What is interception?
Under the TICSA, to ‘intercept’, in relation to a private telecommunication, “includes hear, listen to, record, monitor, acquire, or receive the telecommunication while it is taking place on a telecommunications network; or while it is in transit on a telecommunications network”. Surveillance agencies can only undertake an interception when acting under a lawful interception power or authority.
What level of interception capability do I need to have?
Network operators should make themselves familiar with the Interception Capability Duties detailed in Part 2 of the TICSA. Sections 9 and 10 of the Act detail the primary duty of network operators to have full interception capability, in respect of every public telecommunications network that the network operator owns, and every telecommunications service that the operator provides in New Zealand.
Sections 11 to 20 of the Act detail the lesser duties that may apply to certain classes of network operators and services.
The duty to be interception ready applies to network operators with an average of fewer than 4,000 customers over a 6 month period as long as certain criteria are met. An interception ready network operator has the requirement to pre-deploy access points and reserve facilities to allow an interception warrant or any other lawful interception authority to be given effect.
The duty to be intercept accessible applies to wholesale network services provided by a network operator. When presented with an interception warrant or any other lawful interception authority a network operator must be willing and able to provide a suitable access point and facilities for interception equipment.
Infrastructure-level services are not required to be fully interception capable but network operators must advise the Registrar of the names of the customers that purchase these services (section 23).
How do I know if I’m compliant?
It is the responsibility of the network operator’s Chief Executive to satisfy himself/herself that the company is compliant. A Designated Officer may require a certification and/or testing to be carried out. The Registrar can provide advice on compliance testing.
Are there are any standards/specifications that should be followed for interception?
Defined as ‘useable format’, this is either
- a format that is determined by notice in the New Zealand Gazette https://gazette.govt.nz/notice/id/2017-go4175
- a format that is acceptable to the network operator and the surveillance agency executing the interception warrant or lawful interception authority.
What is a ‘duty to assist’?
When presented with a lawful authority to intercept (by a surveillance agency) a network operator or service provider is required to provide the assistance necessary to carry out that interception. More detail about what a "Duty to Assist" entails can be found in section 24 of the TICSA.
How will I know I’ve been served with a Lawful Warrant or Authority?
For NZ Police Surveillance Device Warrants:
A copy of the surveillance device warrant will be provided to an authorised person of the network operator or service provider. In some situations of emergency or urgency the Police may use a surveillance device without warrant for a period not exceeding 48 hours. In these circumstances a representative of Police will contact the authorised person of the network operator or service provider.
An authorised person means ‘any person authorised to execute or assist in the execution of an interception warrant or other lawful interception authority’.
For NZSIS Interception Warrants:
The warrant will be shown to the chief executive (or their delegate). It will clearly state that it is a warrant authorising interception and will be signed by the Prime Minister and, in the case of a domestic warrant, also by the Commissioner of Security Warrants.
The warrant itself is a classified document so will not be copied, though the chief executive will be provided with a certificate, signed by the Director of Security, identifying that the warrant has been served.
For GCSB Interception Warrants or Access Authorisations:
The Interception Warrant or Access Authorisation will be shown to the chief executive (or their delegate). It will clearly state what actions are being authorised and will be signed by the Minister responsible for the GCSB and, in cases that authorise access to the private communications of New Zealanders, also by the Commissioner of Security Warrants.
The Interception Warrant or Access Authorisation itself is a classified document so will not be copied, though the chief executive will be provided with a letter, signed by the Director of GCSB, identifying that the Interception Warrant or Access Authorisation has been served.
Do I need a security clearance?
Where necessary, a Designated Officer (or surveillance agency) may request a network operator to nominate a suitable employee(s) to apply for a security clearance. Not all network operators will require staff to undergo a security clearance, but those having more frequent interaction with the agencies may be requested to have a number of key employees cleared to SECRET level. These clearances will generally be managed by NZ Police. Occasionally a surveillance agency may ask to have certain employees security vetted and cleared to a level consistent with the tasks they may perform or the information they may handle.
The network operator should keep the vetting agency appraised of any factors that may impact on an employee's security clearance, e.g. a change in job role where the clearance is no longer needed.
When nominating employees to be cleared, network operators should consider:
- the position of those people within their organisation;
- the minimum number of people required to be cleared to respond to a request for interception; and
- whether the nominated employees hold sufficient technical knowledge to carry out their interception role.
Network operators should only nominate staff they believe are likely to obtain and maintain a clearance, and to nominate as few employees as possible to sufficiently support their organisation in fulfilling this function.
As a guide, nominated staff should be New Zealand citizens who have lived in New Zealand for at least 10 years.
Can I share interception capability resources?
Network operators may co-ordinate, share or contract for services (equipment or staff) in order to meet the interception capability requirements in the Act. However, it remains the responsibility of the network operator to ensure that any such arrangement does not affect any obligations that apply under the Act. Before entering into any such arrangement a network operator must notify the Director of the GCSB.