Some people got in touch asking me to clarify my recent tweet, “Sadly #TICS Bill submissions I’ve seen ignore/misunderstand duty to assist as over and above interception. Complex stuff.”
This is important to understand to get a full view of the powers government is legislating for itself and what it means for New Zealanders.
The duty to assist provisions are in clause 24 of the Telecommunications (Interception Capability and Security) Bill. The duty to assist is the obligation to identify and intercept telecommunications as well as providing call associated data and content of the telecommunication in response to a warrant or other lawful interception authority. These must be in real-time or near real-time as possible.
1. It applies to all network operators and service providers, regardless of whether they are operating from within New Zealand or overseas.
2. The duty to assist is separate and in addition to the lawful interception capability obligations imposed on network operators and, at the direction of the Minister or Cabinet, on a service provider. To be clear, a service provider has the duty to assist obligations even if it is not otherwise covered by the legal interception capability requirements.
3. It comes into force as soon as the law does (6 months after receiving Royal assent), which means service providers have obligations straight away, distinct and separate from possible additional network operator type interception capability obligations that may be imposed over time.
4. Any ‘surveillance agency’ can demand assistance when issued a warrant or other lawful interception authority. This includes both law enforcement agencies as well as intelligence/security agencies.
5. The network operator could do the interception on behalf of the surveillance agency. No interception equipment may therefore be required.
6. Information must be provided in the specified format.
The network operator or service provider must assist the surveillance agency by taking all reasonable steps that are necessary to “decrypt telecommunications where the operator or provider has provided or applied the encryption.” Further, they “must consult with the surveillance agency executing the warrant or lawful authority, regarding the most efficient way to undertake the decryption.”
While at first glance the decryption requirements seems similar to those required under interception capabilities (clause 10), there are in fact significant differences in the actual wording. Specifically, the decryption requirements in the case of the duty to assist could be interpreted to be far more oppressive than those in the case of lawful interception.
For example, the words could require a service provider to decrypt telecommunications in all cases where it has “provided or applied the encryption”, whether or not it is able to actually do so.
This seems to be counter to the intentions of the Bill. Mega has made exactly that point in its submission on the Bill.
While much of the debate on the Bill has been about interception capability and GCSB’s involvement in network design/procurement, the duty to assist has not received much attention. Nevertheless, the duty to assist applies to all network operators and service providers.
It is likely but unclear whether “lawful interception authority” includes warrantless interception under the GCSB Bill. If it does, it means that GCSB can demand a service provider intercept and hand over metadata as well as content of the communication without a warrant (as no interception device is required) even if the service provider does not have an interception capability requirement.
New Zealanders using online services should be aware of the duty to assist provisions as they apply to all network operators and service providers, whether located in New Zealand or not, as soon as the law comes into force.
That leaves open the question of how service providers operating outside New Zealand are going to respond to this imposition. For those within New Zealand, there really is no choice if the Bill’s duty to assist provisions become law.