While domestic debates around the Government Communications Security Bureau (GCSB) have focused on its role in spying on New Zealanders, more questions need to be asked about its involvement in mass surveillance of the electronic communications of people living outside New Zealand. Now the European Parliament, a body directly elected by the citizens of the 28 countries of the European Union (EU), is taking New Zealand to task for spying on Europeans’ communications.
The European Parliament’s powerful Committee on Civil Liberties, Justice and Home Affairs (the “LIBE” Committee) yesterday condemned New Zealand for its involvement in mass surveillance as part of the “Five Eyes” intelligence-sharing network that comprises signals intelligences agencies of the United States, United Kingdom, Canada, Australia and New Zealand. The LIBE Committee voted to refer a motion to the Parliament regarding the US National Security Agency’s (NSA) surveillance of European communications (a draft was first made public over a month ago, but appears to have escaped the notice of the New Zealand media). This motion includes the following statement:
“[A]ccording to the information revealed and to the findings of the inquiry conducted by the LIBE Committee, the national security agencies of New Zealand, Canada and Australia have been involved on a large scale in mass surveillance of electronic communications and have actively cooperated with the US under the so called ‘Five eyes’ programme, and may have exchanged with each other personal data of EU citizens transferred from the EU.”
The motion damningly states that the revelations “seriously affect trust in the legal systems of these countries [New Zealand and Canada] as regards the continuity of [data] protection afforded to EU citizens”. The draft motion is the result of a six-month long inquiry the LIBE Committee conducted into NSA mass surveillance, involving hearings with representatives of civil society organisations, parliamentarians from across the EU, members of the US Congress, journalists, IT experts, former members of the intelligence community, and others. The European Parliament will consider the motion in mid-March; seasoned observers consider that a majority of the members of that body will vote in favour of it.
EU law requires that when personal data – a category that ranges from something as simple as a person’s name to information about their health or sexuality – is transferred outside the EU, EU countries must ensure that the country receiving the data provides an “adequate level of protection” for the data. In 2012, the European Commission (the EU’s Executive body) examined New Zealand’s privacy and data protection laws. On the basis of this analysis, it determined that New Zealand provided an adequate level of protection for personal data.
The LIBE Committee report throws this conclusion into question. The motion asks that the European Commission and the 28 EU member states, which include major economic powers such as Germany and France, “assess without delay” whether the determination that New Zealand provides an adequate level of protection has been “affected by the involvement of [its] national intelligence agencies in the mass surveillance of EU citizens and, if necessary, to take appropriate measures to suspend or revers the adequacy decisions”. In essence, this means that because of the GCSB’s integration into the US National Security Agency’s (NSA) spying network, the EU does not trust New Zealand’s laws.
The LIBE Committee report – and the likely adoption of the motion by the European Parliament – should be a major embarrassment for the Government. But it is unlikely to even register on the Prime Minister’s radar, as he has shown a singular lack of interest in the GCSB’s involvement in mass surveillance of people overseas. In a remarkable admission last October, John Key stated that he does not know – and does not care to know – anything about this topic. In his 29 October post-cabinet press conference, Key was asked if the GCSB was “a part of” mass surveillance; he blithely replied, “I don’t have all of the details. And I haven’t bothered to ask those particular questions”. He has given no further clarification on the subject.
When the controversial amendments to the GCSB’s governing legislation were pushed through Parliament last year, Key promised that they would “[put] in place a stronger oversight regime that will go some way to rebuilding public confidence in the GCSB”. This oversight regime, at the centre of which lies the Prime Minister himself, has not demonstrated any willingness to look into the GCSB’s systematic, disproportionate and secret invasion of the privacy of millions of people in contravention of human rights standards. At the December public hearing of Parliament’s Intelligence and Security Committee, the GCSB Director deftly avoided answering the few questions that were put to him about the GCSB’s involvement in mass surveillance of people outside New Zealand; there is no evidence that the other limb of the oversight regime, the Inspector-General of Intelligence and Security, is looking into the question.
The culture of secrecy is so pervasive that at the December hearing the GCSB Director even refused to acknowledge the existence of the NSA’s PRISM programme, which “facilitates extensive, in-depth surveillance on live communications and stored information”, and the GCSB’s access to it. This is despite the US government’s explicit official acknowledgement of PRISM’s existence in June 2013. It is also hard to realistically dispute that the GCSB has access to PRISM; further, the UK government has made public the fact that its signals intelligence agency has access, without citing any operational concerns in confirming this piece of information.
New Zealand’s participation in the Five Eyes is not benign. Our practical involvement includes contributing intelligence, telecommunications and internet data to the “X-Keyscore” database. X-Keyscore has been described by internal NSA presentations as an “analytic framework” which enables a single search to query a “3 day rolling buffer” of “all unfiltered data” stored at 150 global sites, including one in New Zealand, on 700 database servers. Another part of the Five Eyes intelligence-gathering operations includes the collection of email and instant messenger contact lists. The Washington Post has reported that in a single day in 2012, the programme collected 444,743 email address books from Yahoo!, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from other providers. The figures are described as a typical day, suggesting that more than 250 million address books are harvested in a year. New Zealand’s involvement in this programme is made clear by a document that refers to “NZC” alongside US, UKC, CAC and AUC, indicating the Five Eyes member countries.
There is undoubtedly more to be revealed, and soon. Last week the Prime Minister stated that he had a “sense of the total level of information” that NSA whistleblower Edward Snowden had obtained, observing, “I don’t think there will be other revelations that will truly shock people”. It is extremely likely that the forthcoming revelations he is referring to will pertain to the GCSB’s role in mass surveillance of foreign populations. Thousands of New Zealanders took to the streets in 2013 to protest at the expansion of the GCSB’s powers to spy on us. But Key is betting that we will be silent when we receive confirmation that people outside New Zealand are being subjected to the very worst we feared from the GCSB: the untargeted surveillance of the electronic communications of millions of innocent people.
In line with New Zealand’s traditional commitment to upholding human rights, the GCSB’s governing legislation includes the principle that it acts “in accordance with New Zealand law and all human rights standards … ”. The LIBE Committee’s condemnation should be a wake-up call. It’s time for the government and the New Zealand public to begin to think seriously about whether our continued involvement in the Five Eyes alliance is really something that accords with New Zealand’s national values.
 More than 500 amendments were proposed to the original text; the Committee voted on them yesterday, before approving the report as a whole. A consolidated text of the motion is not yet available. The text cited here incorporates amendment 81, which was approved by the committee (the original draft report did not include a reference to Australia in this paragraph). A video of the vote and associated documents is available at the European Parliament website: http://www.europarl.europa.eu/portal/en
Anna Crowe is a Research Officer at Privacy International – www.privacyinternational.org. They can be contacted at firstname.lastname@example.org.