Adams AmyHon AMY ADAMS (Minister of Justice): It is my pleasure to take a call in this first reading on the intelligence and security legislation and I particularly want to begin by endorsing the comments made by the Attorney-General in his opening remarks. I too want to acknowledge—and put it on the record—and thank Sir Michael Cullen and Dame Patsy Reddy for what I think was an excellent piece of work and a very well-considered well-balanced piece of work. I think the fact that we are beginning this debate in this House with a broad level of political support really does reflect the quality of that report and I do think it is important for legislation as important as this that we seek to achieve consensus wherever possible and that New Zealand feels that it has a good chance to test through these issues.These issues are important. I know there are some in New Zealand who would like to believe that we can live in a world where legislation like this is not necessary but actually the vast majority of New Zealanders understand and accept that this is a very real part of keeping our people and our country safe. But equally importantly and perhaps even more importantly because of that we have to have legislation that is very clear—there is no room for ambiguity or uncertainty as to how provisions apply. There needs to be absolute certainty around the scope of the powers the authority that they convey and the oversight of them and this legislation in my mind undoubtedly puts us on a better footing than we have previously been on as we have already had acknowledged by the Privacy Commissioner as just one commentator. The part I want to focus on in my contribution is not the issue of surveillance which is the one that obviously takes up a lot of the public interest but actually on the critically important function of the Government Communications Security Bureau (GCSB) around cyber-security. I think that in all of the talk around these agencies this role really does get overlooked and I think it is important that we reflect on it. As a Minister who has a very active role in policy around cyber-security I think it is appropriate that I talk to it. Just by way of context it is worth putting on the record for the House the incredible size and complexity of the cyber-security issue and the incredible damage resulting from the cybercrime industry. Whether we are talking about State-sponsored cyber-security attacks whether we are talking about hacktivism" whether we are talking about what has actually become a vast army of entire criminal enterprises that provide entry to almost any computer system and that provide made-to-order stealing of information or the duplication of identities this is a sector that I think most New Zealanders do not quite appreciate the size of. Can I tell this House that cybercrime globally is now bigger than the global drugs trade. That is how big this is. We are talking about $600 billion a year in cybercrime and it is growing increasingly quickly. Just by way of context in New Zealand most members of the House I am sure will be aware of the issue of ransomware which is particularly pernicious. It is when cyberactors get in lock up your information and then will not decrypt it without a payment. Just in this year alone between the months of January to March—so just a very small period of time—we went from seeing ransomware being about 33 percent of all of the malware affecting New Zealand to being 93 percent. So the explosion in that area alone is huge. Just one of our telecommunications service providers told me that on average it is blocking 51 dedicated denial-of-service attacks every day—every day. And one of those attacks in particular was 20 percent of the capacity of its entire network. So we are not talking about small isolated attacks. I also have to tell this House how incredibly sophisticated these actors are. You may think "Oh well I'm all right; I've got a password." I was talking with a cyber-security firm here in Wellington just this morning actually. We were talking to some of its penetration-testers who specialise in providing services for businesses to understand where their vulnerabilities are. They were telling me that in all of the years they have been operating across almost every type of business you can imagine—very large very sophisticated businesses in New Zealand—there is not a single business whose network they have not been able to get full access to when they have gone in and penetration-tested it. So if we think this is just people around the edges who have forgotten to password their systems we are absolutely wrong. This is incredibly sophisticated and it needs a very very high calibre of dedicated unbelievably clever people doing it. Most of that expertise resides within the GCSB. One of its great successes in recent times has been the development of Project Cortex which involves a very clever shield effectively around our most important networks and our critical institutions of national importance whether they be core infrastructure core financial or core Government. That has been very very effective in the time it has been running in protecting those organisations against very—as I say—high calibre sophisticated events. The GCSB is also incredibly important in this space because cyber of course is global. We cannot just sit in New Zealand and assume it is all within our own borders. The GCSB's ability to work effectively with our international partners is fundamentally important to our ability to protect New Zealand from cybercrime. This is not imaginary it is not some sci-fi movie; it is happening every day. It is accelerating at rates you would not believe and we have got to be in front of it. We cannot say: "Well we're at the bottom of the world; they're not going to target us." They can they do and it is the GCSB that is really very much at the forefront of understanding and responding to those very sophisticated attacks. This bill is an important part of maintaining the GCSB's ability to carry out those cyberfunctions. It is not the only thing we are doing of course. We have a wide-ranging cyber-security strategy which I released with the Prime Minister recently that goes through a number of initiatives including standing up New Zealand's first Computer Emergency Response Team which the GCSB will be a part of. But just as it is important in the roles of national security and surveillance protection against terrorism and all of the things the public more commonly associates with our intelligence agencies we have to have clear transparent rules of operation for the GCSB in relation to cyber-security. I want to just touch on a couple of the aspects of the bill that are relevant in this regard. The existing scope of the GCSB's information assurance and cyber-security function is now going to be incorporated within the broader umbrella function of protective security as the independent reviewers proposed. This also of course covers some of the SIS's functions such as security clearance vetting. In clause 15 of the bill we still though set out the detail of that information assurance and cyber-security function and preserve the existing scope. Consistent with the clear decision of the Government as outlined by the Attorney-General that we must maintain clear delineation between the agencies the bill makes it very clear that only the GCSB is mandated to provide that cyber-security service as part of the protective security function. The bill goes on to explicitly recognise that the GCSB can provide these cyber-security and assurance functions with the consent of affected entities as it does with Project Cortex. But it also makes clear and I think this is important to get on record that any information that the GCSB obtains in the course of carrying out its protective security functions—and its cyber-security functions in particular—if it needs to use that information for any other purpose it would have to go back and get a warrant. This is not another way of getting information. Cyber-security information is collected and used for cyber-security purposes only. It cannot be used for other functions and if needed would have to be sought under a warrant in the normal way along the lines the Attorney-General set out. The GCSB is limited to the powers available to it in any warrant where that is required. It makes it clear in the bill that the GCSB retains its existing powers to access information infrastructure as required and overall I think we can be confident that the bill ensures that the GCSB will be able to continue to provide those very effective very necessary information assurance and cyberservices. As I said when you are looking at an area like cyber-security we cannot be left behind we cannot for one moment have a regime that does not permit our agencies to continue to develop work collaboratively internationally and respond and keep pace with this pernicious growing highly talented highly lucrative area of crime. I am confident that the bill will absolutely enhance and protect the ability of our agencies to keep New Zealand safe from cyber-security. I too look forward to the debate at select committee. I think the bill is in very good shape as I say thanks to the excellent work of the reviewers initially and then the collaborative work that has been led by the Attorney-General to get it to this point. I look forward to its report back."