classified information means information that—

(a) is of a kind specified in any of paragraphs (a) to (c) of section 96(2); and

(b) the disclosure of which would be likely to do any of the things specified in paragraphs (a) to (d) of section 96(3)

Clause 8

In clause 8(1A), after “should” (line 27 on page 15), insert “, in the absence of any applicable regulations,”.

Replace clause 8(2) (lines 29 to 33 on page 15) with:

(2) The Minister responsible for the Government Communications Security Bureau must, when making any decision or exercising any function or power under Part 3 in relation to a network security risk, have regard to the principle in subsection (3).

Replace clause 8(4) (line 36 on page 15 to line 6 on page 16) with:

(4) In subsection (3), a decision or an exercise of a function or power is proportionate to the network security risk if the Minister is satisfied that it does not impose costs on network operators, customers, or end-users beyond those reasonably required to enable the network security risk to be prevented, sufficiently mitigated, or removed.”

Clause 24

In clause 24(3)(b), replace “including, but not limited to” (line 30 on page 26) with “which may include, but are not limited to”.

After clause 24(7) (after line 13 on page 28), insert:

(8) Nothing in this section affects the application of the common law defence of foreign state compulsion to a service provider outside New Zealand.

Clause 29

In clause 29(1)(b), after “section 13” (line 9 on page 30), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”.

Clause 33

In clause 33(1)(b), after “section 13” (line 37 on page 33), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”.

Clause 34

In clause 34(1)(b), after “section 13” (line 34 on page 35), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”.

Clause 39

Delete the cross-heading above clause 39 (lines 14 and 15 on page 40).

Delete clause 39 (line 16 on page 40 to line 31 on page 41).

Clause 47

Replace clause 47(1)(a) to (c) (lines 26 to 32 on page 45) with:

(a) the procurement or acquisition of any equipment, system, or service that falls within an area of specified security interest; or

(b) any change—

(i) to the architecture of any equipment, system, or service that falls within an area of specified security interest; or

(ii) that may affect the ownership, control, oversight, or supervision of any equipment, system, or service that falls within an area of specified security interest.

Replace clause 47(2)(a) (line 34 on page 45 to line 2 on page 46) with:

(a) comply with subsection (1)(a) before any steps are taken, as part of the procurement or acquisition decision-making process, to approach the market (whether by request for quote, tender, or otherwise) or comply with subsection (1)(b) during the development of a business or change proposal; and

Clause 50

After clause 50(2) (after line 38 on page 48), insert:

(3) If the Director does not accept the proposal or part of the proposal, the Director must—

(a) decide, at the same time, whether or not to refer the matter to the Minister responsible for the Government Communications Security Bureau under section 52; and

(b) advise the network operator of his or her decision accordingly in writing.

Clause 52

In clause 52(a), after “may” (line 9 on page 49), insert “, after complying with section 53A,”.

Cross-heading above clause 53

Delete the cross-heading above clause 53 (line 18 on page 49).

Clause 53

In clause 53(2)(a), after “may” (line 33 on page 49), insert “, after complying with section 53A,”.

New clause 53A

After clause 53 (after line 6 on page 50), insert:

53A Review by Commissioner of Security Warrants

(1) If the Director is of the opinion that a significant network security risk exists or may arise and is intending or considering whether to refer the matter to the Minister responsible for the Government Communications Security Bureau under section 52 or 53,—

(a) the Director must, before referring the matter, notify the Commissioner; and

(b) on receipt of the notice, the Commissioner must, as soon as practicable, conduct a review in accordance with this section.

(2) The Director must make available to the Commissioner all of the material (including any classified information) that informed the Director's opinion.

(3) The Commissioner must consider whether the significant network security risk identified by the Director exists or may arise by—

(a) assessing the material made available to him or her; and

(b) considering the matters that the Director was required to consider under section 48A(1)(a) and (b); and

(c) considering any other matter that the Director, under section 48A(1)(c), considered relevant.

(4) The Commissioner must prepare a report on the Commissioner's consideration, under subsection (3), of the significant network security risk identified by the Director and—

(a) give a copy of the report to the Director; and

(b) give a copy of the report to the affected network operator, except those parts of the report that would reveal any classified information.

(5) The Commissioner must not, when conducting the review, seek or accept any further communications from the affected network operator or the Director (except as provided in subsection (2)).

(6) Any material made available to the Commissioner under this section must be kept secure and confidential, and returned to the Director when the review is completed.

(7) If the Director decides to refer the matter to the Minister, the Director must, when referring the matter, give the Minister a copy of the Commissioner's report under this section.

(8) In this section and section 54, Commissioner means the Commissioner of Security Warrants within the meaning of section 2 of the New Zealand Security Intelligence Service Act 1969.

Clause 54

Replace clause 54 (line 7 on page 50 to line 9 on page 51) with:

54 Minister may make direction

(1) The Minister responsible for the Government Communications Security Bureau may make a direction under this section only if the Minister—

(a) has been referred a matter under section 52 or 53; and

(b) has considered any submissions from the affected network operator; and

(c) has considered the report of the Commissioner under section 53A; and

(d) has consulted the Minister for Communications and Information Technology and the Minister of Trade; and

(e) is satisfied that exercising his or her powers under this section is necessary to prevent, sufficiently mitigate, or remove a significant network security risk.

(2) Before making a direction under this section, the Minister must—

(a) have regard to—

(i) the nature and extent of the network security risk:

(ii) the impact on the network operator of meeting costs associated with the direction:

(iii) the potential consequences that the direction may have on competition and innovation in telecommunications markets:

(iv) the anticipated benefits to New Zealand from preventing, sufficiently mitigating, or removing the network security risk:

(v) the principle in section 8(3):

(vi) the potential impact of the direction on trade:

(vii) any other matters that the Minister considers relevant; and

(b) be satisfied that the direction is consistent with the purpose in section 7.

(3) A direction under this section—

(a) may require a network operator to take steps, as specified by the Minister, to prevent, sufficiently mitigate, or remove the significant network security risk, and those steps may include—

(i) requiring the network operator to cease a particular activity or to do or refrain from doing a particular activity in the future; or

(ii) directing the network operator to make changes to, or remove, any particular system, equipment, service, component, or operation on or related to the network; and

(b) may provide for any other relevant matter.

(4) The Minister must ensure that any time by which a network operator must comply with a requirement of the direction is specified in the direction and is reasonable in the circumstances.

(5) The Minister must issue the direction in writing to the affected network operator together with reasons, except those parts of the reasons that would reveal classified information.

(6) The Minister must not delegate to any person, other than another Minister, the power to make a direction under this section.

New clause 54B

After clause 54A (after line 17 on page 51), insert:

54B Director must comply with regulations made under section 109A relating to time frames

The Director must comply with any regulations made under section 109A.

Clause 57

In clause 57(1)(e), delete “and all public telecommunications networks” (lines 24 and 25 on page 52).

Clause 76

After clause 76(2) (after line 26 on page 60), insert:

(3) Nothing in section 72 or 73 permits a designated officer or the Director to require a network operator to supply, produce, reproduce, or assist in reproducing any information or document that could have been obtained, or should have been sought, under an interception warrant or other lawful interception authority.

Clause 82

In clause 82(b), delete “39,” (line 14 on page 63).

Clause 86

After clause 86(1) (after line 18 on line 65), insert:

(1A) However, a surveillance agency may apply to the High Court for an order under section 92 in relation to a contravention of a compliance order without complying with subsection (1).

Clause 102

Replace clause 102(1) (line 34 on page 77 to line 4 on page 78) with:

(1) This section applies to any dispute between a surveillance agency and a network operator or a service provider about the reasonableness of the costs under section 100 that are incurred, or are claimed to have been incurred, in the performance of the duty under section 24.

Clause 103

In clause 103(2)(a), after “performance” (line 25 on page 78), insert “or intended performance”.

In clause 103(2)(b), after “exercise” (line 27 on page 78), insert “or intended exercise”.

In clause 103(3), delete “39 or ” (line 30 on page 78).

After clause 103(3) (after line 30 on page 78), insert:

(4) Nothing in this section limits any immunity under any other enactment.

Clause 104

In clause 104(1)(b), after “designated officer ” (line 1 on page 79), insert “, the Director,”.

In clause 104(2), after “designated officer ” (line 5 on page 79), insert “, the Director,”.

New clause 109A

After clause 109 (after line 13 on page 81), insert:

109A Regulations relating to time frames that apply to Director under Part 3

(1) The Governor-General may, by Order in Council, on the recommendation of the Minister responsible for the Government Communications Security Bureau, make regulations—

(a) prescribing, in relation to any decision that the Director must make or steps that the Director must take for the purpose of exercising a function or power under Part 3, the time by which that decision must be made or those steps must be taken:

(b) allowing the Director to extend a time prescribed under paragraph (a) for a reasonable period after having regard to the circumstances and being satisfied that any criteria prescribed under paragraph (c) apply:

(c) prescribing criteria relating to an extension referred to in paragraph (b):

(d) providing for any other requirements that apply in relation to an extension referred to in paragraph (b).

(2) The Minister responsible for the Government Communications Security Bureau must consult the Minister before recommending the making of regulations under subsection (1).

Schedule

In the Schedule, after the item relating to the National Animal Identification and Tracing Act 2012 (after line 26 on page 82), insert:

New Zealand Security Intelligence Service Act 1969 (1969 No 24)

After section 5A(5)(f), insert:

“(g) to conduct reviews under section 53A of the Telecommunications (Interception Capability and Security) Act 2013 relating to significant network security risks.”

Explanatory note

This Supplementary Order Paper amends the Telecommunications (Interception Capability and Security) Bill.

The amendments to clause 8 affect the principles relating to network security. The amendments—

amend the principle in clause 8(1A) that any decision or steps required of the Director (for the purpose of exercising a function or power under Part 3) should be made or taken as soon as practicable, to the effect that the principle applies only in the absence of any applicable regulations:
replace clause 8(2) (which relates to the principle in clause 8(3) that a decision or an exercise of power be proportionate to the network security risk). New clause 8(2) no longer includes a reference to the Director and requires the Minister responsible for the Government Communications Security Bureau (the Minister for GCSB) to have regard to the principle in clause 8(3):
replace clause 8(4) (which describes when a decision or an exercise of a function or power is proportionate to a network security risk) with a provision based on the Minister’s assessment of whether the decision or exercise of the function or power is proportionate to the network security risk. The matters in respect of which the Minister must be satisfied are carried over from current clause (8)(4)(a).

The duty to assist in clause 24 is amended to ensure that the common law defence of foreign state compulsion is not affected by clause 24.

Clause 39 is removed (this relates to the Minister’s power to make a direction prohibiting the provision of resold overseas telecommunication services).

Clause 47(1)(a) to (c) is replaced. The effect of the change is that the network operator must notify the Director of any proposed decision, course of action, or change made by the network operator regarding—

the procurement or acquisition of any equipment, system, or service that falls within an area of specified security interest; or
any change to the architecture of any equipment, system, or service that falls within an area of specified security interest; or
any change that may affect the ownership, control, oversight, or supervision of any equipment, system, or service that falls within an area of specified security interest.

The amendment to clause 50 relates to the Director's assessment of whether a proposal from a network operator will, if implemented, prevent or sufficiently mitigate a network security risk. The amendment provides that if the Director does not accept the proposal, he or she must, at the same time, decide whether to refer the matter to the Minister for GCSB under clause 52.

New clause 53A provides that if the Director is of the opinion that a significant network security risk exists or may arise,—

the Director must, before making a decision to refer the matter to the Minister for GCSB, refer the matter to the Commissioner of Security Warrants for review; and
the Commissioner must conduct the review on the basis of the material that informed the Director’s opinion, and by considering the factors referred to in clause 48A(1)(a) and (b), and any matter that the Director considered relevant; and
the Commissioner must provide a report of the review to the Director and the affected network operator; and
if the Director decides to refer the matter to the Minister, he or she must also provide the Minister with a copy of the Commissioner’s report.

Clause 54 is replaced. The principal change is in new clause 54(2), which sets out the matters to which the Minister must have regard before making a direction under that section. The Minister must also have considered a report from the Commissioner under clause 53A before making a direction.

New clause 54B requires the Director to comply with regulations made under new clause 109A.

Clause 57 (which relates to registration information) is amended to remove a redundant reference to public telecommunications networks.

Clause 76 (which contains miscellaneous provisions concerning the information-gathering powers in subpart 4 of Part 4) is amended to clarify that the powers do not permit a designated officer or the Director to require a network operator to supply or produce information that could have been obtained, or should have been sought, under an interception warrant or other lawful interception authority.

Clause 102 is amended to remove an unnecessary reference to a dispute about costs under clause 99.

Clause 103 (which protects certain persons from liability) is amended to refer to the intended performance or exercise of a duty, function, or power (in addition to the actual performance or exercise of a duty, function, or power). In addition, the clause is amended to clarify that it does not limit an immunity under another enactment.

New clause 109A enables regulations to be made prescribing times by which the Director must make a decision or take steps for the purpose of exercising a function or power under Part 3. Regulations may also be made allowing the Director to extend a prescribed time after having regard to the circumstances and being satisfied that any prescribed criteria have been met.

The Schedule is amended to make a consequential amendment to the New Zealand Security Intelligence Service Act 1969.

This Supplementary Order paper also makes a number of minor and technical changes, of which the following are of note:

the amendment to clause 3 replaces the definition of classified information. The new definition provides a clearer link to the provisions in clause 96 (which relates to classified security information):
clauses 29, 33, and 34 are amended to clarify that exemptions may be granted relating to the duty that a network or service be intercept ready.

Departmental disclosure statement

The Ministry of Business, Innovation, and Employment considers that a departmental disclosure statement is not required to be prepared for this Supplementary Order Paper.

Telecommunications (Interception Capability and Security) Bill - Amendment paper No 366