17 April 2013


The NZ Government has released a redacted version of the Kitteridge Report [PDF], ie the inquiry by Rebecca Kitteridge into the Government Communications Security Bureau (GCSB) - counterpart of Australia's DSD and the UK's GCHQ.

GCSB Director Ian Fletcher indicates that he accepts all of Kitteridge's recommendations and is implementing them.
Within GCSB we are already following the report’s recommendations as quickly as we can. Many of the issues are longstanding and there are some that will take longer than others to address appropriately.
The structure of the GCSB has been reviewed and the functions of senior management are being addressed. We are increasing the legal and compliance teams, with a new chief legal adviser in place, and recruitment of other legal staff is in hand.
Fletcher acknowledges
a longstanding lack of good systems and processes in relation to compliance, as well as underlying organisational problems for GCSB. 
The advice we have recently received from the Solicitor-General is that there are difficulties in interpreting the legislation, and there is a risk that some long-standing practices of offering assistance to other agencies would not be found to be lawful.
Longstanding dates from at least 2003.

Fletcher comments that
I will be reporting publicly each quarter on our progress in delivering the review’s recommendations. You will be seeing and hearing more from us.  
Despite the systemic problems, I am proud of the commitment that staff have to their work, the organisation, and to protecting New Zealand and New Zealanders. The review notes that staff find the idea of unlawful activity, whether by error or deliberate act, abhorrent and they have a strong commitment to comply with the law. We take our responsibilities very seriously. 
We are working together to ensure the Government Communications Security Bureau is an organisation in which the public can again have trust and confidence.
That trust might be more solid if Fletcher's media release hadn't been so elliptical about the agency having "unlawfully intercepted communications of two New Zealand residents", ie elsewhere characterised as public acknowledgement "that GCSB had undertaken unauthorised surveillance of Mr Kim Dotcom, his family and an associate".