One of the country’s two spy agencies revealed that it retrieves information directly from where it is stored or processed on computers.
“Computer network exploitation” operations have until now been a highly classified secret at the GCSB.
American commentators refer to the exploitation of computer networks as a form of cyber warfare or “data theft”.
“Our legislation…allows us to access information infrastructure, which is more than just interception,” said the director general of the government’s Office of Communications Security, Andrew Hampton.
It also “allows us to retrieve digital information directly from where it is stored or processed”.
The GCSB calls this “access to information infrastructure”.
Spy watchdog Inspector General of Intelligence and Security Brendan Horsley cited Hampton’s speech at the Institute of International Affairs in May as making the revelation.
This had freed Horsley to be able to assure the public that logging operations were being controlled, he said in his annual report released on Friday.
Previously, it had to refer to “certain operations”.
“Although it has been subject to monitoring, it has not been possible to provide clear public assurance on this matter.”
In fact, he had conducted a review which found that the compliance systems around the CNE “were generally effective and appropriate”.
However, he was still not allowed to go into detail “about the bureau’s use of this important capability”.
Elsewhere, the Inspector General reported that the SIS was doing a lot more “target discovery”, which required it to manage a lot more data, at a time when its checks and checks on data – while improving – were “not there yet”.
Horsley is conducting a review of target discovery by the SIS this year, and will soon include the GCSB as well.
Both agencies stepped up this work after the 2019 mosque attacks.
“The potential danger of target discovery activity, from a civil liberties and privacy perspective, is the intrusion into the lives of people who have done nothing to merit the attention of an agency. national security,” the Inspector General said.
He concluded that there was no significant problem with Section 19 of the Security Acts – that S19 merely required each agency to be able to justify monitoring or collection “other than certain ideas being expressed on a platform”. form”.
As for the retention of any additional data, the GCSB had adopted a new policy late last year under which “it may not retain information simply because it might be useful to its duties at the ‘coming”.
However, the report says the SIS is struggling on the political front. A total of 93% of its policies were overdue for review and in some cases, including data analysis, were “non-existent”.
“Draft procedures were used to guide decisions,” Horsley said.
While the SIS had a plan to address the backlog, and even though it had reduced the number of its policies by a fifth, “in the meantime, there is no guarantee that these policies are fit for purpose”.
It was also way behind in revising its data-sharing agreement with the Home Office.
Both the SIS and the office scored higher on internal controls and how they handled breaches.
Agencies have improved their common policy of sharing information with foreign partners when there is a risk that it could contribute to human rights abuses.
The new policy was “a marked improvement” on the 2017 policy, although Horsley retained reservations about certain terms, criteria and “the treatment of reports likely obtained through torture”, and he wanted more of the policy be made public.
The report showed it had reviewed 63 spy warrants, including 49 of the most serious type, a Type 1, which allows an agency to carry out otherwise illegal activity in order to collect information about a New Zealander.