Hon Amy Adams, in Committee, to move the following amendments:
Clause 3
In clause 3(1), replace the definition of classified information (lines 14 and 15 on page 8) with:
classified information means information that—
Clause 8
In clause 8(1A), after “should”
(line 27 on page 15), insert “, in the absence of any applicable regulations,”
.
Replace clause 8(2) (lines 29 to 33 on page 15) with:
(2) The Minister responsible for the Government Communications Security Bureau must, when making any decision or exercising any function or power under Part 3 in relation to a network security risk, have regard to the principle in subsection (3).
Replace clause 8(4) (line 36 on page 15 to line 6 on page 16) with:
(4) In subsection (3), a decision or an exercise of a function or power is proportionate to the network security risk if the Minister is satisfied that it does not impose costs on network operators, customers, or end-users beyond those reasonably required to enable the network security risk to be prevented, sufficiently mitigated, or removed.”
Clause 24
In clause 24(3)(b), replace “including, but not limited to”
(line 30 on page 26) with “which may include, but are not limited to”
.
After clause 24(7) (after line 13 on page 28), insert:
Clause 29
In clause 29(1)(b), after “section 13”
(line 9 on page 30), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”
.
Clause 33
In clause 33(1)(b), after “section 13”
(line 37 on page 33), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”
.
Clause 34
In clause 34(1)(b), after “section 13”
(line 34 on page 35), insert “and, in relation to the requirement under that section that the network or service be intercept ready, from all or any of the requirements of section 11”
.
Clause 39
Delete the cross-heading above clause 39 (lines 14 and 15 on page 40).
Delete clause 39 (line 16 on page 40 to line 31 on page 41).
Clause 47
Replace clause 47(1)(a) to (c) (lines 26 to 32 on page 45) with:
(b) any change—
(ii) that may affect the ownership, control, oversight, or supervision of any equipment, system, or service that falls within an area of specified security interest.
Replace clause 47(2)(a) (line 34 on page 45 to line 2 on page 46) with:
(a) comply with subsection (1)(a) before any steps are taken, as part of the procurement or acquisition decision-making process, to approach the market (whether by request for quote, tender, or otherwise) or comply with subsection (1)(b) during the development of a business or change proposal; and
Clause 50
After clause 50(2) (after line 38 on page 48), insert:
Clause 52
In clause 52(a), after “may”
(line 9 on page 49), insert “, after complying with section 53A,”
.
Cross-heading above clause 53
Delete the cross-heading above clause 53 (line 18 on page 49).
Clause 53
In clause 53(2)(a), after “may”
(line 33 on page 49), insert “, after complying with section 53A,”
.
New clause 53A
After clause 53 (after line 6 on page 50), insert:
53A Review by Commissioner of Security Warrants
(1) If the Director is of the opinion that a significant network security risk exists or may arise and is intending or considering whether to refer the matter to the Minister responsible for the Government Communications Security Bureau under section 52 or 53,—
(b) on receipt of the notice, the Commissioner must, as soon as practicable, conduct a review in accordance with this section.
(2) The Director must make available to the Commissioner all of the material (including any classified information) that informed the Director's opinion.
(3) The Commissioner must consider whether the significant network security risk identified by the Director exists or may arise by—
(4) The Commissioner must prepare a report on the Commissioner's consideration, under subsection (3), of the significant network security risk identified by the Director and—
(5) The Commissioner must not, when conducting the review, seek or accept any further communications from the affected network operator or the Director (except as provided in subsection (2)).
(6) Any material made available to the Commissioner under this section must be kept secure and confidential, and returned to the Director when the review is completed.
(7) If the Director decides to refer the matter to the Minister, the Director must, when referring the matter, give the Minister a copy of the Commissioner's report under this section.
(8) In this section and section 54, Commissioner means the Commissioner of Security Warrants within the meaning of section 2 of the New Zealand Security Intelligence Service Act 1969.
Clause 54
Replace clause 54 (line 7 on page 50 to line 9 on page 51) with:
54 Minister may make direction
(1) The Minister responsible for the Government Communications Security Bureau may make a direction under this section only if the Minister—
(2) Before making a direction under this section, the Minister must—
(3) A direction under this section—
(a) may require a network operator to take steps, as specified by the Minister, to prevent, sufficiently mitigate, or remove the significant network security risk, and those steps may include—
(ii) directing the network operator to make changes to, or remove, any particular system, equipment, service, component, or operation on or related to the network; and
(4) The Minister must ensure that any time by which a network operator must comply with a requirement of the direction is specified in the direction and is reasonable in the circumstances.
(5) The Minister must issue the direction in writing to the affected network operator together with reasons, except those parts of the reasons that would reveal classified information.
(6) The Minister must not delegate to any person, other than another Minister, the power to make a direction under this section.
New clause 54B
After clause 54A (after line 17 on page 51), insert:
54B Director must comply with regulations made under section 109A relating to time frames
The Director must comply with any regulations made under section 109A.
Clause 57
In clause 57(1)(e), delete “and all public telecommunications networks”
(lines 24 and 25 on page 52).
Clause 76
After clause 76(2) (after line 26 on page 60), insert:
(3) Nothing in section 72 or 73 permits a designated officer or the Director to require a network operator to supply, produce, reproduce, or assist in reproducing any information or document that could have been obtained, or should have been sought, under an interception warrant or other lawful interception authority.
Clause 82
In clause 82(b), delete “39,”
(line 14 on page 63).
Clause 86
After clause 86(1) (after line 18 on line 65), insert:
Clause 102
Replace clause 102(1) (line 34 on page 77 to line 4 on page 78) with:
(1) This section applies to any dispute between a surveillance agency and a network operator or a service provider about the reasonableness of the costs under section 100 that are incurred, or are claimed to have been incurred, in the performance of the duty under section 24.
Clause 103
In clause 103(2)(a), after “performance”
(line 25 on page 78), insert “or intended performance”
.
In clause 103(2)(b), after “exercise”
(line 27 on page 78), insert “or intended exercise”
.
In clause 103(3), delete “39 or ”
(line 30 on page 78).
After clause 103(3) (after line 30 on page 78), insert:
Clause 104
In clause 104(1)(b), after “designated officer ”
(line 1 on page 79), insert “, the Director,”
.
In clause 104(2), after “designated officer ”
(line 5 on page 79), insert “, the Director,”
.
New clause 109A
After clause 109 (after line 13 on page 81), insert:
109A Regulations relating to time frames that apply to Director under Part 3
(1) The Governor-General may, by Order in Council, on the recommendation of the Minister responsible for the Government Communications Security Bureau, make regulations—
(a) prescribing, in relation to any decision that the Director must make or steps that the Director must take for the purpose of exercising a function or power under Part 3, the time by which that decision must be made or those steps must be taken:
(2) The Minister responsible for the Government Communications Security Bureau must consult the Minister before recommending the making of regulations under subsection (1).
Schedule
In the Schedule, after the item relating to the National Animal Identification and Tracing Act 2012 (after line 26 on page 82), insert:
New Zealand Security Intelligence Service Act 1969 (1969 No 24)
After section 5A(5)(f), insert:
Explanatory note
This Supplementary Order Paper amends the Telecommunications (Interception Capability and Security) Bill.
The amendments to clause 8 affect the principles relating to network security. The amendments—
amend the principle in clause 8(1A) that any decision or steps required of the Director (for the purpose of exercising a function or power under Part 3) should be made or taken as soon as practicable, to the effect that the principle applies only in the absence of any applicable regulations:
replace clause 8(2) (which relates to the principle in clause 8(3) that a decision or an exercise of power be proportionate to the network security risk). New clause 8(2) no longer includes a reference to the Director and requires the Minister responsible for the Government Communications Security Bureau (the Minister for GCSB) to have regard to the principle in clause 8(3):
replace clause 8(4) (which describes when a decision or an exercise of a function or power is proportionate to a network security risk) with a provision based on the Minister’s assessment of whether the decision or exercise of the function or power is proportionate to the network security risk. The matters in respect of which the Minister must be satisfied are carried over from current clause (8)(4)(a).
The duty to assist in clause 24 is amended to ensure that the common law defence of foreign state compulsion is not affected by clause 24.
Clause 39 is removed (this relates to the Minister’s power to make a direction prohibiting the provision of resold overseas telecommunication services).
Clause 47(1)(a) to (c) is replaced. The effect of the change is that the network operator must notify the Director of any proposed decision, course of action, or change made by the network operator regarding—
the procurement or acquisition of any equipment, system, or service that falls within an area of specified security interest; or
any change to the architecture of any equipment, system, or service that falls within an area of specified security interest; or
any change that may affect the ownership, control, oversight, or supervision of any equipment, system, or service that falls within an area of specified security interest.
The amendment to clause 50 relates to the Director's assessment of whether a proposal from a network operator will, if implemented, prevent or sufficiently mitigate a network security risk. The amendment provides that if the Director does not accept the proposal, he or she must, at the same time, decide whether to refer the matter to the Minister for GCSB under clause 52.
New clause 53A provides that if the Director is of the opinion that a significant network security risk exists or may arise,—
the Director must, before making a decision to refer the matter to the Minister for GCSB, refer the matter to the Commissioner of Security Warrants for review; and
the Commissioner must conduct the review on the basis of the material that informed the Director’s opinion, and by considering the factors referred to in clause 48A(1)(a) and (b), and any matter that the Director considered relevant; and
the Commissioner must provide a report of the review to the Director and the affected network operator; and
if the Director decides to refer the matter to the Minister, he or she must also provide the Minister with a copy of the Commissioner’s report.
Clause 54 is replaced. The principal change is in new clause 54(2), which sets out the matters to which the Minister must have regard before making a direction under that section. The Minister must also have considered a report from the Commissioner under clause 53A before making a direction.
New clause 54B requires the Director to comply with regulations made under new clause 109A.
Clause 57 (which relates to registration information) is amended to remove a redundant reference to public telecommunications networks.
Clause 76 (which contains miscellaneous provisions concerning the information-gathering powers in subpart 4 of Part 4) is amended to clarify that the powers do not permit a designated officer or the Director to require a network operator to supply or produce information that could have been obtained, or should have been sought, under an interception warrant or other lawful interception authority.
Clause 102 is amended to remove an unnecessary reference to a dispute about costs under clause 99.
Clause 103 (which protects certain persons from liability) is amended to refer to the intended performance or exercise of a duty, function, or power (in addition to the actual performance or exercise of a duty, function, or power). In addition, the clause is amended to clarify that it does not limit an immunity under another enactment.
New clause 109A enables regulations to be made prescribing times by which the Director must make a decision or take steps for the purpose of exercising a function or power under Part 3. Regulations may also be made allowing the Director to extend a prescribed time after having regard to the circumstances and being satisfied that any prescribed criteria have been met.
The Schedule is amended to make a consequential amendment to the New Zealand Security Intelligence Service Act 1969.
This Supplementary Order paper also makes a number of minor and technical changes, of which the following are of note:
the amendment to clause 3 replaces the definition of classified information. The new definition provides a clearer link to the provisions in clause 96 (which relates to classified security information):
clauses 29, 33, and 34 are amended to clarify that exemptions may be granted relating to the duty that a network or service be intercept ready.
Departmental disclosure statement
The Ministry of Business, Innovation, and Employment considers that a departmental disclosure statement is not required to be prepared for this Supplementary Order Paper.