Telco Intercept Bill becomes law

UPDATE / Nov 5: The Telecommunications (Interception Capability and Security) Bill has passed its its third and final reading in Parliament this afternoon, 61 votes to 57.

-----------------

Mixed verdict on Adams' last-minute Telco Intercept Bill changes

Oct 15: ICT Minister Amy Adams has outlined a series of changes to the controversial Telecommunications (Interception Capability and Security) Bill, or "TICS" - which requires telecommunications companies to not just make their networks interceptable, but consult with the GCSB on upgrades and technology suppliers. 

Critics say fundamental flaws remain.

In a last-minute concession before the legislation goes back to Parliament today for its second reading, a Supplementary Order Paper (SOP) drops the controversial clause 39, which said a network operator must not offer an overseas service in New Zealand if its "lack of interception capability raises a significant risk to law enforcement or national security."

The clause was seen as a threat to the local availability of services like Google Hangouts, Facebook Messenger Microsoft Skype and Apple's iMessage.

In a submission, Telecom revealed that its customers were using such "over-the-top" services en masse, with May 2013 figures showing 150,000 used Apple’s iMessage service, 140,000 used Facebook messenger, 78,000 used Viber and 67,000 used Microsoft's Skype or Live Messenger.

"Tuanz is also pleased to see the back of the unenforceable Clause 39 which would have seen the government outlaw services that provide unbreakable security, such as Apple's iMessage service," Telecommunications Users' Association CEO Paul Brislen tells NBR.

"[But] the SOP doesn't address the issue of US-based companies, like Google and Facebook, which are prohibited by US law from sharing customer data with foreign intelligence organisations," he notes.

"This will mean major US-owned companies will have to decide whether to abide by US law or by NZ law. I know which they'll probably choose."

One of the legislation's harshest critics, Vikram Kumar, tells NBR, "The changes are positive for network operators [including the major phone companies] and shows the Government is listening to their major concerns. Notably, the changes are to make the law work better rather than a change in the provisions themselves."

But from a service provider perspective, there is zero change and all the negatives remain, the InternetNZ chief executive turned Mega CEO says.

"Disappointingly, the Minister makes no reference to what is not in the Bill - the planned use of secret orders to entities covered by the Bill." The government is playing down the potentially crippling burdens that can be placed on service providers with zero evidence that it is actually even required, Mr Kumar says.

Fundamental flaws remain
"There are a number of changes that are good and we welcome them, particularly around tightening up time frames for GCSB to respond to telcos wishing to make changes to network deployments," Mr Brislen says.

The best practice is to separate out the role of network security advisor from that of intelligence gathering, as having the two under one roof lead to immense tension within the organisation and a lack of trust from those on the outside, the Tuanz boss maintains.

"However, The SOP [supplementary order paper, doesn't address the fundamental problem of the new component of the Bill which is having an intelligence gathering service (the GCSB) maintaining oversight of atnational infrastructure owned by commercial entities," Mr Brislen says.

"Allowing the GCSB to decide when and how key network components can be updated and/or removed is fraught with difficulty. The SOP tries to ensure that telcos won't be left with no course of action should they disagree with the GCSB regarding any changes that are to be made, but it only goes so far as to give the Minister the final say. That won't be much comfort to telcos that want to use a Chinese network provider (for example) for a future upgrade to the network, but which finds itself on the wrong side of the GCSB's alliances."

No prizes for guessing the Chinese network provider that could be affected by the legislation. Telecom has chosen Huawei for its 4G network upgrade. The Chinese telco giant is already 2degrees primary network build partner, as well as providing equipment for parts of Vodafone's network and Ultrafast Fibre's leg of the UFB fibre rollout.

IT company a network operator? 
"This is very late in the day to be making changes without time for review," says NZ Rise cofounder Don Christie.

Mr Christie has previously said the legislation's wooly definition of a "network operator" is a threat to IT services company Catalyst, where he is a director, and others in the digital sector.

"It seems that the key issue for the NZ digital sector, the definition of 'network operator' has not been addressed," he tells NBR ONLINE.

"So we can assume this extraordinarily broad definition is now deliberate," he says.

"The irony of describing this new Bill as an attempt to update our legislation whilst retaining the - now very dated - definition of network operator is not lost on the local digital sector. While the rewording of clause 54 seems to allow the Minister to address some concerns we have raised this is only on a case-by-case basis, with unclear criteria, and doesn't give the industry any certainty."

Mr Christie is also still concerned about Clause 47, which while amendened, still requires consultation with the GCSB when a network operator wants to upgrade or replace equipment.

"Clause 47 still looks pretty horrible. Do our servers need to be authorised by the government?," he asks.

"If you have a look at the flow chart on page 2 of the second document [released by Amy Adams yesterday] you can see why digital companies, like Catalyst, have so much reason for concern."

The flow chart outlines a the multi-step process of keeping the GCSB during equipment upgrades, and seeking its approval. If companies like Catalyst are deemed network operators, they face a drawn-out, expensive process.

NZ Rise is asking the Minister to delay today's second reading of the legislation.

"Analysing the SOP against the Bill will take a little bit of time. One of our concerns was that despite this legislation being a response to significant changes in technology there has been very little consultation with technologists when it comes to drafting and updating definitions," Mr Christie says.

ckeall@nbr.co.nz