Adams Amy: Telecommunications (Interception Capability and Security) Bill — Referral to Law and Order Committee Second ReadingText is incorporated into the Bound VolumeAdams Amy: Telecommunications (Interception Capability and Security) Bill — Referral to Law and Order Committee Second Reading[Sitting date: 15 October 2013. Volume:694;Page:13842. Text is incorporated into the Bound Volume.]Hon AMY ADAMS (Minister for Communications and Information Technology): I moveThat the Telecommunications (Interception Capability and Security) Bill be now read a second time. The bill was referred to the Law and Order Committee in May 2013 and I would like to thank the committee for its consideration of the bill. I also want to acknowledge the many useful public submissions that have resulted in changes to the bill.The bill contains two key parts. Part 2 of the bill amends and replaces existing obligations on telecommunications companies in the Telecommunications (Interception Capability) Act of 2004 to ensure that obligations are targeted future proof and flexible. Part 3 of the bill introduces a new network security framework to ensure that network operators work with the Government Communications Security Bureau (GCSB) to identify and address security risks in the design build and operation of public telecommunications networks at the point that decisions are being made. This builds on and formalises the approach taken today. These parts are reinforced by a robust compliance and enforcement framework.Looking firstly at interception capability submitters said that there were some ambiguities in the bill as introduced and in response definitions have been clarified such as the definition of “service provider”. This will put beyond doubt that the provisions of this bill apply to all service providers that make their telecommunication services available in New Zealand. There has been a change to clarify the position on decryption in relation to the duty to assist. Once more this puts beyond doubt that network operators or service providers may be required to decrypt a communication only if they themselves have provided the encryption. The select committee heard from industry that it needed time to participate in decision-making processes and also to implement its obligations so amendments have been made to ensure that companies will have a reasonable amount of time in which to make submissions to a Minister and reasonable time frames to comply with any directions or new obligations.Looking at network security the select committee has made two key additions to the network security requirements to provide greater certainty to industry about how network security risks will be identified and how the framework will work in practice.The first is that the bill sets out a clear decision-making process that the Director of the GCSB and the Minister responsible for the GCSB will follow in finding a network security risk. The second is that the bill now provides that the GCSB can issue guidelines that will assist the industry in complying with its requirements. These amendments respond to requests from the industry for greater specificity and certainty. The industry also sought that the framework be better targeted. The select committee has made a number of changes to achieve this. It has narrowed the scope of the requirement for network operators to engage so that it is clearly focused on future risks while also ensuring that the director can exempt network operators from discussing matters that will not raise network security risks.Amendments have also been made to give greater clarity to network operators about the areas of the networks that they must report on when they are proposing changes or making procurement decisions. In addition the bill now provides that the director can identify only network security risks that are more than minimal. This responds to concerns from industry that minor issues could have been raised with it.To ensure that the GCSB acts in a timely way and does not unduly interfere with network operators’ commercial operations the select committee has included a new statutory principle for network security that requires the director to make any decision or take any required steps as soon as practicable. Together these amendments will provide greater clarity and certainty to network operators about network security requirements.In respect of the compliance and enforcement provisions the bill as introduced provided for the protection of classified security information and court proceedings and that a special advocate be available to assist non-Crown parties in court by accessing classified information on their behalf. Submitters said that the special advocate provisions could be strengthened giving more safeguards to non-Crown parties. The select committee has responded to this by making amendments to allow a special advocate to make oral and written submissions to the court and to cross-examine witnesses allowing the non-Crown party to propose a person to be the special advocate and by making it clear that the relevant surveillance agency is to pay the cost of that special advocate. These changes will provide additional protections to network operators and service providers in court proceedings.I will shortly be asking the House to consider a Supplementary Order Paper during the Committee of the whole House stage that will also make a number of additional amendments. Firstly that Supplementary Order Paper proposes removing the ministerial direction power in relation to overseas telecommunication services resold in New Zealand as this could create a competitive disparity if applied and we agree is better addressed through the enforcement framework. Secondly the Supplementary Order Paper introduces a review by the Commissioner of Security Warrants of the material that has informed the opinion of the Director of the GCSB that there is a significant network security risk. This will be a mandatory step in the process if the director is considering referring the matter to the Minister responsible. If a direction is sought the Minister must consider the report from the commissioner.The Supplementary Order Paper will also strengthen and clarify the matters that the Minister responsible for the GCSB must take into account before issuing any direction on network security. This will require a thorough weighing of costs and benefits. The Supplementary Order Paper also contains other minor amendments such as narrowing the kinds of changes that a network operator must not notify to the Government.This bill is about reducing obligations on some network operators to pre-invest in interception capability. It allows more flexible and faster processes for exemptions and provides a structured process for changing obligations where there is an operationalneed. These changes are important so that our legislation can keep pace with the changing telecommunications industry and remain fit for purpose. The network security framework formalises and builds on the existing partnership approach taken between Government and some network operators. It allows the sharing of information and collaboration between Government and industry to help ensure that the public telecommunications networks are secure and remain secure. The shared compliance and enforcement framework underpinning the bill gives surveillance agencies an ability to deal with minor and serious non-compliance in more appropriate ways.Finally can I respond to some of the incorrect claims that have been put forward by some groups which do not reflect an accurate understanding of what the bill does and does not do. There have been incorrect claims that this bill will create back doors in our public telecommunications networks. This is simply incorrect. Encryption requirements do not have the effect of weakening encryption or creating security vulnerabilities. The requirements in this regard are consistent with the position in the current Act. The bill also does not require a network operator to provide open access to their networks to surveillance agencies. The bill also maintains requirements on network operators and service providers to protect the privacy of communications not affected by the warrant.The bill does not provide for the GCSB to force a company to fundamentally undermine the security of their services as some have claimed. The only role of the GCSB in relation to network security is to identify risk and to advise the network operator. It is up to the network operator solely to take any action. It is only where the GCSB believes that there is a significant risk to national security that it can advise the Minister to issue a direction. This is an option of last resort for our most serious security concerns. Again I would like to reassure the public that this bill does not change in any way the authority of agencies to intercept telecommunications. It does not change existing privacy protections and it does not require data to be stored or require any stored data to be disclosed. The bill relates only to real-time interception under warrant. This bill gives greater clarity and certainty to industry about their obligations and will ensure that our law enforcement and security agencies have the appropriate support from industry to keep New Zealand and New Zealanders safe. I commend the bill to the House.