is that the committee said these provisions would allow us to catch more criminals, and that we should simply trust the intelligence agencies. We just need to look at the history of intelligence agencies to know they do make mistakes, including some in New Zealand, which had the David Small and Aziz Choudry cases. The agencies did make mistakes, and both those gentlemen won awards from the courts against the police and the SIS, respectively.

What is happening here, through the granting of these powers, is an additional move down the road towards what many people are worried about: the move towards creating more of a surveillance State. We see that in other forms, too. A lot of these measures are generated out of the United States and the track it is going down with its Department of Homeland Security. We are having imposed upon us other privacy intrusions, such as those reported in the paper recently—that is, when we visit the United States next year we will need to have fingerprint data on our passports to enter that country, and possibly other biometric information provided on our passports. Facial recognition systems are being developed for our airports and for American airports, and there is increasing use of surveillance cameras throughout society. When those things are added to the provisions of this bill, they represent substantial intrusions on our privacy—intrusions that we should not grant to the State.

Such intrusions are becoming more prevalent in society because of the advance of technology. We read that cellphones that can take pictures are creating a great privacy problem —they can be left around to take pictures and transmit them by email. People have raised concerns that those sorts of intrusions can occur in public places and in workplaces, and we do not want to give those powers, legally, to the police and the intelligence agencies. So it is very good that the bill contains general provisions against such powers.

The Green Party supports many things in this bill but, because of the intrusive provisions, we will not vote for the second reading.

New Zealand First supports this legislation. It is a law and order bill, and in terms of our three policies at the last election, we are strongly in favour of law and order matters. It is wonderful to follow the Green speaker—it makes life seem normal, once again. Mr Locke is very consistent, and I suppose I very consistently oppose him in his views when it comes to things like interception warrants and suchlike. Obviously, from his past, he knows a lot more than me about those things—interception warrants and the sorts of ways that someone can look at things. If people have been involved in—

💬 Ron Mark: Very left-wing party.

Very left-wing parties will know what is involved, because those parties have the opportunity to, and the knowledge of how to, use those things. As my friend and colleague Ron Marks says, following Mr Locke is like shooting a duck on the water, but sometimes one has to if one is to eat. I really will not say much more than that. We disagree entirely with the Greens on law and order issues time and time again, and it is great to feel normal once again.

This is fairly straightforward legislation. I was interested, not having seen this legislation before, to realise that it came into the House in September 1999—just before an election. I looked at the interpretation clause and saw it talked about home invasion. That was a big issue in 1999. It is surprising how some issues like that are not quite as big after the passing of time. I am disappointed that the Labour Government did not keep moving this legislation along, because home invasion was a very, very big issue, and I am sure in 1999 people made big promises about it. Labour has failed to keep its promises on the home invasion amendments, and here we are in 2003, 4 years later, looking at this bill, which was reported back to the House on 20 July 2001. This bill was reported back to this House 2 years ago and has sat on the Order Paper since then. That is how much the Labour Government really cares about law and order, and about being tough on things like home invasion.

I really have only one point to make on this legislation, and that is that people practising in criminal law ought to get themselves a copy of this legislation, because of the virtual repeal of Part 10 of the Crimes Act and the introduction of a new Part 10 dealing with crimes against rights of property. It covers the entire ambit of that part, so duty solicitors and people doing legal aid work at the District Court level, and suchlike, should really bring themselves up to date with this legislation, because it is the day-to-day stuff of anyone who is a duty solicitor or who is trying to conduct a defence in the District Court.

I would like the Minister to tell the House when he expects this legislation to come into force. We have seen the bill take 2 years at the select committee, and sit for 2 years on the Order Paper. Should people start to worry about it, or will it be another 2 years before it becomes law—another 2 years before the Labour Party shows any regard for home invasion?

💬 Ron Mark: There will be an election before then!

Yes, there will be an election before then, and New Zealand First in Government will have the opportunity to make sure that this bill is brought into effect.

This is fairly straightforward legislation, as I have said. I notice that in schedule 2 there are amendments to the Criminal Investigations (Blood Samples) Act. I seem to recall that there is a discussion on the blood sample legislation at the moment, and I would have liked the Minister to comment on that and on the way that aggravated burglary, robbery, aggravated robbery, assault with intent to rob, and suchlike are now to be dealt with, as a result of that legislation with regard to blood samples. That will be a very interesting point.

I see a reference to the Motor Vehicle Dealers Act is still there in schedule 2. Has that Act not been repealed? I thought we repealed that Act a little while ago. The Minister said that he would make a number of consequential amendments, and of course they will be on Supplementary Order Paper 84. Any lawyer who is looking at the bill should also look at that Supplementary Order Paper, because there will be consequential amendments as a result of it.

I really do not want to take up the time of the House any further. New Zealand First wants to make sure that legislation proceeds promptly, and I will now resume my seat.

I rise in support of this bill, and I want to speak to two aspects of it. The first is hacking, and trade secrets in particular. Until this legislation is passed, there is a lacuna in our law relating to various computer hacking crimes, including those relating to trade secrets. A little personal anecdote will show the increasing relevance of that in an age where proprietary information is of increasing value, and is normally held in electronic form. One of the biotechnology companies I was involved in prior to election stored its information on computer, as most organisations do. That organisation was lucky that a relation of one of the major shareholders and directors was a computer guru and had installed anti-hacking software. That anti-hacking software recorded attacks on the firewall between it and the Internet connection through which other people were trying to access information on the computer. The software also sent back a “worm”—as they call it—to track the source of the attempts at industrial espionage. It tracked them to a university in a country in the East, and as a consequence of that, we made complaints through the various police authorities in New Zealand. It became apparent that even if we were eventually able to pin anything, with any degree of proof, on the people attempting to steal the information, there was no effective remedy available to the New Zealand authorities because of a lacuna in the legislation, which would mean that nothing was being stolen. This legislation remedies that by introducing provisions that say that trade secrets stored in electronic form can be property for the purposes of theft. It also prohibits the hacking that would be used to get at that property. Those are good reforms.

The other thing I would like to mention briefly is penalties. One of the submitters to the Law and Order Committee—and this is recorded in the select committee commentary—suggested that penalties for causing intentional damage to computer systems should be increased from a maximum of 7 years’ imprisonment to 14 years. I think the select committee reacted quite appropriately to that. It noted that when it comes to penalties for damage to property, there should be consistency between computers and other private property. It then noted that a maximum of 14 years would be inappropriate, because penalties of that magnitude should be reserved for serious offences against the person, rather than against property. The committee amended the penalty provisions in the Act so that the maximum of 10 years’ imprisonment is applicable where the person who does the damage knows that it will endanger life. In respect of all other property damage—be it to computers or other property—the maximum penalty is 7 years’ imprisonment. Those are the two points I would like to make, and I recommend the legislation to the House.

Was it not great hearing from Keith Locke, who spent his entire adult life supporting and giving comfort to the KGB, Soviet expansionism—

💬 Keith Locke: I raise a point of order, Madam Chairperson. Besides being totally false and not a debating point, it does not help to maintain good order in this House to say that a member has spent his or her entire adult life supporting the KGB.

💬 Madam DEPUTY SPEAKER: No, I’m sorry, the time has come to leave the Chair.

Debate interrupted.

The House adjourned at 6 p.m.