The Search and Surveillance Bill currently under consideration by Parliament is an attempt to create a unified law for all government agencies. These powers are currently defined, differently, in over 70 different acts ranging from the Crimes Act to the Meat Board Act.

The stated intention of the bill is to “reform the law to provide a coherent, consistent and certain approach in balancing the complementary values of law enforcement and human rights” while “[providing] for the appropriate legislative powers to enable law enforcement and regulatory agencies to extract electronic information and use surveillance devices in order to investigate and combat criminal activity”.

The bill is largely based on the Law Commission’s report, Search and Surveillance Powers. The search and surveillance powers of the Security Intelligence Service are not included in the bill.

Major parts of the bill are:

• Defining police powers of search with and without search warrants
• Examination and monitoring orders
• Surveillance warrants
• Production orders
• Procedures around obtaining warrants
• Procedures around executing warrants
• Procedures around seized materials
• Reporting on warrants issued and executed

Current Status

The bill passed the first reading in Parliament on August 4th 2009 and was sent to the Justice Select Committee for public submissions. Submissions closed on Friday, 18th September, 2009. The committee was due to report back to Parliament in February but due to the concerns raised has extended this until May 2010.

Reactions to the Bill

Taken on face value, the Search and Surveillance Bill looks to be a good attempt at clarifying the laws around search and surveillance, making them more consistent and better administered. However, the bill has ended up significantly expanding the scope of the current powers as well as adding new provisions and this has generated significant opposition:

The Human Rights Commission has accused the bill of neglecting human rights and going too far in giving power to the state. They particularly criticised the ability for the Attorney-General to authorise anyone to issue search warrants (currently only judges, court registrars and JPs may do so), as well as the extension of the search and surveillance powers to government agencies beyond the Police and SIS.

The Privacy Commissioner has also reported on the bill. Criticisms included the lack of provision for notifying someone that they had been under surveillance after it was over, concern that computer searches are not well specified enough and could turn into trawling expeditions, and the way that the use of production and monitoring searches is expanded from very specific cases to possibly being used for any offence for which a search warrant can be obtained.

Law firm Chapman Tripp made a submission. They raised a number of concerns and particularly questioned the way that the bill takes individual powers given to individual regulatory bodies and aggregates them to give all of the powers to all of the bodies. They also questioned the establishment of residual warrants that have no limits on the type of investigative techniques that can be used.

And finally the New Zealand Council of Civil Liberties also questions a number of provisions in the new bill:

No strong case has been made, either in the Law Commission report or in the subsequent discussion, for the increase in the powers of the State to search cars and houses without warrant, to seize personal property, to flout laws relating to privilege, to use a range of surveillance measures with little accountability, and to charge people who fail to cooperate. The argument for increasing such powers has been made in the context of creating consistency between agencies, not based around clear evidence of need.

The Bill and Tech Liberty

While there are obviously a number of issues with general civil liberties in the bill, what impact will it have on the areas that concern Tech Liberty?

Searching Computers

The bill allows for a copy to be taken of all information stored on a computer system, at which point the copy can be taken away and analysed at the searcher’s leisure. We note that there is a trend for people to store more and more of their personal information digitally, and this provision means that many search warrants will result in receiving far more personal information than intended. For example, the people executing a search warrant looking for particular paperwork wouldn’t take your personal photo album, but when these are both stored on the same computer they will be swept up together.

Even worse, many people share computers, so not only will the subject of the search have their privacy invaded, so will any other users of that system.  While any search must breach privacy to a certain extent this seems like a disproportionate invasion.

The Privacy Commissioner notes that this risk could be mitigated somewhat by tying the search parameters to the purpose for the search warrant, with the warrant describing what information is to be seized (e.g. “financial transactions”). We agree that this would be a valuable addition to the bill to prevent overreach.

Remote Access to Computers

Section 101(4) k allows for “the remote access and search of things such as Internet data storage facilities that are not situated at a physical location that can be searched”. The warrant must specify the access information (we think this refers to information such as the Internet address) for the things to be searched.

This has been taken to allow for the investigators to access data at other sites (owned by the people being searched) as well as accessing data on any other systems or services used by the person, e.g. Google Mail.

Enforced Assistance

Related to this provision is the ability to force people to give access to computer systems they own or control. The penalty for failing to comply is up to three months in prison.

Security is an ongoing problem for computer systems and one of the ways used to prevent security breaches is to use strong encryption, encoding the data so that only the person with the right digital key can access it. In many cases the systems are specifically designed so that the people who control the systems can not read the information stored by the people who use the system, as that would make it too easy for others to also access it.

How will the courts determine the truth when someone says that they don’t have the key? Will they believe the system administrator who says that they have no way to read their user’s files? Will the courts be prepared to jail someone who might be incapable of doing what they are ordered to do?

The common law in New Zealand has long upheld the principles, taken from English law, that people have a right to silence and to avoid self incrimination. These are important parts of our civil freedoms and our right to a fair trial. We should not so easily remove them.

Monitoring Orders

A monitoring order allows an agency to apply to a telecommunications provider for all call-related information concerning the subject of the order. This includes data about phone calls, SMS messages, emails, instant messaging and other forms of electronic activity, as well as the content of these communications. As this order can be made again and again, it effectively amounts to ongoing surveillance.

Privacy of communication is an important part of free speech and thus democracy. People need to be able to communicate ideas without having to fear that everything they say is being intercepted by the government. The problem is compounded when you realise that any interception breaches the privacy of two people – the person being monitored and the person they’re talking to.

Tech Liberty supports the use of monitoring orders for the investigation of serious crimes, when approved by a judge and with suitable systems in place to ensure they are not abused. Such orders should be limited to only capture the relevant information. Monitoring orders as defined in the current Search and Surveillance Bill are available for all crimes, approvable by anyone to a large range of government agencies, and without suitable limits on the data to be captured.

Residual warrants

The bill includes the idea of a residual warrant. This is a catch-all warrant that allows an investigator to apply for a warrant using any search method that they choose (one may ask why one would bother defining any other form of warrants if the residual warrant is available). As Chapman Tripp describes it, “There is no limit to the kinds of investigative techniques that could be deployed under cover of a residual warrant.”

For example, a residual warrant could be used to authorise the covert installation of root-kits or monitoring software on computer systems. This could then lead to problems with other people accessing the systems, corruption of evidence, and/or disruption of the work performed computer system.

The clauses relating to residual warrants are too broad and give government agencies too much scope. At Tech Liberty we oppose the idea of residual warrants and recommend that they are removed from the bill. If there is a need to periodically approve new surveillance methods and techniques it may be necessary to include provisions to allow that in a reworked bill.

Conclusion

The Search and Surveillance Bill is offensive to civil liberties in general and to technical civil liberties in particular. While some of the bill’s provisions are already in law, the general tendency of the bill is to extend them and make them uniform across government agencies and regulatory bodies. There is no real argument in favour of this, no justification for the extension of powers, other than that it will make them consistent.

The power to search, to seize and to surveil are highly intrusive – they invade people’s privacy, cause significant disruption in their lives, and are done on suspicion rather than on established fact. Even if we optimistically assume that government agencies wouldn’t deliberately abuse the powers, we also have to acknowledge that incompetence and vindictiveness are problems that no human organisation can ever eliminate. Any extension of powers should be carefully considered and balanced against people’s freedoms to go about their lives without government interference.

We support the principles that led to the Search and Surveillance Bill. We do think that these powers need to be used and administered consistently and it does make sense to implement reform. However, as part of that we should be taking the opportunity to rethink these powers, to do our best to reduce them to the required minimum to reduce the impact on our civil liberties. We believe that the bill needs to be substantially rethought and rewritten from this perspective.