Intelligence and Security Bill

Thank you for giving us the opportunity to talk with you about the proposed legislation and what it could mean for our two agencies.

It is my assessment that the proposed legislation will increase the effectiveness of the GCSB and enable us to work more effectively with others.

Just as importantly, I think the proposed legislation will provide greater transparency and clarity for the public about what the GCSB does and how it is held accountable. This is something I really welcome.

The Bill aligns to where the GCSB is heading

The proposals within the Bill are a continuation of changes that have been underway within the Bureau and the wider Intelligence Community in recent years.

The GCSB has had a strong focus on compliance to ensure everything we do is in accordance with the law and New Zealand's human rights obligations, and is properly authorised.

We have established robust compliance processes and a dedicated compliance team to both review what we do and to provide advice and guidance.

Most importantly, we have developed and embedded a strong culture of compliance. As someone new to the organisation, I have been struck by how professional and committed our staff are to doing the right thing. They take their responsibilities incredibly seriously.

You may be aware that the Inspector General last year certified us as having good compliance procedures and systems in place in the Annual Report.

There has also been a dedicated effort recently to build public trust and confidence in the GCSB and the wider Intelligence Community by being more open and transparent.

Because of the secret nature of much of our work there will always be limits to what we can say. However, I have followed previous recent Directors and Rebecca's lead by talking publicly about why our agencies exist, the nature of the threats we as a country face and our role in responding to this. Unfortunately, the age and inconsistency of our legislation is sometimes a hindrance to better public understanding about the agencies.

The Intelligence Community is also focussing on how we can work together more effectively for the benefit of New Zealanders. We are separate agencies with separate capabilities, and currently separate legal frameworks.

However, neither our customers who we provide services to nor the people who wish to do New Zealand harm make distinctions between SIGINT and HUMINT or between internal and external security. We therefore need to work effectively together as a community.

To support this, we have established a joint Leadership Team that sits across the Intelligence Community and governs the projects and work programmes that are important to both agencies. This includes our joint workforce strategy, ensuring we get the benefit of the investment the Government has recently made in us and implementing the legislation once enacted.

Interception of New Zealanders Communications

Let me now turn to Section 14 of the current GCSB Act, which as it stands prohibits the GCSB from intercepting the private communications of New Zealanders. Notwithstanding this prohibition, the current Act also allows the agency to intercept New Zealanders private communications if:

• the person is acting as an Agent of a Foreign Power, or
• the GCSB is supporting the NZSIS, NZDF or NZ Police.

This apparent inconsistency is potentially confusing to the public and impacts on their trust and confidence in the GCSB.

Section 14 also means that the GCSB cannot always assist, or assist in a timely way New Zealanders who are in trouble overseas. For example, we cannot currently target the private communication of a New Zealander who is taken hostage unless we are assisting another agency who has the legal authority to do so.

We may also become aware, through partner reporting, of a New Zealander who is in contact with a terrorist organisation, yet there may not be sufficient information for the SIS to obtain a warrant under its legislation or for the person to be designated an Agent of a Foreign Power. It could take days for these issues to be worked through, which in a potential terrorist situation may be too long.

Under the proposed legislation, as you have heard, the GCSB will be able to target a New Zealander's communications in such circumstances, as long as it is for the purpose of National Security and a Type 1 warrant is obtained from the Attorney-General and a Commissioner of Intelligence Warrants. These are significant checks on the ability of the Bureau to exercise such an intrusive power.

Another significant check included in the proposed legislation relates to the designation of someone as an Agent of a Foreign Power, and therefore able to be targeted by the GCSB. Currently it is me as Director who makes this determination. Under the proposal, this would require a Type 1 warrant which is signed off by the Attorney-General and a Commissioner of Intelligence Warrants. This is the appropriate level for such an important decision to be taken.

Cyber Security by Consent

One of the GCSB's key roles is to provide cyber security and information assurance services. This role continues under the proposed legislation, which is important, given the significant increase we are seeing in advanced and persistent cyber threats.

The Bill allows the GCSB to provide our services on a "by consent" basis. This would apply to the CORTEX range of cyber protection services that we offer to nationally significant organisations in both the public and private sectors.

Any New Zealanders' communications that are accessed for cyber security or information assurance are subject to very stringent checks and controls and the IGIS has a role in monitoring this.

I expect the Committee will hear, but I hope it doesn't, that the GCSB uses its capabilities to undertake mass surveillance of the population. I can assure you that it does not.

But don't just take my word for it. This is also the conclusion of the independent reviewers Sir Michael and Dame Patsy, the Inspector General of Intelligence and Security and the Privacy Commissioner.

Information Sharing with Partners

Finally, I wish to turn to information sharing with partners.

New Zealand is very dependent on our international partners, especially within the Five Eyes, for much of our foreign intelligence. We derive huge benefits from the access and capabilities that our partners have, which we simply can't replicate.

As the independent reviewers pointed out, for each foreign intelligence report the GCSB produces itself, we receive 99 from partners.

It maybe in New Zealand's national interest to share with partners intelligence that we have collected or analysis that we have undertaken. For example, we may have intelligence about terrorist attack planning in another country due to a unique access that we may have. We can also round-out the picture about a potential terrorist or espionage suspect by sharing their name with partners and checking their data bases.

As with the current GCSB Act, the proposed legislation requires Ministerial approval to share intelligence and analysis. In addition, the Minister is required to issue a ministerial policy statement providing guidance about co-operating, providing advice and assistance, and sharing intelligence with overseas public authorities. This policy statement must be provided to the Intelligence and Security Committee. This will ensure greater visibility of our activities or the types of activities and the ability of the Minister to refine or constrain.

GCSB is already required to comply with the law and human rights standards recognised by New Zealand law when performing its functions. The Bill makes it even clearer that these are things the Minister must be satisfied of when authorising the agencies to share intelligence. The Bill also makes us subject to more provisions of the Privacy Act.

I am happy to take questions.