Budapest Convention and Related Matters Legislation Amendment Bill

I present a legislative statement on the Budapest Convention and Related Matters Legislation Amendment Bill.

ASSISTANT SPEAKER (Maureen Pugh): That legislative statement is published under the authority of the House and can be found on the Parliament website.

Hon PAUL GOLDSMITH: I move, That the Budapest Convention and Related Matters Legislation Amendment Bill be now read a second time.

This bill aligns New Zealand’s laws with the requirements of the Council of Europe Convention on Cybercrime, also known as the Budapest Convention. The Budapest Convention is the first binding international treaty on cyber-crime, and it aligns members’ national laws relating to computer-related offences, improves investigative techniques, and streamlines evidence sharing. By acceding to this convention, we join almost 80 countries party to the convention who are committed to working together to tackle cyber-crime. This positions New Zealand to negotiate further agreements creating key infrastructure, and underpins international criminal justice cooperation.

Now, what does this mean for New Zealanders? Why do we care about all this? Well, obviously, the Government has a very clear target to reduce the number of victims of serious crime and to restore law and order more broadly. The broad area of fraud and cyber-crime has been growing significantly over time. The Ministry of Justice public perceptions reporting shows that 78 percent of New Zealanders are worried about this, as they should be. Over the past three months of 2024, for example, the National Cyber Security Centre reported that New Zealanders lost $6.8 million worth to cyber-crime; a 91 percent increase in 12 months—so it’s a big issue; it’s a real concern.

The purpose of this legislation is to enable us to be part of this Budapest Convention and to share more information more quickly, deal with evolving threats more quickly, and it helps us to be part of a coordinated international response to the broader issue.

The bill was reported back to the House from the Justice Committee. I want to thank the committee for their careful consideration of the bill. I want to thank the submitters who took their time to share their views.

From copyright infringements to computer-related fraud, violations of network security to child exploitation material, this bill will help safeguard New Zealanders from cyber-crime. It makes several important amendments. The bill amends the Search and Surveillance Act 2012 to introduce a new tool for law enforcement called a “preservation direction”. A preservation direction enables law enforcement agencies to require a person in a company to hold a specific document to preserve it for a specified period, protecting vulnerable evidence, such as digital records, from being deleted or destroyed. So that’s important. We’ve got new disclosure requirements. Further amendments to the Search and Surveillance Act create an offence for everyone affected by a preservation direction to disclose that the direction exists. Where police have a warrant to undertake surveillance, it will be an offence for anyone who assists them to carry out that warrant, to disclose its existence—that’s obviously important for successfully achieving that.

Then, we’re making an amendment to the Mutual Assistance in Criminal Matters Act 1992, which governs the assistance we give to other countries in criminal investment investigations. The bill enables police to apply for production orders and surveillance device warrants in response to a request for assistance from a foreign country. That’s how we share our information.

Then, to safeguard human rights, all existing requirements in the Search and Surveillance Act and Mutual Assistance in Criminal Matters Act must be met before a production order or a surveillance device warrant can be issued for mutual assistance purposes. So those are very important protections, by allowing only a mutual assistance order or warrant to be issued by a High Court judge. Collectively, these amendments will enable New Zealand to accede to the Budapest Convention.

Now, the Justice Committee recommended some important changes to strengthen the policy of the bill. Two amendments to clause 37: ensuring the judge considers the public interest in both avoiding prejudice to proceedings as well as investigation, and ensuring the seized thing is not sent out of New Zealand before the person concerned has the opportunity to challenge. It also recommended clarifying section 10(1)(b) and (c) of the Telecommunications Interception Capability and Security Act 2013 to not require an internet service provider to obtain traffic data—that is, information identifying the nature of the telecommunication—if the telecommunication is not the internet service provider’s own product. So we welcome those amendments.

In conclusion, this is an important part of our effort to meaningfully cooperate with other nations in our fight against cyber-crime, and will ensure that our laws protect New Zealanders in the digital age, and will send a strong signal internationally of our commitment to combat cyber-crime while upholding a rules-based international order that protects fundamental human rights. On that basis, I commend this bill to the House.

The question is that the motion be agreed to.

Kia ora. Thank you, Madam Speaker. Oh, the Minister’s approaching me across the—no, he’s not. The Labour Party supports this bill. This is a convention which was acceded to, I understand, in the last Labour Government. I do want to point out that these cross-border matters raise some quite difficult questions. When we get to committee stage, I do want to interrogate the Minister on New Zealand’s approach to this, because cyber-crime in particular is borderless, and the whole point of the Budapest Convention is to ensure that the response to cyber-crime is borderless, as well. That means ensuring that telecommunications—which is, in one form or another, pretty much the vehicle for cyber-crime—can essentially be searched and surveilled effectively. But we in New Zealand and in the common law world hold dear privacy and freedom from arbitrary search and seizure.

So here in this bill, we need to make sure that the framework on this, around these telecommunications, is robust and consistent both with the Budapest Convention but also with the things that we hold dear. The main innovation or new aspect in this legislation is, as the Minister said, the preservation direction. That is the direction that a telecommunications provider essentially hold and preserve information that might have content; it could be an email or a text message, something of that nature, or it could simply be traffic data—there were telephone calls that went in this direction, or there were encrypted messages between these two parties.

Now, again, there needs to be more than just an interest, and I think it’s important to recognise that not all countries have the same robustness in their criminal justice procedure as we do. Equally, not all countries have the kind of scrutiny about what ought to be criminalised as we do. There’s always a risk, particularly when we’re assisting foreign nations, that we are assisting them in doing things that we wouldn’t accept in New Zealand.

We have to be very careful when the authorities here—and the Attorney-General has an important role in this legislation—when those authorities are given, we need to have more than just a weather eye; we need to be vigilant that we are not being unwittingly used to further either political ends or to allow a foreign State to pursue a proceeding against something that might be a crime in a foreign nation, but it certainly isn’t a crime in New Zealand and shouldn’t be something for which criminal sanction follows.

So that’s what I mean when I say these cross-border matters raise really significant issues, because we do not want to be essentially assisting foreign States in oppressing others. The Minister mentioned the Mutual Assistance in Criminal Matters Act, and if we look at the parties to that, that is to say those foreign States who we are required to assist, that includes the Hong Kong Special Administrative Region. We know that some of the things that are criminalised there are very much free speech here. So that’s this kind of thing. We certainly don’t want to be having surveillance orders and preservation directions in respect of messages which are simply political activities in New Zealand, so we need to be very careful about that. I think we also need to make sure that we’re not subjecting people who are innocent parties to inappropriate surveillance.

Of course, one of the things that this bill does, because aspects of it are quite technical, is it shows the pathways of communications. People might want to know, for whatever reason, where messages are routed and who has passed those on. So those kind of things need to be examined, as well. The legislation creates a raft of new offences which I think, again, any time an offence is created—they’re generally offences about non-cooperation or destruction of material—we need to make sure that they have the right settings; that a criminal offence shouldn’t exist unless there’s, particularly, an appropriate mens rea element.

A lot of these offences are organisational offences, because if you’re going to be seeking preservation directions from a telecommunications company, you’ve got to make sure the left hand knows what the right hand’s doing—and if some junior member of the organisation deletes files in a routine way, we’ve got to be cautious about imposing genuine criminal liability for that.

So there’s a whole lot of stuff in this legislation, but at the same time, the Budapest Convention is a convention which requires New Zealand to essentially take a cooperative attitude. I must say, one of the challenges in cross-border enforcement is timeliness. Whilst the timeliness aspects in the domestic setting in this legislation, you know, I think are pretty much OK, if you look at the length of time that orders can exist in respect of cross-border orders, it seems quite extraordinary. The length of time seems very long, and so information can be held in abeyance.

I guess the other thing that I’d point out and try to preface what I intend to raise in the committee stage, is the suggestion that there can be essentially secret seizures—that items can be seized, including communications, and sent to a foreign State, and the person who is affected doesn’t know. Now, “secret” and “justice” are two words that don’t usually go together. So I want to know—I will be wanting to know—exactly what the kind of threshold is for us sending secret evidence to foreign States, especially when we think about some of those foreign States that will be asking for it and their own record.

So there is actually a lot in this bill. To the uninitiated, it’s a very dry piece of legislation. But in fact, it touches on freedom from arbitrary search and seizure, it touches on open justice, and it touches on criminal offending. They’re all, actually, pretty important matters. It might not be as kind of headlining as some of the criminal justice material that comes before this House, but it is important. And to be honest, the Minister did make a good point when he said cyber-crime—crime which often is scams; is often depriving people of their hard-earned money—is serious criminal offending and it’s very hard to detect. We need to absolutely be pursuing those crimes, because they cause real harm. For the victims, it can cause extreme financial distress to lose tens or even hundreds of thousands of dollars to scams and other cyber-crime.

And of course, hacking—the space bill we’ve just done, essentially underlying that is a hacking issue that, you know, the idea of blackmail by hacking is another massive issue. We need to be on top of that. It’s a massive security risk as well as a commercial risk.

So yes, we do support this bill, but I do think that, particularly as it’s being heard under urgency, a robust committee process will be important, and I look forward to that shortly.

Thank you, Madam Speaker. I take this call on behalf of the Green Party to speak to the Budapest Convention and Related Matters Legislation Amendment Bill. The Green Party have reviewed this bill carefully and in good faith throughout first reading and select committee stage. At the first reading, we supported it through to select committee, as this is the place where we sought to raise concerns with how this bill is currently drafted. It should be of the utmost importance to all MPs to make sure that our laws that we are creating are fit for purpose.

I want to be clear that the Greens are committed to the underlying kaupapa behind this bill and acknowledge that the implementation of the Budapest Convention was a recommendation of the royal commission of inquiry into those horrific 15 March attacks, where it was clear that our laws and our processes did not protect the people of Aotearoa. We are committed, across this House, to ensuring that those atrocious acts never happen again here in Aotearoa. Here in the submission from the Federation of Islamic Associations of New Zealand (FIANZ) to the royal commission of inquiry into the attack on the Christchurch mosques, I just want to start by showing the 51 names of the people who lost their lives in that attack in my hometown of Christchurch. It is so important that we listen to the people that were most affected by those attacks. We all recognise the responsibility that we as a legislator have in ensuring that our policy settings in Aotearoa are safe and protect all of us.

The Budapest Convention and Related Matters Legislation Amendment Bill amends two key pieces of legislation, the Search and Surveillance Act 2012 and the Mutual Assistance in Criminal Matters Act 1992, to better equip our collective resistance against cyber-crime, because cyber-crime knows no bounds and no borders. Offenders can be located in one country, their victims in another, while the evidence is stored on a server in a third. The Budapest Convention, which this bill implements, provides a framework that allows countries to work together on criminal investigations. It covers critical cyber-crimes such as the deployment of virus software, fraud, the distribution of child exploitation material, and terrorism.

With that responsibility comes the responsibility to make sure that we are passing the best law possible that seeks to achieve the intent it says it will. At the first reading and throughout the select committee stage, we engaged constructively and worked across the House to raise concerns on some of the specific clauses and sections in this bill. However, as the bill has not subsequently addressed these concerns in its current form, we cannot at the Greens support this bill in good faith.

I want to be very clear that if these concerns are addressed in the committee of the whole House stage, which is coming up just after lunch, and our Amendment Papers are agreed to—Amendment Papers that we have created through consultation with our trusted stakeholders like FIANZ—then we will passionately support this bill. We have a responsibility to ensure that Aotearoa is safe for all of us.

The Greens remain concerned about the definition of “an offence”, specifically the use of terminology such as “improper conduct”, which remains unacceptably broad. This could leave interpretation open as to whether individuals or groups could be operating as part of a foreign power when engaging in non-violent protest or criticism of the state. The language used in this bill leaves open the possibility that an individual engaging in political protest, in solidarity with an international movement, could be swept into the scope of an offence. If we narrow this definition, it will make it much clearer that we will be sticking in line with the laws of Aotearoa New Zealand.

This bill does not make the distinction clear, and the Greens are committed to passing legislation that is fit for purpose and achieves the intent of keeping communities safe. Now, while we support the intent of this bill, which was to strengthen international cooperation on cyber-crime and protect victims, there are provisions that, as currently drafted, raise serious concerns and must be improved at the committee of the whole House stage, which I’m looking forward to getting into with my colleagues after the break.

Specific concerns are new section 88A(4), which could allow surveillance of political refugees simply because their country of origin is a treaty partner. This risks undermining human rights obligations—something that we don’t want to do in Aotearoa. Further, new sections like 88B and 88V in Subpart 1 of the bill, and new sections 20A and 43 in Subpart 2 of the bill, lack clear human rights and proportionality safeguards. We can put these safeguards into our legislation, and that is what the committee of the whole House stage is there for. Without these, New Zealand might be required to assist in investigations into conduct that isn’t even a crime here, or cooperate with countries that do not meet basic standards for a fair trial or privacy protections. Furthermore, the Greens remain concerned about the new offences introduced in Part 2 of the bill, particularly new sections 253 and 254. This is work we will continue to push for—and across the House—at the committee of the whole House stage.

I would also like to take this call to raise my disappointment in the consultation process of this bill. A big failing of this process was not hearing from FIANZ. I spoke with our trusted stakeholder, the Federation of Islamic Associations New Zealand, and their representative Atif, who expressed their concern around the lack of consultation, and they have provided a quote here: “Despite being the community most directly impacted by the March 15 terrorist attacks, the national umbrella body FIANZ was not consulted. The royal commission of inquiry clearly recommended that meaningful consultation with affected communities must be a core part of the Government process. With the release of the New Zealand National Security Strategy, it is essential that such consultation becomes standard practice, ensuring that communities are not only informed but actively involved in shaping the politics that affect them.”

So, on one hand, we are bringing in one of the recommendations of the royal commission of inquiry, but whilst ignoring another one, and we can do better than that. I urge the Government to actively consult with FIANZ moving forward to ensure the best possible outcome for this bill.

To conclude, the Green Party acknowledges the sobering context which led to the introduction of this legislation. The royal commission of inquiry into the March 15 terrorist attack made it clear that together we must strengthen our collective ability to prevent harm, particularly where online platforms are being used to spread extremist content and incite violence.

We must protect our sovereignty and our core values as Kiwis. We need to be careful that we are not upholding laws from other countries that do not even fit with our own laws. While we cannot support this bill in its current form, we are working to put forward constructive amendments to address these concerns. We continue to do so in good faith and in the hope that with the support across the House, this legislation can be strengthened to achieve the outcome we all want: a safer Aotearoa for everyone.

Thank you, Madam Speaker. I rise in support of the Budapest Convention and Related Matters Legislation Amendment Bill, on behalf of the ACT Party. Firstly, I’d just like to acknowledge the previous speaker’s acknowledgment and recognition of the victims of the mosque terrorist attack. Also from Christchurch, I feel that really deeply, as do all the members of Parliament here in New Zealand, and I acknowledge that this was also a recommendation of that report, to ratify or to enact our agreement as part of the Budapest Convention.

I was actually in the EU—was it last week? Gosh, I can’t remember—a couple of weeks ago, with my colleague James Meager, who I believe sits on this committee, and I actually had some meetings with our counterparts around a lot of these kind of issues and where we could work together in order to make New Zealand and the world a safer place.

I share some of the same opinions as the Hon Dr Duncan Webb around privacy and around foreign States and how they may manipulate this legislation in order to harm individuals that are New Zealand citizens. I do share those concerns, but I think, on balance, we need to think about some of those countries and what they’re doing in the space of cyber-crime and how that does, in fact, cause foreign interference here in New Zealand. I think that in itself is one of the main reasons why we need to work together with other like-minded countries when it comes to these issues. We need to make sure that our sovereignty and our security is, in fact, protected. Being a tiny island nation at the bottom of the planet in a digital world, we need to make sure that we do have strong links and strong ties with other like-minded countries in order to tackle these really big issues. We don’t want to be left behind.

So I’m really keen to hear some of the points hashed out in the committee of the whole House stage because, like I said, the ACT Party does always consider the sovereignty and security of our residents here in New Zealand—our citizens—and we do take that really seriously, but I do commend this bill to the House.

Thank you, Madam Speaker. It seems a very appropriate time, given the two previous pieces of legislation we’ve considered—this Budapest Convention is our ratification of an international treaty, in effect. That’s, essentially, exactly what we were doing yesterday in ratifying the UAE trade agreement. So we are showing ourselves as a responsible partner—in that case it was a one-to-one; in this case, it’s a multilateral arrangement—as a responsible part of the global community.

The other piece of legislation, of course, which we just considered was the one relating to outer space. Why is that relevant? That’s an area which is changing very, very fast. So is the area of cyber-crime, and so this is about us responding to a fast-changing situation, as well. We talked, in those discussions, about being a responsible global citizen. That’s true here, too. What this legislation is all about—what the convention is all about—is encouraging and allowing for a cooperation between what we’ve heard is over 40 nations to combat cyber-crime, which is obviously something which we experience ourselves here directly. I mean, even this Parliament has been under attack in terms of cyber activity, and so we are well aware of that.

The legislative statement, interestingly, says that it ensures that New Zealand’s legislation fully aligns with the requirements of the Council of Europe Convention on Cybercrime (the Budapest Convention). But it’s interesting that the Justice Committee actually says that there are a number of areas where legislation in New Zealand needs to be tweaked to ensure that we do actually fully comply. So there’s a slight discrepancy there in terms of the language that is being used. It’s all about preservation of documents—so if the document is suspected as being something related to cyber-crime, it requires that preservation, that prevents disclosure of that. So there are some very useful initiatives which are being taken there.

I did hear the concern about some of the broad definitions. I guess one of the things that I would say is—and I’m asking questions of the Minister about whether this is the same language that other countries which are signatories to this convention are also using. I note, also, that there are a number of reservations that would not apply to New Zealand: the reservation about the range of offences—so they are more severe offences, more significant offences, rather than relatively minor ones; and the second reservation that would limit New Zealand’s ability to prosecute New Zealanders who commit cyber-crimes outside New Zealand to only those most serious and severe offences, such as terrorism and human trafficking.

I look forward to the ongoing discussion about this. But this is about us being a responsible player in the global environment in the area of cyber-crime. I commend the bill to the House.

Thank you. Madam Speaker, I rise on behalf of the Green Party to speak on the Budapest Convention and Related Matters Legislation Amendment Bill. Now, as the previous speaker has already mentioned, this particular legislation does amend two key pieces of legislation: the Search and Surveillance Act 2012 and the Mutual Assistance in Criminal Matters Act 1992. Also, there are different elements of the Crimes Act in there, as well.

This is something that is addressing an issue that we’re currently seeing manifesting in a greater capacity due to the prevalence of online presences, in general, in our daily lives. One of the other things that is also really important, as a result of this legislation, is that it does come on the back of the recommendation from the royal commission of inquiry into the 15 March attack. I want to really acknowledge my colleague Kahurangi Carter who, in her speech, talked about the way that we have supported this in the first reading. It has gone through the select committee in good faith in order to try and get an outcome that both addresses the concerns but also doesn’t diminish the rights of people here in Aotearoa New Zealand. Unfortunately, during the select committee stage, we haven’t really got to that stage, so the Green Party cannot support this bill in its current form in the second reading. But, of course, if the Minister is open to conversations and discussions and amendments in the committee stage, we may revisit our position in the third reading.

Just in terms of the process itself, we have heard from a range of submissions around this particular bill during the select committee stage, but I think it is important to, again, highlight the fact that while this bill was a recommendation of the royal commission of inquiry into the 15 March attack, one of the most affected communities as a result of that attack was not consulted as part of this—we heard that loud and clear from the Federation of the Islamic Associations of New Zealand, FIANZ, in their submission—which is disappointing because it is something that we were hoping would strengthen our domestic legislation and make our people safer. But there are certain parts of this bill that do fall short of that.

I think the other really important thing, as we’re looking at it from a New Zealand Bill of Rights Act (BORA) perspective, is the way that this legislation that provides the ability for people to conduct search and seizure, and also investigation, does touch on a number of New Zealand Bill of Rights Act concerns, specifically things like clauses 14, 15, 17, and 21—anything from freedom of expression, freedom of association, freedom of association in terms of religion and also thoughts and thinking, and also the conditions around unreasonable search and seizure. The reason that this bill touches on a lot of these particular areas and has drawn BORA concerns from the Green Party is the ability for us to investigate or even survey people here in Aotearoa who are captured and who are protected by the New Zealand Bill of Rights Act on the basis that our treaty partners, potentially, would consider these people to be a threat without us, at least from a legislation perspective, going into the detail of whether those requests from our international treaty partners are in line with our domestic value and the value that we hold really close to our hearts in Aotearoa New Zealand—and that’s particularly from the perspective of the New Zealand Bill of Rights Act, as I have mentioned.

There are specific concerns that we have seen, and I think the consistency report that we do see against BORA doesn’t quite go far enough to unpack the severity of this. Finally, I want to say that one of the things we’re also going to be looking into a lot more as a result during the committee of the whole House stage is the Amendment Paper that the Minister has also released, which wasn’t seen during the select committee stage. We look forward to that in the committee stage, as well.

Thank you very much, Mr Speaker. It gives me great pleasure to rise in support of the Budapest Convention and Related Matters Legislation Amendment Bill. To our friend from Te Pāti Māori—who has turned up to give a contribution, which is great—I want to clarify for him that this bill fully aligns with the requirements of the Council of Europe Convention on Cybercrime, hence why it is known as the “Budapest Convention”, which is quite useful and quite good to clarify for members across the House. I know others will have substantive contributions on the material involved with this legislation. I commend it to the House.

Thank you very much, Mr Speaker, for an opportunity to take a call on this bill. The Budapest Convention is designed to update New Zealand’s legal framework to combat cyber-crime more effectively. It paves the way for New Zealand to be able to join the Budapest Convention, and it also enhances our international cooperation in this space. Can I just highlight how important it is, particularly in cyber-crime, to have those international connections when we know that cyber-crime criminals, those operating in this space, specifically work to exploit where there are gaps between countries and to exploit those gaps for their own financial and personal gain. So the more that we can join up and have a network of agreed rules and how we cooperate with each other—it reduces the opportunities for those cyber-criminals to be able to carry out their work.

This bill introduces new tools to be able to do that work, new tools for law enforcement such as limited data preservation orders—sounds long, but we’ll talk about that later; big fan of limited data preservation orders. This helps to secure digital evidence—really critical to trace who is doing the crime on the internet and, also, how we try and hold those individuals accountable. That is an incredibly difficult thing to do in cyber-crime.

This also improves the mechanisms for accessing electronic data and cooperating with other countries on cyber-crime investigations. That’s an important note to make. I think it’s important for anyone who’s been a victim of cyber-crime, who understands the different forms it can come in—whether it be phishing scams that we’re all trained here in Parliament not to click on the links; ransomware attacks; identity thefts; financial fraud that’s online; and also hacking into computers—we are all familiar with those and how cyber-crime operates.

But it is interesting that in New Zealand, what I often hear in terms of electorate inquiries is that if someone has been a victim of identity theft or someone has been a victim of cyber-crime, it does appear that the threshold for law enforcement action is a lot higher than it would be if it happened in real life. So if shoplifting—we know that under $500 under National is not investigated by police, but say it’s over $500—is over $500 and you get someone turning up to investigate that crime, whether it’s been shoplifting or a burglary, that threshold for cyber-crime does appear to be quite a bit higher. So when you have someone who’s been a victim of a scam and they may have lost $10,000, they’re often directed to simply go through their bank or go through other channels as opposed to trying to actually have a proper investigation on that.

It doesn’t seem right that we have different thresholds for the fact that things happen online as opposed to in real life, because what that does is that sends a green light to criminals who operate in this space that if you’re wanting to take people’s money, then you’re less able to be held accountable online than in real life. That is why having these agreements in place but also backing up these agreements with the appropriate resource so we have a specific unit that is able to investigate and hold criminals accountable for cyber-crime, whether they are based in New Zealand or whether we are cooperating with our international counterparts—we want to be able to share that information and hold people accountable, because the tighter the net is around these areas, it reduces the chances of people being scammed and losing their savings, particularly for those who are new to using the internet.

I think of people in my parents’ demographic, where they’ve clicked on links and had themselves exposed to ongoing text messages or ongoing scams to try and extract money. It can be really stressful for people who’ve retired, who’ve got their fixed income, who have their retirement savings. They are targeted often through operations such as this.

What this bill does, in fact, is it amends the Search and Surveillance Act, which was passed back in 2012, and it also amends the Mutual Assistance in Criminal Matters Act. The primary change to the Search and Surveillance Act introduces preservation directions in support of domestic criminal investigations and also overseas criminal investigations and proceedings. It establishes an agreed network of cooperation to minimise the opportunities for criminals to use online tools to extract money and to extract threats from people.

This bill enables the Commissioner of Police here in New Zealand to issue a preservation direction requiring documents—and that includes computer data, it’s important to note—to be preserved where there are grounds to believe that documents are particularly vulnerable to loss or modification. A preservation direction is an interim measure, and that interim measure ensures that the evidence—in the form of documents—is preserved before a production order is sought requiring those documents to be produced. It’s essentially an evidence-gathering tool that can be used not only to trace who is doing the offending but also to hold them accountable from where they’re operating from. If those actions are taken earlier on, then it shuts down that operative from preying upon more and more individuals, whether they be here in New Zealand or in other countries across the world.

This bill also requires a person who is subject to a preservation direction or assisting in executing a surveillance device warrant—such as, for example, a telecommunications provider—to keep the existence of the direction or warrant confidential for a period of time to avoid prejudice in a criminal investigation. We know from the select committee process and from hearing some excellent evidence and information provided from telecommunications providers that there were some concerns about how long they would have to hang on to large amounts of data. And so we talked through all of those issues in detail to be able to understand how we can make sure that the telecommunications providers are still able to operate effectively, but, at the same time, they are also doing their bit to enable that data capture to occur when required.

As mentioned, this bill also amends the Mutual Assistance in Criminal Matters Act to enable production orders and surveillance device warrants to be applied for in support of international criminal investigations and proceedings. This is about New Zealand doing its part, because we do know that those cyber-criminals are operating in big-scale scams right across the world. So if we are participating alongside other nation States, then that reduces those opportunities for them to take advantage of people and their savings. There are appropriate oversights to ensure that human rights are upheld, and this ensures that the full suite of investigatory tools are available in New Zealand, where appropriate, to be able to support those international criminal investigations and proceedings.

Labour supports this bill because we support the Budapest Convention in order to try and fight cyber-crime. We believe that we have a clear role in taking up our part in a global fight to increase cyber-security capabilities and international cooperation. This bill builds on Labour’s previous efforts to join the Budapest Convention, and it also implements the recommendation from the royal commission of inquiry into the Christchurch terror attack. It also has the benefit of modernising New Zealand’s legal framework to effectively combat cyber-crime, and that is important. It maintains a balance with privacy and human rights protections while also ensuring we increase our cooperation and ability to get on top of cyber-crime.

The legislation strengthens our law enforcement tools, improves international cooperation, and demonstrates our dedication in Labour to have public safety in the digital age—so incredibly important. By joining the Budapest Convention, we aim to position New Zealand as a responsible global actor in addressing cyber-threats. And we know that this crime area is growing; this is an area where there’s more crime happening. Not only do we need to make sure that we’re signing up and participating, but also in making sure our law enforcement agencies here in New Zealand are adequately resourced so that we can take our part on the world stage to reduce cyber-crime.

Thank you, Mr Speaker, for the opportunity to speak to the Budapest Convention and Related Matters Legislation Amendment Bill. The Budapest Convention is the Council of Europe’s Convention on Cybercrime. With cyber-crime posing a serious and significant threat to the public, and because our international partners are mostly already signed up as parties to the convention, and because we take cyber-crime seriously, we support the bill and the cross-border mutual cooperation to enforcement that it enables. I commend this bill to the House.

Thank you, Mr Speaker. I stand to take a call on the Budapest Convention and Related Matters Legislation Amendment Bill, which Labour continues to support. We signed up to the Budapest Convention, so it’s good to see that this important work continues.

A number of speakers have already discussed the borderless nature of cyber-crime, and that’s what can make it so difficult to detect and to prosecute offenders unless we have an appropriate level of international cooperation. That’s what the Budapest Convention sets out to achieve. When these offences are committed online, you can have an offender in one jurisdiction, the victim in another, and the evidence of the offence being held in a server in a third country or territory. It can be very difficult, with various countries’ legislation, to join all of that together to be able to track down and, ultimately, apprehend and prevent further cyber-crime from happening.

Cyber-crime can take many forms, and I think it’s worth taking a moment, as we step through this legislation that we all agree on, to look at a particular example of some fairly abhorrent cyber-crime that has happened here in Aotearoa New Zealand, where a Taranaki grandmother has lost close to a quarter of a million dollars to an AI deepfake that featured Prime Minister Christopher Luxon—an online, manipulated video purporting to be a message from the Prime Minister. As a result, this person has lost a quarter of million dollars online into cryptocurrency.

The way that this happened was that a video advertisement appeared; the person listened to the message, apparently from the Prime Minister, and started to engage with what they thought was an investment advisor online. Over a series of weeks, $20,000 each time was taken out of term deposits that were, in fact, the victim’s inheritance. A lot of the funds were also earmarked for the victim’s grandchildren. No one can afford to lose a quarter of a million dollars, but this was someone for whom that was essentially their life savings, and, over a series of days, the funds were drained and transferred, converted into cryptocurrency in a foreign account, and then bounced away out of reach of the New Zealand-based victim.

Potentially the worst part of this, because the scammer was able to access this person’s online banking and watch and manipulate her actions—the last words that the scammer ever said on the phone while speaking to the victim was an aside to someone else in the scam centre they were operating from. They simply said, “This woman has no money.”—“This woman has no money.” That scammer had literally drained all of the funds out of that victim’s account and only stopped when there wasn’t a single dollar left for them to take. That’s why legislation like this is so important to be able to track down people operating from other territories that do those kinds of attacks.

There was an interesting comment—because the Prime Minister, rightfully, was questioned about this and said that he would never endorse a particular investment, and the best way for people to protect themselves was to be vigilant and aware of risks. To a point, absolutely, that’s true, but, also, legislation like this helps to protect people and helps to provide international cooperation around enforcement.

On that note from the Prime Minister, that very sage advice where he says the best way for people to protect themselves is to be vigilant and aware of the risks—that comes with any scam. If, for example, 21,000 people are promised that they will be eligible for FamilyBoost and only 153 are actually delivered the funds that were promised, then that, potentially, could fall into a scam, as well, and, in my opinion, should be a risk that all New Zealanders need to be aware of. Whether it’s a deepfake or a shallow fake, a promise that’s not delivered and a promise that’s broken is shameful. But I do commend this bill to the House.

I’m glad we can all agree that rising cyber-crime is of great concern for New Zealanders. That’s why we’re here in the House today supporting the Budapest Convention and Related Matters Legislation Amendment Bill. This legislation improves cross-border investigations and prosecutions related to cyber-crime, all while upholding human rights and, particularly, the right to be free from unequal search and surveillance. It’s all a part of our plan to restore law and order and to restore real consequences for crime. I commend this bill to the House.

Thank you, Mr Speaker. It’s a pleasure to rise in support of this bill. As the House has gone a little bit quiet, I thought I’d speak about urgency for a little bit, because we are still an urgency—we are still in urgency. I was just wanting to make a brief point and then extend—I was going to say, “extend a fig leaf”, but no—an olive branch to the other side, because I do think the issue of urgency is an important one for the House to think about when we use it.

I did obtain some research from the Parliamentary Library on the hours that the House has been in urgency this term compared to last term. In the 53rd Parliament, the House was in urgency for 15.7 percent of those total hours. For this Parliament, up until 9 May, the House was in urgency for 22.6 percent of the total hours. There absolutely has been an increase in terms of hours, but I also do think, particularly for my National Party colleagues, that it does a disservice to the people of New Zealand when we point fingers at each other, both ways.

In truth, there is a sense that urgency is being used more often than it should be, and there is an opportunity, as the Standing Orders Committee considers the Standing Orders, to think about the parameters under which urgency should be used. You will not find an objection, in terms of my Labour Party colleagues and I, that there are good reasons for using urgency. The question is simply when it should be used and how legislation that has gone through the House under urgency should be reviewed. I did speak earlier about other countries who’ve adopted various measures, including post-legislative scrutiny; including sunset clauses, as well. I do hope that members opposite will take that on board as we head into a period of reviewing the Standing Orders.

I do rise in support of this bill. As my colleagues have pointed to across the House, cyber-crime is absolutely an issue for New Zealand, and it’s an increasing issue. The Ministry of Justice’s Crime and Victims Survey 2019 showed that over 320,000 people experienced one or more incidents of fraud or cyber-crime in the 12 months preceding the survey. But as my colleague Ginny Andersen also pointed out, there is an issue in terms of policing this and monitoring it and ensuring that people get a response. I do think this legislation is important, but I also do think we need to think about how we give it effect.

Interestingly, this isn’t the only international convention in existence, in relation to cyber-crime. There is the Budapest Convention; there is also a draft UN cyber-crime convention—and I think, in the international space, sometimes there’s confusion between the two. I wanted to briefly just set out the differences between the UN draft convention and the Budapest Convention, because I think it points clearly to why New Zealand is using the Budapest Convention as the model under which we’re developing legislation.

The UN convention, firstly, is broader in scope. It goes far beyond what would be considered cyber-dependent crimes. The UN convention also creates new offences that aren’t in the Budapest Convention, so it’s far broader. It has also expanded jurisdiction, and what was interesting when the UN convention was being negotiated was that there were countries, like Russia and China, who wanted to include what are called “content” offences. This is where you might find freedom of speech significantly limited, and that was absolutely the intention: to reach into quite a different space in terms of monitoring what, potentially, their citizens were saying overseas, as well as others.

The UN convention also has fewer human rights safeguards, and that, alongside these extensive criminal definitions, I think, is problematic—and certainly a lack of safeguards in terms of procedural requirements, which members have spoken about today, in terms of the person who is accused. While I do think that the Budapest Convention is a better model for us to develop legislation, we do also still need to be careful that we’re managing the fine balance of preventing global cyber-crime while also protecting the rule of law and, certainly, rights against unlawful search and seizure.

I did want to speak to a couple of aspects in this regard. Firstly, in relation to the requirement that requires a person subject to a preservation direction to keep the existence of the order confidential—keeping this confidential from the individual who is accused, if you like—not only do we have the protections and legislation; I think often, in the House, we forget that we also have principles of common law that apply in this case. The duty of candour is essential in our law, and, essentially, it provides that, where there are adversarial proceedings, ordinarily you will have a right of response if you’re accused of something. For obvious reasons, when it comes to a search warrant or it comes to situations like this, you may not want to, for obvious reasons—the information may be destroyed—so you may not be able to provide that information to the individual.

The duty of candour, in my view, still applies. You would still have a circumstance where the application for a preservation order would need to consider any potential objections that could be made before it is granted. While I couldn’t find case law precisely on this point, there is case law in terms of search and seizure, or certainly search, where the individual isn’t notified before a search is conducted. The case of Hager v Attorney-General is looked to fairly frequently in this regard. It says that that obligation must be satisfied. You have to look at how the individual might object.

The other issue is, of course, what happens when information is seized and then sent out of the country. This is an issue that the select committee raised, in terms of amending clause 37. The bill now includes a requirement that people affected by search are notified before seized material is sent out of the country. This is, essentially, so they can potentially bring a judicial review claim should they wish to prevent that information going out of the country. Interestingly, this was a point that also came out of case law in the Dotcom v Attorney-General case.

The reason this is important is something that my colleague the Hon Dr Duncan Webb pointed to, which is that there is misuse—or there can be; there’s potential to be misuse—in terms of requiring that information is sent overseas. Part of the misuse is due to a lack of dual criminality—if there are criminal offences that exist in a foreign country that simply don’t exist in New Zealand—and, sadly, around the world we’re seeing more of what’s called “transnational repression”. This is Governments who are actively looking to target often their own citizens and prevent them from speaking out against human rights violations. Certainly, the likes of Amnesty International and Human Rights Watch have commented on this very frequently.

We need to be extremely cautious that we’re not aiding that, in terms of potentially extraditing individuals—or even, without extraditing them, putting them in harm’s way because they have family members in a home country and evidence would be supplied by New Zealand to show that they were a dissident in some way that was considered illegal in their home country. Certainly there are many examples of that happening, even in terms of foreign nationals who are in the US. There were some fairly famous cases in the early 2000s of attempted kidnappings of Iranian nationals who were human rights activists. Now, of course, we haven’t seen that happen here, but what’s interesting is that, before those kidnappings happened, there were other measures that those Governments took to try and stifle their free speech.

I am supportive of this bill, but I do think it’s a very careful line that we have to walk. It’s a piece of legislation that I do hope we will rigorously examine, in terms of the committee stage, which I look forward to doing. Kia ora.

Before I take the next call, what I will do is take the National Party call and then I will come to the Te Pāti Māori call.

Thank you, Mr Speaker. It’s a pleasure to rise in support of the Budapest Convention and Related Matters Legislation Amendment Bill. This is a sensible piece of legislation. We’ve well discussed it throughout the House today; many really excellent points about the requirement to make online activity a lot safer and to tighten things up. I commend the bill to the House.

Mōrena. Tēnā koe, Mr Speaker. Tēnā tātou e te Whare. Exactly like my colleague on the right, I would repeat comments made this morning that unless the House recognises, appreciates, and completely embeds in any of our debates in this House and into legislation Te Tiriti o Waitangi—unless that occurs in a genuine and real way, we’re screwed. So here we go.

Just to say it is obviously easier to go from a “no” to a “yes”. We can’t support this, because it doesn’t quite have enough in it, from our point of view and from our experience, for us to support it going forward. Any international treaty on security must come with firm assurances. This is especially important when our own Government refuses to uphold Te Tiriti o Waitangi, our founding document. So when we discuss cyber-security, our security more broadly, we need to understand it through more than the Western lens or the comfortable and privileged lens. What security means to Māori may look very different, and it absolutely does. For us as Māori, security must include direction from Te Tiriti o Waitangi, particularly in the protection of Māori data sovereignty. And within the context of this bill, security must also protect us from Government overreach that disproportionately harms our communities.

Very recent history—let me recall it—when security powers are misused: the Government-sanctioned raids on Tūhoe, where false accusations of conspiracy led to a deeply harmful and unjust operation on one of the most recent large-scale examples of this behaviour. That poorly managed Government-sanctioned response costs lives. We cannot afford to open that door to that kind of behaviour again. Yet we need only fast forward to the absolute tragedy of the Christchurch mosque attacks. Where was the security for this community? A deeper look into the prevention failures from Government revealed that resources had been misallocated, driven by bias and prejudice against our Muslim communities. Once again, lives were lost.

This bill risks continuing that pattern by expanding surveillance and international data-sharing powers without explicit safeguards for Māori rights. That speaks directly to the issue of Māori data sovereignty. Our data and our information should be just that: ours. What this treaty risks is the ability for our people to exercise mana motuhake over our data. This is critical to the success of Māori self-determination for whānau, hapū, and iwi Māori businesses. Unlocking economic and social potential is enabled by Māori data collection and analysis. Māori must own Māori data, Māori future, Māori mokopuna, Māori whenua.

We do recognise here that there are some upsides to this bill but, like I started off, it’s easier to go from a “no” to a “yes” than a “yes” to a “no”. We’re still in the “no” lane. We acknowledge the kōrero that other members of the House have provided, but our role here has been and will always be to advocate for mokopuna Māori, for whānau Māori. Nō reira i runga i tēnā [And so, on that], just to again remind us that unless the House fully recognises—to my left and to my right—that Te Tiriti o Waitangi is and always for be our founding document. And just to encourage the House: please read some more. That would be really helpful. I think just filling that gap of knowledge, like my colleague on my right said very early in one of his first calls in this House, there’s such a huge gap of knowledge. So I’d encourage you please read some more. Kia ora tātou.

Motion agreed to.

Bill read a second time.

This bill is set down for committee stage immediately. I declare the House in committee for consideration of the Budapest Convention and Related Matters Legislation Amendment Bill.

In Committee

Part 1 Amendments relating to investigatory tools