International Treaty Examinations — International Treaty Examination of the Council of Europe Convention on Cybercrime—Report of Justice Committee

Thank you, Mr Speaker, for the opportunity to speak on this important occasion. The House is debating not only the Budapest Convention and Related Matters Legislation Amendment Bill but also the international treaty examination of the Council of Europe Convention on Cybercrime. You’ll be well aware that these are two important pieces of House business for us as a Parliament to consider.

In 2001, the Council of Europe decided to progress its international treaty on the convention on cybercrime, and it was adopted by the 27 member States of the EU at that time, and then applied more broadly to signatories to the convention, like New Zealand. It has taken a long time for these conventions to be recognised in our domestic law, and successive Governments have been working through the arrangements that it would take for various agencies in our Government, like our police force, to be able to give effect to some of the provisions.

Some of these provisions are wide ranging and grant powers unlike Government agencies have held before. This would not only require, for instance, New Zealand Police to be able to require record keeping of companies and ordinary natural persons in New Zealand, which are unlike powers they’ve had before, but it would also then require international cooperation on these issues. It is something that this Parliament needs to be cognisant of when we have entered into an agreement which is now 24 or 25 years old. It also requires this Parliament to think about the updates that will be needed for that framework. When it was designed, it was in a world that was quite different from the one we face now, and the threats, in terms of cyber-crime, are quite different to those that were faced at that time.

Not only should New Zealand be continuing the work that was agreed to in 2001 at the Council of Europe level but we should also be looking for opportunities to improve our arrangements. The EU provides good examples for New Zealand to do this. For instance, organisations like FIMI, the organisation within Europe that deals with misinformation and foreign actors, are also relevant too when we consider the provisions that we have in our domestic law for cyber-crime here. We should be looking for opportunities to participate with the kind of legislative provisions that this treaty gives effect to and to do our part on the international stage as New Zealanders to improve the net around the world to deal with this kind of cyber-crime. It’s a pleasure to support this bill and to have had the opportunity to speak on it.

Thank you, Mr Speaker. I rise to support this bill, the Budapest Convention and Related Matters Legislation Amendment Bill. This legislation has to do with cyber-crime, which is not confined to borders. Those involved might be in one country and the victims may be in another, while evidence is kept on servers in a different location. The Budapest Convention, which this bill implements, provides a framework that allows countries to work together on investigations that cover cyber-crimes, such as the deployment of virus software, fraud, the distribution of child exploitation material, and terrorism.

Now, there are some challenges, because, of course, one man’s terrorist is another man’s freedom fighter. And that’s a less than trite comment, because, as we well know, right now, today, as the Israel Defense Forces are burning children in Gaza this week, the idea that we can simply designate a group as a terrorist organisation has its challenges because of the nature of alliances. We have to be very careful in these sorts of legislative frameworks that we actually uphold principles of international law, and those must be fiercely adhered to. I, sadly, do not believe that some of our traditional allies are adhering to international law currently. I have seen in this country myself—personally, in the case of Ahmed Zaoui—where someone is falsely accused of terrorism and gets on the wrong list and finds themselves in Pāremoremo prison.

We have some questions about how we uphold the New Zealand Bill of Rights Act (NZBORA) in terms of this legislation. It’s very important. There are some extremely valid concerns in relation to the New Zealand Bill of Rights Act, human rights, and individuals’ rights to privacy. The potential for political refugees to be surveilled for minor offences and for people who there simply aren’t reasonable grounds for suspicion against—we must tread very carefully as to what we deem acceptable when someone’s right to privacy is breached, and the Greens feel the Justice Committee is the appropriate place to scrutinise and work through these issues relating to NZBORA and privacy concerns. We’re happy to support it to select committee, but we believe it needs thorough scrutiny.

Let’s take a moment to consider this bill in the context of one of New Zealand’s darkest days: the terrible atrocities of March 15, 2019. Fifty-one lives were lost, and we all remember how horrific that day was. One of the findings of the royal commission on the terror attacks was—there were 44 recommendations and only 18 of them have specifically been fulfilled. Recommendation 18 specifically called for New Zealand to join and implement the Budapest Convention as part of strengthening our legislative framework, and we support that for that reason—around terrorism and extremism—but here, we know, in the case of the Christchurch terror attack, that one of the failings of our way of seeing the world is that we can fail to notice, as our security services did, that the greatest threat was not coming from the Muslim community; it was coming from the white supremacist community. That is one of the risks with how we approach the designation of who is a risk to our society, who is a terror threat. Consequently, we had one of our worst modern-day acts of terrorism.

While this bill is a step forward, it’s not enough. This Government has chosen not to implement eight of the 44 recommendations of the royal commission, and I believe that is an affront to the victims, the survivors, and all the communities at risk of hate crimes in our country. If this Government is unwilling to take up key recommendations that could prevent such attacks from happening again, we must question their commitment to real change. The failure to implement stronger measures around hate speech is concerning. At the time when we are seeing an increase in online extremism, disinformation, and division, we cannot afford to ignore the root causes of terrorism. Terror doesn’t start with bullets and bombs; it starts with hate speech. Especially when left unchecked, it can lead to violence. We’ve seen that, and we see that all over the world, sadly, today.

Look, Aotearoa should not be taking half measures. If we take half measures and we don’t thoroughly address the causes of hatred and terrorism, then we end up with a worse situation. The principle behind this legislation is very important. We will support it to the select committee and we look forward to it having very thorough scrutiny there. Thank you, Mr Speaker.

Thank you, Mr Speaker. This bill is important because it helps New Zealand move towards joining the Budapest Convention, the international agreement to fight cyber-crime. Cyber-crime is a big problem here, and I think, as Minister Penk mentioned in his opening speech, it affected 11 percent of New Zealanders just in 2023 alone.

The SecurityBrief New Zealand report reported a total of $6.8 million in losses to cyber-crime between 1 April and 30 June 2024—so it’s a six-month period of this year. A significant portion of this amount totalled $5.5 million and stemmed from 11 large incidents, which were a reported loss exceeding $100,000. Only, really, 11 of those were really large attacks.

The thing is that by joining this convention, we show our commitment to fighting cyber-crime and we align with our international partners. It will also help our law enforcement gather evidence, especially digital evidence stored overseas, which is often necessary for solving and prosecuting crimes.

The former speaker, Steve Abel, discussed the March 15 attacks, and having that valuable information and being able to share data is extremely important. I mean, it may, in fact, help us prevent further disasters like that.

The bill makes some key changes, including adding a preservation direction to prevent important evidence like digital records from being deleted before law enforcement can seize them. This is especially useful for records held by banks or telecommunication companies; while these companies won’t have to hand over the records immediately, they must ensure the evidence isn’t destroyed while the legal process is followed.

The bill also introduces new rules to prevent people from disclosing that they’re being watched by police, which could ruin investigations. It makes it illegal to tell someone that the preservation direction or a surveillance warrant exists, unless the risk to investigation is over. This is important because it stops criminals from being tipped off too early.

Additionally, the bill allows New Zealand to help other countries with their investigations and request similar help in return. This includes applying for surveillance orders in response to foreign requests, ensuring that international cooperation in fighting cyber-crime is fair and reciprocal.

The bill contains safeguards to protect human rights. It ensures that mutual assistance requests can’t be used to persecute people based on their race, religion, or political beliefs. A High Court judge will oversee these requests, and people affected by searches will be notified before any material is sent overseas.

In conclusion, this rule strengthens New Zealand’s ability to fight cyber-crime, both domestically and internationally, by protecting human rights. It gives law enforcement the tools that they need to investigate crimes in the digital age. I support this bill being passed. Thank you.

Thanks, Mr Speaker. I also rise to support the bill, on behalf of New Zealand First. This is about aligning our laws with the Budapest Convention. As best I could see, we weren’t actually a signatory of the convention, but the signatories cross every continent of the globe, except Antarctica. This is about us working with other countries to try and investigate and prosecute cyber-crime, and to do so more effectively.

We know that cyber-crime has an increasing impact on us all. This Parliament itself has been subject to a cyber-attack, and we’ve heard from other speakers that the perniciousness and the amount of cyber-crime and the effects of cyber-crime are only going to grow.

I just wanted in a few brief words to say that I think that the way in which people are abusing the wonderful technology that we now have in the, if you like, electronic communication—the internet, and so on—just undermines its overall effectiveness. You can look at so many places where you have communication and you don’t know where that communication has come from, and people immediately have to mistrust it. You kind of have to mistrust it, so these things are important.

I also wanted, in talking to some of my colleagues, just to reflect on the issue of identity theft, and that is something which has certainly affected some of my colleagues. It is where people have used the internet, social media, etc., to act as though they were somebody else and then to portray somebody in a way in which they are not, and it takes a lot of effort and a lot of work to try and undo the damage of doing that.

Suffice it to say that cyber-crime is real. It’s something that affects us all, and it is a very sensible thing for us to be involved and to be aligned with the signatories of the Budapest Convention to align our laws with the Budapest Convention. I know that it’ll be a complex process. There’ll be a lot of technical and legal submissions involved in it, and I wish the select committee which is hearing these submissions all the very best in trying to work their way through this. I commend the bill to the House.

Tēnā koe e te Pīka. E tū ana ahau, kua riro māku ngā whakaaro o Te Pāti Māori e waha, e whakatakoto ki mua ki te aroaro o tēnei Whare, he whakaaro mō tēnei o ngā pire e kīia nei ko te Budapest Convention and Related Matters Legislation Amendment Bill.

Ko te tikanga o te pire, mō te hunga noho ki te kāinga, he pire karo i ngā whiunga kino mā runga i te ipurangi.

[I stand, it is my responsibility to represent Te Pāti Māori and speak to what our thoughts are. To speak before the House today to the bill that is before us, the Budapest Convention and Related Matters Legislation Amendment Bill.]

This bill is for the people who sit at home. It’s a bill to parry off the bad remarks made via the internet.]

The Budapest Convention is known as the convention on cyber-crime. To all our whānau who are at home who might not get it from the title, it’s a bill about combating cyber-crime, and it’s an international treaty—an international treaty—aimed at addressing crimes committed via the internet and other computer networks, obviously. It’s good to see that the House is interested in upholding its international treaties, and we look forward to seeing that spread across all of the treaties that pertain to the House and the Treaty partners in it.

From a mana Māori or Te Pāti Māori policy position, we’re fundamentally opposed to the bill—we’ll just make that clear; fundamentally opposed—and we’re opposed on the basis of mana motuhake, in as much as Te Pāti Māori policy is to establish a Māori governance entity to hold authority over the collection, analysis, and use of all Māori data. Māori data sovereignty is paramount for the Māori future. We oppose it on the basis of mana ōrite [equal rights]. Mana ōrite is the guarantee of Te Tiriti o Waitangi.

Given the history of Māori being falsely accused of terrorism and other crimes, there need to be some protections to ensure it is not used to collect data or illegitimately target Māori independence leaders, like we saw in the Tūhoe raids, in a shameful operation that inflicted intergenerational trauma into the Tūhoe people and the Māori people at large. It wasted $8.5 million of the country’s money while they were at it. We are fundamentally opposed to the bill, but in aspects like mana mokopuna, where there are protections providing safety for mokopuna, then there is space for an ongoing kōrero.

To address the concerns around Māori data sovereignty, in the debate pack, a professor from Waikato University says, “The New Zealand Government should have sovereignty over its own data. The Government should have the right to determine who and what data is shared with overseas partners to investigate cyber-crime.” Kei te pai tēnā. [That’s fine.]

He goes on to say, “But Māori should have sovereignty over Māori data. Māori should be the only entity that has a say on who and what data is shared.” He goes on to say, “Examples exist in crime and health and education, just to name a few. We need the Government looking at Government data, and a Māori entity”—nē [right]; a Māori entity—“looking at Māori data from a Māori perspective.”

Te Pāti Māori policy states that Māori data sovereignty is critical to the success of Māori self-determination for whānau, hapū, iwi, and Māori business. Unlocking economic and social potential is enabled by Māori data collection and analysis. Māori must own Māori data.

Māori data also underpins the development of the Māori economy. I reflect on the comments of Adrian Orr, the Reserve Bank Governor, regarding the latest Business and Economic Research Learning report, and, most recently, the report on the Māori economy, which calculated that it grew at nearly twice the rate of the total economy between 2013 and 2018. Māori data underpins the ongoing development of that economy, and that economy plays a significant role in the future of the country. So we look forward to this side of the House supporting it. Tēnā tātou.

Thank you, Mr Speaker. A number of speakers have covered, at length and breadth, the content of the bill, so I wanted to confine my contribution this afternoon to a couple of aspects of it—first of all, just generally, the purpose of the bill in terms of supporting the Government and New Zealand’s efforts to combat cyber-crime. What we’re talking about here is international cyber-crime, because, as we will all be well aware, a good proportion of the crime committed online will be coming from jurisdictions outside of our control, so it’s important that these laws are in place and aligned across the world so that we can have a joined-up, consistent approach to that effort.

The second thing I wanted to talk very briefly about is what the bill actually does. Of course, as my learned colleague His Worship mentioned, New Zealand is not a party to the convention, but it is a signatory to the Budapest Convention. Of course, with all conventions and international treaties, those conventions and those treaties do not have force of law in New Zealand unless incorporated into domestic statute and domestic legislation, and that is what we are doing here today. We are taking a position as a Parliament and as a House of Representatives to incorporate provisions and to align our laws and to make sure that the strands and the parts of these conventions are able to be implemented in domestic law. The only way we can do that in a way which is proper and enforceable is through the Parliament, by giving Parliament sovereign right to determine the laws and incorporate international conventions and international guidance into our domestic statute.

That is what we are doing here today. That is what we are doing when we specify in legislation that parts of these international conventions apply and that parts of our statute book should be interpreted consistently with those conventions. It’s important that we do that, because it should be Parliament that determines what international treaties and international conventions apply. Of course, the executive have the right under our constitution to sign up to these and to accede to these, but it is the Parliament, it is the House of Representatives, that gives them force of law, and so that is what we’re doing here today. It is a genuinely honest and good effort and attempt by this House to combat the growing issue of cyber-crime across the international community. With that, I commend it to the House.

Thank you, Mr Speaker. It’s a privilege to speak to this bill. This bill is really about joining the club that keeps Kiwis safe online. It’s pretty simple in principle, but the actual reality of keeping New Zealanders safe in online spaces, as we know, is not a simple one. There are a lot of examples of exactly why it’s not simple and not straightforward.

The 2024 technology, media, and telecoms risk report by Willis Towers Watson highlights cyber and data privacy risks as the primary concern for the technology, media, and telecommunications industry. The report surveyed the global industry and indicated that heightened cyber-threats accompanied reliance on artificial intelligence and machine learning for growth. Specifically, 51 percent of media and telecom businesses and 46 percent of technology firms identified cyber-security as a major risk.

More locally, Kordia tells us that the independent research commissioned by Aura Information Security tells us that more than half of businesses in New Zealand have been targeted by a ransomware attack just in the past year, and one in five of those businesses have said that that attack caused serious disruption to operations. One in five of those businesses estimates their organisation is affected by 16 or more ransomware attacks not per year but per quarter—that’s 64 per year. And two-thirds of businesses—and this is quite concerning—admit that they would pay a ransom to retrieve data after a ransomware attack. One in 10 of those would consider paying more than $50,000.

You can see why bad actors are motivated to do the attacks, to act in bad ways online, when companies and organisations see that the easiest way out is to pay the money and get their data back. That’s why it’s so important that New Zealand takes a step forward to join this club that’s about keeping Kiwis safe online. I guess you could say that it’s a coalition. It’s a group of countries coming together to keep people safe. It’s a really good coalition. It’s a coalition that’s been created for over 20 years now, and we’re invited to be members of it, and we should. It’s good to have a coalition that does good things. We don’t have really any recent examples in New Zealand of such a thing, so it’s good to be able to talk about a positive coalition in this House.

I am supporting this bill and Labour is supporting this bill for a number of reasons. Firstly, it’s the continuation of the work that we started in Government. Importantly, it enhances support for victims of cyber-crime. We’ve all seen lots of stories about the really negative personal impacts that cyber-crime can have on people’s lives, on their businesses, but also on people’s health and mental health. For that reason, we really support the victims of cyber-crime.

It allows for ongoing updates to keep pace with technological advancements. I think it’s important that we think about that in legislation, particularly with the speed at which AI is rolling out across the globe and here in New Zealand—that we have legislation that’s future-proofed to be adaptable to address the challenges that AI will face us with, as well as the manifold opportunities.

Really importantly, as both a Christchurch resident but also as a New Zealander, it fulfils Labour’s promise to implement the recommendations from the royal commission of inquiry into the Christchurch terror attack. I think that it’s really important that we follow through on those steps and honour those that we lost, but also take steps in every possible place to keep New Zealanders safe. It’s good to see legislation being progressed through this House that does that. Thank you, Mr Speaker.

It gives me pleasure to rise on the first reading of the Budapest Convention and Related Matters Legislation Amendment Bill. I don’t think, in the history of the New Zealand Parliament, we have talked so readily about the beautiful capital of Hungary, being Budapest. For those who are interested, this omnibus bill is 75 pages. It will take a lot of reading, but it’s available on the parliamentary website, for those who want to see what this is for.

This 75-page bill will ensure that the New Zealand legislation, as my colleague James Meager has said, fully aligns—fully aligns—with the requirements under the Budapest Convention, improving international cooperation, which has been well canvassed, against cyber-crime by providing a consistent framework for defining computer crimes, enabling lawful access to evidence, and outlining expectations on how relevant international agencies assist each other.

As has been mentioned, it’s had a long gestation, a 20-year gestation—back even further; the convention was signed in 2001—23 years ago—and now has 65 member States, predominantly from Europe but also from Asia, North and South America, Australia, and the Pacific. It entered into force in July 2004. Our Ministry of Foreign Affairs and Trade wrote to the Council of Europe in 2020 expressing interest, and so today we are beginning that pathway of ensuring that our legislation, that our commitments, fully align with the Budapest Convention. I commend the bill to the House.

Tēnā koe e te Māngai. Otirā, e tika ana kia tuku mihi atu ki te Whare.

[Thank you, Mr Speaker. And so it is right that I acknowledge the House.]

I join with colleagues around the House to support this bill on the Budapest Convention. I’ve actually had to look that up for myself—I wasn’t expecting to take a call on this bill—but what I found interesting was not only the number of countries that have signed up to it but the active cooperation, and this time around the world is really important for this matter. We are increasingly doing everything online, and the number of bad actors out there seems to get more and more each time I turn the computer on—and I’m not that person!

I think it’s really important that we make a distinction also about what’s happening here. To me, it’s a matter of cooperation around the world with like-minded States to address cyber-crime, because, at the moment, we can’t always do that. We’ve got to have that framework in place and the mechanisms available to us for us to be able to deal with it, and this bill delivers that.

There are some other things too, and my colleagues have mentioned also for us here in Aotearoa the recommendations that have been made on the Christchurch terror attack. It’s really important that this House continues to acknowledge that and passes this type of legislation, which addresses it. Those were the recommendations—to do that.

I am struggling a little bit with the notion of Māori sovereignty of data. It’s not the sovereignty—I get all that and I accept that—but this is about protecting it from overseas people. There’s a whole different conversation about the protection of data in New Zealand compared to data that has been accessed illegally and having a framework to be able to address that with other nations. That’s a totally different issue. That’s about our sovereignty in our country, not about the way that we interact with other countries around the world to combat cyber-crime. I think that that’s an altogether different conversation that we need to have; a valid one, none the less.

Anyway, it’s important, I think, that we do get collective agreement on this. I look forward to seeing what happens at select committee and whether Māori organisations around the country have the same view or what their views are on it, and that will be interesting to see, but, from my view, I don’t think we would separate that out or that we would need different kinds of protections, because there’s only one kind, and that’s cooperation between our nation and other nations to combat cyber-crime. Kia ora.

Thank you, Mr Speaker. It’s good to have the opportunity to rise and speak in support of the bill before us today in its first reading, the Budapest Convention and Related Matters Legislation Amendment Bill. As my colleague before me, the excellent, hard-working MP for Upper Harbour, Cameron Brewer, mentioned, this is an omnibus bill and that means it affects a number of bills, and that’s what we’re dealing with here today.

Look, I think my colleagues across the House, most of them at least, have given a good synopsis of what this bill is about. What I’d like to add is that, essentially, cyber-crime is crime that takes place via the internet. What we know is that cyber-crime and fraud at this stage makes up 11 percent of all scam victims in New Zealand and is increasing rapidly. I know that when we speak to police people, they tell us that as well. We do all make jokes about the prince from Nigeria, but that alleged prince from Nigeria is part of the 11 percent of people that have been scammed. In pursuit of finding where this alleged prince is, we commend this bill to the House.

The question is that the report be noted.

Motion agreed to.

The question is, That the Budapest Convention and Related Matters Legislation Amendment Bill be considered by the Justice Committee.

Motion agreed to.

Bill referred to the Justice Committee.