Finlayson Christopher: Government Communications Security Bureau and Related Legislation Amendment Bill — Referral to Government Administration Committee In CommitteeText is incorporated into the Bound VolumeFinlayson Christopher: Government Communications Security Bureau and Related Legislation Amendment Bill — Referral to Government Administration Committee In Committee[Sitting date: 06 August 2013. Volume:692;Page:12347. Text is incorporated into the Bound Volume.]Hon CHRISTOPHER FINLAYSON (Attorney-General):Part 1 of the Government Communications Security Bureau and Related Legislation Amendment Bill deals with amendments to the Government Communications Security Bureau Act 2003. I thought it would be helpful if I outlined to the Committee 12 key aspects of the changes that are set out in the bill. The purpose of these changes is to provide a clearly formulated and consistent statutory framework to create a greater oversight regime and to update the Act to respond to the changing security environment.As I say there are 12 key aspects. The first deals with definitions and interpretation. If one looks at section 4 of the 2003 Act one sees that it contains definitions of various terms that are now outdated and require replacement amendment or repeal. They include definitions of “computer system” “foreign communications” “foreign intelligence” and “network”. The amendment bill inserts a new definition for “information infrastructure” to replace the definitions of “computer system” and “network” and to take into account the new ways in which communications are carried and stored. The definition is a broad one and it is there to make sure all the ways of communication are indeed captured.The next key aspect I wish to tell the Committee about deals with clause 6. Sections 7 and 8 of the 2003 Act are replaced. The first is the objective of the Government Communications Security Bureau (GCSB). The current objective section is a lengthy statement of what the bureau contributes to in the interests of New Zealand. The bill proposes an objective clause based on the current section but greatly simplified and clearer. So the bureau will contribute to the national security international well-being and so on. Then we have a replacement for section 8 dealing with the functions of the bureau. Section 8 of the 2003 Act sets out three functions: foreign intelligence information assurance and cyber-security and cooperation and assistance to other entities. What has happened here is that this aspect of the functions of the bureau is spelt out a lot more clearly.The bill repeals and replaces section 8 with four new sections sections 8A to 8D. They set out the three functions more clearly and specify the limitations and restrictions that apply to each of those functions so foreign intelligence is covered by section 8B information assurance and cyber-security by section 8A and cooperation and assistance to other entities by section 8C. It is very important to focus on section 8C and the greater restrictions and limitations that are put around this function. The agencies that can be assisted are limited to three named agencies and the bureau is going to be subject to the limitations restrictions and oversight that the requesting agency is subjected to. The Hon Mr Dunne has a Supplementary Order Paper Supplementary Order Paper 308 that is going to tighten up that aspect even more.I then come to the principles of the legislation. In actual fact the 2003 Act does not contain any principles but the bureau as a core public sector department comes under the provisions of the State Sector Act 1988 which means it is subject to thePublic Service Code of Conduct . Section 8CA sets out the principles underpinning the performance of the bureau’s functions. An explicit set of principles is inserted and these are modelled on the principles inserted in the New Zealand Security Intelligence Service Act 1969.Andrew Little: Who’s going to enforce them? How are they going to be enforced? Who will know?Hon CHRISTOPHER FINLAYSON: Those principles include acting in accordance with the law and human rights standards and in a manner that facilitates effective oversight. Another important point I say to Mr Little is that there is a requirement in section 8CA that the director must regularly consult the Leader of the Opposition.Then we have provisions relating to the appointment of a director. The current Act provides that the director is appointed by the Governor-General on the recommendation of the Prime Minister. Cabinet decided in 2010 to involve the State Services Commissioner in managing the appointment process. This was done through theCabinet Manual  pending an opportunity for the review of the legislation and so the bill incorporates theCabinet Manual process into statute making the management of the appointment more transparent. The same process provisions are going to be inserted into the New Zealand Security Intelligence Service Act.The next clause clause 12 is a critical clause dealing with section 14. The bureau is not to target New Zealanders’ private communications. The current section 14 was intended to codify the basic premise underpinning the bureau’s operations. However the way the basic premise was incorporated into the Act meant that it applied not only to the foreign intelligence function but also to its two other functions—unfortunately some sloppy drafting there. So the bill retains the fundamental premise but section 14 is amended to make it clear that it does not apply to cyber-security or to cooperation and assistance. Where New Zealanders’ communications are to be intercepted then additional safeguards have been put in place.The next aspect concernswarrantless powers. The current Act provides for the interception of communications without a warrant in certain limited circumstances. Thosewarrantless powers are retained but are further restricted. The bill makes it clear that thewarrantless powers cannot be used if a New Zealander is involved. The next provision I want to talk about concerns warrants and authorisations. I refer the Committee to the existing sections 17 and 18. The bill repeals those provisions and replaces them with clearer and more consistent provisions set out in a better order and I refer honourable members to sections 15A to 15F in clause 14. Significant new limitations are added in particular a requirement that any warrants involving New Zealanders must be issued jointly by the Minister and the Commissioner of Security Warrants and more important that privileged communications—legal medical and religious—as set out in the Evidence Act 2006 cannot be targeted.Under the existing legislation there is no requirement for record keeping but under the proposed legislation the information must be recorded for every warrant and be put in a statutory register available at any time for the Inspector-General of Intelligence and Security and the Minister to review. Mr Dunne’s Supplementary Order Paper will provide some further information in that regard.Very important under the existing legislation on the subject of immunities there is an immunity provision but its effect is uncertain and unclear. The new legislation tightens this up and there is an immunity provision that basically is modelled on theSearch and Surveillance Act 2012. That immunity provision is not absolute. A bureau employee will still be subject to legal proceedings if he or she acts in bad faith unreasonably or outside their powers.I have two final points. One concerns incidentally obtained intelligence. The current Act allows intelligence about New Zealanders that is incidentally obtained during foreign intelligence operations to be communicated to other people if it relates to serious crime. Section 25 of the Act is replaced to make it clearer when and with whom such intelligence can be shared. The intelligence can be communicated only to public authorities.And finally there is the issue of protection of personal information. The bureau is currently exempt from principles 1 5 8 and 9 of the Privacy Act 1993. In 2011 the Law Commission recommended that those principles should apply and so the bill addresses that issue. The director will be required in consultation with the Privacy Commissioner and the Inspector-General of Intelligence and Security to formulate a policy on the protection and disclosure of personal information that complies with those principles. So they are the 12 key aspects and I think it would be very helpful if we could address those.