Telecommunications (Interception Capability and Security) Bill

This is Part 2 of the Telecommunications (Interception Capability and Security) Bill. We are in the Committee stage of the bill and we are now talking about Part 2. This is the part of the bill that I would describe as being the “tying itself up in knots” part. This is the part of the bill where, essentially, the discussion that was happening in Part 1 takes effect around how those definitions play out, particularly with regard to the service providers.

The service providers, for the sake of anybody listening in, are the organisations and companies that are becoming more and more prevalent in our lives, otherwise known as the over-the-top providers, such as the Facebooks, the Googles, the Microsofts, and other such entities. They are mainly entities that have a base in another country, rather than in our own country. These are the big organisations that are enabling us to communicate in all kinds of different ways. How the provisions of this bill relate to those service providers is very important. As we discussed in the debate on the previous part of the bill, the definition of “service provider” is so broad and so encompassing that it does provide a potential conflict with international law, how this generally plays out, and the service providers’ ability to provide what is called the “duty to assist” our surveillance agencies.

I just want to put on the record that although Labour is opposed to this bill in its entirety, we are not at all opposed to the modernisation of the legislation. We are not opposed to the provisions that existed in the previous legislation that put a duty to assist on organisations—a duty to assist the surveillance authorities when there was cause to do so. The problem that we have with this part of the bill—well, there are several problems.

I think that clause 35 is probably the most significant part of Part 2 of the bill. It gives a deem-in provision to the Minister in the chair at the moment, the Minister for Communications and Information Technology, and extraordinary, unheard-of powers that we have not seen in this country before, where a Minister gets to have, for whatever reason, the power to decide whether a service provider can be deemed in to become a network operator. A service provider, just so that everybody knows, has to have a duty to assist. That is fair enough. There is no issue with that. But the ability to deem in that service provider—such as Google, such as Microsoft, such as Facebook—to become a network operator would mean that it would then come under the provisions in Part 3, which are much, much stronger. That then means that it becomes, essentially, an organisation that our surveillance agencies can have an enormous amount of power over. The conflict in law is actually really important.

Again, just so that everybody knows, in her last-minute Supplementary Order Paper 366, which was brought before the Committee, the Minister deleted clause 39, which is in Part 2—the reseller clause. That will have some beneficial effect, I suppose, for some of our internal telecommunications organisations. There will be a bit more of a fair playing field for them when it comes to making their products available to the New Zealand public and the onerous conditions that could have been put on them through this bill.

We are very dubious about the assurances that have been given by officials during the passage of this bill through the Law and Order Committee that the Telecommunications (Interception Capability and Security) Bill could require non - New Zealand service providers to provide access to customer data to the New Zealand Government. That is at odds with the providers’ own domestic legal obligations. The point that is being made here and that certainly has been made very publicly in the last week by these organisations—and, you know, this is not about getting in behind them and thinking that they are wonderful—is why is it that there should be a piece of legislation going through this Parliament when there is a question mark over whether it is in direct conflict with international law? That is just simply not good enough. The warnings were given. The submissions were made. They were made very powerfully, but for some reason they have been ignored.

Secondly, for this part of the bill—and I know there will be more discussion by my colleagues around this, and this goes directly to the amendment in Labour’s Supplementary Order Paper 370—after clause 35, Labour has put forward an amendment that creates a technical advisory board, which is a check and balance. That is the other major issue with this bill—again, there are many—there are no checks and balances. When we are talking about privacy, we are talking about the rights of citizens, and not just citizens but companies and their ability to innovate, their ability to control their own destinies, and their ability to go about their business in a context where security for the country, for the bigger-picture interest, is brought into balance. Unfortunately, that balance has been tipped. One of the problems is that we do not have enough checks and balances in this law.

We contend that there should be a technical advisory board established, as was recommended by many of the submitters. The submitters included the Telecommunications Carrier Forum, the peak body group for all of the major telecommunications companies in New Zealand. The forum said that there needed to be a technical advisory board, such as there is under legislation in the UK, which is, essentially, a panel that is set up to provide advice. It provides advice before decisions are made by the Minister on whether or not there should be interception undertaken, and it should have an independent chair.

As I said in the second reading debate on this bill, New Zealand is a small, stable, peaceful democracy. We take really seriously in this country what those principles actually mean and how they are reflected in law and in regulation. This piece of legislation before us today tips that balance. It tips the balance in favour of State surveillance and secrecy without checks and balances.

I would like to hear directly from the Minister, who still has not got to her feet yet in this debate. She still has not got to her feet—

💬 Grant Robertson: An hour and a half, she’s had.

—after the 2 hours, pretty much, that we have been here. She still has not got to her feet. One of the reasons why is that she—I am starting to ask myself whether she just does not understand the legislation that is before her, does not understand the impact of it, has not listened to the community, and has not listened to the industry. Certainly she is not taking any heed of what the implications are of her Draconian piece of legislation, which is before us today. She shakes her head. Unfortunately, I have come to the conclusion that she actually does not understand it, because otherwise we would actually be hearing from her as to what the implications are. Why is it that a technical advisory board could not be put in as a check and balance to provide the public with an assurance?

I am sure my colleague Clare Curran will continue with her contribution on this bill, the Telecommunications (Interception Capability and Security) Bill, in a further call on this part. Part 2 is the interception capability part of the bill. As Clare Curran has said, this is really where the balance between protecting New Zealanders’ security and protecting New Zealanders’ rights and freedoms to communicate with one another has to be put into balance. As Clare Curran has also already said, in the earlier legislation that this bill amends that balance was already put there. There was an acknowledgment that network providers, or network operators as they are now defined here, would have roles and responsibilities around allowing for an interception capability.

No matter what we might like to think about the world, there are people out there who may well be wanting to do things involving cyber networks in New Zealand that are against the law and put New Zealanders in danger, and therefore that capability is something that we, on this side of the House, accept. What we do not accept is allowing that capability to be opened up to such an extent that an enormous power now rests in the hands of the Minister of Communications and Information Technology around where that capability is used, on what networks, and what obligations are now on the providers of those networks.

Again, this is not just about Opposition politics. This is not about just getting up and saying: “This is a Government bill. We oppose it.” The Law and Order Committee heard submission after submission from those who are directly involved in the provision of internet services and the provision of networks in New Zealand that this part of the bill would have the effect of stifling innovation, potentially reducing investment in New Zealand by large telecommunication companies and by the over-the-top providers that Clare Curran mentioned before, and that overall it would extend out the powers of the Minister in such a way that that necessary balance between protecting our security and the freedoms of New Zealanders would go out of balance.

At the select committee, Microsoft came and said: “An obligation to have interception capability on a fundamentally different technology to what we have seen in the past in our view needs to be considered on its merits, not swept up in broad legislation that gives wide powers to surveillance agencies and Ministers.” That is the point. It is not that Microsoft is saying it should not have any interception capability requirements upon it, but that they should not be part of legislation like this, which is loose, poorly defined, and associated with a massive expansion in the powers of the surveillance agencies, in this case the Government Communications Security Bureau (GCSB) through the Government Communications Security Bureau Act and through an expansion of the powers of the Ministers. Microsoft has come along and it has said that. It has also said—and this comes to clause 39, which we can still debate because it is actually in the Minister’s Supplementary Order Paper 366, which we will vote on later on. She has decided to delete clause 39 after a massive backlash from across the telecommunications industry. But the signal sent from the Minister with clause 39 was that New Zealand was trying to, in some way or other, shut itself off from the rest of the world and actually cut off the possibility of innovation within the information and communications technology sector in New Zealand.

It is interesting to note—and I am reading a column from the National Business Review about the burden that New Zealand - based businesses will face. It is one thing for the Microsofts, the Googles, and the Apples of this world to come and say they do not like the burden that this bill is going to place upon them—and they have a legitimate claim there—but what about New Zealand providers? What about those who are the providers of, for instance, cloud services, where New Zealand actually has a very good reputation—

💬 Clare Curran: Had.

Had? Well, yes, indeed. It had a very good reputation in terms of the development of innovative cloud technology. Well, what has been said by those who provide that is that this actually, over time, will put huge costs on those providers and essentially make them weaker in comparison with the international cloud service providers.

Here we have the National Government, supposedly the friend of business, bringing to the House a piece of legislation that is actually going to stifle innovation. It is potentially going to shut off interest internationally, but it is actually going to stifle innovation from New Zealand companies. New Zealand businesses, which will have to be able to put their services up against this law and ask whether they have the capability the New Zealand Government wants, will simply walk away, in my view, when they see this kind of approach from the Minister. If we look at it both from the terms of those companies from overseas and companies from New Zealand, the powers that are in Part 2 of this bill around interception capability, quite simply, put a great deal of extra cost on those companies and potentially stifle the innovation that they will be part of.

In Part 2, how does this come about? Well, there is a range of ways that Part 2 does this. But, essentially, the area that I want to focus this part of my contribution on is around clause 35 of the bill—and this is the part of the bill where Clare Curran has an amendment to establish a technical advisory board—because what we see here is the classic expansion of ministerial power. Again, from a National Party supposedly all about reducing government and reducing the impact of the State, we now have enormously expanded powers. Subpart 5 “Ministerial directions”, states: “Minister may require service providers to have same obligations as network operators”.

💬 Clare Curran: Unprecedented.

Clause 35, 36, and 37 go through the way in which the Minister will do that. Everything is in the control of the Minister. There is a review provision put in here under clause 36, but it is totally within the control of the Minister. The expansion of powers alongside the complete control of the Minister is, as my colleague Clare Curran interjected before, unprecedented.

This legislation is loose, it is poorly defined, and it breaks new ground. That combination is something that all New Zealanders should be very, very concerned about. That is why, under Supplementary Order Paper 370, we are looking to establish a technical advisory board. This technical advisory board would at least have the ability to be somewhat independent from the Minister. In Supplementary Order Paper 370, which Clare Curran has put forward, the Minister appoints members of the technical advisory board only after consulting with representatives from the telecommunications industry. It needs to comprise equal representation from Government and the industry, with an independent chair. Any matter referred to the Minister requesting they exercise their discretion or recommend providing an additional area of specified security interest must first be referred to the technical advisory board, and it has to be established with the purpose of increasing expertise in relation to network security and consideration of proposed mitigations.

At least if we have this in the law we can have some reassurance that the Minister’s increased powers will not be abused. The industry wants this. It has come to the select committee and said: “Can we have something like this?”, and the Government has ignored it. Consistently, throughout the process of this bill, the Government has ignored the warnings of industry—ignored the warnings of the very people who provide these services to New Zealanders. It is not like they are being unreasonable. As late as the last couple of weeks, telecommunication groups have been writing to the Minister saying: “Please can we meet with you to talk about how we can mitigate some of the problems we see in here?”. They are not walking away. They are not saying they do not want to be a part of a regime in New Zealand that provides that balance of security, and the Minister will not talk to them. The Minister will not talk to them. The Minister puts up some tweaks in her Supplementary Order Paper. She gets rid of the clause that is causing her the most grief, but in reality that does not change the fact that this bill breaks new ground and is unprecedented in the level of power it gives to the Minister and the expansion of powers it creates for the surveillance agencies.

Yet here we are, the day after the second reading, with the Government trying to shove this bill through. All through this week it has been trying to get it out of the way. Well, that is simply not the way to make good law. This is an area that is technical. It is difficult. It is in an area of technology that a lot of people do not fully understand. It is exactly the kind of law where there should be time taken, where we should be able to get buy-in from industry, and in Part 2, on interception capability, the industry is crying out to be listened to and to say: “Yes, we will take on our responsibilities to allow for interception capability, but not at any cost and not with wide open powers for the Minister to do just as she pleases.”

We would call on all members of the Committee to support Supplementary Order Paper 370, which inserts into clause 35 the provision for a technical advisory board. At least that will give New Zealanders some assurance that there will be an independent overview of the Minister’s powers. The Minister has seen fit to take out clause 39. Now is the time for the Minister to accept that there need to be some limits based on the powers. This is what industry wants from this bill. It is time that the so-called business friendly National Government actually gets off its chuff and does something to support industry.

I am very happy to take a call on the Telecommunications (Interception Capability and Security) Bill. I have been waiting all evening for something to come up in debate that was worth responding to and was not more of the misinformation, the scaremongering, and the beat-up rhetoric that we have heard from Opposition parties all through this debate. I have waited and I have waited, and we have not heard anything—to the point where I had to wonder whether we were in here debating the same bill—because almost all of what I have heard is simply not correct.

Let us run through what this part of the bill actually does. For a start, this part of the bill, Part 2, deals with interception capabilities. What it does is it rewrites and replaces the 2004 law put in place by the Labour Government. I was very pleased to hear the member Clare Curran say that she has no problem with any of the provisions in the current law. That is great, because the provisions that Labour members spent an hour and a half before dinner complaining about are ones that are copied directly from the 2004 Act. Given that Labour members have just said they have no problem with—

💬 Grant Robertson: No, they’re not. That’s not right. The definitions have changed.

Look back at the Hansard, Mr Robertson. Look back at the Hansard. Read the bill. The definitions of network operators, telecommunications servers, and public telecommunications networks are word for word what Labour wrote in 2004. None of that has changed. The duty to assist on service providers has not changed. The fact that it applies to overseas service providers has not changed. The encryption requirements have not changed. The privacy protections—and we have heard ad nauseam from Labour that somehow this bill is going to destroy the privacy protections—have not changed. In fact, we worked very hard with the Privacy Commissioner on putting this bill together, to the point where she indicated that she was very happy with it. So for all the rhetoric, for all the scaremongering, we have a Privacy Commissioner who confirmed that the bill worked well, privacy protections that are carried over from 2004, and definitions that are carried over from 2004.

If parties want to know whether they are covered under the obligation of being network operators, there is a very simple test—a very simple test. The test is that if they were not a network operator for the last 9 years under the provision that Labour has just told us it was very happy with, then they are not one now. The definition is the same. Nothing has changed. If members have read the bill they will know that.

So let us talk about the effect on service providers, because, again, we have had all of this rhetoric—some of it quite misinformed—about how it applies to service providers in this section. What happens is that at the moment if you provide a telecommunications service in New Zealand, you are subject to our law. Frankly, my view is that if you are providing telecommunications services to New Zealanders, you should be subject to our law, no matter where you are residing. Is it Labour’s position that New Zealand companies should be bound, but that anyone else should get off scot-free? Well, that is not my position. They have always been bound in New Zealand, and they will continue to be. The concern about conflict of laws in my view was never an issue, and that is very clear under common law. Recognising that there was a concern, we have made it clear through Supplementary Order Paper 366 that there is an absolute defence if there is a conflict of laws issue arising in our duty to assist. So there simply is no basis for concern in that regard.

Equally, we have heard comments that somehow this is new and it puts us out of step with the rest of the world, which, again, is not true. Just recently we have had the Australian Parliament confirm that its service providers are already regarded as being within the full interception capabilities in Australia. So we have not even gone that far. That is the case in Australia.

Can I also confirm that, as I said, with the service providers, their obligations have not changed. They have protection from conflict of laws. It is not internationally inconsistent. The interesting thing for me is that the New Zealand telecommunications companies put in submissions asking why the service providers were not subject to full obligations straight away. So if Labour’s position is right and we are being far too hard on these poor overseas multinationals, then they would be taking the opposite position to what New Zealand companies want, which is full extension of powers to service providers right now. That is what the New Zealand telecommunications companies want, so Labour has to decide whether it is backing the overseas mega-multinationals, or whether it is backing New Zealand companies. Our view is that at the moment we are in the right space. We have the duty to assist, and for now that is sufficient. If in the future there needs to be a greater level of obligation, bringing us into line with what New Zealand companies want and what overseas jurisdictions already do, then we have a process to do it.

It is completely wrong to say that there are no checks and balances on that process. The process is very clearly set out in legislation. It is akin to what Ministers do under any number of pieces of legislation for granting exemptions or putting restrictions in place. It is subject to the review of a specifically and highly qualified review panel, and of course it is subject to judicial review. It would make no sense to have a standing panel sitting around waiting for the odd situation where this would occur. I know Labour loves to set up committees and panels and put all its mates on them. But having a panel sitting there, doing nothing, for the odd occasion that this might happen—

💬 Hon Trevor Mallard: Or their sisters-in-law.

—oh, you want to talk about Mike Williams—then it can do that. But in our world you do not do that. You have an appointed ad hoc panel that can have the skills and expertise needed in that case.

💬 Clare Curran: Appointed by the Minister?

Yes, appointed by the Minister, Ms Curran—very well spotted. You can read. It is an ad hoc panel appointed to serve the needs of that provision. It is an independent panel and it reports back on how that works, so that if people have concerns there are of course other processes they can follow to review that as well.

Let us be very clear. This provision does not in any way change the power of these agencies. We have heard from Mr Horan, from the Greens, and from New Zealand First that somehow this is open slather for people to access our networks. Anyone who says that, frankly, is being absolutely duplicitous and giving quite false information. It is clear from the most basic reading of this bill that nothing in this changes what can be accessed or by whom. The warranting powers are in other legislation. They determine what can be looked at. This is simply the mechanism by which that warrant is given effect to. Nothing in this bill changes the warranting powers and nothing extends the warranting powers. All this bill talks to is the extent to which they can be given effect to.

Let us be very clear. The reason for this bill and this part of the bill is that it reduces the cost of compliance and the compliance time and commitment for companies in carrying out interceptions. Under the law that Labour wrote, there was the requirement for full standing intercept capability on every provider of any size, at every level. That is not necessary. It was hugely burdensome and it did not work for industry. This bill reduces that cost. It reduces it by tens of millions of dollars potentially, and it reduces the compliance time and cost on those companies. Anybody can see that to have a much more tiered, proportionate, sophisticated response targeted to where we need it is better than having a blank “everyone invest fully in areas where it is simply not needed”. This bill simply modernises that part of the framework where the warrants are granted under other legislation and given effect to. It is business-friendly. It strikes the right balance between need and futureproofing. It maintains all the privacy protections and it does not extend the reach any further.

The Minister for Communications and Information Technology does not understand her own bill, the Telecommunications (Interception Capability and Security) Bill. She does not understand the impact of it, or she has got her fingers in her ears. I will just to talk about the response from industry. NZRise is a credible organisation that represents New Zealand tech-based industries—New Zealand, Kiwi companies. Google, Facebook, Yahoo!, and Microsoft represent a group of international service providers and all of them are actively opposing the key measures in this bill that we are talking about today. What they say is that as currently drafted this bill would impose in Part 2 a duty to assist on service providers and empower the Government to impose additional—not what the Minister just said, but additional—interception obligations on a service provider by deeming them in to be a network operator for certain purposes. That is the difference in this part of the bill. Clause 35 in this part of the bill provides unprecedented powers to a Minister to decide whether a service provider, which is the over-the-top provider such as the Googles or the Facebooks, etc., can be deemed in to become a network operator. In other words, they get treated just the same as organisations such as the telecommunications companies in Part 3 of this bill. It is the Minister who gets to decide that, on the recommendation of the Government Communications Security Bureau (GCSB), with no checks and balances.

The issue in this bill is that there are not the checks and balances. There is a shadowy situation being set up for recommendations to be made on national security, including something called economic well-being, which is not defined, and huge powers, discretionary powers, being given to a Minister to make those decisions. This is not the New Zealand way of doing things. The New Zealand way of doing things is where you put into legislation measures that ensure that dodgy decisions cannot be made. We have no guarantee in this legislation that a Minister, based on a recommendation that cannot be made public, will not make a questionable decision that cannot be challenged, or, if it is challenged, it is through a judicial review.

The big issue for the New Zealand - based companies is that the smaller tech-based companies such as our emerging innovative companies are concerned that they are going to get caught up in this legislation and be caught up in being defined as the traditional telecommunications companies are, and those smaller companies do not have the resources or the means to question, to provide a push-back, or to have the kind of dialogue that may need to be had, which their bigger brother organisations such as the Telecoms, the Vodafones, etc., of the world could do. They do not have the means to do that and so there is no check and balance for them. Those are the New Zealand - based tech companies and they have written as a group. Every member of Parliament in this House will have received in the last few days a letter saying: “Please do not broaden the definition of ‘network operator’ in this legislation to include us.”

The Minister shakes her head—the Minister shakes her head. Well, Minister, you have heard it said because there are cross-references in this legislation to definitions that do provide an enormous encompassing. Yes, they do. So, as with the GCSB legislation, everybody else in the country is wrong except for the Minister. Is that right? Everybody else in the country is wrong! Yet the evidence could not be given to the Law and Order Committee on these matters properly. The Minister referenced tens of millions of dollars that are somehow going to be saved. In the regulatory impact statement provided on this legislation all of that information was redacted. We were not allowed to hear that information.

In the first version of the bill, clause 24(6) would have extended the application of the duty to assist to global service providers. This was a hotly debated part of the bill and it was clearly an issue. Eventually, there was a decision to delete that clause, which would have helped, but the fact is that along with that went an expanding of the definition of “service provider”, which meant that that conflict in international law, which we have talked about several times tonight in this debate, has been expanded. So every time “service provider” appears in this piece of legislation, as set out in clause 3, it “(a) means any person who, from within or outside New Zealand, provides or makes available in New Zealand a telecommunications service to an end-user (whether or not as part of a business undertaking and regardless of the nature of that business undertaking); but (b) does not include a network operator”. That is the difference between the two definitions, but the fact is that it is still an extremely broad definition, and clause 35 of this bill means that the Minister, on the recommendation of the GCSB and without a check and balance, can deem in one of those service providers and make it a network operator. You deny in this Chamber tonight, Minister, that that is a wrong interpretation. That is a true interpretation.

So that gives the Minister enormous, unprecedented powers. How are those powers reflected in the existing legislation? This is a new provision and it is a provision that has been hotly contested by, as I have said, the international organisations—the Googles, Facebooks, Yahoos!, and Microsofts of the world—who argue that this puts them in a direct conflict of law, which makes our law look very foolish to the rest of the world. And for the New Zealand - based technology companies, that definition of “network operator” draws them in, in a way that is unprecedented in terms of the potential conditions that are going to be imposed on them by surveillance agencies, and that will be the stifling of innovation in this country. What is missing is a check and balance from another entity that provides some balance and provides some good advice to the Minister and recourse for those smaller companies in terms of pushing back against those decisions over which they have no control. I would like the Minister to get up again and tell me how those organisations are supposed to operate under this legislation as it is put before us tonight.

I rise to speak to Part 2 of the Telecommunications (Interception Capability and Security) Bill. This interception capability and security is again part of the same problem that we talked about in Part 1, where we have to ask where the instructions are for New Zealand to go down this track. Was it just because of the Kim Dotcom case where there was some illegal surveillance, some illegal spying, and we are fixing that up? Because even when the officials were looking at this bill—looking at how we compare with other countries, how our legislation stacks up, and what layers of interception capability were required—the places they looked at were our “Five Eyes” partners. I do not recall seeing anything else. There was the United States, the United Kingdom, Canada, and Australia. That is where the comparisons were done. Clearly, there is an international move, and the Minister for Communications and Information Technology herself has said how there was nothing internationally that we were not consistent with.

Well, we are apparently getting less and less inconsistent with the “Five Eyes” - Echelon partnership, and it would seem, in fact, that this is what a lot of this is about. Of course, we need some capacity for natural law surveillance. We have issues of kidnapping and issues of serious crime where we expect and accept, it seems, as a community a certain level of surveillance. That can happen under existing legislation, and clearly does. What was happening illegally, but what was not meant to be happening, was spying on New Zealand citizens by an internationally linked spy agency, the Government Communications Security Bureau (GCSB). I will keep on about Waihopai and the spy agency thing because that is often forgotten about when we look at where these different capabilities are in terms of access, and I did touch on that earlier.

In her letter to us, the Minister was talking about clause 39, which is part of Part 2, and the fact that the bill currently allows the responsible Minister to direct that a network operator must not resell an overseas telecommunications service in New Zealand where the interception capability or lack of interception capability raises a “significant risk” to law enforcement or national security. Of course, we have looked at some of that in the interpretation provisions, but that also can be rather subjective.

What is a significant risk to law enforcement? What is a “significant risk to national security”? Some of this is necessary only in a full surveillance State. It is not about dealing with organised crime in a way that the police could be managing under other law, or with some other issues that might be addressed under the search and surveillance legislation. This is law that allows something much greater and, as I say, that is only necessary in a full surveillance State—Big Brother. There is a need for a full, genuine inquiry into what we actually want as citizens in this country as a basis for surveillance law and surveillance agencies.

We need that discussion because these things—the Government Communications Security Bureau Amendment Act 2013 and this bill, and the interception capability in Part 2 here—are all about trade-offs between privacy, human rights, and the level of access by State agencies, and some are, unfortunately, linked with overseas agencies. So what would we do? What are we prepared to do as citizens in terms of that trade-off? There is some point at which we will say “No, the risk isn’t worth it.” because the event or the concern may not happen in a matter of years—terrorism as such—or it might happen once or twice in terms of a kidnapping. We have to look at that level of risk as to how much we will give over in terms of reduction in privacy and the like. So the level of access is a big part of this.

Under Part 2 of this bill, the network operators as such must ensure that every public network they own, control, or operate has full interception capability. I think that what the Minister and the officials have achieved in terms of the bill is probably very, very effective for what they are trying to achieve, but it does not make it right. That is the point that the Greens are very, very concerned about. We do not think it is right. There are other parts around effectiveness, I must say, and you would have to raise questions about the size of the operators—those with fewer than 4,000 customers. The bill has got a staggered level of obligation around capability. In some respects you could say that is fair enough, because maybe some do not have the economic capacity to achieve everything, but they still have to be basically able to turn it on, if the Minister decides it.

In that different degree, and also in the aspect around encryption and decryption, there is some encryption that these agencies are not going to nail. We know that through the committee stage—not this Committee stage, but the select committee stage—there was an acknowledgment that not everything is going to be able to be surveilled. Then you have to say that if that is not going to be that effective at that point, is it fair that some operators still have to provide capability when another one has got a way through or a way out of it? So we have to ask whether there is a point where we do not do some of these things because the things that are absolutely critical and accepted by the community can be done through another method. So if it is not even going to be able to be applied fully, maybe it is time for us to have a rethink. That is why we say we need to have a full, independent inquiry to look at this, including the interception capability aspect of it.

The Law and Order Committee also recommended that proposed regulations relating to Part 2 of the bill be the subject of consultation with the telecommunications industry. Clearly the Green Party will support Clare Curran’s Supplementary Order Paper 370 on that basis, because there is in it that concept of having an industry group or others, where some of these issues can be considered.

So the Green Party will be opposing this bill and will be looking forward to other aspects of this bill to bring up too. Thank you.

Thank you very much for the chance to speak to Part 2 of the Telecommunications (Interception Capability and Security) Bill. On this side of the Chamber, we would like to thank the Minister for Communications and Information Technology for standing up and taking a call on this part of the bill, because there is no better advertisement for the reasons why this legislation ought not to pass than when the Minister is talking about it. That is because everything she has said does not marry up with what the reality is.

The Minister said that nothing has changed in Part 2 of this bill about the reach or the powers that the Government has to surveil via telecommunications companies. That could not be any further from the truth. It is clear from the Minister saying that that those things have not changed and that her ignorance of the concerns around the industry has not changed. The Government’s arrogance around this bill and the Government Communications Security Bureau (GCSB) legislation has not changed. The Government’s attitude towards New Zealand Bill of Rights Act considerations around privacy has not changed. The Government’s inability to find some kind of balance between the need to surveil and the rights of the individual citizens has not changed, because it has rammed through this piece of legislation in haste, and it has given huge powers to the Minister in the chair, who has taken only one call to completely and utterly deny the concerns that the industry has around this bill.

One of the assertions made by the Minister in the chair was that the industry was quite happy with the level of consultation and with the costs that it will be facing if it is compelled by this bill to do what it needs to do. That could not be any further from the truth. In a submission to the Law and Order Committee, Vodafone—one of the largest telecommunications companies, if not now the largest—said that “The burden continues to fall disproportionately on existing large telecommunications providers, ignoring the significant interception gaps created by the proposed regime inadequately covering OTT and smaller providers;”. So there you have it. Vodafone is saying that there are going to be huge cost implications to the company, and the Minister completely and utterly denied that.

Later on in its submission to the select committee, Vodafone also went on to make a point around network security, saying that “The proposed approval process does represent a significant compliance cost to network operators, in order to further government objectives. Network operators should be fully compensated for these additional costs.” So there will be costs to the network operators in this bill. Vodafone has said that within its submission to the select committee. But you did not hear that from the Minister during her contribution on Part 2.

There were also concerns from the industry around the lack of consultation on this piece of legislation, and my colleague Clare Curran has brought in Supplementary Order Paper 370 to bring in a measure for that. I will come to that later, but I do want to show or read out to those at home the part of the regulatory impact statement that pertains to industry consultation. It says: “In developing the above proposals [information withheld] telecommunication industry representatives were consulted.” There is a very small gap there where it says “information withheld”, so it seems like there were not many consulted. Then the next point goes on: “Wider consultation with industry was not undertaken, given the technical and sensitive nature of the subject-matter,”. That is borne out in the submissions to the select committee, and that was certainly borne out in the submission by Vodafone. It wants to have more consultation with the Government and with those intelligence agencies, so that if there is going to be any major change to its network or any major cost implications to it, it has the ability to talk that through with the Government or with the surveillance agencies before that is imposed upon it. I think that is a reasonably sensible thing to do, and that is why we have got this Supplementary Order Paper in the name of Clare Curran, which will look to establish a technical advisory board so that those kinds of issues can be worked through before they are imposed on telecommunications companies, at potentially huge expense to them and without the technical discussions around what kinds of implications that will have for their networks.

Can I just move to clause 10 of the bill, which is also around the interception capabilities of this piece of legislation, and move towards a submission that was made by Microsoft. In her contribution earlier, the Minister said that this bill does not change anything and that things have not changed, but can I take the opportunity to read a section of the submission from Microsoft, a huge software company operating right around the globe. Microsoft is realistic. In its submission it said: “Every day the New Zealand Government and millions of Kiwis are using technology to get things done securely and privately over a diversity of data connections.” We all know that. “Of course, one side effect of this”, it said, “is that it is no longer possible to tap into a phone line and interpret every signal that is communicated over that line. The world has changed”—we can tick that off; everyone can agree with that—“and it can’t be assumed that the same approach that worked for a phone conversation can simply be applied to every service that happens now to be delivered over that same network. Yet the proposed law will include powers to extend telecommunications interception capability obligations to every provider of any good or service that enables or facilitates virtually any conveyance of any information from one device to another.” It then asks us to look at the definitions of telecommunications service under the Telecommunications Act.

The damning sentence here, which the Minister in the chair completely ignored or was ignorant of, is, as it goes on to say: “That would be a dramatic change to the law, and it is far from clear why this is necessary.” I will just repeat that for those who might be listening at home: “That would be a dramatic change to the law, and it is far from clear why this is necessary.” So we have actually got an opportunity now, because the Minister is in the chair to answer that question from Microsoft as to why that expansion of powers, which she says does not exist in this bill, is necessary, when the Minister says that nothing has changed in terms of what the surveillance agencies can access and the types of telecommunications they can access. The Minister said in her contribution that nothing has changed. Microsoft, which is not a little company in a back shed in Hokitika—sorry, Mr Damien O’Connor—is saying that this is a huge change in the law. Microsoft is asking a question and saying that it is far from clear why this change is necessary. So maybe the Minister in the chair, who said in her speech that nothing has changed, would like to stand up and answer that question, which I am putting to the Minister in the chair for Microsoft. Why is it necessary for you to change the law, which you said is not being changed? The Minister has said that nothing is changing.

💬 Hon Amy Adams: No, I didn’t.

The industry disagrees. She is exasperated. She has taken one call. Tell us why you needed to change this thing, which you said is not changing. Why are you ignoring the likes of Vodafone? Why are you ignoring the likes of InternetNZ? Why is the Minister ignoring the likes of Microsoft? The Minister is changing a piece of legislation, which Microsoft says goes well beyond what she said she was doing. What is the rationale for that? Hopefully, the Minister in the chair can take another call. As I say, we do enjoy it when she does. I am sure that the answer will not answer the question I have asked, but if the Minister could take an opportunity to address that question from the Labour Party and also from Microsoft, we would be very happy.

Maybe she would like to look at the technical advisory board that could be set up under Clare Curran’s Supplementary Order Paper and that could answer that kind of question, but, unfortunately, I do not think the Government is going to take up that very sensible proposal from this side of the Chamber. It is another indication that this Minister’s attitude towards, and ignorance of, the concerns about this bill have not changed. The Government’s arrogance around this bill and the GCSB has not changed, and the Government’s arrogance around balancing the rights of private citizens and surveilling them for security reasons has not changed, either. It has rammed this piece of legislation through.

Part 2 compels network operators to do something that they agree they should do, but it puts massive costs on to them. They are worried about the lack of consultation leading up to this bill and also about the lack of consultation that might happen when this legislation is enforced. That is why the Government should seriously think about looking at this Supplementary Order Paper 370, which contains the—

I move, That the question be now put.

I rise to take a call on Part 2. Before I start I would like to reiterate the reasons why we are so strongly opposed to this particular bill, the Telecommunications (Interception Capability and Security) Bill. We have primarily three main reasons why we are so strongly opposed to this bill. The first one is that this bill seeks to facilitate the implementation of its companion legislation, the Government Communications and Security Bureau Amendment Act, which fundamentally reduces the rights and freedom of New Zealanders to communicate with each other by failing to provide sufficient protection against the spying on New Zealand citizens by State agencies. The second reason is that the bill in its current form is poorly and broadly drafted. Thirdly, it is unacceptable that such concessions have been made to the global majors, such as Google, Facebook, etc., but not to the citizens of New Zealand.

Part 2 provides interception duties. Part 2, from clause 9 through to clause 42, sets out the interception capability duties that apply to network operators and service providers. The primary duty, which, as the Minister in the chair, the Minister for Communications and Information Technology, has acknowledged, is the duty to have full interception capability, remains substantially the same as in the Telecommunications (Interception Capability) Act of 2004—namely, the current Act. Despite the fact that the primary duty remains largely the same, the problem is that under the current bill the definitions provided in Part 1 are either inaccurate or too broad. The bill as drafted places onerous obligations upon network operators and may capture many whom it may not have been intended to. So without clarifying the definition, blog sites such as news sites like the New Zealand Herald or Scoop and other—

💬 Hon Simon Bridges: What about sites that Shane Jones looks at?

Well, what about Mr John Banks? Also, other service-oriented websites such as TradeMe are likely to be captured by this legislation, as well.

💬 Hon Simon Bridges: What’s he got to do with it?

💬 Kris Faafoi: He’s all over the websites.

Ha, ha! Subpart 1, “Duty to have full interception capability”—namely, in clauses 9 and 10—sets out the primary duty that applies to network operators, which is a duty to have full interception capability in respect of every public telecommunications network that the network operator owns and every telecommunications service that the operator provides in New Zealand.

But what are we talking about here, and what do all transmissions and information infrastructure mean in terms of ordinary life in New Zealand? We are not talking about rocket science, we are not talking about somebody else’s business; we are talking about emails, we are talking about telephone calls, messages, history or records left on, for instance, Facebook or Google, or any website we have just visited. They are all potentially accessible without a warrant by spy and other agencies.

So all internet service providers, as a starting proposition, are covered by the impact of this bill. Any internet service providers, even smaller ones, must at the very least be intercept-ready and substantial ones must actually be intercepted. This is a huge cost and it is a huge broadening of the powers of the State to access the private information of New Zealanders. Subpart 2 is “Reduced duties”, and I would like to touch on that later on. The so-called GCSB amendment Act, which this bill seeks to implement, provides for the ability to intercept all transmissions that apply to information infrastructure for any purpose to do—

I move, That the question be now put.

I would like to make a contribution on Part 2 of the Telecommunications (Interception Capability and Security) Bill, and I would say that this is one of the two really substantive parts of this bill. This is a bill that is exceptionally controversial. It is one that divides the country, it is one that divides the House, and it is one where I think it is important to have a full debate. I know I am not meant to draw attention to the absence of members in the Chamber, but I think I can say that I was away for about a quarter of an hour of this debate, and in all the time that I have been here, I have heard only one substantive call from the Government. I think it is important that Ministers do make proper contributions and respond in the Committee stage.

To really emphasise the importance of this part, I want to indicate to you, Mr Chair—as I am sure you are aware from looking at all the clauses—that this Part 2, between clauses 9 and 42, sets out the interception capability duties that apply to network and service providers under the bill. There is a primary duty that sits here that is very similar—substantially the same—to what has been in place under the current Telecommunications (Interception Capability) Act from 2004. What Subpart 2—that is, between clauses 11 and 20—does is provide for a reduction of the full interception capability by introducing lesser duties, which will apply to certain classes of network operators. I do want to give notice to the Minister for Communications and Information Technology. I am going to come back to those schools in west Auckland that are providing network services to parents in their particular area and ask whether, in fact, they will have a duty to comply with clauses 9 and 10. I am sort of gathering from the way the Minister’s head shook earlier, and one could almost hear the rattles from back here, that that would not apply. But then the question is whether they have an obligation to be intercept-ready or whether they have a duty to be intercept-accessible. My understanding is that they will end up having to be intercept-accessible.

Then you ask the question: if an organisation has to be internet-accessible, and it is something like a school board, is it, in fact, appropriate for the Government Communications Security Bureau (GCSB) or the SIS, or, for that matter, the police, if it is a police matter—there has been quite a lot of discussion here about the intelligence agencies and their surveillance, but not a lot of discussion about the surveillance on the part of the police. My question to the Minister is whether this duty to be intercept-accessible will apply to schools that are providing internet service provision to their communities. There might be only a thousand of them. I understand that if they do not go over 4,000, they do not have the full requirements. But if there are only a few hundred parents, what is the requirement there?

The question then is that if the level of interception capability that is required from that school operator—my understanding is that there is a provision in the bill for the level of that to be increased not by legislation, but by a decision by a Minister about a particular provider. One of the very serious questions I have got is whether it is appropriate that just at the whim of a Minister—not in the case of a proper, warranted arrangement and all the things that are meant to happen under the GCSB and SIS legislation, but just at the whim of a Minister—the entire organisation has to provide an increased level of interception capability. I accept that there is an ability for the affected network operator to make submissions to a Minister. There has got to be certain consultation, and the applicable criteria have to be taken—

I move, That the question be now put.