On the balance between civil liberties and intelligence operations.

In recent days there have been claims that there has been both more and less spying by New Zealand intelligence agencies. Proponents and opponents of the intelligence community have seized on one or the other claim to argue in favour or against NZ’s involvement in the 5 Eyes signals intelligence network and the expansion of powers awarded the NZ intelligence community under amendments to various security Acts during the past few years. Given that there is a forthcoming parliamentary review of the NZ intelligence community, it is worth cutting to the gist of the issue of “balance” between civil liberties and intelligence operations.

Monitoring and intercept technologies available to signals and technical intelligence agencies today are superior to those of ten years ago, especially in the field of telecommunications. This allows signals and technical intelligence agencies to do much more than was possible before, something that legal frameworks governing signals and technical intelligence collection have had difficulty keeping pace with. It would therefore seemingly defy credulity to claim that that spy agencies are doing less spying now than in the past, especially given what is known about the 5 Eyes network from the Snowden documents currently being introduced into the public domain.

But perhaps there is a way to reconcile the opposing claims. Can spy agencies actually be doing less with more?

The assertion that there is less spying by NZ intelligence agencies now than seven years ago can be reconciled with the recently released GCSB annual report stating otherwise by understanding that under the intelligence community’s interpretation, “mass collection” is not equivalent to “mass surveillance.” Although the 5 Eyes and other national signals intelligence agencies use systems like PRISM to grab as much meta-data as possible as it passes through nodal points, that data has to be mined using systems like XKEYSCORE to obtain collectable information. Bulk “hovering” of all telecommunications in specific geographic or subject areas by agencies like the GCSB still has to be searched and analysed for it to become actionable intelligence. That is where the use of key words and phrases comes in, and these are not just of the usual “jihad” or “al-Qaeda” variety (since the bulk of intelligence collection is not focused on terrorism).

Although the GCSB may be doing more bulk collection of electronic data, it claims to be analysing proportionately less of what is collected than during the last year of the Fifth Labour government. So it is doing less with more. But a fundamental problem remains when it comes to intercepting telecommunications in democracies.

That problem is that whether it is analysed or not, mass collection of so-called meta-data of everyone’s personal and professional telecommunications presumably violates the democratic right to privacy as well as the presumption of innocence because it is obtained without there being a particular suspicion or specific reason for its collection (much less a warrant for its collection). Bulk intercepts can then be data-mined after the fact using classified search vehicles in order to build a case against individuals or groups.

That runs against basic tenets of democratic jurisprudence. Moreover, indefinite storing of meta-data that has not been analysed but which could be in the future in the event target (and key word) priorities change is something that is the subject of legal argument at this very moment.

There are therefore fundamental principles of democratic governance at stake in the very collection of meta-data, and these cannot be easily set aside just because the threat of terrorism is used as a justification. The issue is constitutional and needs to be resolved before the issue of “balance” can effectively be addressed.

However, for the sake of argument let’s accept that bulk collection is not mass surveillance and that the former is legal. How does one balance civil liberties and security under such circumstances?

The implementation of balance under such conditions starts at the point where data mining begins. What are the key phrases and words that identify targets for closer scrutiny? What are legitimate targets and what are not? Some search terms may be easy to understand and broadly accepted as necessary filters for the acquisition of more precise information about threats. Others might be more controversial and not widely accepted (say, “opposition leader sex life” or “anti-TPPA protest leaders”).

That is where the issue of effective intelligence oversight comes into play and on that score NZ is sorely wanting. There have been some cosmetic changes in the workings of and a slight extension of the powers of the Inspector General of Intelligence and Security, and the process of issuing domestic security warrants made more robust with the participation of the Commissioner of Security Warrants. Yet any honest assessment of the oversight mechanisms of the NZ intelligence community will show that they are inadequate when it comes to providing effective and transparent proactive as well as retroactive oversight and review of our intelligence community’s activities given the range and scope of the latter.

These mechanisms are fewer and less effective than those of most liberal democracies (including our 5 Eyes partners), which means that NZ’s intelligence partners may well ask it to do things that they cannot do themselves due to the restrictions imposed by their own oversight mechanisms. That possibility should be of concern and needs to be addressed. Relying on the good faith of NZ intelligence agencies involved is not enough, especially given their history of playing loose with the rules when it suits them.

Therein lies the core problem with regard to balancing civil liberties and intelligence operations. If there is effective intelligence oversight before the fact (“proactive” in the sense that oversight mechanisms dictate was is permissible data-mining before it occurs) as well as after the fact (“retroactive” in the sense that oversight mechanisms hold intelligence officials to account for their use of bulk collection and data-mining), then balance can be achieved. However, if such effective oversight is lacking–again, both proactive and retroactive in nature–then the “balance” will be skewed heavily in favour of unaccountable intelligence collection and usage. That is not acceptable in a democracy but is in fact the situation at present in New Zealand.

Then there are the issues of how national security is defined and what role intelligence agencies play in its defense, on whose behalf NZ intelligence agencies engage in espionage, and with who the intelligence obtained by human, signals and technical means is shared. This matters because trying to achieve balance between civil liberties and intelligence operations without addressing the larger context in which the latter occur is much like putting the cart before the horse.

14 thoughts on “On the balance between civil liberties and intelligence operations.

  1. A very reasoned analysis, Pablo. Sadly, this issue is being used by the opposition as a political point-scoring exercise, rather than being used to put pressure on National to formulate better oversight. While this is occurring, I seriously doubt anything constructive such as this will be developed. National and, in particular, John Key, are too busy being defensive.

  2. Thanks MacDoctor, and welcome back.

    My hope is that some of the points argued herein will find their way into the parliamentary review. The Greens actually have some good ideas in this regard but they undermine their case for better oversight with calls for NZ to abandon 5 Eyes or solely focus on domestic intelligence gathering on criminal activities. Whatever the merits of these views, they simply are not practicable given the realities of the moment, although I do think that the Snowden revelations provide NZ a window of opportunity to re-negotiate some aspects of its relationship with its intelligence partners.

  3. So NZ collects meta data on all telecommunications, big deal.
    Look if I say “ bang bang ”’, and it goes down some tube, who cares.
    Cry me a river Pablo. There was a public song during the elections which said kill the PM and rape his daughter ..

    Collection of data and Surveillance are entirely different
    Surveillance [to me] means actively watching or listening on me and collection is just metadata, linked to some number
    You can have your oversight if you want, but what for. The spook will do what he wants.. What would it mean ? surveillance over surveillance ?
    The 1080 case shows how weak it all is anyway’.
    We need as much security as we can muster, and I suggest surveillance of Green party activists, as a good venture forward.

  4. Paul:

    Please refrain from using offensive racist language. I deleted that passage. It is OK to engage in a little rough and tumble banter but we draw the line at obscenity and hateful slurs.

  5. Wet rabbit food Pablo, I was simply using an example of the kind of expression which may attract collection. But you wet prissy left can not call a spade from a shovel. Its ok to talk about rape the PM daughter Pablo but not to say the word. Ban me if you like , talk pussy to prissy.

  6. Paul:

    Please get a grip. No one here has ever talked abut raping the PM’s daughter etc. You are confusing us with someone else. Our policy against offensive language has been here from the start (look at the comments policy on the banner above).

    There is no need for us to ban you but I will continue to delete any offensive language in all comments, not just yours.

  7. My comments Pablo, were about words and expressions used in writing which may attract attention to metadata collection.
    But I see you have a list of banned words, precious one, too PC, its all beneath your lofty lefty head

  8. The constant focus on electronic surveillance never really includes any discussion on the likely probability that individuals and organisations with something to hide are going to encrypt their communications anyway – in fact behaviour no different to how our own intelligence agencies communicate.

    And we all know now that Bin Ladan long ago gave up using telephones of any description (cellular, satelitte, etc), or the internet, and relied instead on “couriers” to physically pass his messages (which is how he was eventually found and killed).

    That said, one can only speculate how much of an intelligence agencies resources are spent on “collecting” and how much on “decrypting”, and “translating”.

    I think the value of this electronic eaves-dropping is over-rated and it mostly collects incidental unencrypted information sent by people and governments will little to hide.

    Most of the information these intelligence agencies collect will be “chicken-shit” with a few occasional nuggets. This is not a criticism of them, but rather a reflection of the fact that the really bad buggers (and upon whom agencies like the GCSB justify their existence) are going to be using their own secure communications anyway.

  9. Meta-data, as far as TCP/IP packets are concerned, is the IP address that the packet is from and where it’s going to. It may also contain the route it takes across the internet but that’s is, IMO, unlikely as it really doesn’t tell you anything.

    For email it would be the email address of the sender and receiver(s), the IP addresses and possibly the subject.

    The third and last type is the searches sent to search engines. These will also be tied back to IP addresses.

    Meta-data primarily reveals two things – the relationships between people and entities and what they’re interested in. You can pretty much be certain that the meta-data is being analysed as it’s collected by the software even if it’s not reported to people until an actual search is requested. The reported capabilities of XKeyscore would indicate that this happens.

    It’s being analysed so that, when an agency picks up suspicious behaviour by a person (of course, that suspicious behaviour just may be that the person is an environmentalist or left-wing), it can determine the relationships that person has and their interests. It is the relationships that most matter especially the ones over time.

    Of course, those relationships can reveal even more. If someone is seeing the same dentist every week for five years we can assume that it’s something other than a professional relationship.

    Due to this capability to reveal even more, possibly private, information meta-data should not be collected as a matter of course but only once a warrant has been obtained on a specific person to show their relationships.

  10. Chris: Remember that signals intelligence is about code making and code breaking. In today’s context that means encryption and decryption. There is no such thing as 100 percent secure encryption. It just may take a little longer to decrypt, which is why storage facilities are used to allow dedicated teams to break particularly hard codes.

    Draco: I refer you to my remarks about effective proactive oversight. It would be one way to define what meta-data can be collected. I also think that the SIGINT collection systems are a bit more sophisticated than what you are describing, but I could be wrong.

    Paul: The only thing that has been deleted is the racist term in your comments. I deleted the entire comment with the link to the KB general debate because it contained that term as well as another offensive remark. I understand the point that you are trying to make but you do not have to use racist language to do so. Again, read the comments policy. As for the point itself–a little subtlety can go a long way.

  11. I wonder if Paulscott also thinks the Jews run Hollywood and the financial system too, with the Frankfurt School in charge of the universities just to rub it in.

Leave a Reply

Your email address will not be published. Required fields are marked *