Dear Mr Key
This letter is partly in response to the findings of the Kitteridge report about the GCSB and their failures to follow the law, but is also mindful of the recent PRISM revelations about the actions of the NSA in the USA, as well as the mass spying revealed to have been carried out by the GCHQ in the United Kingdom. As disturbing as these revelations have been, we cannot help but be shocked that this surveillance was done in secret without the knowledge of the citizens of each country.
We assert that, as citizens of a democratic society, we have the right to know the methods that government agencies use to watch us. Without this knowledge we cannot assert our rights to put appropriate limits on their use.
Full text of the Tech Liberty submission to the Intelligence & Security Committee concerning the Government Communications Security Bureau and Related Legislation Amendment Bill.
Tech Liberty has deep concerns about the extent of the powers granted to the GCSB by this Bill, especially when combined with the proposed changes to the Telecommunications (Interception Capability) Act (2004) contained in the TICS Bill.
We do not believe that the GCSB should be spying on New Zealanders. We are particularly concerned with the Bill’s silence on the GCSB’s existing practice of collecting and analysing metadata.
We do not believe that the GCSB is the right agency to have oversight and control of New Zealand’s telecommunications infrastructure in the name of “cybersecurity”.
We do not believe that the Bill makes any significant improvement to the current woefully inadequate oversight procedures.
We submit that this Bill and the TICS Bill should both be rejected. Rather there needs to be a formal review of New Zealand’s domestic and foreign intelligence requirements.
Apple recently released a statement about their cooperation with law enforcement. It includes:
For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data.
[Update: see this discussion about whether this is entirely true.]
Does this mean that Apple will not be complying with New Zealand law?
Full text of the Tech Liberty submission to the Law & Order Select Committee concerning the Telecommunications (Interception Capability & Security) Bill.
In general we support the ability of the government to have interception capabilities on telecommunications where possible, when those interception capabilities have suitable oversight and control. We have made some technical suggestions on how Part 2 - Interception Duties could be improved and clarified:
- Publish a list of service providers with interception responsibilities.
- Remove the ability for the Minister to ban the resale of overseas services.
- Clarify the duty to decrypt to indicate that it does not require network providers to supply deliberately weakened encryption with government backdoors.
We reject the idea that the GCSB should have oversight and control of communications networks in New Zealand. No need for this has been established and the use of an agency whose main focus is spying on external organisations is inappropriate and open to abuse. We therefore recommend the removal of Part 3 - Network Security in its entirety, possibly to be replaced by the establishment of a coordinating and consultative, not controlling, network security body.
Finally, we find the idea of evidence being presented in court that cannot be seen by the defendant and their lawyer to be extremely offensive to the right to a fair trial as promised by section 25 of the Bill of Rights Act. We therefore recommend the removal of Subpart 8 - Protecting Classified Information (sections 96-98). If this is retained we recommend that the appointment of a special advocate as in 97(3)(c) should be mandatory rather than optional.
There have recently been a number of revelations about the US government spying on its citizenry and other people around the world (a good summary). Many people have been shocked to find out the extent of the US's spying and access into theoretically private systems.
What many New Zealanders don't realise is that the NZ government is currently changing both the GCSB Act of 2003 and the Telecommunications Interception Capability Act of 2004 to allow similar levels of access to New Zealand communications for the GCSB (Government Communications Security Bureau).
The current TICA law already gives the GCSB, Police or SIS the technical capability to intercept all NZ communications if they have a valid warrant.
The GCSB can get warrants to spy on the communications of foreign people and organisations, although they can spy without a warrant if it doesn't require the installation of any device (e.g. wireless/satellite/radio/mobile).
TICS - Telecommunications Interception Capability and Security Bill
The new TICS Bill clarifies and expands on these interception capabilities. It also allows them to be extended to service providers (people who offer "goods, services, equipment, and facilities that enable or facilitate telecommunication") such as email providers, Trademe forums, Mega, etc.
TICS continues the existing regime where these interception powers can only be accessed with a valid warrant, but keep reading for the new exceptions to this in the GCSB Bill.
Furthermore, the TICS Bill also creates a new role for the GCSB, ensuring the security of New Zealand's telecommunications infrastructure. This includes wide powers of oversight and control of how communications networks are managed and implemented in order to "protect New Zealand's national security or economic wellbeing".
GCSB - Government Communications Security Bureau and Related Legislation Amendment Bill
The new GCSB Bill gives the GCSB three purposes (we'll come back to these):
- 8A - Information assurance and cybersecurity. (Expanded from protecting government communications to a much wider responsibility for New Zealand's communications.)
- 8B - Intelligence gathering, analysis and sharing. (Similar to the existing law except that it adds "gathering information about information infrastructures" to the existing spying on foreign people/organisations.)
- 8C - Helping the Police, SIS and Defence Force by providing advice and assistance in helping them execute their own legally obtained warrants. (This is entirely new.)
The bill doesn't significantly change how the GCSB can apply for an interception or search warrant, but it does add a whole new class of "access authorisation". To quote section 15A(1)( b)
The Director may apply in writing to the Minister for the issue of an access authorisation authorising the accessing of 1 or more specified information infrastructures or classes of information infrastructures that the Bureau cannot otherwise lawfully access.
These authorisations are granted at the whim of the Minister (although see below) and are incredibly wide-ranging and open-ended. There are no recommendations of limits (other than what the Minister sees fit to impose) and there is no automatic expiry. And just in case you thought that the TICA/TICS law might provide some protection, the GCSB Bill goes on to add section 15A(5):
This section applies despite anything in any other Act.
Most importantly these new access authorisations can be used for purpose 8A (cybersecurity) as well as 8B (information gathering). As paragraph 36 of the Regulatory Impact Statement explains: "an amendment will also be required to allow the GCSB to see who (namely NZ individuals and companies) is being attacked". That is to say, the GCSB believes that it needs to be able spy on New Zealanders to maintain ther security. Based on what we know from recent reports in GCSB activities, we assume that the GCSB particularly intends to collect communications metadata (i.e. who speaks to who, when and how often but not what they say).
If you had any doubts about whether this applies to NZ communications, section 15B then further clarifies that for any access authorisations "for the purpose of intercepting the private communications of a New Zealand citizen or permanent resident of New Zealand under section 8A (cybersecurity)" the authorisation must be approved by the Commissioner of Security Warrants as well as the Minister.
And finally if you were hoping that section 14, which controls the ability of the GCSB to target New Zealanders would provide any protection, this only applies when the GCSB is performing duties under section 8B (intelligence gathering) and not section 8A (cybersecurity).
Putting it all together
The GCSB believes it needs to monitor the communications of New Zealanders in order to ensure that it can protect them from attacks.
TICA and TICS establish the technical capability for the GCSB to spy on any communications, subject to the limits in that law and the GCSB Act.
A section 15A(1)(b) access authorisation can give GCSB power to access any communications system it wants for the purpose of spying or information security, irrespective of any legal controls in any other law. This will allow it access to the facilities provided by TICS/TICA.
The GCSB will be spying on New Zealanders.
These new laws are not some minor adjustments to the work of the GCSB and how interception works. They are not just about letting the GCSB provide technical assistance to the Police, SIS and Defence Force.
While people in the USA are getting upset about the revelations of the extent of NSA spying there, these new laws give the GCSB far greater control of New Zealand communications networks, and practically unlimited capacity to intercept New Zealand communications.
These new laws are the point at which New Zealand switches from being a society that investigates "bad guys" subject to judicial oversight, to being a surveillance state where the government is always watching and recording everyone just in case they're thinking about doing anything wrong.
We don't want to live in that society. We believe that these new laws contravene the right in the NZ Bill of Rights to be free from unreasonable search and seizure, and will have a chilling effect on the rights to free expression and freedom of association.
We think that these laws need to be stopped.
Update 1st August 2013
The DIA have now confirmed that they did filter some sites hosted by Google and that this caused problems for both the filter and some internet users.
Officials provided an oral briefing on the incident reported regarding a degradation of service noted by some users of certain services. The Filter Operations Team worked with the provider of those services in question. It was discovered that hentai and cgi based child abuse sites hosted on the blogspot.com domain, a resource operated by Google Inc were included in the list in error.These sites were then shown to the IRG. It was then explained that a list refresh, removed the sites in question, and subsequently resolved this issue.
The problem was further compounded by the severe congestion in the networks of one of the upstream providers used by the system. A review of the Filter’s failsafe systems was undertaken. Steps have been added to ensure that the IPs of large hosting providers are flagged and placed on a white list with a reporting mechanism for the removal of the content from the site. Additional resources were requested from the upstream provider in question to ensure traffic congestion can be avoided in the future.
Back in 2011 we spotted the first indications of how the Department of Internal Affairs Internet filter, used by 90% of all New Zealand Internet connections, actually operates. At the time, we noticed an address - 126.96.36.199 - appearing where it shouldn't in traceroutes to a site.
Now that same address has popped up in traces to Google addresses, specifically googlehosted.l.googleusercontent.com (188.8.131.52). As noted in this thread on Geekzone, some people have been experiencing performance problems reaching some Google services.
These performance problems could be caused by a Google-load of traffic to that IP being routed to the DIA's filtering server which may not be coping with the volume. Note that the filter will only be blocking one web address (URL) at that IP and letting the rest of the traffic through.
Of course this won't affect you if you are using an ISP that doesn't use the filter. Check the list of ISPs here.
Making the link
As noted back in 2011, the address appearing in traces where they shouldn't be are controlled by Fastcom, who list the Department of Internet Affairs as an important customer and which they host infrastructure for.
This was always one of the fears when the filter was introduced - that it would reduce the stability and performance of the New Zealand internet. It appears that this has now happened. Two questions:
- Will the DIA remove the entry for this IP now that they realise the problems it's causing?
- How will the DIA block web addresses hosted at high volume websites such as Google (or Wikipedia) when the filter can't cope?
Seeking more information
Have you been experiencing any issues accessing Google? Can you provide a traceroute for us? Post a comment below.
Rumours and hearsay
Thanks to the people who contacted us with more information, we just wish you were prepared to speak on the record. So far we have heard the following from people that we typically find to be reliable:
- That the DIA has denied filtering that IP address.
- That a senior ISP engineer says that the IP address was definitely filtered by the DIA filter and that they have seen the relevant BGP records.
- That the filtering of at least one Google IP address has been removed but that there might be more.
- That Google was greatly annoyed by the block and contacted the Minister to get it removed.
We'll update these rumours as we can confirm/deny them. Please email any information to firstname.lastname@example.org. We will do our best to keep your name confidential if requested, but suggest using an anonymous remailer for the best anonymity.
After our recent article looking at the TICS (Telecommunications Interception Capability & Security Bill), we were contacted by Brad Ward, the Programme Manager of the Telecommunication Review at the Ministry of Business, Innovation and Employment (MoBIE).
He had some issues with what we wrote, and in particular he rejected our claim that the bill gave the GCSB sweeping new powers of oversight and control over NZ telecommunictions networks, writing that (emphasis added):
The new formal framework for network security does not give “sweeping powers of oversight and control” to the GCSB, and it does not give the GCSB “final control of network design and operation.”
The GCSB already works in partnership with network operators on network security issues, to agree on measures that are proportionate and risk-based. The Bill will formalise and build on this existing approach.
The Bill emphasises that network operators and the GCSB are to work cooperatively and collaboratively on identifying and addressing network security risks.
In the event that the network operator and the GCSB are unable to agree, the Bill establishes a Ministerial direction power that can be used where significant national security concerns are involved, and as a last resort. This Ministerial power relates to network security issues.
The GCSB would apply to the Minister responsible for the GCSB to direct a network operator to take specific steps to prevent, mitigate or remove the security risk.
The Minister can receive any submissions on this directly from the network operator, and is required to consult with the Minister for Communications and Information Technology and the Minister of Trade.
When exercising the direction power, the Minister is required to take into account the principle that the direction should be proportionate to the network security risk. This means considering whether costs would be higher than reasonably required to address the risk, and whether there would be undue harm to competition or innovation in telecommunications markets.
Looking at the law
Firstly, while it is nice that the Bill suggests that network operators should work in partnership with the GCSB over security, the reality is that there is no choice. Let's quote section 45(1):
A network operator must engage with the Director as soon as practicable after becoming aware of any network security risk, or proposed decision, course of action, or change that may raise a network security risk.
A network security risk is defined as: "any actual or potential security risk arising from (a) the design, build, or operation of a public telecommunications network; or (b) any interconnection to or between public telecommunications networks in New Zealand or with telecommunications networks overseas".
Further more in section 47(1) (edited for clarity/length), "a network operator must notify the Director of any proposed decision, course of action, or change made by or on behalf of the network operator regarding procurement of..., changes to..., and ownership control... of anything that falls within an area of specified security interest."
This applies to areas of specified security interest which are defined in section 45(1) as (slightly edited for clarity) "network operations centres, lawful intercept equipment, any part of a public telecommunications network that manages or stores aggregated customer information or administration authentication credentials, and any place in a network where data aggregates in large volumes being either data in transit or stored data".
The compliance process
So, what happens after this engagement/notification if the GCSB thinks it would raise a network security risk? Sections 49 to 54 have the process:
- Director of the GCSB notifies the network operator and then again in writing in s49(1)(a) and s49(2)
- Network operator must immediately stop work. s49(1)(b)
- Network operator can propose an alternative. a49(3)
- GCSB considers the network operator's proposed alternative and possibly accepts it. s50(1) and s50(2)
- Network operator must implement the response. s51
- If the GCSB is not happy with the proposal it may refer the matter to the Minister (the Prime Minister normally has responsibility for the GCSB) to make a direction. s52
- Network operator may choose to make a submission to the Minister. s53(2)(b)
- The Minister must consult with the Minister for Communications & Information technology and the Minister of Trade. s54(3)
- The Minister may direct the network operator to either cease/refrain from an activity or make changes to or remove any system or operation on the network. s54(2)
- If the network operator refuses to comply with an s54 Ministerial direction, this is treated as serious non-compliance. s82(b)
- The GCSB can servce an enforcement notice on the network operator. s85(2)
- The GCSB can apply to the High Court for a court order. s86(1)
- The High Court can make an order (subject to normal apeals). s87
- The High Court can make the network operator pay a fine of up to $500,000 and/or $50,000 per day of continuing non-compliance. s92 and s93
In other words, the Bill may suggest that the GCSB and network operators should cooperate, but the content of the law and the procedure I have just outlined makes it very clear to everyone involved where the power really lies. Indeed, the expectation that network operators will do what they're told is so clear that we wouldn't expect any fines to be issued because there won't be a lot of point fighting any directions from the GCSB.
But it's only security issues!
Now one might claim as Brad Ward has that "This Ministerial power relates to network security issues."
However when it comes to network design and operation, everything has an impact on network security. What you buy, what systems they run, who you buy them from, how they get delivered to you, where they're installed, how they're configured, who you've employed, how well they're trained, etc, etc, etc - network security is not one attribute but is a product of the system as whole.
We stand by our original statement that the TICS Bill as written will give the GCSB sweeping powers of oversight and control over New Zealand telecommunications networks.
One final point of interest is - why is a government bureaucrat trying to deny this is the case? Does the Bill as written not reflect the intention of the people who wrote it, or is this a case of the government trying to pull the wool over people's eyes?
The government has announced two new Bills for reforming the GCSB and expanding their powers. The first is the GCSB and Related Legislation Amendment Bill (PDF) and the second is the Telecommunications (Interception Capability and Security) Bill (PDF).
This article is a summary of the major parts of the TICS Bill.
The TICS Bill is a replacement for the Telecommunications (Interception Capability) Act 2004. This law forced communications providers (ISPs, telcos, data networks, etc) to provide "lawful intercept" capabilities so that the Police, SIS and GCSB could access communications once they had a suitable warrant. The new bill expands and clarifies these requirements.
However, the addition of the word "security" is the key to what has changed. The new bill now gives the GCSB sweeping powers of oversight and control over the design, deployment and operation of all data and telecommunications networks run by network providers in New Zealand. The stated reasons are to both protect New Zealand's infrastructure and to ensure that surveillance agencies can spy on traffic when required. As part of this, the GCSB will have the power to stop network providers from reselling overseas services that do not provide these capabilities.
Summary of major elements of the TICS Bill
From the Bill:
A network operator must ensure that every public telecommunications network that the operator owns, controls, or operates, and every telecommunications service that the operator provides in New Zealand, has full interception capability.
Note that the surveillance agencies still need to have a legally issued warrant (under the Search & Surveillance Act, NZ SIS Act, or GCSB Act) to actually intercept any communications and there are obligations to avoid capturing communications that are not covered by the warrant.
The new Bill splits communications providers into multiple classes, with small, wholesale and infrastructure providers having reduced obligations. Providers must either have a full intercept capability, to be "intercept ready", or to be "intercept accessible". Membership of these classes can be varied by direction of the Minister.
The Bill specifies that the law applies to companies whether based in New Zealand or overseas. It then goes on to give the Minister the power to ban the resale of an off-shore telecommunications service in New Zealand if it does not provide interception capabilities. This could stop the resale of foreign-hosted VPNs, instant message services, email, etc.
Finally, there is more detail about how intercepted data should be formatted and delivered (apparently this has caused problems under the existing law).
Encryption and decryption
Network operators must decrypt the intercepted communications if they have provided the encryption, but there is no obligation to do so if the encryption is provided by others.
What does this mean for providers such as Mega (file locker) or LastPass (password storage) who have a business model based on the fact that they supply a cloud product that uses encryption but have deliberately designed it so that they can not decrypt the files themselves? This gives users the assurance that they can trust them with their data. Will the government close them down unless they provide a backdoor into the system?
There is a major new role for the GCSB in overseeing the design and operation of commercially available data and voice communications networks.
The Bill says that network providers and the GCSB are to work co-operatively and collaboratively on identifying and addressing network risks. If they fail to cooperate sufficiently, the law provides for penalties of up to $500,000 with an additional $50,000 per day.
Network operators must notify the GCSB of any proposed decision, course of action or changes made by them in regards to purchases, network changes or ownership/control of the "specified security interest". This includes their network operations centre (NOC), lawful intercept equipment, customer databases, databases of user accounts, and "any place where data aggregates in large volumes".
The GCSB can also demand any other information about the security and interception capabilities of the network including copies of contracts, specifications, and so on. That the information is commercially sensitive or held in confidence is not a defense.
All network operators will have to register themselves with the government. The register will be administered by the Police and available to the Police, SIS and GCSB.
The register will include the numbers of customers, names of responsible contact people within the organisation, the regions they operate in and the types of services they provide. Providers of infrastructure services (e.g. companies that provide fibre links but not the equipment for communicating over those links) will also have to give the names of their customers to the register. There are penalties for non-compliance.
The government can insist that communications providers must obtain secret-level security clearances for some of their staff. It does not say what will happen if none of the technical staff qualify for a security clearance.
Liability and protecting classified information
People who do any act in good faith under the new law will be protected from subsequent prosecution or lawsuits. i.e. the new law is superior to other NZ laws or existing contracts.
There is also a provision that allows the courts to receive classified information in a court case in the absence of the defendant or the defendant's lawyer. This applies to information that might reveal details of the interception methods used by the surveillance agency or is about particular operations in relation to any of the functions of the surveillance agency, or is provided as secret information from the surveillance agencies of another country. It can also be used if that disclosure would prejudice security of NZ, prejudice the maintenance of law, or endanger the safety of any person. The judge in the case can appoint someone with an appropriate security clearance to represent the interests of the defendant for these parts of the trial.
Analysis and comment
The new TICS Bill is a major expansion of government power over the internet and other communications networks in New Zealand. While the existing TICA Act already mandated the provision of lawful intercept capabilities, handing over final control of network design and operation to the GCSB in the name of "security" seems incredibly wide and open ended.
Adding an additional level of government bureaucracy to the design and operation of these systems would appear to be a fairly significant hindrance to the ability of network operators to run their businesses.
There also must be concern about the GCSB being able to ban the resale of any services that do not provide lawful intercept capability. This means that New Zealanders will be prevented from protecting their communications from the New Zealand government - but equally they will be prevented from protecting their communications from foreign governments too. (We can safely assume that a foreign service that gives access to the NZ govt will also provide it to others.) These rules could wipe out businesses such as file lockers and password stores that rely on providing secure storage to their users.
One must ask where the justification for this expansion of power is coming from. Has New Zealand already been materially affected by attacks on our communications infrastructure? It seems clear that while the GCSB may not be that competent at exercising the powers they already have, they have done a fine job of convincing the government that they can handle a lot more.
There are many other parts of concern and there will need to be more analysis of the interception capabilities in conjunction with the new GCSB bill. One that does stick out as particularly offensive to civil liberties are the provisions for convicting people based on secret evidence. How can you defend yourself fairly when you can't even find out the evidence presented against you?
We will be doing further work on analysing this bill and would welcome contributions, particularly from those within the industry who already have experience working with TICA requirements.
The following is a guest post from someone who has established to us that they have good reason to remain anonymous.
Judith Collins is not alone in taking the view that any use of a computer that retrieves more than it should is a criminal act. Each time another government agency is publicly mocked for yet another failure to handle information security competently, the outcry is always directed towards the "evildoers" who found the hole and exploited it.
Information security is not a trivial matter, it's not easy and it's very rare that any organisation actually has the in-house skills needed to deal with the multitude of new ways systems can be attacked. Worse, as was illustrated in the breach of MSD's network, management do not pay attention to the possible damage even when the risks are plainly pointed out to them.
It is worth noting that "hacking" is a term often thrown around in the media or by the public for acts which barely extend beyond the normal usage of a system. "Hacking' is, if we believe the way the term is used, literally any unintended use of a system no matter how trivial or obvious. A significant part of my job is to imagine how people can attack systems, and to weigh up the likelihood of those attacks being successful. I am, in part, a hacker by those terms.
Faced with any system, my first instinct is to poke it and notice the details most people do not - it's my job to notice and reason about those details. Most geeks will do it somewhat instinctively, not because they're "evil" as much as certain people want to make us out to be, but just because it's there and it's interesting. Given an "open file" dialogue box they're going to see what else they can open, just like happened at MSD.
What is then done with the knowledge is where things get harder to define.
Whistleblowing is a dangerous business. The whistleblower becomes part of the story, with their motives and character questioned both in the media and by politicians and civil servants desperate to distract attention from their own failings. For some people it can be the end of their career.
It should not be taken lightly. You will note this story is published under a pseudonym, I won't be putting my name out there to be dragged into the wrath of an embarrassed Minister's rage. My objective as a whistleblower may have been to get a security hole fixed so that others can't exploit it, but that won't matter once it's a media story.
Equally, if you are blowing the whistle, you had better be sure your own actions were honourable and can be demonstrated to be so. You should expect any and all of your interaction with the organisation will now be released/leaked for public consumption. But how should you disclose the vulnerability in such a way that it gets fixed and your name doesn't get dragged through the mud?
What do we want?
We need to decide what the desired outcome is. Do we want information to be secure and for people who discover flaws to feel comfortable in disclosing them so security can be improved? Or do we want people to be too scared to speak up, so that those flaws live on to be discovered and traded on the black market?
It is in society's interests that systems and information are well protected. We should expect that promises given to keep information secure are met, and that disclosures of holes aren't responded to with yet another series of excuses and blame shifting. You might not feel that a breach of any given system affects you, but if breaches are covered up there is very little incentive to fix them.
What can organisations do to encourage good disclosure? The first is to have the right attitude to information security. There are simple steps that any organisation can take to ensure vulnerabilities discovered by the public are handled properly.
- Make it obvious where people should report any vulnerabilities that they find. This is no different from any other emergency contact details or a feedback point in a website.
- A clear, public, policy on vulnerability disclosure. What steps will be taken with a claim of a vulnerability, how should information obtained be handled, and so forth. This is as much about ensuring you have processes internally as it is about making it safer for people to disclose to you.
- Ensure vulnerability reports are reviewed by staff who are capable of giving them expert consideration. You don't want a half-garbled explanation trying to be handled by people without the depth of experience to see the problem and to speak the same language.
This, however, leads us to the thornier issue of what responsible disclosure and handling looks like. What does ethical hacking, if there is such a thing, actually consist of? There are no hard and fast rules about what is acceptable.
Even within the IT security field there is significant debate on whether organisations should be notified privately or whether 'full [public] disclosure' is the only way to get real change in security practices. And if you do go the private route, how long do you persist with it before you give up and go public?
Unlike a theoretical exploit against a system these are breaches which involve real data. That becomes much harder to make set of ethical guidelines about because fundamentally it's a criminal act. And as we started out this post with, there are no end of people who will attempt to convict you for it. For that reason you had better have a lawyer and I should note that none of this post is intended as legal advice.
Take too much data, or exploit the system too often and your intent will be read as a criminal act. How much is "too much" is not easily identified either. Limiting the amount of information copied and limiting how often the breach is exploited may help.
"Responsible disclosure" states that at a minimum the organisation should be notified and given a chance to correct the problem, before public or "full" disclosure takes place. The point is that organisations who value information security will have good policies and clear contact points to deal with breaches and those organisations should be rewarded for doing so. The outcome is what everyone wants, better information security.
Disclosing to journalists or competitors is much less ethical if the original organisation has not been contacted. This is less true if they have been and they have dismissed the breach or failed to respond in an adequate time. Again, there are no hard rules about how long that should be. But in either case, this is a path that is almost certainly going to result in questions about your intent.
Extending the Protected Disclosures Act?
This is not a new problem. The law already recognises that there are times when people have a duty to breach an obligation they may have, and offers legal protection when they do so. The Protected Disclosures Act 1990 allows employees and other people inside an organisation to blow the whistle provided they act in accordance with a specific set of rules.
Perhaps it is time we had an IT vulnerability disclosure law that applies to people who are not employees. It would outline rules to follow when disclosing a vulnerability, and would provide legal protection as long as those rules were followed. The outcome would be that more holes can be discovered and fixed, thus improving the security of all our information.
What outcome do we want. Do we want vulnerabilities fixed, or points to be scored? I want my information secure, and I don't care how that breach is discovered. I just want it fixed, and for all organisations to take information security seriously.
A cabinet paper (PDF) shows that the Government has accepted most of the Law Commission's proposals to control and punish cyber-bullying and other 'digital harms'. This includes:
- Clarification of existing laws such as the Harassment Act to explicitly say that they apply to modern communications technology.
- Establishment of an agency (probably NetSafe) that will provide non-coercive mediation of online issues.
- More encouragement of anti-bullying measures in schools.
- New criminal offences for "using a communications device with the intention to cause harm" and "incitement to suicide".
- Establishment of a new regime with wide ranging censorship powers for controlling online speech, including new tighter standards for what speech is acceptable online.
One significant change is that the paper rejects the establishment of a separate Communications Tribunal (staffed by District Court judges with specialist knowledge in this area) in favour of passing it to the District Court as a whole. This would seem a step backwards in many ways as we question whether the average District Court judge is up to the task of understanding the technology involved.
Read our response to the Law Commission's original proposals: What's Wrong with the Communications (New Media) Bill and can it be fixed?
Many of these problems remain in the current proposal.
From a civil liberties point of view, the most serious concerns are around the idea that online speech should be held to a different and significantly higher standard than offline speech, a position we strongly object to. There is also a concern around why harming someone via online communication is seen as so much worse than other forms - it would make more sense to us to concentrate on the extent of the harm caused, not the means by which it was delivered.
From a purely practical point of view, when we consider the wide-ranging use of anonymity and foreign services on the internet, combined with the speed at which many situations blow up online, we still question how much good these proposals will be able to do.
Our page listing reactions to the initial report.
No Right Turn reports that the proposal is the return of the offence of criminal libel:
Back in the dark ages, when spousal rape was legal and homosexuality was a crime, there was a criminal offence in this country of "criminal libel". Publishing material "designed to insult any person or likely to injure his reputation by exposing him to hatred, contempt and ridicule" wasn't just a matter for defamation lawyers; it was a crime punishable by two years imprisonment. The law was clearly incompatible with the Bill of Rights Act (not to mention with modern ideas about defamation being a tort), and so it was repealed in 1992. Now Judith Collins wants to bring it back - but only on the internet.
Lawyer Steven Price points out some of the hurdles you'll have to get over to actually use the new new censorship regime and then questions the wisdom of handing over decision making around some complex technical and Bill of Rights issues to the next District Court judge off the bench.
Blogger David Farrar generally favours the proposal but questions the communications principles.
InternetNZ points out that the proposal has some worrying flaws.
Do New Zealanders want web-based email services to be subject to take-down orders? Do people understand that such orders, as outlined in the Cabinet paper, could be based on lower legal standards than is the case today – and could be imposed on people without them being part of the Court’s proceedings?
Vikram Kumar worries that the proposals will cause collateral damage to the NZ internet.
NZ Herald editorial in favour.