Adams Amy: Telecommunications (Interception Capability and Security) Bill — In CommitteeText is incorporated into the Bound VolumeAdams Amy: Telecommunications (Interception Capability and Security) Bill — In Committee[Sitting date: 16 October 2013. Volume:694;Page:13983. Text is incorporated into the Bound Volume.]Hon AMY ADAMS (Minister for Communications and Information Technology): I thought I would take a call early in Part 3 and run through very clearly what this part of the Telecommunications (Interception Capability and Security) Billintends to do so that everyone has that information in front of them. What I want to do is to start by addressing the question of the member Clare Curran that I said I would address. She raised a question about Telecom seeking exemptions which relates to Part 2 which we have now of course completed but nonetheless she has asked me while we are talking about Part 3. As she will know the restriction on selling resold services was in clause 39 which has been removed so that really answers her question in respect of the right to seek exemptions. If they have other exemptions that they wish to seek from their general capabilities then clearly there is a regime in Part 2 for that. Turning to—Hon Trevor Mallard: Oh uneven treatment.Hon AMY ADAMS: Oh do not be silly Mr Mallard. That reflects what is in the current legislation.So in Part 3 which we are on and we are talking about now what I want to reflect is that this is the part of the bill that is a new regime. I want to be very clear about that. Currently what we have is a loose partnership arrangement where a number of the network operators—not all but some of them—have seen the value in working with the intelligence agencies to identify threats. What I think everyone in this Committee is likely to accept is that the cyber-threat environment is considerably more serious today than it has ever been and that is going to continue very much to be the case. If we do not protect very carefully the security of our telecommunications networks then we not only put at risk the safety and well-being of New Zealanders but we put at risk all of the intellectual property of New Zealand businesses and all of our economic prosperity is potentially at risk.I think everyone recognises—or at least all sensible people recognise—that if you want to be a country that is a good place to invest and do business in then you have to be able to reassure people that your telecommunications infrastructure is secure. I think everyone would agree with that. What we know is that increasingly there are attacks by various players who try to get access to the telecommunications networks in New Zealand and through those networks to gain either commercial ends or some other ends that suit their agendas. This part of the bill is about doing what we need to do in a world of increasing threat to ensure that there are not undisclosed capabilities in our networks to copy or divert or destroy or disrupt data. These are very real threats and I think anybody with even a cursory understanding of the current geopolitical or threat situation understands that the cyber-threats are real they are very serious and they are increasing all the time. That is commonly understood in freely available publications.So what we have at the moment as I said is an informal situation where the better network operators choose to go to the intelligence agencies and work with them to identify and address threats. But unfortunately that process has its failings. It is not transparent it does not apply to everyone not all operators know it even exists and of course there is no power ultimately to enforce it if it does not work. So what the powers in this part of the bill require is for network operators—and let me be very clear that it is only network operators. It is not service providers it is not cloud companies and it is not software providers. It is only network providers that are subject to this part of the bill. They approach the Government Communications Security Bureau (GCSB) if they are dealing with an area of critical infrastructure and we have tightened the definition around where that applies. They identify to the GCSB what their intentions are. If there is a risk identified then the network operators themselves decide how they want to fix it.The GCSB does not tell them what to do. The GCSB does not do anything. It does not make them do anything. It does not require any particular fix. The network operator is the only one who determines how it wants to address that risk. If however the GCSBis concerned that there still remains a significant threat to national security—not just a risk; a significant threat to national security—then the only power the GCSB has is to refer that up to the Minister. Before the Minister can do anything about that they will now under Supplementary Order Paper 366 have to go through another check which is to be reviewed by the Commissioner of Security Warrants to ensure there is a second set of independent eyes reassuring the Minister that the information that the GCSB has presented confirms that there is a significant threat to national security.For me if we have a significant threat to our national security through a vulnerability—a serious vulnerability—in our network infrastructure then we all have an interest in seeing that addressed. I do not want to be in charge or be in a country where we have absolute vulnerabilities in our network infrastructure and we see them and we can do nothing about them. It was only last year that Australia made some decisions to ban certain players from certain parts of its network and we had all of this side of the House jumping up and down saying: “Why isn’t the Government banning this? Why isn’t the Government doing that?”. The reality is there is no framework to do it. So if there is a threat—and they are the first ones to jump up and down if they see one—right now there is no power for a Government in New Zealand to respond to it. There is none.What we have done is create a situation where in the most serious cases—in the most serious cases and it would be very rare—it can be escalated to the Minister. After it has been through the review of the GCSB and another review of the Commissioner of Security Warrants then the Minister has to go through a detailed process set out in the law of consulting with all the affected parties. Only then if the threat is serious enough to the well-being of New Zealand can action be taken. Yes that is a new power. It is a new framework but we are living in a new age. These threats are real they are serious and we need to have a framework to respond to them.