Budapest Convention and Related Matters Legislation Amendment Bill

Members, we now come to Part 2, and Part 2 is the debate on clauses 54 to 62, “Amendments to Crimes Act 1961”, and includes the debate on the proposed new Schedule 3, set out on the Minister’s Amendment Paper 333. The question is that Part 2 stand part.

Madam Chair, thank you. Part 2 is a pretty brisk part which relates to amendments to the Crimes Act. The reason for amending the Crimes Act is to ensure that New Zealand law fully aligns with the requirements of the Budapest Convention relating to computer-related offending. For the most part, these minor amendments are to the status quo. That’s important because, of course, international conventions and treaties only have force of law in New Zealand when they are incorporated into statutes. So making changes in the Crimes Act is an important part of upholding that part of parliamentary sovereignty, which is that international conventions and treaties entered into are all well and good, but they don’t have force of law until they’re actually implemented in New Zealand statutes. So, like trade agreements, this is part of that commitment to our international obligations.

Just generally, along with some of those minor adjustments, two main things: the first one is that Part 2, clause 58 amends section 228B of the Crimes Act, which already criminalises a person “Possessing, selling, … disposing of goods designed, manufactured, or adapted with intent to facilitate commission of the crimes involving dishonesty”, just to also include procurement as an element. The other part of the part—Part 2—is that it splits the existing section 252 into two new offences. The first being “Designing, writing, or adapting software … if the resulting software would enable a person to commit an offence”, and also, “Dealing in or possessing software or other information for committing [a] crime”. In so far as the Amendment Paper, I think that’s pretty self-explanatory and speaks for itself.

Thank you, Madam Chair. I have a question: I want to check with the Minister and I’m also just trying to see if there is a specific definition of “software” in the Crimes Act, because one of the reasons I asked this is, what is the scope of what is considered software? Would the Minister consider social media—for example, and particularly when it comes to apps, a software in the definition in this case? I’m curious about this because: what happens in this case if that is within the scope, that you have a social media platform that is being used to facilitate a person who commits a crime against sections 249, 250, and 252? So, just specifically, I am looking at clause 62, new section 253 and 254, and I’m looking at 253(1)(a) at this stage. So I do want to check that particular part with the Minister on whether the scope does include apps, because that’s one part of it.

I guess the other part is you often do hear that—particularly when it comes to the use of software—the liability is on the user as opposed to the developer of the software. This is something we do see quite often when it comes to app-based devices. Indeed, this is something that the Minister just before mentioned in terms of our trade agreements, and in the e-chapters we do have in trade agreements. This is something that isn’t something that can be captured or even honed.

However, I’m curious to hear what the Minister’s thought is around section 254(1)(a)(ii), which is “knows or is”—in particular—“reckless” has a completely different connotation as on what the tradition has been, using from the perspective of mens rea. So, in that particular case, if we’re looking at recklessness as an indicator, does that mean that those people with the software, if they or if anyone is using the software—and, in this case, if the scope expands to apps—is reckless or has developed their thing in a way that could be used recklessly, that that is considered an offence under this particular legislation now under a new offence that’s been created in the Crimes Act 1961? So it’s a very interesting, I guess, legal question in terms of the scope of software use, and I want to check with the Minister if he wouldn’t mind answering those two questions.

Without wanting to get into providing legal advice, generally, common interpretation techniques would say that you’d take the plain meaning of a term in its context and in the purpose of the legislation. Let’s just take the plain, common-sense definition of “software”—again, don’t want to get into providing legal advice—but an app, I think, would generally be considered to be software; it’s a computer program. Whether or not you’d include social media in that definition would be arguable. Social media is, essentially, code and computer programming written to enable individuals or communities to share information. Whether or not you’d define social media itself—as the concept—as being software, I’m not too sure. I think in any common-sense prosecution, you would apply the plain, intended meaning of the word in line with the context in which it is in the statute, and the purpose of the statute itself.

Thank you, Madam Chair. I want to ask a question about new section 254(2), inserted by clause 62, but as it relates to subsection (1). It defines who a person is who is dealing in software or other information and subsection (2)(b) includes a person who “offers or exposes it for sale or supply to any other person”, which is quite a low threshold, really, in terms of being within that category. While we’re talking social media, it could be someone who’s sharing a product, for example, or sharing an ad regarding an app. If you couple that with the lowest bar of guilt in new section 254(1)—the provision that my colleague was referring to—and someone was recklessly advertising somebody else’s product via social media and thereby exposing it, they’re potentially, then, caught by new section 254 and they’re potentially, then, liable for a conviction to a term of imprisonment not exceeding two years. I guess my simple question is: is the intention to be able to capture a situation like that because of the use of the word “expose”, so that person doesn’t have possession of?

Again, without trying to get too much into providing legal advice for individuals, I point the member to section 254, which does include various mens rea elements, as Dr Xu-Nan listed before, and also that includes intent, knowledge, knowing, or being reckless as to whether or not an offence is committed. So you’d have to combine the intentionality aspects with the definition of whether or not a person deals in software or not. I would also note that this is a pre-existing section within the Crimes Act, and all this section does is split the existing section 252 into two new offences. So it is taking pre-existing offences within the Crimes Act with, presumably, a body of jurisprudence and common law sitting in behind it and splitting it into two new offences. There are no new obligations or offences or definitions being included in this piece of legislation, unless I am advised otherwise.

Thank you, Madam Chair. I’m looking at page 73, Part 2, clause 62, inserting new section 253. My colleague Vanushi Walters talked about new section 254, so I just want to be clear that I’m not covering that ground again, but looking at new section 253, which is “Designing, writing, or adapting software for committing certain crimes”. Now, we know that this is a really key part to this bill because we know that cyber-crime knows no borders, and it is important that we have a vigorous understanding of what it means to design, write, adapt software for committing certain crimes, because we don’t want that to happen.

Looking at new section 253(1)(a) and (b), we want to make sure that this is not going to be applied to anyone who isn’t actually breaking any laws. So I’m just wanting to ask the Minister in the chair: can you explain the intent behind new section 253 and how the drafting may avoid capturing legitimate or dual-use software developed for security or educational purposes?

It can be quite murky when we’re looking at cyber and software, so we know that, sometimes, people are developing these for security purposes or for educational purposes. I’m just wondering how this actual wording came to be and how it avoids capturing those legitimate dual-use purposes.

Yes, I can address that. If we go to new section 253(1)(b), inserted by clause 62, there is an intention element there. So the person must intend to use the software, or must intend any other person using the software, to commit an offence against section 249, 250, or 252. So, essentially, there must be an intention to commit an offence and it’s not an inadvertent use of or development of software for any other reason; it must be for nefarious purposes. Again, these two new sections are a reworking of existing section 252 into two new offences to clarify exactly how they apply.

Members, the time has come for me to leave the House for the dinner break. The House is suspended until 7.30 p.m.

Sitting suspended from 5.58 p.m. to 7.30 p.m.

Members, the committee is resumed on the Budapest Convention and Related Matters Legislation Amendment Bill. When we were considering the bill before the dinner break, we were debating Part 2. This is the debate on clauses 54 to 62, “Amendments to Crimes Act 1961”, and includes the debate on the proposed new Schedule 3, set out on Minister’s Amendment Paper 333. The question is, again, that Part 2 stand part.

Thank you, Mr Chair. Thank you to the Minister in the chair for the explanation around this. I totally appreciate the fact that the Minister is not providing legal advice but just, mainly, ministerial intent. I have one last, final, really small question on this part, which is around whether in the context—because I haven’t looked specifically in the Crimes Act 1961—the definition of a “person” here is a real person and not a legal person. Can I just ask the Minister to confirm that if it is a legal person, for example, who designs, writes, or adopts, then it’s a different connotation? I guess the other question is: with a real person, what happens if it’s not so much a person who designs, writes, or adapts software, but a company who does it?

I’ll take some advice, but given it’s a Crimes Act definition of person, my basic understanding would be that it would be a legal human person, and not in the company sense. I’m not sure—I’m going to take some advice on that. Let me check some advice, but I’m just not as familiar with whether or not a corporation can be guilty of a crime under this Act—whether it’s the individuals acting in their individual capacity, but let me double-check.

Thank you so much, and I just want to also thank the Minister for taking such a thorough approach to answering our questions—that’s all. Can I just check—I guess a clarification from the Chair: while the Minister is receiving advice, if we have no more questions around this, how do we proceed?

I mean, the Minister has just told me that he could make that answer available during the title and commencement debate, if that was fine with people.

Dr Lawrence Xu-Nan: Yes.

OK, so it’s fine with people. The question is that the Minister’s amendment to Part 2 set out on Amendment Paper 333 be agreed to.

Amendment agreed to.