Cheryl Gwyn Inspector-General of Intelligence and Security—written evidence

Introduction

1.              Thank you for the opportunity to submit this evidence. The submission outlines the functions and powers of the New Zealand Inspector-General of Intelligence and Security (Inspector- General) and how my role relates to other authorisation and oversight mechanisms within the New Zealand system. I hope it may provide useful comparative material to inform the Joint Committee’s consideration of the role of the proposed Investigatory Powers Commission.

2.              I do not seek to comment on the policy or specific provisions of the Draft Investigatory Powers Bill.

Intelligence and security oversight framework

3.              In New Zealand, as in other jurisdictions, the framework of oversight for the intelligence and security agencies has a number of elements and layers:

3.1                    The Directors of the agencies: the Directors authorise the use of certain intellligence- gathering powers against statutory criteria and, when applying to exercise further powers under warrant, must apply on oath.

3.2                    The responsible Minister(s): the Minister in charge of each of the intelligence and security agencies is accountable to Parliament for the general conduct of the agencies. The Minister is also responsible for authorising the exercise of specified intrusive powers, by way of warrant or authorisation.

3.3                    The Minister for National Security and Intelligence: a non-statutory portfolio first assigned in 2014; leads the national security sector and sets the overall framework within which the agencies operate.

3.4                    The Commissioner of Security Warrants: the Commissioner has a joint role with the Minister responsible for the Government Communications Security Bureau (GCSB) in authorising interception warrants or access authorisations if anything is to be done for the purpose of intercepting New Zealanders’ private communications and a joint role with the Minister in charge of the New Zealand Security Intelligence Service (NZSIS) for domestic intelligence warrants, where the warrant relates to a New Zealand citizen or permanent resident.

3.5                    The Intelligence and Security Committee (ISC): the ISC is a statutory committee,[1] rather than a committee of Parliament as select committees are, but its members serve on the ISC in their capacity as Members of Parliament. The ISC consists of the Prime Minister, the Leader of the Opposition, two Members of Parliament nominated by the Prime Minister after consultation with the leader of each party in any government coalition and one member nominated by the Leader of the Opposition, with the Prime Minister’s agreement, after consultation with the leader of each party not in government or in coalition with a Government party. The ISC’s principal responsibility is to examine the policy, administration and expenditure of each intelligence and security agency.

3.6                    The Inspector-General of Intelligence and Security.

3.7                    Institutions such as the Controller and Auditor-General, the Privacy Commissioner and the Office of the Ombudsman.

4.              The New Zealand intelligence and security agencies can also be, and from time to time are, subject to judicial review and other proceedings before the general courts. There is some specific provision for closed hearings in those courts. There is no New Zealand counterpart to the Investigatory Powers Tribunal.

Role of the Inspector-General of Intelligence and Security

5.              The principal external oversight body is my office, the Office of the Inspector-General of Intelligence and Security.

6.              The Inspector-General and Deputy Inspector-General are appointed by the Governor-General on the recommendation  of the Prime Minister following consultation  with  the ISC.[2] The Inspector-General’s appointment is for a term of three years, with one possible renewal.[3] Removal or suspension from office is by the Governor-General, upon an address from the House of Representatives, for disability affecting performance of duty, bankruptcy, neglect of duty, or misconduct.[4]  Leaving aside the term limit, the protections as to grounds and process of removal are similar to those for Judges of the High Court.[5]

7.              The role of the Inspector-General was significantly strengthened in late 2013.[6] Previously the Inspector-General had to be a retired Judge, the position was part-time and the Inspector- General had very limited resources and no  investigating staff. Under the amendments it became a fulltime role; appointment is no longer limited to former Judges, and the powers and resources of the office now more closely match the mandate.

8.              I have held office as Inspector-General since May 2015. I am not a Judge and  have not previously held judicial office. Prior to appointment I was a civil litigation lawyer, with fifteen years experience in private practice and ten years acting for the Crown, as Deputy Solicitor- General. I also have experience in a senior public sector policy position.

9.              The role of the Inspector-General under the Inspector-General of Intelligence and Security Act 1996 is to “assist” the responsible Minister[7] to ensure that each intelligence and security agency for which he or she is responsible complies with the law. My role is defined functionally, rather than in terms of specific agencies or particular powers. As presently defined, intelligence and security agencies are the New Zealand Security Intelligence Service (NZSIS) and the Government Communications Security Bureau (GCSB).[8] Any other agency may be declared by the Governor-General from time to time by Order in Council as an intelligence and security agency for the purposes of the Inspector-General of Intelligence and Security Act 1996.[9]

10.          The Inspector-General does not have a direct reporting relationship to the ISC, but may at any time, with the concurrence of the Prime Minister, report either generally or in respect of any particular matter, to the ISC[10] and the ISC may “consider and discuss with the Inspector- General his or her annual report as presented to the House”. The ISC does not have power to request the Inspector-General to undertake an inquiry. The ISC is precluded from inquiring into any matter within the Inspector-General’s jurisdiction.[11] I have appeared periodically before the ISC.

Jurisdiction

11.          As Inspector-General I have jurisdiction to:

11.1                 receive complaints from the public, current and former staff members of the intelligence and security agencies.[12]  Complainants must show that they have been or may be “adversely affected” by any act, omission, practice, policy or procedure of the GCSB or NZSIS. Complaints must be independently investigated.[13] The IGIS is also the nominated authority for  the purpose of receiving protected  disclosures (“whistleblowing”) from employees of an intelligence and security agency;[14]

11.2                 initiate inquiries at the request of the Prime Minister or the Minister responsible, or on my own motion, into the legality and/or propriety of the actions of the intelligence and security agencies.[15] “Propriety” is not defined in the legislation but is clearly intended to have a broader reach than pure legality;[16]

11.3                 I am obliged to report publicly on all of my inquiries, including inquiries into complaints (subject to security constraints and excepting reports concerning employment matters and security clearance issues).[17] Inquiry reports must be provided to the responsible Minister and the Chief Executive of the agency concerned;[18]

11.4                 review the agencies’ internal systems with a view to certifying annually whether their compliance systems are “sound”. In doing so I apply a “positive assurance” approach, that is, I examine what compliance systems and controls are in place; examine a sample of each agency’s actions (except in the case of warrants and authorisations, all of which are scrutinised – see below); and apply a materiality threshold;

11.5                 review interception and intelligence warrants and authorisations. All of the GCSB interception warrants and access authorisations and  all NZSIS  domestic and  foreign intelligence warrants are reviewed. Some of those warrants are selected for deeper analysis – a comprehensive check of the process and path by which the application for the warrant or authorisation was formulated (ie what was the intelligence case and whether other requirements, such as comprehensive disclosure, were met), to the application signed by the Minister (and Commissioner of Security Warrants where required), review and cancellation/non-renewal or renewal of the warrant, what intelligence was collected under it, what use was made of that intelligence, what arrangements were in place for retention and storage, and destruction of the information collected. We make recommendations to improve systems and procedures and sometimes identify a failure to meet the requirements of the legislation.

12.          My role is ex post facto; I do not have any responsibility for directing or approving operations or warrants. This approach does not preclude the agencies briefing me on planned or ongoing operations. Although it is not my role to approve or authorise, there are situations where prior discussion with my office can help to ensure clarity about the legality and propriety of any planned activity.

13.          In my experience there is considerable value in having one oversight body which covers a range of functions, across all intelligence and security agencies. Information and insights obtained in carrying out one function frequently inform another. For example, investigation of specific complaints made by individuals has provided a detailed insight into general operational issues and systemic problems, and I have then been able to take up those general or systemic issues under my wider functions.[19]

14.          Likewise, knowledge obtained through my broader oversight functions informs my judgement on complaints. Questions or issues that arise in respect of one agency may inform my approach in  respect of the other agency. While New Zealand’s intelligence and  security agencies are understandably small in scale, their activities are nonetheless complex and raise many of the same issues faced by such agencies in larger jurisdictions. The breadth of functions and powers under the IGIS Act enables me and my staff to acquire and maintain a comprehensive understanding of those activities.

Rights of access; investigative and remedial powers

15.          The Inspector-General’s powers are coupled with a right of access to all security records held by the agencies and a right of access to all of the agencies’ premises, ICT systems and staff.[20] The quid pro quo for that privileged access is that my staff and I are subject to the same constraints on receiving, holding and using classified information as are intelligence and security agency staff. We must all be security cleared to the highest level. Security clearance vetting is carried out by the NZSIS, which has the statutory mandate to conduct all vetting. We work in a SCIF (secure compartmented  information facility) and follow the same security measures as agency employees.

16.          In the case of inquiries, I have strong investigative powers akin to those of a Royal Commission, including the power to compel persons to answer questions and produce documents and to take sworn evidence.[21] My proceedings, reports and findings are challengeable only for lack of jurisdiction.[22]

17.          I have recommendatory powers only, including the recommendation of remedies that involve the payment of compensation.[23] In addition to the persuasive effect of my findings at the level of the agencies themselves, Ministers and/or the public and the possibility of indirect enforcement by court proceedings based on an inquiry report, the IGIS Act also specifically provides that, where I have made recommendations, I can subsequently report further on whether those recommendations have been met.

Public education

18.          It is also, in my view, part of the Inspector-General’s role to help the public to understand the powers and activities of the agencies – and the limitations and controls on those powers. To that end, in addition to publishing reporting on all inquiries, my office has a website (www.igis.govt.nz) and a Twitter address (@igisnz) and  I look for  opportunities for public engagement to talk about the work of the office.

19.          It is not for the Inspector-General to seek to increase public confidence in the agencies but if, over time, the public can see that there is robust and independent oversight and that the agencies and their Minister(s) respond to criticisms and recommendations, then one would expect public confidence to grow.

Funding, staffing and administrative support

Funding

20.          The Inspector-General’s office is funded through  two  channels. The first is a Permanent Legislative Authority (PLA) for the remuneration of the Inspector-General and  the Deputy Inspector-General.[24] The second is the operating costs of the office which are funded from Vote: Justice (Equity Promotion and Protection Services), as part of the Ministry of Justice’s non-Ministry appropriations.

21.          Pursuant to Cabinet direction the capital costs of establishing the expanded IGIS office (following the 2013 legislative changes)  and its operational costs were funded from reprioritising existing New Zealand Intelligence Community baselines. It would not be appropriate in the longer term for the agencies which are being monitored to have to fund the oversight body.

Staffing

22.          The Inspector-General may appoint such staff as necessary, but must consult with the Chief Executive of the Department of the Prime Minister and Cabinet as to staff salaries and allowances.[25] My office currently comprises the Inspector-General, Deputy Inspector-General, four Investigating Officers, an IT Manager/Security Advisor and an Executive Assistant/Office Manager. All are fulltime roles. Of the current Investigating Officers, one is employed on a permanent basis and three are seconded  from other government agencies (New Zealand Police, New Zealand Customs Service, Inland Revenue). The secondments have enabled me to procure a range of essential investigative and analytical skills.

23.          Effective oversight of the agencies’ use of current and developing technologies requires a sufficient understanding of those technologies by the oversight body, whether through the knowledge and expertise of our own staff or by access to external technical experts. My office has an IT expert but we also rely on agency expertise. While the agencies are generous with their time it is important for the credibility of the Inspector-General’s office as an independent oversight body, and the ability to ask necessary searching questions, that  we continue to develop our own knowledge and expertise.

24.          The current operating costs of the office are approximately $1.5m per annum in total, including staff costs and the cost of operating secure systems and premises. As at May 2015 when I discussed this question with the ISC, a crude calculation indicated that the Inspector- General had the equivalent of just under 1% of the staff and budget of the two agencies for which I have oversight responsibility. That percentage remains at a similar level. It is not fixed in policy or in legislation.

Advisory panel

25.          I am supported by a two member statutory advisory panel.[26] The panel members have appropriate security clearances to enable them to have access to, and discuss with me, the classified material held by the NZSIS and the GCSB that my office must consider in order to carry out our review, inquiry and audit functions.

Administrative support

26.          Ongoing administrative support, including finance and human resources advice, is provided to the Inspector-General’s office by the Ministry of Justice. The New Zealand Defence Force provides standalone secure offices (separate from the agencies’ premises) and also provides IT support, both on a cost recovery basis.