The Intelligence and Security Act 2017

On Tuesday last week, the Intelligence and Security Act 2017 was signed into law. We participated in both the independent review and Select Committee processes that have led us to this new law. Some think it's a terrible law; some think it's great and others have never heard about it. Seeing as I wrote most of our analysis and submissions, I thought I'd let you know what I think about it, and how well our views were heard in what is a very difficult area to get traction for movement.

What did we ask for in our submissions?

The main points in our submission to the Select Committee were focussed around making the law as clear and robust as possible so that everyone was clear what was in, and out, of scope for the intelligence agencies. Fear of spying and concerns about mass surveillance undermine trust online. We can't realise the potential of the Internet, and build a better world with the Internet, if we don't trust it. That's the lense we brought to this process and that's why we focussed on:

  1. changing, and moving, the definition of national security
  2. raising the definition of what constitutes serious crime
  3. fixing New Zealand's broken definition of private communication.

New definition of national security

There is a new, tighter definition of national security which is a dramatic improvement over the old one, that has been moved from the front end of the Act (where it would shape and colour ALL of the concepts of national security in the Act) to part 4 which deals with warrants. This is a better place for it as the only real reason we need a robust definition of national security is the policy decision to let the GCSB spy on New Zealanders for national security purposes.

My verdict is that this new definition is not perfect, but it's a damn sight better. When I look at the definition of national security, and where it is, I feel like our concerns were listened to and our suggestion to move the definition was useful, constructive and taken up. Chalk that up as a win both for the Internet, civil liberties and good public policy.

The definition of serious crime

The Bill defined serious crime as any offence that could land you in jail for two or more years. Let me be frank, that is ridiculously low and flies in the face of existing domestic and international concepts of serious crime.

The commentary from officials and the Select Committee seems to indicate that they thought about raising it to five years (in line with money laundering and international law definitions) or seven years (consistent with concepts in the Search and Surveillance Act). But officials seem to have had a hand-wave about it being "too hard" and their advice to the Select Committee was, in effect, "figuring out the national security-relevant offences below five years is too hard" (it's not, they attached tables showing the relevant offences).

So, now the intelligence agencies can spy on New Zealanders in vital national security cases involving bigamy, setting traps (the most useless of criminal offences), offences involving coinage, and careless use of firearms (to name a few crimes).

My verdict: this is still far too low and I can't take this definition of serious crime... well, seriously, because it's just silly. But even though it's just silly, it has real meaning in this Bill - effectively meaning that more stuff is relevant for a warrant and within scope for intelligence agencies to not only conduct operations against New Zealanders, but to share intelligence with other government agencies.

Fixing the definition of private communication

The Government and Parliament have continued to use the flawed and ineffective definition of private communication. After multiple submissions over multiple years on the problems with this definition, they have knowingly kept a definition which enables the mass collection of New Zealanders communications.

Let me be clear. This definition is circular and self-defeating. It is entirely possible to read it in a way that means that NO Internet-based communication is considered private, therefore enabling unwarranted interception. This definition enables mass collection and mass surveillance of New Zealanders and why Parliament and the Government refuse to fix it is perplexing.

I'm very disappointed and highly sceptical about this. Politicians have been told numerous times that this definition is self-defeating and needs fixing. Yet it STILL is being used to determine when our intelligence agencies can intercept our communications with, or without a warrant. This is very worrying and I genuinely don't know why Parliamentarians would choose to keep such a low quality, unclear, useless definition in place given its critical role in protecting New Zealanders from unwarranted surveillance.

Final verdict?

We are pleased that this legislation was amended to include a better definition of national security. That has had a meaningful impact on reducing the scope of some of this unwarranted intelligence gathering over the Internet.

Aside from that though, our other suggestions did not change this Bill. That's ok - you win some and you lose some after all.

But it does make us ask why - and it does still leave some of the biggest questions around all of this unresolved, such as whether we can't change these definitions because of how they are linked to wider surveillance activities by the Five Eyes.

The Act is better than the laws we used to have, and the Inspector-General is now an even more powerful and well equipped overseer, so this IS a step forward, but there were another two steps that we could have made which would have reinforced trust online and drawn a line under questions around whether the New Zealand Government can undertake mass collection or mass surveillance. Surveillance over the Internet is curbed, somewhat, by these changes. But we still have more work to do, and unfortunately we will continue to have questions without robust law to look to for answers.