Urgent public meeting in Auckland
A public meeting to oppose the GCSB Bill is being held at 7pm Thursday, Auckland 25th July at the Mt Albert War Memorial Hall. Get the flyer (PDF).
Continue reading Opposition to the GCSB Bill
TICS Bill – Oral Submission
Text of our submission to the Law and Order Select Committee re the Telecommunications (Interception Capability & Security) Bill.
Introduction
I represent Tech Liberty, we’re a group dedicated to defending civil liberties in the digital age.
In general we support the ability of the government to have interception capabilities on telecommunications where possible, when those interception capabilities have suitable oversight and control. However we fear that technological development is slowly making this lawful intercept regime increasingly irrelevant.
We’ll be addressing this and some other elements of the first two parts of the bill, before talking about the proposal to make the GCSB responsible for cyber security in New Zealand.
Continue reading TICS Bill – Oral Submission
GCSB Bill – Oral Submission
Text of our oral submission to the Intelligence and Security Committee concerning the GCSB Bill.
Introduction
I represent Tech Liberty, we’re a group dedicated to defending civil liberties in the digital age.
We see many problems with this bill and the thinking that lies behind it, problems that we described in our written submission. Today I want to concentrate on just a few of those that are particularly central to our group’s reason for existing.
Open letter to John Key – the right to know
Dear Mr Key
This letter is partly in response to the findings of the Kitteridge report about the GCSB and their failures to follow the law, but is also mindful of the recent PRISM revelations about the actions of the NSA in the USA, as well as the mass spying revealed to have been carried out by the GCHQ in the United Kingdom. As disturbing as these revelations have been, we cannot help but be shocked that this surveillance was done in secret without the knowledge of the citizens of each country.
We assert that, as citizens of a democratic society, we have the right to know the methods that government agencies use to watch us. Without this knowledge we cannot assert our rights to put appropriate limits on their use.
Continue reading Open letter to John Key – the right to know
Submission: GCSB Bill
Full text of the Tech Liberty submission to the Intelligence & Security Committee concerning the Government Communications Security Bureau and Related Legislation Amendment Bill.
Summary
Tech Liberty has deep concerns about the extent of the powers granted to the GCSB by this Bill, especially when combined with the proposed changes to the Telecommunications (Interception Capability) Act (2004) contained in the TICS Bill.
We do not believe that the GCSB should be spying on New Zealanders. We are particularly concerned with the Bill’s silence on the GCSB’s existing practice of collecting and analysing metadata.
We do not believe that the GCSB is the right agency to have oversight and control of New Zealand’s telecommunications infrastructure in the name of “cybersecurity”.
We do not believe that the Bill makes any significant improvement to the current woefully inadequate oversight procedures.
We submit that this Bill and the TICS Bill should both be rejected. Rather there needs to be a formal review of New Zealand’s domestic and foreign intelligence requirements.
Continue reading Submission: GCSB Bill
Will the GCSB ban Apple from New Zealand?
Apple recently released a statement about their cooperation with law enforcement. It includes:
For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data.
[Update: see this discussion about whether this is entirely true.]
Does this mean that Apple will not be complying with New Zealand law?
Continue reading Will the GCSB ban Apple from New Zealand?
Submission – Telecommunications (Interception Capability & Security) Bill
Full text of the Tech Liberty submission to the Law & Order Select Committee concerning the Telecommunications (Interception Capability & Security) Bill.
Summary
In general we support the ability of the government to have interception capabilities on telecommunications where possible, when those interception capabilities have suitable oversight and control. We have made some technical suggestions on how Part 2 – Interception Duties could be improved and clarified:
- Publish a list of service providers with interception responsibilities.
- Remove the ability for the Minister to ban the resale of overseas services.
- Clarify the duty to decrypt to indicate that it does not require network providers to supply deliberately weakened encryption with government backdoors.
We reject the idea that the GCSB should have oversight and control of communications networks in New Zealand. No need for this has been established and the use of an agency whose main focus is spying on external organisations is inappropriate and open to abuse. We therefore recommend the removal of Part 3 – Network Security in its entirety, possibly to be replaced by the establishment of a coordinating and consultative, not controlling, network security body.
Finally, we find the idea of evidence being presented in court that cannot be seen by the defendant and their lawyer to be extremely offensive to the right to a fair trial as promised by section 25 of the Bill of Rights Act. We therefore recommend the removal of Subpart 8 – Protecting Classified Information (sections 96-98). If this is retained we recommend that the appointment of a special advocate as in 97(3)(c) should be mandatory rather than optional.
Continue reading Submission – Telecommunications (Interception Capability & Security) Bill
GCSB’s new powers for wide-spread spying on New Zealanders
There have recently been a number of revelations about the US government spying on its citizenry and other people around the world (a good summary). Many people have been shocked to find out the extent of the US’s spying and access into theoretically private systems.
What many New Zealanders don’t realise is that the NZ government is currently changing both the GCSB Act of 2003 and the Telecommunications Interception Capability Act of 2004 to allow similar levels of access to New Zealand communications for the GCSB (Government Communications Security Bureau).
Current law
The current TICA law already gives the GCSB, Police or SIS the technical capability to intercept all NZ communications if they have a valid warrant.
The GCSB can get warrants to spy on the communications of foreign people and organisations, although they can spy without a warrant if it doesn’t require the installation of any device (e.g. wireless/satellite/radio/mobile).
TICS – Telecommunications Interception Capability and Security Bill
The new TICS Bill clarifies and expands on these interception capabilities. It also allows them to be extended to service providers (people who offer “goods, services, equipment, and facilities that enable or facilitate telecommunication”) such as email providers, Trademe forums, Mega, etc.
TICS continues the existing regime where these interception powers can only be accessed with a valid warrant, but keep reading for the new exceptions to this in the GCSB Bill.
Furthermore, the TICS Bill also creates a new role for the GCSB, ensuring the security of New Zealand’s telecommunications infrastructure. This includes wide powers of oversight and control of how communications networks are managed and implemented in order to “protect New Zealand’s national security or economic wellbeing”.
GCSB – Government Communications Security Bureau and Related Legislation Amendment Bill
The new GCSB Bill gives the GCSB three purposes (we’ll come back to these):
- 8A – Information assurance and cybersecurity. (Expanded from protecting government communications to a much wider responsibility for New Zealand’s communications.)
- 8B – Intelligence gathering, analysis and sharing. (Similar to the existing law except that it adds “gathering information about information infrastructures” to the existing spying on foreign people/organisations.)
- 8C – Helping the Police, SIS and Defence Force by providing advice and assistance in helping them execute their own legally obtained warrants. (This is entirely new.)
The bill doesn’t significantly change how the GCSB can apply for an interception or search warrant, but it does add a whole new class of “access authorisation”. To quote section 15A(1)( b)
The Director may apply in writing to the Minister for the issue of an access authorisation authorising the accessing of 1 or more specified information infrastructures or classes of information infrastructures that the Bureau cannot otherwise lawfully access.
These authorisations are granted at the whim of the Minister (although see below) and are incredibly wide-ranging and open-ended. There are no recommendations of limits (other than what the Minister sees fit to impose) and there is no automatic expiry. And just in case you thought that the TICA/TICS law might provide some protection, the GCSB Bill goes on to add section 15A(5):
This section applies despite anything in any other Act.
Most importantly these new access authorisations can be used for purpose 8A (cybersecurity) as well as 8B (information gathering). As paragraph 36 of the Regulatory Impact Statement explains: “an amendment will also be required to allow the GCSB to see who (namely NZ individuals and companies) is being attacked”. That is to say, the GCSB believes that it needs to be able spy on New Zealanders to maintain ther security. Based on what we know from recent reports in GCSB activities, we assume that the GCSB particularly intends to collect communications metadata (i.e. who speaks to who, when and how often but not what they say).
If you had any doubts about whether this applies to NZ communications, section 15B then further clarifies that for any access authorisations “for the purpose of intercepting the private communications of a New Zealand citizen or permanent resident of New Zealand under section 8A (cybersecurity)” the authorisation must be approved by the Commissioner of Security Warrants as well as the Minister.
And finally if you were hoping that section 14, which controls the ability of the GCSB to target New Zealanders would provide any protection, this only applies when the GCSB is performing duties under section 8B (intelligence gathering) and not section 8A (cybersecurity).
Putting it all together
The GCSB believes it needs to monitor the communications of New Zealanders in order to ensure that it can protect them from attacks.
TICA and TICS establish the technical capability for the GCSB to spy on any communications, subject to the limits in that law and the GCSB Act.
A section 15A(1)(b) access authorisation can give GCSB power to access any communications system it wants for the purpose of spying or information security, irrespective of any legal controls in any other law. This will allow it access to the facilities provided by TICS/TICA.
The GCSB will be spying on New Zealanders.
Conclusion
These new laws are not some minor adjustments to the work of the GCSB and how interception works. They are not just about letting the GCSB provide technical assistance to the Police, SIS and Defence Force.
While people in the USA are getting upset about the revelations of the extent of NSA spying there, these new laws give the GCSB far greater control of New Zealand communications networks, and practically unlimited capacity to intercept New Zealand communications.
These new laws are the point at which New Zealand switches from being a society that investigates “bad guys” subject to judicial oversight, to being a surveillance state where the government is always watching and recording everyone just in case they’re thinking about doing anything wrong.
We don’t want to live in that society. We believe that these new laws contravene the right in the NZ Bill of Rights to be free from unreasonable search and seizure, and will have a chilling effect on the rights to free expression and freedom of association.
We think that these laws need to be stopped.
DIA now filtering .. Google?
Update 1st August 2013
The DIA have now confirmed that they did filter some sites hosted by Google and that this caused problems for both the filter and some internet users.
Officials provided an oral briefing on the incident reported regarding a degradation of service noted by some users of certain services. The Filter Operations Team worked with the provider of those services in question. It was discovered that hentai and cgi based child abuse sites hosted on the blogspot.com domain, a resource operated by Google Inc were included in the list in error.These sites were then shown to the IRG. It was then explained that a list refresh, removed the sites in question, and subsequently resolved this issue.
The problem was further compounded by the severe congestion in the networks of one of the upstream providers used by the system. A review of the Filter’s failsafe systems was undertaken. Steps have been added to ensure that the IPs of large hosting providers are flagged and placed on a white list with a reporting mechanism for the removal of the content from the site. Additional resources were requested from the upstream provider in question to ensure traffic congestion can be avoided in the future.
Back in 2011 we spotted the first indications of how the Department of Internal Affairs Internet filter, used by 90% of all New Zealand Internet connections, actually operates. At the time, we noticed an address – 124.150.165.62 – appearing where it shouldn’t in traceroutes to a site.
Performance Problems
Now that same address has popped up in traces to Google addresses, specifically googlehosted.l.googleusercontent.com (74.125.237.11). As noted in this thread on Geekzone, some people have been experiencing performance problems reaching some Google services.
These performance problems could be caused by a Google-load of traffic to that IP being routed to the DIA’s filtering server which may not be coping with the volume. Note that the filter will only be blocking one web address (URL) at that IP and letting the rest of the traffic through.
Of course this won’t affect you if you are using an ISP that doesn’t use the filter. Check the list of ISPs here.
Making the link
As noted back in 2011, the address appearing in traces where they shouldn’t be are controlled by Fastcom, who list the Department of Internet Affairs as an important customer and which they host infrastructure for.
Filtering problems
This was always one of the fears when the filter was introduced – that it would reduce the stability and performance of the New Zealand internet. It appears that this has now happened. Two questions:
- Will the DIA remove the entry for this IP now that they realise the problems it’s causing?
- How will the DIA block web addresses hosted at high volume websites such as Google (or Wikipedia) when the filter can’t cope?
Seeking more information
Have you been experiencing any issues accessing Google? Can you provide a traceroute for us? Post a comment below.
Rumours and hearsay
Thanks to the people who contacted us with more information, we just wish you were prepared to speak on the record. So far we have heard the following from people that we typically find to be reliable:
- That the DIA has denied filtering that IP address.
- That a senior ISP engineer says that the IP address was definitely filtered by the DIA filter and that they have seen the relevant BGP records.
- That the filtering of at least one Google IP address has been removed but that there might be more.
- That Google was greatly annoyed by the block and contacted the Minister to get it removed.
We’ll update these rumours as we can confirm/deny them. Please email any information to thomas@techliberty.org.nz. We will do our best to keep your name confidential if requested, but suggest using an anonymous remailer for the best anonymity.
Does the TICS Bill really give the GCSB control and oversight of NZ telecommunications?
After our recent article looking at the TICS (Telecommunications Interception Capability & Security Bill), we were contacted by Brad Ward, the Programme Manager of the Telecommunication Review at the Ministry of Business, Innovation and Employment (MoBIE).
He had some issues with what we wrote, and in particular he rejected our claim that the bill gave the GCSB sweeping new powers of oversight and control over NZ telecommunictions networks, writing that (emphasis added):
The new formal framework for network security does not give “sweeping powers of oversight and control” to the GCSB, and it does not give the GCSB “final control of network design and operation.”
The GCSB already works in partnership with network operators on network security issues, to agree on measures that are proportionate and risk-based. The Bill will formalise and build on this existing approach.
The Bill emphasises that network operators and the GCSB are to work cooperatively and collaboratively on identifying and addressing network security risks.
In the event that the network operator and the GCSB are unable to agree, the Bill establishes a Ministerial direction power that can be used where significant national security concerns are involved, and as a last resort. This Ministerial power relates to network security issues.
The GCSB would apply to the Minister responsible for the GCSB to direct a network operator to take specific steps to prevent, mitigate or remove the security risk.
The Minister can receive any submissions on this directly from the network operator, and is required to consult with the Minister for Communications and Information Technology and the Minister of Trade.
When exercising the direction power, the Minister is required to take into account the principle that the direction should be proportionate to the network security risk. This means considering whether costs would be higher than reasonably required to address the risk, and whether there would be undue harm to competition or innovation in telecommunications markets.
Looking at the law
Firstly, while it is nice that the Bill suggests that network operators should work in partnership with the GCSB over security, the reality is that there is no choice. Let’s quote section 45(1):
A network operator must engage with the Director as soon as practicable after becoming aware of any network security risk, or proposed decision, course of action, or change that may raise a network security risk.
A network security risk is defined as: “any actual or potential security risk arising from (a) the design, build, or operation of a public telecommunications network; or (b) any interconnection to or between public telecommunications networks in New Zealand or with telecommunications networks overseas”.
Further more in section 47(1) (edited for clarity/length), “a network operator must notify the Director of any proposed decision, course of action, or change made by or on behalf of the network operator regarding procurement of…, changes to…, and ownership control… of anything that falls within an area of specified security interest.”
This applies to areas of specified security interest which are defined in section 45(1) as (slightly edited for clarity) “network operations centres, lawful intercept equipment, any part of a public telecommunications network that manages or stores aggregated customer information or administration authentication credentials, and any place in a network where data aggregates in large volumes being either data in transit or stored data”.
The compliance process
So, what happens after this engagement/notification if the GCSB thinks it would raise a network security risk? Sections 49 to 54 have the process:
- Director of the GCSB notifies the network operator and then again in writing in s49(1)(a) and s49(2)
- Network operator must immediately stop work. s49(1)(b)
- Network operator can propose an alternative. a49(3)
- GCSB considers the network operator’s proposed alternative and possibly accepts it. s50(1) and s50(2)
- Network operator must implement the response. s51
- If the GCSB is not happy with the proposal it may refer the matter to the Minister (the Prime Minister normally has responsibility for the GCSB) to make a direction. s52
- Network operator may choose to make a submission to the Minister. s53(2)(b)
- The Minister must consult with the Minister for Communications & Information technology and the Minister of Trade. s54(3)
- The Minister may direct the network operator to either cease/refrain from an activity or make changes to or remove any system or operation on the network. s54(2)
- If the network operator refuses to comply with an s54 Ministerial direction, this is treated as serious non-compliance. s82(b)
- The GCSB can servce an enforcement notice on the network operator. s85(2)
- The GCSB can apply to the High Court for a court order. s86(1)
- The High Court can make an order (subject to normal apeals). s87
- The High Court can make the network operator pay a fine of up to $500,000 and/or $50,000 per day of continuing non-compliance. s92 and s93
In other words, the Bill may suggest that the GCSB and network operators should cooperate, but the content of the law and the procedure I have just outlined makes it very clear to everyone involved where the power really lies. Indeed, the expectation that network operators will do what they’re told is so clear that we wouldn’t expect any fines to be issued because there won’t be a lot of point fighting any directions from the GCSB.
But it’s only security issues!
Now one might claim as Brad Ward has that “This Ministerial power relates to network security issues.”
However when it comes to network design and operation, everything has an impact on network security. What you buy, what systems they run, who you buy them from, how they get delivered to you, where they’re installed, how they’re configured, who you’ve employed, how well they’re trained, etc, etc, etc – network security is not one attribute but is a product of the system as whole.
Conclusion
We stand by our original statement that the TICS Bill as written will give the GCSB sweeping powers of oversight and control over New Zealand telecommunications networks.
One final point of interest is – why is a government bureaucrat trying to deny this is the case? Does the Bill as written not reflect the intention of the people who wrote it, or is this a case of the government trying to pull the wool over people’s eyes?