This is the transcript of a speech given by Thomas Beagle at Kiwicon in Wellington on November 6th, 2011.

Hi everybody. I'm Thomas Beagle from Tech Liberty. We're a lobby group dedicated to protecting civil liberties in the digital age.

I'm going to talk about how the government is protecting us by using technology to make us safer and happier people – while possibly not caring so much about our freedom.

Now, in the tech field we often laugh about the government and the law being one step behind - I bet more than one of you has looked at the new copyright law and thought "Ha, they're cracking down on torrenting but these days I get all my content via usenet!"

The problem is that this goes both ways. Sometimes it's the government that is using the new technology and the it's the laws we use to protect ourselves that haven't caught up with it yet.

Automated Number Plate Recognition

I'm going to start with automated number plate recognition because there's a good chance many of you won't have heard of it and it provides a good example of the way digital technology is changing things. But what is it?

It's pretty simple really - it's a camera that gets installed in a police car. It recognises the number plates of passing cars and checks them against a central database. Get a match to a "vehicle of interest" and the police can pull over the car and have a little chat with the driver.

Now you might think that sounds pretty innocuous, it's just automating an existing manual process. And it means that the police will spend less time and money catching more bad guys. How could anyone have a problem with that?

Of course, you lot have probably already worked out the problem. It's more than just a simple database lookup - it also includes the date, the time and the place. And it’s doing it for every car. And it’ll end up being installed in every police car. So the police are going to end up with an ever-growing database of car sightings that will let them know where you have been.

Tracking someone used to be hard.

Automated number plate recognition is going to make tracking easy. You don't need a whole team of people, you don't need to install a GP tracking device, you don't need to get a court order to access mobile phone data - you just install ANPR devices everywhere and then you can ask the database whatever you like. Because you're storing historical data, you can even go back in time - "Where did car X go on the night of May 5th?"

It's the sort of information that a totalitarian regime would love to have. It's the sort of information that an over-zealous police force obsessed with green or brown terrorism would use. But is it the sort of information that we want our government to have about everyone?

At one time the answer would have been no. When tracking devices became practical, the law was changed to make the police have to have a warrant before they could use them. Of course, the law change was partly to enable police to trespass to install the devices, but us civil liberties types have to take what we can get. This new automated number plate recognition system could be implemented without the need for any law changes or any oversight - and the NZ police are trialling it at the moment.

Search warrants

Another example of how the government’s use of tech is outpacing the laws we use to protect ourselves - the common or garden search warrant. Let's say that you're suspected of embezzling funds, or armchairs, from the company you work for. A complaint is made, the police investigate, they get a search warrant and kick down your door.

In the old days you'd expect them to take any sort of financial papers, documents, etc, etc. But would they take your old love letters or the family photo album? Of course they wouldn't, and the terms of the search warrant wouldn't let them.

Things are different now - sure they'll take any papers they find but they're also going to take your computer and any other digital storage on the premises. And, well I don't know about you, but my entire life is on that computer. My business files, my letters, my medical records, my family photos, ... my not so family photos... all in the hands of the police. All available to be indexed and searched with the police able to keep a copy indefinitely.

Once again, the law hasn't changed but the digitisation of information means that the effect of the law is much more oppressive.

Customs

And while I'm on the subject of searching computers, did you know that Customs have the power to seize any digital device or storage coming into the country and examine the contents? They can even take copies of the device for review later.

This is not just theoretical – they have been doing it. We got a complaint from someone about them taking his netbook as he returned from holiday in Samoa, and of course there were the Switched on Gardening people who had their phones and laptops taken every time they crossed the border.

In theory Customs can only do this to look for contraband or censored works, but it seems very likely that they are using this power at the behest of the police to do the searches that the police legally can't. You might want to bear this in mind the next time you cross the border.

Civil liberties

The question has to be - do we want to live in a society where our movements and secrets are open to the authorities? It's traditional to mention Orwell's 1984 at this point - not least because it is such a terrifying view of the surveillance state that we're rapidly developing the ability to implement.

How do we decide what is acceptable and what isn't Trying to come up with answers to this question is one of the reasons we founded Tech Liberty. We saw that one of the best ways to look at this is through some rather old rights such as freedom of speech, the right to due process, the freedom from unreasonable search, and the recent addition of the right to privacy. And some of our new laws are stomping all over them.

But I promise this isn't a recruitment session! Instead let's start running through some of the things happening at the moment in New Zealand.

Control of the internet

The big one is control of the internet. Over the past 7 years there has been a three way legal combo attack that, as far as I'm concerned, means that the government has largely won.

The first part of this combo is the Telecommunications Interception Capability Act of 2004, known as TICA. It simply says that communications companies - telcos and ISPs - must provide facilities for law enforcement and intelligence agencies to be able to intercept communications - phone calls, data, etc. Sure, they have to have a warrant, but as our judges have declined just 1 of the hundreds of applications for interception warrants in the last three years, I think we can assume that that isn't too difficult to get.

Second is the internet filter implemented by the Department of Internal Affairs. There is no law enabling this and therefore use of the system is "voluntary" by the ISPs - but I note that in the UK they made moves to make a similar system mandatory after some of the smaller ISPs failed to realise they were meant to volunteer. Right now over 90% of New Zealanders get their internet through a connection that is censored by the government and, unlike the rest of our censorship laws, they refuse to tell us what has been blocked.

Finally, our new copyright law to stop the evils of infringing file sharing has two interesting provisions. The first is that ISPs are obliged to keep records of which account had which IP address at any one time. Secondly the government has decided to skip all that messy having to prove you actually did something bad, and has decided that they can penalise the account owner for anything done through their internet account.

So, this three way combo means that the government has established that it has the right to control where we can go on the internet, it has the right to monitor what we do, and if someone does anything it doesn't like, the government has someone it can punish.

Now this is currently being done with a fairly light hand - they only filter "the really bad stuff", they have to get a warrant to monitor or intercept, and no account holders have been fined yet (although the first notices have just gone out) - but it means that the tools are in place and ready to be extended as required.

For example, currently it's the Department of Internal Affairs who choose what to censor and I believe them when they say that they want to limit the use of the filter to child pornography... but they're not the only ones with influence. How about the courts - a judge in the UK has just ordered British Telecom to use their "really bad stuff" filter to block access to a file sharing site - because the tech is available. Or what happens if there's another media scandal about bomb-making instructions on the internet and some politician thinks that the government must come up with a solution - again, the technology is there and ready to be used.

Of course, you're all sitting here thinking "haha, I am elite masterhacker and I use encryption and VPNs, they'll never catch me!". And to a certain extent you're right - the careful and technically savvy person can avoid some of these things to a greater or lesser extent (although of course, your VPN has to come out in a legal jurisdiction somewhere...). But while this is all right for you and me, what about everyone else in New Zealand? Don't they deserve some freedom and privacy as well? When governments oppress people, it affects all of society.

Cameras

What else is happening? I think we can safely assume that the number of surveillance cameras, both govt and private, continues to rise. At some point the promise of facial recognition might even live up to its marketing claims.

But there are also special cameras. Customs have been trialling the naked body scanners even though the Aviation Crimes Act expressly forbids use of technology that shows the naked form. Customs claims that the law only applies to the use of scanners to detect weapons and other threats, whereas they're using them to detect contraband. In other words, either they're lying - or they're willing to invade your privacy by taking naked pictures of you to find counterfeit Rolex watches.

Privacy Act

Of course, we do have the Privacy Act. People and companies can't just give your private info away, right? Well, first you have to worry about the jurisdiction that your data is in - services based overseas may not have the protections we do.

But even in New Zealand the act includes a provision that you're allowed to release information "to avoid prejudice to the maintenance of the law". You may think that the police would need a warrant or court order to get Trademe to release information about you, but they're happy to admit that they will give the police any assistance that they request. Do you know whether the NZ companies you deal with will stick up for your privacy?

The Law Commission has just finished the review of the Privacy Act and we're expecting to see a bill to modify the law soon. The good news is that they intend to make the Privacy Commissioner a little less toothless. More interestingly, they've recommended making it a responsibility to notify people if security is breached and personal data is stolen. I think this is a good idea and, for any black-hats out there, it's going to make cracking the right targets just that much more satisfying when they're obliged to put out a press release telling everyone about it.

TICA and Search & Surveillance

Speaking of reviews, earlier I mentioned TICA, the Telecommunications Interception Capability Act. There's a general perception that the law doesn't work well, with both law enforcement and comms companies struggling with the lack of specifics. The Ministry of Economic Development is planning a review of the law next year. I think it's going to be one to keep a sharp eye on as law enforcement is never shy about asking for more powers.

The best example of that is undoubtedly the Search & Surveillance Bill. The Law Commission was asked to review and revise our rather chaotic laws around search & surveillance. Now, they could have had a serious look at what sort of invasive powers we let the government have in a free and democratic society - but instead they just gave the police and everyone else whatever they asked for. I still find it hard to believe that they thought it appropriate that even the local city council could apply for a search warrant to put a hidden video camera in your bedroom.

The original version was so over the top, and so badly drafted that it got sent back to be rewritten somewhat, and you can tell it’s still bad because then the govt chickened out and put the rewritten version on hold until after the election. Some of the things I'm particularly unhappy about are the lack of notifications - how can you challenge the government for doing an illegal search if you never find out that it was done? There’s also further erosion of the right to silence through the extension of production and examination orders to more types of crimes.

But one part you should all be aware of is related to searching computer systems. If you have "relevant knowledge" of the system being searched, you can be compelled to assist in the execution of a search. Refuse? You could be jailed for up to three months.

Now this could be unpleasant for a number of reasons - who wants to be caught up in someone else's drama just because you're a sysadmin or work at an ISP? But what if the assistance you're asked to provide is "Crack the encryption on these files"? How well do you think the average judge will understand that cracking a well designed encryption system isn't exactly trivial? After all, they watch TV, they know hackers can get into anything with few minutes work.

Why do we get these laws and why are they often so bad?

The final thing I want to talk about is - where do these laws come from and why are they often so bad?

Wikileaks very clearly showed that our new copyright laws are a result pressure from the US. And they’re still going – now it's the promise of a free trade treaty, the Trans Pacific Partnership, where the cost of joining and getting better access for our agricultural products will be gutting Pharmac and implementing stronger IP laws.

Then there's our local politicians who need to be seen to be doing something and are always happy to pander to the law and order trolls to get votes. Don't you trust our brave boys in blue? Of course they need more powers to stop these evil islamic Greenpeace terrorists!

Unfortunately "something" is often ineffective or has undesirable consequences. We end up with King Canute laws - someone is standing on the beach and ordering the tide to stop coming in, and it's not doing a lot of good.

Will our new copyright laws stop file sharing? No, but they have undermined our right to a fair trial.

Will the internet filter stop children being abused? Of course not, but it has given the government a new system designed for mass censorship.

Will naked body scanners stop terrorist attacks? Well, we don't have any terrorists so maybe this one will be effective!

Political solutions

Kiwicon is a very technical conference but these aren't technical problems with technical solutions. Instead they're political problems and the solutions also have to be political. The good news is that in New Zealand we do have, no matter how much people sneer at it, a working democracy.

You can get involved, you can give an opinion, you can help educate our politicians, you can influence our laws.

And this is the point where I say that Tech Liberty needs more people who want to be involved in that political process, that we have a website at techliberty.org.nz, and thanks very much for listening.

One thing that has become clear in the debate around the bill is that many people are not fully aware of the existing powers that government agencies have to pry into our personal affairs. It's not uncommon for someone to decry a 'new' power in the Search and Surveillance Bill, only to be told that it is already in existing law.

This article lists, to the best of our knowledge, the current ways that the government can use to watch us. We will expand/correct it as additional knowledge comes to light.

Contents

• General Surveillance
• ACC - Accident Compensation Corporation
• Customs
• Fisheries
• GCSB - Government Communications Security Bureau
• IRD - Inland Revenue Department
• Police
• SIS - Security Intelligence Service

General surveillance

Common rights

Everyone has the right to (in broad terms and with exceptions):

• Record conversations that they are part of.
• Report on things they see.
• Take photos or video of anyone and anything.
• Follow someone to see where they go and what they do.

The media can use these rights and, if not prohibited, so can government departments. For example, the Police don't need to get a warrant to tail someone or to pay an informer to report what they've heard.

However, it is illegal to intercept other people's private communications or to sell equipment designed to do that. it is also illegal to make "intimate visual recordings".

Note that licensed private investigators are not allowed to photograph, video or record people without the written consent of the target.

Video cameras

Video cameras are increasingly common in public and private places in New Zealand. Some examples:

• Cameras in banks and shops that watch both the customers and the workers.
• Council operated cameras in streets and squares.
• Road cameras operated by the NZ Transport Agency.
• Security cameras at airports.

The Police can normally gain access to camera records upon request.

ACC - Accident Compensation Corporation

The Accident Compensation Corporation is known to use private investigators to check up on claimants, but it appears that they have no particular legal powers to do their own surveillance.

Customs

Summary Proceedings Act 1957

The same law that gives the Police the power to install tracking devices on vehicles or anything else can also be used by the Customs Service. The Comptroller of Customs must submit an annual report to Parliament listing the use of tracking devices. In 2008/2009 the use was as follows:

• Warrants issued: 14
• Average duration (days): 27
• Devices used without warrant: 1

Customs and Excise Act 1996

Customs officers have the ability to patrol the bank of any river or lake and the adjacent land, and to enter any building there or part of an air strip for the purpose of surveillance.

Ministry of Fisheries

Fisheries Act 1996

This law gives Fisheries the power to place a person as an observer on any vessel to collect fishery-related information. The owner of the vessel must provide them with food and accommodation.

The Ministry of Fisheries also use investigators to watch and follow people who they suspect of breaching fishing laws.

IRD - Inland Revenue Department

While the IRD has extensive powers to search it appears to have no powers to engage in surveillance.

GCSB - Government Communications Security Bureau

The GCSB derives its powers from the Government Communications Security Bureau Act of 2003.

The GCSB has two roles - interception of communications and the protection of the government's communications from interception. However, the interception explicitly excludes NZ citizens or permanent residents:

Neither the Director, nor an employee of the Bureau, nor a person acting on behalf of the Bureau may authorise or take any action for the purpose of intercepting the communications of a person (not being a foreign organisation or a foreign person) who is a New Zealand citizen or a permanent resident.

However, there is some doubt about the exact workings of the GCSB's satellite interception stations and how much control the GCSB has over the information captured by the other countries it partners with. The GCSB has recently issued a statement denying these allegations.

Police

The Police surveillance and interception powers come from a wide variety of Acts. We have sorted it by act:

Summary Proceedings Act 1957

Summary offences are petty crimes that are dealt with "summarily" - i.e. by a District Court judge without a jury. This law includes provisions for the use of tracking devices. These are devices that reveal the location of a person or thing and/or whether something has been opened/tampered with.

Warrants to use a tracking device must be issued by a High Court or District Court judge. They can be granted for the investigation of any offence. Warrants are issued for up to 60 days but can be renewed. The warrant also gives the office the ability to enter premises to install the device.

An officer can install a tracking device without a warrant if it is not practicable to get one and the officer believes that a judge would issue one.

The Commissioner of Police must submit an annual report to Parliament listing the use of tracking devices. In 2008/2009 the use was as follows:

• Warrants issued: 22
• Average duration (days): 40
• Devices used without warrant: 0

Misuse of Drugs Act 1975 and Misuse of Drugs Amendment Act 1978

This law allows the Police to apply to a High Court judge to get a warrant to intercept private communications for the purpose of collecting evidence about drug crimes. This includes the ability to install interception devices (see note below). Any intercepted information that is not about drug dealing or other serious crime must be deleted.

The Commissioner of Police must submit an annual report to Parliament listing the use of interception warrants. The report must also include the number of prosecutions taken against the Police for misusing the information gained. In 2008/2009 the use was as follows:

• Warrants granted: 38
• Warrants refused: 0
• Warrants that authorised entry onto private premises: 19
• Average duration (days): 24
• Emergency permits: 1
• Interceptions recorded from emergency permits: 326
• People prosecuted: 111
• People convicted: 16
• People still being prosecuted: 82
• Number of prosecutions of police for misusing information: 0

Crimes Act 1961

Part 11A of the Crimes Act 1961 allows for the Police to apply to a High Court Judge for a warrant to intercept private communications where the target is a participant in an organised criminal enterprise or has committed or is about to commit a serious violent offence or act of terrorism.

This includes the ability to install interception devices (see note below). Any intercepted information that is not about serious crime must be deleted.

As a general rule, Judges should only grant warrants where they believe there are reasonable grounds for believing that the crime has occurred or will occur; that the evidence could be collected in no other way; and that the intercepted communications are not likely to be privileged (i.e. talking to your lawyer).

A police constable with the rank of inspector or higher can authorise the use of an interception device in an emergency situation where one person is threatening to kill or seriously injure another.

The Commissioner of Police must submit an annual report to Parliament listing the use of interception warrants. In 2008/2009 the use was as follows:

• Warrants granted: 30
• Warrants refused: 0
• Warrants that authorised entry onto private premises: 14
• Average duration (days): 19
• Emergency permits: 8
• Interceptions recorded from emergency permits: 1763
• People prosecuted: 46
• People convicted: 1
• People still being prosecuted: 36
• Number of prosecutions of police for misusing information: 0

International Terrorism (Emergency Powers) Act 1987

The Prime Minister and three other Ministers can declare an international terrorist emergency. This gives the police the power to, amongst other things, intercept private communications for the purpose of preserving life. This power is also extended to the armed forces when working alongside the police.

Terrorism Suppression Act 2002

This law says that anyone who owns or controls anything that they suspect might belong to a designated terrorist entity must report any transactions concerning it to the police.

Telecommunications (Interception Capability) Act 2004

This law says that communications companies (e.g. phones and internet) must provide facilities that enable law enforcement and intelligence agencies to intercept communications and gather information about those communications (e.g. when they were made).

The warrants themselves are issued under the authority of the other acts mentioned in this article.

Anti-Money Laundering and Countering Financing of Terrorism Act 2009

This law says that financial institutions and casinos must report to the police any transactions that they suspect may be relevant to the prosecution and investigation of money laundering, drug crimes, terrorism, proceeds of crime or any other serious offence.

The Police Commissioner provides guidelines that the banks use to determine whether a transaction is suspicious and therefore must be reported.

Note : Interception Devices

The Misuse of Drugs and Crimes Acts both refer to "interception devices".

interception device means any electronic, mechanical, or electromagnetic instrument, apparatus, equipment, or other device that is used or is capable of being used to intercept a private communication

This is generally taken to exclude video recording (one of the justifications for the Search and Surveillance Bill is to add rules around video recording).

SIS - Security Intelligence Service

The SIS gets its powers from the New Zealand Security Intelligence Service Act 1969. The SIS can also take advantage of the Telecommunications (Interception Capability) Act 2004.

The SIS can "install or modify any device or equipment" to watch someone. We take this to mean audio bugs, cameras, computer monitoring devices, etc. The Act has very few limitations on how this surveillance can be carried out.

They require a warrant, which is applied for by the Director of the SIS and granted by the Minister (traditionally the PM) and the Commissioner of Security Warrants. The warrant can be granted for up to 12 months at which point a new warrant must be applied for.

While the warrant is only to be used to collect information for the "detection of activities prejudicial to security", if they uncover information relating to any serious crime they can pass that information to the NZ Police.

The SIS must submit an annual report to Parliament listing the use of domestic and foreign interception warrants. In 2008/2009 the use was as follows:

• Warrants issued: 24
• Average duration (days): 158
• Methods used: telecommunications interception, listening devices, copying of documents

The SIS also said that there some foreign interception warrants.

We recently asked Customs whether they were able to do this and they replied that they could under the Customs and Excise Act (1996).

Looking for information

We'd like to find out more about what Customs are doing in this area. In particular we'd like to know what they're looking for, whether they're targeting anyone in particular, and what they do with the systems and data they seize.

Please contact us if this has happened to you or anyone you know. Please include as much detail as possible. We promise to respect your anonymity.

The stated intention of the bill is to "reform the law to provide a coherent, consistent and certain approach in balancing the complementary values of law enforcement and human rights" while "[providing] for the appropriate legislative powers to enable law enforcement and regulatory agencies to extract electronic information and use surveillance devices in order to investigate and combat criminal activity".

The bill is largely based on the Law Commission’s report, Search and Surveillance Powers. The search and surveillance powers of the Security Intelligence Service are not included in the bill.

Major parts of the bill are:

• Defining police powers of search with and without search warrants
• Examination and monitoring orders
• Surveillance warrants
• Production orders
• Procedures around obtaining warrants
• Procedures around executing warrants
• Procedures around seized materials
• Reporting on warrants issued and executed

Current Status

The bill passed the first reading in Parliament on August 4th 2009 and was sent to the Justice Select Committee for public submissions. Submissions closed on Friday, 18th September, 2009. The committee was due to report back to Parliament in February but due to the concerns raised has extended this until May 2010.

Reactions to the Bill

Taken on face value, the Search and Surveillance Bill looks to be a good attempt at clarifying the laws around search and surveillance, making them more consistent and better administered. However, the bill has ended up significantly expanding the scope of the current powers as well as adding new provisions and this has generated significant opposition:

The Human Rights Commission has accused the bill of neglecting human rights and going too far in giving power to the state. They particularly criticised the ability for the Attorney-General to authorise anyone to issue search warrants (currently only judges, court registrars and JPs may do so), as well as the extension of the search and surveillance powers to government agencies beyond the Police and SIS.

The Privacy Commissioner has also reported on the bill. Criticisms included the lack of provision for notifying someone that they had been under surveillance after it was over, concern that computer searches are not well specified enough and could turn into trawling expeditions, and the way that the use of production and monitoring searches is expanded from very specific cases to possibly being used for any offence for which a search warrant can be obtained.

Law firm Chapman Tripp made a submission. They raised a number of concerns and particularly questioned the way that the bill takes individual powers given to individual regulatory bodies and aggregates them to give all of the powers to all of the bodies. They also questioned the establishment of residual warrants that have no limits on the type of investigative techniques that can be used.

And finally the New Zealand Council of Civil Liberties also questions a number of provisions in the new bill:

No strong case has been made, either in the Law Commission report or in the subsequent discussion, for the increase in the powers of the State to search cars and houses without warrant, to seize personal property, to flout laws relating to privilege, to use a range of surveillance measures with little accountability, and to charge people who fail to cooperate. The argument for increasing such powers has been made in the context of creating consistency between agencies, not based around clear evidence of need.

The Bill and Tech Liberty

While there are obviously a number of issues with general civil liberties in the bill, what impact will it have on the areas that concern Tech Liberty?

Searching Computers

The bill allows for a copy to be taken of all information stored on a computer system, at which point the copy can be taken away and analysed at the searcher's leisure. We note that there is a trend for people to store more and more of their personal information digitally, and this provision means that many search warrants will result in receiving far more personal information than intended. For example, the people executing a search warrant looking for particular paperwork wouldn't take your personal photo album, but when these are both stored on the same computer they will be swept up together.

Even worse, many people share computers, so not only will the subject of the search have their privacy invaded, so will any other users of that system.  While any search must breach privacy to a certain extent this seems like a disproportionate invasion.

The Privacy Commissioner notes that this risk could be mitigated somewhat by tying the search parameters to the purpose for the search warrant, with the warrant describing what information is to be seized (e.g. "financial transactions"). We agree that this would be a valuable addition to the bill to prevent overreach.

Remote Access to Computers

Section 101(4) k allows for "the remote access and search of things such as Internet data storage facilities that are not situated at a physical location that can be searched". The warrant must specify the access information (we think this refers to information such as the Internet address) for the things to be searched.

This has been taken to allow for the investigators to access data at other sites (owned by the people being searched) as well as accessing data on any other systems or services used by the person, e.g. Google Mail.

Enforced Assistance

Related to this provision is the ability to force people to give access to computer systems they own or control. The penalty for failing to comply is up to three months in prison.

Security is an ongoing problem for computer systems and one of the ways used to prevent security breaches is to use strong encryption, encoding the data so that only the person with the right digital key can access it. In many cases the systems are specifically designed so that the people who control the systems can not read the information stored by the people who use the system, as that would make it too easy for others to also access it.

How will the courts determine the truth when someone says that they don't have the key? Will they believe the system administrator who says that they have no way to read their user's files? Will the courts be prepared to jail someone who might be incapable of doing what they are ordered to do?

The common law in New Zealand has long upheld the principles, taken from English law, that people have a right to silence and to avoid self incrimination. These are important parts of our civil freedoms and our right to a fair trial. We should not so easily remove them.

Monitoring Orders

A monitoring order allows an agency to apply to a telecommunications provider for all call-related information concerning the subject of the order. This includes data about phone calls, SMS messages, emails, instant messaging and other forms of electronic activity, as well as the content of these communications. As this order can be made again and again, it effectively amounts to ongoing surveillance.

Privacy of communication is an important part of free speech and thus democracy. People need to be able to communicate ideas without having to fear that everything they say is being intercepted by the government. The problem is compounded when you realise that any interception breaches the privacy of two people - the person being monitored and the person they're talking to.

Tech Liberty supports the use of monitoring orders for the investigation of serious crimes, when approved by a judge and with suitable systems in place to ensure they are not abused. Such orders should be limited to only capture the relevant information. Monitoring orders as defined in the current Search and Surveillance Bill are available for all crimes, approvable by anyone to a large range of government agencies, and without suitable limits on the data to be captured.

Residual warrants

The bill includes the idea of a residual warrant. This is a catch-all warrant that allows an investigator to apply for a warrant using any search method that they choose (one may ask why one would bother defining any other form of warrants if the residual warrant is available). As Chapman Tripp describes it, "There is no limit to the kinds of investigative techniques that could be deployed under cover of a residual warrant."

For example, a residual warrant could be used to authorise the covert installation of root-kits or monitoring software on computer systems. This could then lead to problems with other people accessing the systems, corruption of evidence, and/or disruption of the work performed computer system.

The clauses relating to residual warrants are too broad and give government agencies too much scope. At Tech Liberty we oppose the idea of residual warrants and recommend that they are removed from the bill. If there is a need to periodically approve new surveillance methods and techniques it may be necessary to include provisions to allow that in a reworked bill.

Conclusion

The Search and Surveillance Bill is offensive to civil liberties in general and to technical civil liberties in particular. While some of the bill's provisions are already in law, the general tendency of the bill is to extend them and make them uniform across government agencies and regulatory bodies. There is no real argument in favour of this, no justification for the extension of powers, other than that it will make them consistent.

The power to search, to seize and to surveil are highly intrusive - they invade people's privacy, cause significant disruption in their lives, and are done on suspicion rather than on established fact. Even if we optimistically assume that government agencies wouldn't deliberately abuse the powers, we also have to acknowledge that incompetence and vindictiveness are problems that no human organisation can ever eliminate. Any extension of powers should be carefully considered and balanced against people's freedoms to go about their lives without government interference.

We support the principles that led to the Search and Surveillance Bill. We do think that these powers need to be used and administered consistently and it does make sense to implement reform. However, as part of that we should be taking the opportunity to rethink these powers, to do our best to reduce them to the required minimum to reduce the impact on our civil liberties. We believe that the bill needs to be substantially rethought and rewritten from this perspective.

Of course, this assumes that the person involved actually has the password. It's quite common for someone running a system to not be able to break the encryption used by other users to secure their data. Will the courts understand that? And even if they understand that, will they believe it?

The United Kingdom has passed a similar law and has now jailed someone for refusing to give up passwords to encrypted data. It won't be a surprise to anyone that the first victim of a law that was designed to protect the people from terrorists and other serious dangers turns out to be a science hobbyist who appears to be no threat to anyone. This case is at least relatively simple - there is no doubt that the man does have the passwords, but he has chosen to maintain his right to silence even though the law has tried to remove that right.

The same provision in New Zealand's Search and Surveillance Bill is in direct contravention of the right to remain silent. You normally have the right not to answer questions from the police, and the right to choose not to testify in your defence in court. This right came into English law in the late 1600s after the abuses of the Star Chamber.

I believe that this clause is wrong in principle and unenforceable in practice. As such, it should be removed from the Search and Surveillance Bill before it comes law.

Update

Stephen Bell notified me that New Zealand passed the Counter Terrorism Bill in 2003 which already gave the Police powers to compel people to reveal passwords (he wrote about it at the time).

This bill added clause 198b to the Summary Proceedings Act 1957. This gives the power to compel the owner or someone responsible for a computer system to provide access to the information on it. The language in the Search and Surveillance Bill is obviously taken from this clause.

Of course, in the Summary Proceedings Act (1957) only a judge, magistrate or court register could grant a search warrant, and they could only grant them to a Police officer. The Search and Surveillance Bill allows the Attorney General to appoint anyone as being able to issue a search warrant, and they can be issued to members of a very large number of organisations.

The Law Foundation has done a useful analysis (PDF) of the conflict between this power and the common law principle that people do not have to incriminate themselves. Their conclusion is that such a power should be limited to the most serious matters such as counter-terrorism.