Collins Judith: Government Communications Security Bureau and Related Legislation Amendment Bill — First ReadingText is incorporated into the Bound VolumeCollins Judith: Government Communications Security Bureau and Related Legislation Amendment Bill — First Reading[Sitting date: 08 May 2013. Volume:689;Page:9657. Text is incorporated into the Bound Volume.]Hon JUDITH COLLINS (Minister of Justice)on behalf of theMinister responsible for the GCSB: I moveThat the Government Communications SecurityBureau and Related Legislation Amendment Bill be now read a first time. At the appropriate time I intend to move that the Government Communications Security Bureau and Related Legislation Amendment Bill be reported to the House by 26 July 2013 and that the committee have authority to meet at any time while the House is sitting except during oral questions during any evening on a day on which there has been a sitting of the House and on a Friday in a week in which there has been a sitting of the House despite Standing Orders 188 and 191(1)(b) and (c).This omnibus bill focuses on New Zealand’s intelligence community which has a vital role to play in our national security. The bill makes amendments to three separate Acts and it has three main objectives: first to provide a clear and consistent legal framework for the Government Communications Security Bureau to operate within; second to update the bureau’s legal framework in response to the rapidly changing security environment particularly in relation to cyber-security and information security; and third to strengthen the oversight regime that applies to our intelligence agencies.The recent compliance review of the Government Communications Security Bureau has highlighted that there are difficulties of interpretation in the existing Government Communications Security Bureau Act 2003. The 2003 Act sought to codify and make transparent existing practices of the then Government Communications Security Bureau but under scrutiny the 10-year-old Act potentially limits the bureau’s ability to provide the support and advice that successive Governments expected possibly limits current support and advice that can be provided and most certainly will restrict the bureau’s ability to look after New Zealand and protect New Zealanders. For an organisation with intrusive powers like the Government Communications Security Bureau an unclear legal framework is simply not good enough. Therefore the responsible thing for this Parliament to do is to move to clarify that Act. This bill does that. This bill will make the Government Communications Security Bureau Act clearer and more transparent so that it is clear what the agency can and cannot do. In addition to that the bill also strengthens the oversight regime of our intelligence agencies by making amendments to the Inspector-General of Intelligence and Security Act 1996 and the Intelligence and Security Committee Act 1996.The Government Communications Security Bureau is arguably more important in New Zealand now than it has been for many years. As the key agency responsible for advising on and protecting against threats to New Zealand’s cyber-security the Government Communications Security Bureau is at the forefront of tackling a rapidly increasing threat. The bureau has three core functions: first information assurance and cyber-security; second foreign intelligence; and third cooperation and assistance to other entities. Two of the Government Communications Security Bureau’s three core functions—specifically information assurance and cyber-security and cooperation and assistance to other entities—are currently compressed into only a single paragraph in the Act. This makes it both complex to negotiate and inadequate to empower the bureau to carry out the full range and scope of activities envisaged in these functions. Splitting the two functions apart in the legislation will allow us to more easily articulate what the Government expects the Government Communications Security Bureau to do and will provide greater transparency. It is important because New Zealand is no longer as distant from security problems as it has been in the past.The particular role of assisting with information security is clearly indicated in the Government Communications Security Bureau Act but the current wording could be interpreted to mean helping only the public sector potentially excluding critical infrastructure operators and organisations of national significance. We want to be able to use the Government’s significant investment in technology and expertise in this field for the benefit of the wider State sector critical infrastructure operators and other keyeconomic contributors. A safeguard is built into the bill in this area. It requires the Government Communications Security Bureau to get a warrant from the responsible Minister and the Commissioner of Security Warrants when it is performing this function in relation to the communications of New Zealanders.I will now speak briefly about the bureau’s foreign intelligence function. This function is currently defined in the Government Communications Security Bureau Act in a highly prescriptive way describing the overall function that the function involves and how it is to be achieved. The Act specifies such activities as deciphering decoding translating examining and analysing communications. When the House considers how technology has changed the way we communicate over the past 10 years and in light of future changes that can already be anticipated these specific descriptions are extremely limiting. They are also likely to mean that the Government Communications Security Bureau’s abilities to protect New Zealand and New Zealanders are left behind by technology. We are therefore proposing to describe the bureau’s foreign intelligence function at a higher level than the current prescriptive legislation.I would like to move now to talk about the third function of the Government Communications Security Bureau which is cooperation and assistance to other entities. A particular issue has arisen around the bureau’s role in supplying crucial support to other entities including the New Zealand Defence Force the New Zealand Security Intelligence Service and the New Zealand Police. It has been a longstanding practice of the Government Communications Security Bureau including under successive Labour-led and National-led Governments to provide assistance to other entities. However as I stated earlier there are difficulties of legal interpretation in the existing Government Communications Security Bureau Act including in relation to this assistance. The Government has decided that there is too much uncertainty to continue this very important activity under the existing law. The vast bulk of this type of activity remains on hold until legislation is passed by this Parliament to provide greater clarity about whether the bureau can provide assistance to others. Currently the Act says that assistance may be provided but only on matters relevant to the pursuit of the bureau’s own objective or the safety of a person or the prevention or detection of serious crime. That limits or at least makes uncertain when the bureau is able to share its expertise across the intelligence community and the wider public sector. We want to provide greater clarity and ensure the bureau can help other agencies fulfil their lawful duties particularly in the areas of security and law enforcement.I would like to move now to speak about the significant changes to the oversight regime supporting the clarifications to the Government Communications Security Bureau Act. The most immediate oversight of activities by our intelligence agencies is internal oversight within an organisation. In respect of the Government Communications Security Bureau two of our proposed law changes to the Act will impact directly on the way it manages itself. First the bureau will be required to maintain written records of all warrants and authorisations in a way that is readily accessible by the Inspector-General of Intelligence and Security. This will support a compliance culture.Second we are creating new obligations for the bureau in respect of the handling of personal information. These obligations will be based on the following principles which are recognised under the Privacy Act: the purpose of collection storage and security accuracy and not keeping information for longer than necessary. Under this bill the principles identified above will be transposed into the Government Communications Security Bureau Act with appropriate modifications to recognise the requirements of national security and the nature of intelligence gathering to serve as the basis of a new policy on personal information. This policy will be signed off by thedirector of the Government Communications Security Bureau in consultation with the Inspector-General of Intelligence and Security and the Privacy Commissioner and compliance will be regularly audited with results communicated to the Privacy Commissioner. The Office of the Privacy Commissioner and the Inspector-General of Intelligence and Security will have overlapping responsibilities in this area which will help give confidence that the bureau is implementing these privacy protections.I would like to discuss external oversight which applies to intelligence agencies as a whole. As one of our most important new measures we are creating the role for the Commissioner of Security Warrants in relation to the Government Communications Security Bureau Act. Whenever the bureau is called upon to intercept the communications of New Zealanders—this could occur either as part of its information cyber-security function or when the bureau discovers a New Zealander acting as an agent of a foreign power as part of its foreign intelligence function which is one of the existing exceptions to the basic premise in section 14. In such circumstances before the bureau can take further action it will first be required to get a warrant issued jointly by the responsible Minister and the commissioner. This is very similar to the role of the commissioner in respect of domestic warrants sought by the New Zealand Security Intelligence Service and is an important safeguard in respect of New Zealanders’ privacy. Of course the commissioner will not play a role when the Government Communications Security Bureau is assisting another entity to perform that other entity’s functions. This is because the other entity will have the authority to undertake that activity. Such authority could take the form of a warrant issued by the courts or an existing statutory authority granted by Parliament or such other source of legal power to carry out the activity. In such cases the bureau will be governed by the restrictions and limitations that apply to the other entity.In broad terms the changes to strengthen the Inspector-General legislation fall into three categories: the first is legislative changes expanding the Inspector-General of Intelligence and Security’s work programme and enhancing reporting responsibilities; secondly increased resourcing of the Office of the Inspector-General of Intelligence and Security; and thirdly legislative change to address the required qualification to broaden the pool of candidates and the appointment process. It is the Government’s intention that the Inspector-General’s office will become a more proactive overseer of the intelligence community that is able to launch its own investigations and is better resourced to do so.In conclusion the changes proposed to the Act do not represent an extension of powers but do clarify that the Government Communications Security Bureau can resume its longstanding practices under successive Governments. The legislation must be clear must be fit for purpose and must allow the Government Communications Security Bureau to get on with the job of protecting the interests of New Zealand and of New Zealanders.The ASSISTANT SPEAKER (H V Ross Robertson): Before the Minister sits down on the issue of process and good governance it is important for the Minister to indicate to the House to which committee this legislation is to be sent.Hon Trevor Mallard: She did.Hon JUDITH COLLINS: OK I did—I did say it.