Budapest Convention and Related Matters Legislation Amendment Bill

Thank you, Mr Speaker. I move, That the Budapest Convention and Related Matters Legislation Amendment Bill be now read a third time.

When people think about the things that this Government has focused on, restoring law and order has been one of our core promises to the people of New Zealand, and that takes many different forms. A lot of it has been canvassed in many other parts of the House, but this piece of legislation is part of that overall plan. It means that New Zealand can finally join the Budapest Convention and demonstrate our commitment to the global fight against cyber-crime. Cyber-crime causes New Zealanders significant financial harm and emotional distress. According to the Ministry of Justice’s New Zealand Crime and Victims Survey, 11 percent of New Zealanders were victims of fraud and cyber-crime in 2024, and the National Cyber Security Centre estimates $1.6 billion was lost to online threats. However, many of the criminals, of course, that seek to exploit New Zealanders do not operate within our borders, and we cannot fight them alone.

By joining the Budapest Convention, we will join a global community of like-minded countries who are dedicated to working together against cyber-crime. Joining the convention will give our law enforcement agencies new tools to protect New Zealanders. It will make it easier to request overseas assistance in gathering evidence, especially digital evidence that is stored outside New Zealand. Access to this evidence can be crucial to successful detection, investigation, and prosecution of crimes of all kinds, not just cyber-crime.

The passage of this bill is a necessary step towards joining the convention, ensuring—as it does—that our domestic legislation complies with the convention’s requirements and international best practice. The bill will also enable law enforcement agencies to take full advantage of joining the convention by ensuring that they are appropriately empowered to gather digital evidence and collaborate with international partners on cross-border investigation. It does this in two ways. Firstly, it amends the Search and Surveillance Act to create a regime for preservation directions, a new power that enables law enforcement to prevent somebody from deleting information that may be evidence of a crime. This will be particularly valuable for cross-border investigations, where it can unfortunately take a long time to get authorisation to seize evidence. Preservation directions will enable law enforcement to act quickly to protect evidence while this is taking place. Secondly, amendments to the Mutual Assistance in Criminal Matters Act will expand the kinds of assistance for criminal investigations we can provide to foreign countries and seek in return. Getting these settings right is crucial to ensuring that we can hold our own offenders to account, regardless of where the evidence is stored, and that we can support other countries to do the same.

In addition to these two key measures, the bill also makes several other small changes, including changes to the Crimes Act and to the Telecommunications (Interception and Access) Act, and these changes ensure our legislation fully complies with the convention. Other amendments ensure the bill provides additional protections for human rights and that international cooperation does not run counter to the public interest of New Zealand.

The bill has been improved along the way by the efforts of the Justice Committee, and I want to thank members of the committee for the time they took, and the many people who took time to submit, and the officials that provided helpful advice.

This Government is committed to ensuring our law and order enforcement agencies have the tools they need to tackle crime in all its forms, and this bill will contribute to this goal by providing modern, fit for purpose powers that will respond to the concerns of the digital age. I look forward to New Zealand being able to join—become a member of—the Budapest Convention, signalling to the world that we are dedicated to the fight against cyber-crime. Thank you, Mr Speaker.

SPEAKER: Before I call the member, I just wonder if the Minister wants to present the legislative statement on this bill.

Hon PAUL GOLDSMITH: Indeed, I do.

SPEAKER: Would you like to seek leave to do so, since it’s out of sequence? Just to get everything right.

Hon PAUL GOLDSMITH: I seek leave to present a legislative statement.

SPEAKER: Leave is sought for that purpose. Any objection? There appears to be none. Away you go. Present—can you use the words?

Hon PAUL GOLDSMITH: I present the legislative statement on this, the Budapest Convention and Related Matters Legislation Amendment Bill, to the House.

SPEAKER: That legislative statement is published under the authority of the House and can be found on the Parliament website.

The question is that the motion be agreed to.

Thank you very much, Mr Speaker. It’s a pleasure to take a third and final call on the Budapest Convention and Related Matters Legislation Amendment Bill. As the House is well aware, Labour supports this bill. It was something initiated under us. It aligns with our commitment to enhancing New Zealand’s cyber-security capabilities and also international cooperation in this space. It brings New Zealand into line with our international obligations, and it is us playing a part in a worldwide network to counter cyber-crime.

One of the issues that has been discussed through the passage of this legislation and that has come up is the importance to say that if we have a threshold for crime in real life—which is shoplifting or burglary—why is that threshold not the same for cyber-crime? Many New Zealanders have been victims of phishing, of identity theft, and of various kinds of online crime or fraud, yet the amounts lost out of their bank accounts far exceeds the amount sometimes stolen from a shop or even a private property. It’s a lot harder for those New Zealanders to seek redress, to seek justice, and to be able to have a clear pathway on how to get their lost funds.

While it is great that we’re having a greater level of international cooperation with our partner agencies in our partner countries, it’s also incumbent upon New Zealand to resource law enforcement agencies to be able to respond to cyber-crime that occurs here in New Zealand. We know that in the recent crime and victims survey, and in other surveys, the level of cyber-crime in New Zealand is growing exponentially. It’s one area where we need to have increased investment. While we know there’s been speculation as to whether, if you have a burglary or a shoplifting worth less than $500, the police will turn up or not—given there was a directive sent out not to go, and then it got retracted when it got bad media—what is the story with cyber-crime?

There are individuals who lose tens of thousands of dollars to cyber-crime, and it’s incredibly difficult for them to seek justice. Often, they are told that it’s for them to go to their bank or their insurance company and to seek redress through those routes. I believe that we need to have a more ready response to those levels. This bill does build on the work that Labour did in Government to join the Budapest Convention, and it implements, also, some of those recommendations that were made in the royal commission of inquiry after the Christchurch 15 March terror attack.

We know that cyber-crime is a growing frontier of criminal activity, and I would like to highlight the fact that it’s important to have that same threshold of crime in real life versus crime online. They should be the same level of severity, irrespective of how that crime is conducted. The problem that we create if there’s not that similar threshold is it incentivises crime to be online. Those criminals who want to operate illicit funds illegally are attracted to online networks and online ways of stealing money and taking people’s savings if they can get more and the punishment is reduced. We want to make sure that we have consistency right across our law and that we are working well with counterparts to make sure there are fewer gaps that criminal networks are able to exploit. That is why this bill is important. It really enables us to join hands with a number of other partner countries to provide limited opportunities for organised criminal networks to exploit those people who work hard and have their savings locked up.

In 2023, 11 percent of New Zealanders were victims of cyber-crime, and that’s a growing number. We know that cyber-crime does cause serious financial harm not only to individuals but also to businesses. We want to make sure that in New Zealand, we are able to have a high level of trust and confidence with our personal information that is used online. That trust and confidence is significantly undermined the more that criminal networks or operatives are able to exploit people. It erodes that trust and confidence, and it makes us less able and flexible to evolve and have a digital system if people do not have that level of trust and confidence.

A lot of cyber-crime does happen across borders, and that’s where criminals exploit those differences between jurisdictions. The Budapest Convention aligns with the international community, and it enables us to cooperate in catching and prosecuting cyber-criminals—knowing where these people are coming from and where they are operating, and working in unison with their jurisdictions to make sure that people are held accountable when they commit a crime. We expect someone who steals from a shop to be held accountable and to be punished. The same thing should occur for those criminals who operate in cyberspace.

What this bill does is it’s designed to update New Zealand’s legal framework to be able to counter that cyber-crime far more effectively than what we do already. It paves the way for New Zealand to really enhance that level of international cooperation, and it does this by introducing new tools for law enforcement that, previously, we did not have. One of these—it’s been discussed at length at the committee stage and other stages of the bill—is data preservation orders. This helps, essentially, to secure digital evidence, to keep that evidence, and make sure it can be used to demonstrate and prove who is behind the criminal activities that has gained funds or accessed personal information. It improves mechanisms for accessing electronic data and international cooperation on cyber-crime. Essentially, it means that that data can be requested from telecommunications companies and be able to be used as evidence to demonstrate a network of criminals operating in that space.

The bill, effectively, amends the Search and Surveillance Act and also MACMA, the Mutual Assistance in Criminal Matters Act. The primary change to the Search and Surveillance Act is the introduction of those preservation directions. That means that New Zealand Police and others are able to have access to computer data to be preserved where there are grounds to believe that documents are particularly vulnerable to loss or modification. A preservation direction is the interim measure for ensuring that evidence in the form of documents is preserved before a production order is sought requiring those documents to be produced.

Typically, when someone has committed an act of cyber-crime, they will simply close an account or shut it down to remove traces of themselves. These orders operate to be in advance of that and to be able to secure that information so that before the account is shut down or closed, law enforcement authorities are able to gain that information and know who is behind that criminal activity. Where a person is subject to a preservation direction, they are legally obligated to keep the existence of that direction confidential for a period of time to avoid prejudicing any potential criminal investigation. That’ll be a difficult area. It’ll be interesting to see, over that time lapse, how our law enforcement authorities will work alongside other agencies to make sure that that comes into force and works well. I’m sure there’ll be some changes to see how it works, particularly if they’re going through courts and if there are delays in the courts, depending on when they’re being prosecuted.

The select committee heard some really excellent evidence, and we made a number of amendments to the bill, including to make clear that the public interest in avoiding prejudice in proceedings for an offence against a foreign country includes public interest in avoiding undue delay. Ensuring that all of those things are looked after, those amendments were made. We also recommended amending clause 37 to include the public interest, ensuring notifiable persons can challenge the legality of a proposed direction. We also heard some really good evidence from telecommunications companies that internet service providers do not typically have the capability to identify whether a customer has sent an email or something similar from a third-party service without intercepting it and analysing it. As a result of receiving that information, the committee has decided to recommend the obligation to provide that the nature of the telecommunication should not extend to third-party communication services carried to the network using an internet-dependent service.

It got quite technical at points there, but I think we mostly got our heads around it. Even Andrew Bayly did. We were really happy to work together, and it’s nice to see the committee agreeing to progressing a piece of work that, hopefully, will strengthen law enforcement not only in New Zealand but also working with our international counterparts to reduce the opportunities for organised networks to use cyber-crime to take money and personal identification of hard-working people. We have to do our part on the global stage, and this bill is a small step in the direction of doing that. I commend it to the House.

Thank you, Mr Speaker. “We are broken hearted, but we are not broken.” This is a quote from the Imam of Al Noor Mosque, where, on 15 March 2019, 51 Muslim worshippers were martyred and 49 were injured in the terrorist attacks during the Friday congregational prayer. Now, I have here the submission of the Federation of Islamic Associations of New Zealand (FIANZ) to the royal commission of inquiry into the March 15 attacks. I would like to quote from it here: “The Police and NZSIS did not anticipate and plan for the attack because the Police and the NZSIS were not monitoring the terrorist. The Police and the NZSIS were not monitoring the terrorist because right-wing extremism was either not previously a national intelligence priority or was not included in the detailed requirements for previous National Intelligence Priorities relating to counter-terrorism. Right-wing extremism was not included in the National Intelligence Priorities … The NZIC did not surveil the online and offline activities of—”

SPEAKER: Can I just ask the member to come to the bill?

KAHURANGI CARTER: Oh, absolutely.

SPEAKER: The document you quoted from was, I think, publicly circulated.

KAHURANGI CARTER: Absolutely. Thank you, Mr Speaker. Cyber-crime, as we know it, knows no borders, and we must work together, as a global community, to make sure the world is a safer place. From the outset, the Green Party has engaged with this bill in good faith. We have supported the underlying purpose and intent of this legislation, which is to enhance international cooperation on cyber-crime and ensure our communities are safe.

We acknowledge the implementation of this convention was recommended at the royal commission of inquiry into the March 15 terrorist attacks, and we remain committed to advancing and honouring the recommendations of the royal commission of inquiry. We know that it is our job here to ensure the legislation is fit for purpose and will actually achieve the stated intent.

Throughout the select committee and committee of the whole House stages, we raised specific and practical concerns about the way this bill is drafted. These concerns relate to human rights, judicial oversight, and the scope of enforcement powers. In particular, we remain concerned about the risk that this legislation could enable with foreign Governments, in a way that could have unforeseen effects on refugees, political dissidents, or those engaged in lawful protests.

But after the committee of the whole House last night, when we talked through new section 88A(4)—which narrowed the political offence exception, meaning that individuals could be subject to surveillance or data preservation solely because their country of origin is a treaty partner, even if the underlying offence relates to peaceful political activity—and also we brought up new sections 88B and 88V and the provisions in Subpart 2 around the safeguards around proportionality, dual criminality, and human rights expectations, we want to make sure, and we all must ensure, that any prosecutions would meet New Zealand’s own legal and ethical standards.

The Minister engaged with our questions, and one of the answers was about the Auditor-General reviewing this legislation and being satisfied that, with other Acts that are currently in our Government, this bill is in line with our New Zealand Bill of Rights Act—which I will refer to as BORA from now on—and to address these issues, we did actually lodge a number of good-faith amendments, which were, unfortunately, not supported. These were a clause to exclude political refugees from preservation directions and related investigation powers; also, a clause to ensure the legislation did not apply to lawful protest activity or acts of political expression—which is, obviously, a legal thing in New Zealand and a part of our democracy here; and, also, a provision requiring regular reviews of the legislation and the impact, specifically focused around the civil liberties, freedoms of expression, and compliance with the New Zealand Bill of Rights Act.

Unfortunately, as I said, these weren’t supported, but what I did look into was our human rights protections that already actually exist under the Mutual Assistance in Criminal Matters Act 1992, and it does show that within the departmental reports and with the Minister’s answers, these would be covered. But I would still really put down the challenge that we need to be reviewing this legislation to ensure that those things that we hold to be really, really important and true to our society here are looked into to make sure that we are staying true to who we are as New Zealanders and the laws and democracy that we live by here.

The biggest concern for me, and which was so disappointing, was the fact that this legislation is about one of the recommendations in that royal commission of inquiry into the March 15 terror attacks, and part of that royal commission was really clear in recommending meaningful consultation with affected communities must be a core part of the legislative response to those attacks—and FIANZ was not even consulted. They didn’t know that the select committee process was coming up. This is a real oversight that we had here and something that I would like to challenge this Government on—that we really take seriously the recommendations of any royal commission and make sure that we are engaging with the communities that our legislation will most affect. I highlighted during my second reading speech that community organisers, including FIANZ—the Federation of Islamic Associations of New Zealand—were not consulted, and they were really disappointed and provided a quote to say, “Let’s work together so that we make our country safer and that this never happens again.”

More needs to be done to ensure the utmost transparency, and judicial oversight must be taken in matters of surveillance. We know, in other jurisdictions, that national security has been used to infringe on democratic rights, and that is something we absolutely do not want here in New Zealand. We do not want to be an over-surveilled country, and we need to learn lessons from our overseas counterparts. The Green Party agrees that cyber-crime is a serious and evolving threat, we agree that international cooperation is vital, and we support the purpose of the Budapest Convention. We remain hopeful that the concerns raised in good faith during this process will inform legislative work in this space, and we will continue to advocate for a framework that protects our communities.

I just want to take the time again to talk directly to all of those families, the communities in Christchurch, the community of Al Noor Mosque—which is just around the corner from my home—and say: today, Parliament heard you. They heard—we heard—that New Zealand was not a safe place for you. You are Kiwis, you belong here, and we are sorry that this law and our systems didn’t protect you. Today, this one is for you.

Thank you, Madam Speaker. I rise on behalf of the ACT Party to support this piece of legislation to enable us to enact the Budapest Convention. It’s really important, as I’ve discussed in my previous speeches, that New Zealand, as a tiny island nation at the bottom of the planet, works with our like-minded partners to counter things like cyber-crime.

We’ve seen over the last few years, particularly the last couple of years, a really big increase in these kinds of global events that do reach as far as New Zealand. I mean, quite a few in this House are probably well aware when even our systems are going down here in Parliament. It is happening all the time, and so this is a really needed piece of legislation.

In order to identify bad actors within the systems, we need to work together. Part of that means preserving data. It means sharing what we have with our like-minded parties. I think that this is a really valuable piece of information and it’s also something that is really important to countries like New Zealand. In fact, it does actually protect our sovereignty.

I do accept the concerns that the Green Party have, and I note previous speakers’ concerns—I think Dr Duncan Webb also mentioned this—around how we don’t want to become over-surveilled, and we also don’t want other countries to use surveillance as a means to get to our citizens here in New Zealand for nefarious means. I think that this piece of legislation does strike the right balance. We need to make sure that we can freely share this information in order to stop cyber-crime, for example, but we need to also make sure that we protect our citizens. As the Minister has said during the committee of the whole House, these concerns are addressed and are in line with the New Zealand Bill of Rights Act.

ACT does commend this bill to the House, and we look forward to seeing more legislation around this space when it comes to the digital world, and I look forward to discussing those other speeches.

I rise on behalf of New Zealand First to speak in support of this third reading. Look, in simple terms, this is about New Zealand ratifying the convention that we have already signed up to, and it’s a normal process to go through for all countries, as far as I understand—certainly in our system—to do that.

Look, it’s interesting to hear some of the concerns which are being expressed by members who are going to support the bill anyway, who often tell us how important it is that we are consistent with various international agreements that we’ve signed up to. Here is an international agreement that we have signed up to and it seems consistent to actually follow through and actually deliver on that, which is what we are doing today. This is about us being a responsible global citizen. It’s about sitting alongside over 80 nations who’ve already signed up to the Budapest Convention.

We’ve heard already through the several readings that we’ve had that cyber-crime is an increasing problem; it’s a growing problem. We heard—in fact, I’ve got a shout-out to Reuben Davidson for the speech that he gave that I did hear—just the devastating impacts that cyber-crime can have on individuals of the scams, the taking of people’s money, leaving them with nothing. I thought that that was quite compelling to hear that and quite tragic to hear that where somebody is taken advantage of and that all their money, effectively, has been stolen—because that’s what it is: it is stolen.

The other element of cyber-crime, of course, is that we are seeing increasing numbers of attacks by malicious actors, sometimes national, sometimes subnational actors, who are conducting cyber-criminal activity on nations like New Zealand. It was actually interesting that we visited one country last year, and they said that they had in excess of 100,000 attacks a day on that nation, trying to, essentially, destabilise that nation to try and put in front of its citizenry inaccurate, misleading information to try and destabilise that nation. We know that cyber-crime, cyber activity, is a huge issue and is probably only going to, sadly, get worse.

There are two or three other things I wanted to say. This convention is about improving cooperation. We’ve heard quite frequently that cyber-crime is something that knows no boundaries, and this is about allowing and improving cooperation across borders so that we are working with like-minded nations who’ve signed up to this convention to try and deal with that international, cross-border crime, and that makes absolute sense. As I said, this is about us being a responsible global citizen.

The information that we’ve also had in the departmental disclosure statement says that the convention requires the provisions to be designed in a way that upholds and promotes human rights, particularly the right to be free from unreasonable search and seizure. We’ve heard quite a lot about making sure that we are not overly surveilled—that is really, really important. My understanding is that is what the convention is intended to do: to make sure that we don’t have excess, unreasonable surveillance.

The final point I want to make—because we’ve heard the comments made around the awful events of 15 March 2019—is, again, the advice we have is that the implementation of the conventions provision was recommended by the royal commission of inquiry into the terrorist attack on the Christchurch mosques on 15 March 2019. So it was a recommendation coming from that inquiry, which has been dealt with through the bill that we are addressing this afternoon, and I commend the bill to the House.

Thank you. I started my second reading, I think, on this one saying it’s easier to go from a “no”, to a “yes”. But we’re still in the “no” lane today, sadly.

Andy Foster: Aw!

MARIAMENO KAPA-KINGI: I know. But just let me say this: Government rightly seeks to include our nation in the global effort to reduce and bring harsher consequence to those engaged in cyber-crime by joining the Budapest Convention. I acknowledge the necessity of this convention as the digital world extends beyond the borders of countries and, therefore, beyond our nation’s laws. Taking action to alleviate the challenge of this, I applaud, yet I cannot commend this bill to the House.

Unity in principle does not blind me to the details of this legislation, nor those of Te Pāti Māori. The proposed bill currently undermines privacy and risks public trust, which is already a bit low in any case—certainly from the communities that I live with and work with—as it exceeds the requirements of the convention.

This bill asserts preservation directions, meaning that your digital data can be frozen, not just for cyber-crime but for any offence, including those not recognised under Aotearoa New Zealand law. This can be done without any judicial oversight. This is deeply concerning, because we’ve seen how this type of approach of overreach to cyber-security can play out for communities that are typically marginalised by most of our society.

I speak specifically to the Tūhoe raids in 2007. That’s not that long ago—18 years ago. In fact, I’m sure the majority of members in this House can recall when those raids occurred. Now, how come they occurred? The raids were undertaken without necessary checks given the broad powers granted under the anti-terrorism legislation. This has stark comparisons to the convention itself and the broader powers within it. But at the time of the raids, it was physical powers that lacked judicial oversight. With this convention it is now digital powers—the lack of judicial oversight. At the time of the raids, our Māori communities were targeted and profiled.

How will this profiling be mitigated against? Have necessary discussions taken place to understand how this convention might negatively impact on marginalised communities, including Māori? History shows us time and time again that Māori are often the first to draw the short straw when it comes to expansive Government powers. The Tūhoe raids show that clearly and explicitly.

This draws me to another point of concern, which is around—and I’ve raised this a few times in first and second readings and even last night—Māori data sovereignty. The value of Māori data sovereignty is critical to our success, to our self-determination, to whānau, to hapū, and to our Māori businesses, right? So unlocking economic and social potentials enabled by Māori data—OK. And Māori data must be owned by Māori. The convention means that we could be compelled to hand over private data to foreign Governments for offences that are not crimes in Aotearoa New Zealand. This risks the safety of Māori data sovereignty and the state of our people, as well. We cannot rely on international countries—and probably a bit rugged here right now, just saying—to place a non-biased lens onto their efforts in reducing cyber-crime.

So we still are opposing this bill. Again, we were trying to go for the “yes”, just so you know—because, I mean, as a bigger idea, of course it’s a good idea, but it’s in the detail that it fails. You can have a great idea but fail and deliver a really poor methodology, and that’s certainly the case in this instance, sadly. So we oppose it to this point. Thank you.

Thank you, Madam Speaker. I rise on behalf of the Green Party to speak in the third reading of the Budapest Convention and Related Matters Legislation Amendment Bill.

We have heard from various speeches already in the House that part of this bill in itself is to ensure that we are aligned with the requirements of the Council of Europe Convention on Cybercrime, known as the Budapest Convention, but also the implementation was recommended by the royal commission of inquiry into the terrorist attack in Christchurch on 15 March 2019. This is a topic that is not to be taken lightly, and this is one of the reasons why the Green Party, up to the first reading, select committee, second reading, and the committee stage, had a lot of concerns around this. I just want to highlight, again, some of the concerns we’ve had and how that was navigated through the committee stage.

I think the main part of this, particularly, in the bill, when we’re looking at clauses 18 and 19 of Part 1 of this bill, which is around the criteria of preservation directions, but also in terms of how that is going to be implemented—one of the key concerns that we had around this is, number one: what are the safeguards for us to be able to protect anyone in Aotearoa New Zealand against potentially foreign authorities that may not hold the same value?

We did put in Amendment Papers, which were not accepted by the Minister of Justice, around safety for those who are refugees, safety for those who are in Aotearoa New Zealand as a result of political persecution from their home country or from their country of origin, and amendments around the ability to be able to protest, which is a right given to anyone here in Aotearoa New Zealand under the New Zealand Bill of Rights Act.

We were assured by the Minister, and we are really kind of taking a leap of faith, in this case, on what the Minister is referring to in new section 88D, inserted by clause 19—and I read—“Commissioner to make preservation direction”. The commissioner may refuse to grant all applications if satisfied—and I will home in on subsection (d)—that “granting the application would prejudice the sovereignty, security, or national interests of New Zealand.”, which includes the core values that we hold dear in Aotearoa, including our Human Rights Act and the New Zealand Bill of Rights Act. That, for us, is incredibly important as a baseline for how we approach this bill.

Now, the other thing that we want to highlight in terms of this bill is around people’s ability, if there is a preservation direction, to challenge that preservation direction by right. This is something that we did seek advice on from the Minister, but we didn’t get a clarification on this particular point, but I’m hoping that is something that is embedded in new sections 88O and 88P, inserted by clause 19, in terms of the ability for reviews and the right of review but also how reviews must be conducted.

Again, this is something for us that provides the kind of safety net that means that we’re not going to see situations that we have seen already, where we are using police resources here in New Zealand to investigate on personnel here in Aotearoa New Zealand that is dictated by a foreign authority and the nature of the investigation may not be in line with our values as New Zealanders and within our national interest. So we’re hoping that this does provide a level of safeguards.

I think the other thing that does provide is a level of transparency that we do see in new section 79Y, inserted by clause 18, around the need for annual reporting.

So, with all of this combined, we are, at this stage, taking a leap of faith to support this bill in its third reading. The Green Party wants to ensure that there is judicial oversight, with full transparency of Government actions involving the surveillance of individuals and also the designation of people as a threat to security. We’re hoping that this bill will strike that balance, but we’ll see in time.

Thank you, Madam Speaker. We are in the third and final reading of the Budapest Convention and Related Matters Legislation Amendment Bill. I was privileged to be a part of this process—part of my role on the very busy and hard-working Justice Committee.

Essentially, what this bill does, as we’ve heard—if we’re going to put it down in a nutshell—is align our domestic laws with the obligations that we signed to on an international level, in international law, under the Budapest Convention, essentially, to fight cyber-crime. Cyber-crime is one of the fastest-growing crimes that we’re seeing not only in New Zealand but, indeed, around the world. The way that this law will do this is by aligning with international law.

We’re amending four of our domestic laws—essentially, the main changes being that law enforcement agencies will be able to require companies to preserve records that can be used as evidence of cyber-crime offending. Another main change is going to be that New Zealand’s ability to receive assistance from foreign countries is strengthened for these criminal investigations. Of course, we will be able to further provide our assistance to different countries in return.

Tackling cyber-crime is being tough on crime, because today’s criminals don’t always wear masks or gang patches—they use keyboards—and this new law brings New Zealand into line with international laws. I commend this bill to the House.

Thank you, Madam Speaker. I know there’s a lot of controversy around this bill. My former colleague Claire Szabó would want me to note this—as to whether it’s the “Budapest” convention or the “Budapesht” convention. I just put that on the record, and I’m not sure how Hansard will record it—ha, ha!—but there is an “s-h” sound by some local pronunciations.

In any event, look, obviously we all support this bill, but I do want to just kind of put a marker down. It has been mentioned that this is, essentially, a search and surveillance bill focused on transnational crime, and particularly around cyber-crime. My Green colleague and Christchurch buddy Kahurangi Carter noted that cyber-crime is, essentially, borderless, but we still do need to be really cautious. Sometimes, I think we take the view that if all we’re intercepting is electronic communications, then, in some ways, the threshold for intervention, the threshold for surveillance, for intrusion, is somehow lower. I just want to say that it’s not. Someone looking at your text messages or even something as apparently benign as, you know, how often you’ve called that number in Columbia or Bangladesh—it’s just as important to protect that as any other aspect of our lives.

I really just want to talk about two aspects of this bill. Whilst we support it, I just want to kind of identify that I’m a little uneasy about aspects of it, right? The big innovation of this bill is preservation orders, so that we don’t see electronic records erased whilst people discuss whether we can seize them or not, so the preservation order which is aimed at providers—the Sparks and Vodafones of this world. One is the right of review, in terms of if there is a preservation order that someone thinks is unfounded, the right of review is entirely administrative. There is a strong principle that administrative action should be subject to judicial supervision, not more administrative action. So an administrative review is problematic.

The other thing about that administrative review—it’s in new section 79J of the amended legislation, inserted by clause 18—is it’s done at the same level. It’s not even something that’s done at a mid-tier level, for example, with the Ministry of Social Development, then you go up the chain. You just stay at the same link and ask the person in the cubicle across the way, “Do you think I made the right decision?” It’s actually really problematic. So that’s the first thing I would say.

So that’s about preservation orders and the right of review—not entirely comfortable with that. The other point is this—and, honestly, it’s the one section that I really don’t know, I can’t understand, and we went through a pretty good committee of the whole House stage and the Minister couldn’t give me a satisfactory answer, and that’s the production of things. It’s about the Mutual Assistance in Criminal Matters Act. It’s about providing something to a foreign State. This is a very significant thing. So we could have a situation where there’s evidence in New Zealand; there is a trial in a foreign State, like China or Hong Kong; and that country has said, “Please provide to us the item of evidence you have seized.” It could be anything from a hard drive to a paper document to a physical thing such as, even, a weapon. Now, that’s fine, I get that—so far, no problem.

But the first thing you’ve got to do is to say to the person who is affected, “We propose to give this piece of evidence to this foreign nation.” That’s kind of obvious. You’re going to take an administrative action which significantly affects the right of a third party. It might not be a citizen, but it could well be. So you say, “Well, we’re going to hand over this hard drive full of all of this data, and we’re going to hand over this object”—which is alleged to be a weapon with which you’ve committed a crime—“to a foreign power.” Now, there are a raft of reasons which you might want to raise as to why that should not happen.

But new section 49B, inserted by clause 37, says that notice telling someone that you’re going to take this administrative action that directly affects their legal rights, you can do—and let’s use the word—in secret. Now, I can’t for the life of me understand why, because the State already has control of the thing. It’s not like there’s a risk that the thing, whatever it is, is going to be destroyed or tampered with. So the only reason is to stop the person affected having an ability to prevent it. To take a judicial review would be an obvious example, to say, “No, there is a compelling reason why that should not go overseas.” That hard drive you’ve got contains a database of the Uyghur support group in Christchurch, for example. Now, if that goes overseas—you know, it might even be by accident. It just looks like a customer database—might not even be called the “Uyghur support group”. It might be a delivery list for groceries, but it’s got contact details on it. Do we want to send that to a foreign State? We need to think about that.

I was really disappointed that the Minister, when given the opportunity, sort of said, “Well, it’s just how it works.” and didn’t give a satisfactory answer, because there might be—I can’t imagine what it is, but I was prepared to listen and hear that there’s a compelling reason where, in a narrow band of cases, we can’t tell the person affected that this thing is going to be given to a foreign State. But I can’t imagine it, and I wasn’t told of it.

So, look, the bill, cyber-crime—absolutely. Hacking—it’s a massive problem. We’ve got to address these things, but the balance between making sure that we protect human rights and certainly that we don’t enable foreign States to, essentially, misbehave is of critical importance. On balance, the bill, we’ve got to support it because it’s essential, and, of course, the Budapest convention—“Budapesht” convention—is a convention to which this Government acceded and we endorse it entirely, but still some concerns in there. I hope and I suspect that the judiciary will have a role to play as this rolls out in making sure that an appropriate balance is struck between the rights as set out in the New Zealand Bill of Rights Act and elsewhere, and achieving the objects of this legislation. Kia ora, Madam Speaker.

Madam Speaker, thank you. Cyber-crime is a growing threat in New Zealand—our seniors are especially at risk. Many are being targeted by scams and losing thousands from their life savings. This bill ensures our domestic law meets the requirements of the Budapest Convention—a convention on cyber-crime. By working together globally, we can better protect our people, our businesses, and our digital future. I commend this bill to the House.

Thank you, Madam Speaker. It’s a pleasure to take a further call on this bill at its third reading, and to continue to support the bill—we signed up to the Budapest Convention, or “Budapesht” Convention, as earlier speakers have indicated. It’s good to see that this important work continues.

Now, one of the important things about cyber-crime—and most speakers have touched on this, but it would be remiss of me not to—is that cyber-crime is borderless. It happens, and can happen, with an actor in one country, a victim or a target in another country, and crucial content regarding that cyber-crime sitting in a third country. So collaboration and cooperation between multiple countries to be able to detect, investigate, and, ultimately, to successfully prosecute, to ensure that victims of cyber-crime are not left without service, help, assistance—the convention does overcome these problems.

There are some specific considerations in New Zealand, as you would expect, when you’re looking at aligning and working with other countries, and these specific considerations that I wanted to touch on here were, firstly, the protection of data. At the select committee stages, and through the committee stage, there were some concerns raised that Māori data may be at risk if New Zealand accedes to the convention. It was noted that, for many Māori, data is considered a taonga—appropriately so. This is a really legitimate issue. So only data and information held or created by both Māori and non-Māori that contains evidence of offending would be sought by law enforcement agencies under the current arrangements or once New Zealand is a member of the convention—and I think that’s very important for us to see.

The other is that the convention requires law enforcement agencies be empowered to preserve and obtain specified electronic evidence of particular instances of criminal offending. Very importantly, the convention does not enable the collection of broad sets of data about populations or communities unrelated to specific criminal offending. It does not enable any type of social profiling, and that’s a really important consideration and should be something that we, as a nation, constantly give consideration to and monitor, in any agreements that we reach with other countries internationally.

Now, a second important consideration that I want to draw attention to at this stage of the bill, at this third reading, and as the spokesperson for the creative economy for the Labour Party, is that issue of copyright and intellectual property. The convention, importantly, protects copyright by requiring countries to criminalise the intentional infringement of copyright and related rights on a commercial scale by means of a computer system. So whilst our legislation is already aligned with the copyright-related provisions of the convention, the convention does not require New Zealand to accede to any treaties relating to copyright to which New Zealand is not already party. That is very important, because we are a creative nation. We are a nation of innovators and artists. Our intellectual property holds deep significance and economic value, and we need to make sure that when we agree to things like the Budapest Convention and Related Matters Legislation Amendment Bill, which we’ve discussed today—we are agreeing to—we need to make sure that we are protecting those innovators, those creative people, and our shared intellectual property here. I think, on balance, it’s a good bill. We continue to support it, and I commend it to the House.

I’m very honoured, and actually feeling excited about all the support from across the House for the Budapest Convention and Related Matters Legislation Amendment Bill. Particularly, I wanted to highlight the fact that this bill is one more step towards the right direction, under the National Government, to restore law and order—either in reality, physically, or online, through the digital platform. This is also particularly good news for all those victims, because, according to the Ministry of Justice statistics, 11 percent of Kiwis have been victims of cyber and digital harm. Therefore, this is a great bill, and I’m very, very honoured to be supporting this in the House.

Thank you, Madam Speaker. Like my colleagues on this side of the House, in terms of the Labour caucus, I’m pleased to be speaking in support of this bill at third reading. I appreciate the time that the various Ministers gave in the chair to responding to questions, but like my colleague the Hon Dr Duncan Webb, I also do have some concerns in terms of whether the bill strikes the right balance in terms of rights protection. Where I land is that, yes, I’m happy to support the bill through to legislation, but I do think it’s a piece of legislation that needs to be actively monitored to ensure that we aren’t infringing on rights. I agree with Duncan Webb that the courts absolutely have a role in terms of making sure that that’s the case.

At second reading and at committee of the whole House stage, I spoke about reports and commentary from the likes of Amnesty International and Human Rights Watch in terms of what we’re seeing around the world in terms of repression of the online voice. There’s also an organisation called Freedom House who publish annual or periodic reports on transnational repression—so this is Governments reaching across borders to silence dissent amongst diasporas and exiles. They do that physically—I’ve spoken about that in terms of assassination and illegal deportations, abductions, threats, including threats to family members—but they also do that through sourcing information through agreements such as this.

I also spoke—I think it was yesterday; we were in committee stage—about the comparison between the UN draft convention and the Budapest Convention. I acknowledge that the UN draft convention is particularly problematic, because we had a number of countries attempting to introduce what are called content crimes—so not just crimes of fraud and corruption but, essentially, crimes of the use of speech in terms of how they’re used against Government. Some of those crimes are suppressing a political voice; others are suppressing a religious voice, as well.

But what Freedom House says in their most recent report, which was a report on 2024, is that we have seen global internet freedom decline for the 13th consecutive year. What they’ve said is 55 of the 70 countries that they monitor have found that people have faced legal repercussions for expressing themselves online, while people were physically assaulted or killed for their online commentary in 41 countries. They’ve also found that generative artificial intelligence threatens to supercharge that online disinformation space, and at least 47 Governments have deployed commentators to manipulate online discussion in their favour during an election period, which was double the amount of a decade ago. They’ve also found that the legal frameworks in at least 21 countries mandate or incentivise digital platforms to deploy machine learning to remove disfavoured political, social, and religious speech.

Now, during the course of committee stage, I asked various questions on this, and there are provisions in the bill that look at protection for political speech. But my questions were really around whether that’s broad enough to cover what we’re seeing happen internationally, because a number of speakers have said that, you know, this is our opportunity to collaborate with others in combating cyber-crime. That is true, but the countries who are signatory to this convention have quite a broad slate of laws on their books. It isn’t just Canada, Japan, the United States, and South Africa; it is now also the Dominican Republic; it’s Israel, Guatemala; it’s Kazakhstan, Kenya, Kiribati, Nigeria, Mexico, Philippines, Tunisia; it’s Sri Lanka; it’s Timor-Leste. It’s a broad slate of countries, each of whom will be criminalising content law in quite a different way—some of it political, but, actually, some of it social, some of it religious. So we do need to be very cautious about how we approach and monitor this area.

Now, having said all of that, the reason why I’m in support of this bill passing into law is in part because my view is the common law principles that have assisted us in lawmaking thus far continue to apply, and one of those protections that I’ve spoken of is the common law duty of candour. This is helpful in terms of the granting of preservation directions where you may not have the subject of that order being able to produce their view as to why the order shouldn’t be granted. Essentially, the common law duty of candour says that a decision maker in that context must take into account the reasons why you should not grant that sort of an action. That applies in common law regardless of the fact that it’s not set out in legislation. That was developed through a number of different cases, but most notably Hager v Attorney-General. We have a number of common law precedents that are equally as helpful in the context of search and seizure in relation to this bill.

I do note that the Justice Committee—and I wasn’t part of much of the hearings in terms of this bill, but the select committee did raise issues about individuals being able to challenge the sending of information overseas before it was sent overseas. This comes out through the common law in Kim Dotcom v Her Majesty’s Attorney-General, where there is an understanding in common law that you should be able to challenge those decisions because they can be detrimental to you. So the common law framework is very helpful.

I do think there’s still potentially a gap, and I asked a question at committee stage about what happens when information is sent overseas not necessarily to disadvantage the individual who’s in New Zealand directly but, potentially, one of their family members. Certainly, from conversations that I’ve had with members of our multicultural community, this is a common occurrence or something that’s commonly discussed, that people don’t want information released or they’re afraid to go to protests or they feel like they’re being monitored in New Zealand, not to directly affect them but to indirectly affect them by threats made to their family members. I wasn’t confident that the definitions we’ve got within the bill as it is will necessarily cover those situations.

Again, I believe this is an area of law that we must address. Clearly, there are increasing numbers of New Zealanders who are impacted by corruption, by fraud, so we must do something. The question is: do we have the balance right? I would urge the Minister of Justice and members of Government to almost flag this piece of legislation as one that will require some particular monitoring going forward. Also, just noting that there were, I thought, very reasonable suggestions made by submitters about the need for the involvement of the judiciary, particularly in granting preservation orders—currently, that’s done by the commissioner—and those recommendations weren’t followed. So, in that light, I would just strongly recommend that there’s a need for review, but otherwise I do commend this bill to the House.

Oh, thank you, Madam Speaker. I too want to thank the Justice Committee for all its work on this Budapest bill over a number of months. The bill ensures that New Zealand’s legislation fully aligns with the requirements of the Council of Europe Convention on Cybercrime, also known as the Budapest Convention. So I commend the bill to the House. Let’s get on with it. Thank you.