- Posted August 27, 2019
- Media Releases
The following is a submission by Director-General of Security NZSIS, Rebecca Kitteridge and Director-General of GCSB, Andrew Hampton to the Justice Select Committee Inquiry into the 2017 General Election and 2016 Local Elections.
Director-General of Security
Thank you for inviting us back to appear before you.
For those Committee members who were not at our last appearance before this Committee, I am Rebecca Kitteridge, Director-General of Security at the New Zealand Security Intelligence Service.
NZSIS’s role in relation to threats to elections and democratic institutions and processes is fourfold:
- We collect, analyse and assess intelligence about foreign interference activities in New Zealand. Our particular focus here is understanding the activities and motivations of foreign state actors operating in, or seeking to influence, New Zealand institutions, processes and individuals;
- We provide intelligence to decision-makers;
- We provide protective security services, advice and assistance to a wide range of individuals and entities, including Members of Parliament and Ministers; and
- We administer the security clearance system which helps to protect New Zealand’s Government against insider threat risks and espionage.
Director-General of GCSB
I am Andrew Hampton and I am the Director-General of the Government Communications Security Bureau.
GCSB is the Government’s cyber and information security authority. Our roles are also set out in the Intelligence and Security Act. In relation to foreign interference in our Elections, GCSB’s key roles are:
- To provide cyber security and information assurance services and advice to authorised individuals and entities. This includes Members of Parliament, Ministers and other entities involved in the conduct of elections;
- To develop and provide intelligence (primarily foreign intelligence) and cyber assessments on the intentions, activities and capabilities of threat actors, including in relation to the Election; and
- To do everything that is necessary or desirable to protect the security and integrity of communications and information infrastructures of importance to the Government of New Zealand, including identifying and responding to threats or potential threats to those communications and information infrastructures. This would include the Electoral Commission’s core systems.
NZSIS and GCSB are politically neutral public service agencies and this is reinforced in our governing legislation, the Intelligence and Security Act. We have a statutory obligation to brief the Leader of the Opposition on matters relating to our functions. The Act also requires us to act independently, professionally and with integrity at all times.
Our activities are guided by the National Security and Intelligence Priorities, set by Cabinet. Our primary oversight body is the Inspector General of Intelligence and Security although we have specific and additional oversight arrangements in place in respect of our warrants.
Our agencies also work closely together – for example, we are increasingly using our protective security functions to ensure that Members of Parliament, Ministers and political parties have the capability to identify and protect themselves from foreign interference risks. This work is led through our outward-facing security functions (the Protective Security Requirements Team within NZSIS and the National Cyber Security Centre within GCSB).
We are currently carrying out protective security briefings for all caucuses and we are working with the Electoral Commission on a range of security matters in the lead up to the next General Election.
We last appeared before the Committee in April 2019. During that session we provided the Committee information about our roles under the Intelligence and Security Act and the nature of foreign interference threats facing New Zealand’s democracy. We outlined four threat vectors. Those vectors were:
- Cyber-enabled threats to the Election (this encompassed hacking Members of Parliament, candidates and political parties and threats to core electoral systems);
- The use of social and traditional media to spread disinformation;
- Building covert influence and leverage, including through electoral donations; and
- The exertion of pressure or control of diaspora communities.
We also outlined the constraints that we face when speaking publicly about national security matters – these continue to hold for our appearance today.
Foreign influence v foreign interference
We also discussed the difference between foreign interference and influence. GCSB and NZSIS are mindful of the need to ensure that efforts to prevent foreign interference in New Zealand do not hinder democratically protected rights to political expression, or the ability of states to openly engage and negotiate with each other, including on issues where our perspectives may differ.
NZSIS and GCSB therefore use foreign interference only to describe an act by a foreign state, or its proxy, that is intended to influence, disrupt or subvert a New Zealand national interest by covert, deceptive or threatening means.
Interference, so defined, does not include normal diplomatic activities or efforts to garner influence or shape perceptions or policy by open lobbying or persuasion.
Structure of session
With the Chair’s agreement, we would like to split this appearance in two – in much the same way we did last time.
The Committee has asked us four questions. The themes in these questions are:
- Firstly, the threshold for and decision-making about security investigations into New Zealand citizens;
- Secondly, what mechanisms we would recommend the Committee looks at in order to address foreign interference risks.
We would like to answer all four questions in the open session. Our comments will cover the application of the Intelligence and Security Act to the questions the Committee has raised and will address how security investigations work.
We would then like to revisit our comments about one of the threat vectors we discussed in April – the use of relationships and donations to influence and leverage. In that context, we will provide some high level comments that build on our remarks last time about the need for greater transparency.
I should note for the Committee here, that NZSIS is the lead on the majority of the questions you have asked – and so Rebecca will be very much in the lead.
We are happy to take some questions in the open, but suggest that we move to a Parliamentary Secret session after that so that the Committee can ask more detailed questions at a RESTRICTED national security classification.
If the Chair agrees to this approach, we would also seek agreement to publicly release our prepared remarks for the open session, in the same way we did at our last appearance.
Director-General of Security
Thank you.
I’ve been thinking about how best to address the Committee’s questions, and with your indulgence I will answer them in a slightly different order, starting with the third question: What causes intelligence agencies to start an investigation into a New Zealand citizen who may have a foreign interference effect on an election?
To answer this, it may be helpful to step you through how NZSIS’s security investigations work.
Every security investigation starts with a lead. A lead is the initial information that indicates a potential threat to national security. Leads come from a range of sources, including from other NZSIS investigations, from overseas partners, tips from members of the public, or members of various communities speaking to us about their concerns.
Every lead is inquired into, and an assessment is made to determine its credibility as a national security issue. It might be determined to be not credible. It might be referred to another agency, such as the Police. It might become an initial national security investigation, or a full national security investigation.
If a full national security investigation is required, we will conduct that investigation in accordance with the intelligence cycle.
First, any NZSIS investigation must be within the scope of the security and intelligence priorities set by government. The intelligence agencies do not decide our own areas of focus. We investigate matters in accordance with our legislation and the priorities set by government. These priorities include foreign interference and espionage.
Within these areas of work we have individual investigations. Those investigations aim to understand what particular actors are doing and to provide intelligence about those actors to decision-makers (like the leaders of political parties) that can take action to mitigate the threat.
The investigator begins by considering a number of questions, or "intelligence requirements", which in a counter-espionage or foreign interference investigation will likely include making an assessment on intent, capability, the credibility of information, whilst considering the impact or implications this may have on New Zealand’s national security at that time. As more information is collected during an investigation, the investigator will constantly re-assess intent, capability, and the potential impact in relation to New Zealand.
An assessment will be made about the best and most efficient way to collect the intelligence that will answer the intelligence requirements. Intelligence collection can take various forms, including physical surveillance by specially trained staff, seeking information from human sources, engaging with communities, collecting publicly available information from the internet, receiving or requesting information from partners (including New Zealand agencies and foreign intelligence agencies). If necessary and proportionate, more intrusive intelligence collection may be carried out under an intelligence warrant. We use the least intrusive investigative method possible in relation to the threat we are investigating.
If the only way to collect important intelligence means undertaking activity that would be unlawful (such as telecommunications interception or technical surveillance) we will first seek a warrant. The bar is set high; we do not seek warrants lightly. The warrant application must satisfy the legal tests set out in our legislation, and show that the action we seek to take is both necessary and proportionate. All warrants are issued by the Minister Responsible for NZSIS, and dependent on the type of warrant may have to be jointly issued by a Commissioner of Intelligence Warrants (a former High Court Judge). After they are issued, warrants are reviewed retrospectively by the Inspector-General of Intelligence and Security.
As the intelligence is collected, it is compiled to create as accurate and comprehensive a picture of the threat as possible. This part of the intelligence cycle involves integrating, evaluating and analysing strands of available information, and distilling them down to the key issues and risks. This process can be very challenging, because usually our targets are actively keeping their activities secret. Through this process we often find that more information is required, in which case the investigator will develop further intelligence requirements for collection. At various points we will take the distilled information and write it up into an intelligence report.
Our intelligence reports are rigorously reviewed, classified and given to those who have a need to know. If the intelligence relates to state-sponsored economic espionage, the intelligence might be reported to MBIE and MFAT. If the intelligence relates to a domestic terrorism threat, on the other hand, we talk to Police.
Sometimes the agencies that receive our intelligence reporting come back with more questions. These questions may require further intelligence collection, so it is very much a cycle of intelligence collection, analysis, and reporting.
What I have described to you is the basic intelligence cycle, which is aimed at ensuring that we can detect national security threats and work with enforcement agencies and decision makers to disrupt them.
For completeness, I should add that as well as investigating "known knowns" in accordance with the intelligence cycle, we also work to understand "known unknowns." This work involves proactively assessing and understanding any areas of threat that may be trending internationally or emerging domestically.
You have also asked: What happens if the intelligence agencies obtain, hold, or become aware of security intelligence regarding candidates or elected representatives?
The Intelligence and Security Act does not include any special provisions regarding the monitoring or collecting of information about MPs or candidates. However, the ISA does place a specific duty on the Directors- General of the intelligence agencies to take all relevant steps to ensure that the activities of the agencies are politically neutral. There are good reasons to be cautious about our agencies being involved in democratic institutions and processes, such as the need for MPs and candidates to freely conduct their affairs and the separation of Parliament from the Executive, and the protection of parliamentary privilege.
In cases involving sitting Members of Parliament, NZSIS’s activities would be subject to carefully prescribed consultation with the Speaker of the House. The arrangements for this consultation are set out in the memorandum of understanding between NZSIS, the Minister Responsible for the NZSIS and Speaker. This MOU is available on the Parliament website and was last updated in June.
The MOU recognises that investigating MPs, or undertaking activity within the Parliamentary Precinct will be rare, and generally precluded unless there is strong justification.
The MOU is based on the principles of respect for parliamentary privilege, enabling NZSIS to meet its statutory objectives effectively and efficiently, and the integrity and professionalism of NZSIS.
Activities that fall under the MOU are, like all activities NZSIS undertakes, subject to review by the Inspector-General of Intelligence and Security. In the rare event that GCSB undertakes activities involving a New Zealand MP, it would comply with the NZSIS protocol as well.
Candidates are not covered by the MOU. Our functions, however, include providing intelligence and analysis to any person authorised by the Minister to receive that information (section 10 of the ISA) and providing protective security advice and assistance to any public authority or person authorised by the Minister (section 11 of the ISA). These activities could include providing protective security advice about a political candidate, if the recipient was authorised to receive the information and the NZSIS was doing so in accordance with the statutory principle of contributing to national security.
We can also offer protective security briefings to candidates and members of Parliament who may face an increased risk of being targeted by a foreign power – perhaps because they have strong links to that country.
Finally, it is important to note that our Act has an in-built requirement that NZSIS and GCSB must act in a politically neutral way. The Act also requires that we brief the Leader of the Opposition on matters relating to our functions.
When working in this area, acting in a politically neutral way could mean, for example, that we might anonymise particular information that relates to another political party.
It should be noted that the Minister Responsible for the NZSIS and GCSB sees all warrants as well as being briefed on national security mattes across the board, and so is the only decision maker with access to the full range of information NZSIS and GCBS holds about foreign interference matters.
Tracking “those seeking to engage in foreign interference rather than the candidates or elected representatives”
The Committee notes in its letter to us that it considers “the intelligence agencies should track and monitor those that seek to engage in foreign interference, rather than the candidates or elected representatives.”
I just want to make it crystal clear that NZSIS does not investigate people because they are members of Parliament or candidates. We investigate people because they are, or intelligence indicates that they may be, engaging in foreign interference or espionage.
As I have mentioned, NZSIS has a statutory function to collect intelligence in line with the Government’s national security priorities, including foreign interference and espionage. We have a duty to go where the intelligence leads us. Investigating a candidate or an MP would be very rare, and such an investigation would only be initiated if it were necessary, lawful, proportionate, undertaken in accordance with the Memorandum of Understanding with the Speaker, and subject to oversight by the Inspector-General of Intelligence and Security. Frankly, it is not territory where NZSIS wishes to be, because of the highly political context. Having said that, a member of Parliament or candidate acting at the behest of a foreign state rather than in New Zealand’s best interests would be of very serious national security concern.
So I assume that the Committee is not suggesting that members of Parliament or candidates should be exempted from lawful investigation under the Intelligence and Security Act. It would not, in our view, be in New Zealand’s best interests to prevent our agencies from investigating in this area when necessary.
Having said that, I think it is important to emphasise that NZSIS’s preference is to keep political parties, candidates and MPs safe from foreign interference. Our goal is to work with political parties so that they are aware of the way in which they may be targeted – whether through cyber attacks, or other kinds of interference – and can protect themselves. As Andrew and I mentioned at our last engagement, both GCSB and NZSIS can offer support and protective security advice to political parties. Ideally that would mean that the Memorandum of Understanding with the Speaker never needs to be activated.
We are happy to come back to this point during the closed session.
Mechanisms to address foreign interference – what do the agencies recommend?
Finally, I would like to turn the Committee’s fourth question about the kind of mechanisms the Committee should be looking at to address the behaviour of foreign state actors in New Zealand.
Before I do, I will briefly revisit the evidence we provided last time on the use of relationships and donations to influence and leverage.
Using relationships and donations to influence and leverage
NZSIS and GCSB’s starting point in this area is that relationship building is a normal, legitimate and expected part of the way other states operate in New Zealand. NZSIS is only concerned where an aspect of the relationship indicates or actually constitutes foreign interference.
Similarly, political donations are a legally sanctioned form of participation in New Zealand politics. However, we become concerned when some aspect of the donation is obscured or is channelled in a way that prevents scrutiny of the foreign origin of a donation.
One of the main reasons we become concerned about these activities is because as relationships of influence and / or a sense of reciprocity are established, they may be used as leverage to facilitate future interference or espionage activity.
We have seen relationship building and donation activity by state actors and their proxies that concerns us. This activity spans the political spectrum and occurs at a central and local government level.
This is an extremely sensitive issue and we are unable to provide specific examples of interference at an unclassified level. We have briefed this Committee at a RESTRICTED level, and have provided classified briefings to successive administrations and Leaders of the Opposition.
We mentioned last time that motivated state actors are adept at finding weaknesses or “grey areas” to help them to covertly build and project influence.
We also mentioned that total transparency of the regulatory regimes governing our elections and democracy is the best counter to this.
We are not policy agencies, but we can try to frame our comments around risk and risk mitigation.
Transparency is not just about banning foreign donations. From the intelligence we have, we know that a foreign donation ban, would not, on its own, be an effective way of mitigating the risks New Zealand candidates and MPs face. You can see how a foreign actor could easily use a New Zealand based proxy to work around such a ban – we know that foreign states are adept at understanding and working around regulatory regimes.
More stringent disclosure requirements across a wider monetary range of donations would improve our ability to trace donations. This would assist our investigative work. We acknowledge this is not a straightforward area and that the Ministry of Justice is better placed to advise on these matters. We know that it is not sensible for people buying raffle tickets or a cake from a party fundraising stall to have to make a declaration they are a political donor. We note though, that other countries have navigated this issue – we understand the Committee has been provided advice on international approaches.
Conclusion
We are happy to take your questions about our statutory framework in this open session but would suggest we move to a closed session if the Committee has follow up questions that involve more sensitive questions, for instance questions about particular activities or states.
Thank you.