Security fears drive requirements for telecom network surveillance

With national security a topic of increasing importance in recent years, it is pertinent to discuss a development in New Zealand telecommunications law will make it easier for police and other agencies to monitor and intercept telecommunications when security concerns arise.

The New Zealand Government has taken certain steps in recent years to bring New Zealand's law around the lawful interception of communications up to speed with other countries.

New Zealand's current legislative regime gives police and other surveillance agencies the authority to intercept, and collect call-associated data on telecommunications under a warrant. The Telecommunications (Residual Provisions) Act 1987 provides a legislative requirement for telecommunications network operators to assist in carrying out such interception.

However, at present there is no legislative obligation to require network operators to ensure that public telecommunications networks and data networks are technically able to intercept telecommunications and data when the need arises. The Bill addresses an apparent need to upgrade and make consistent the interception capabilities of these networks.

In 2002, the Government introduced new legislation in the form of the Telecommunications (Interception Capability) Bill, which is being heard under urgency and is expected to be passed in early 2004.

At the time of writing, the Law and Order Committee has reported back on the Bill, recommending it be passed with certain amendments. The Bill obliges telecommunications network operators to upgrade their telecommunications network systems and data network systems where necessary to ensure that, if required, they are able to intercept telecommunications - including emails, the internet and mobile phones.

Further, the network operators will have a duty to assist the police and the surveillance agencies if they have a warrant to intercept telecommunications. This "duty to assist" has been the subject of some debate, as in its present form it appears to be a wide-ranging obligation and operators are concerned to know what it entails.

The introduction of this legislation will draw New Zealand more closely into line with similar legislative obligations in Australia, Canada, South Africa, the United Kingdom and the United States.

The important difference between the Bill and similar legislation in other countries is that the Bill only deals with obligations to assist with the interception of telecommunications. The Bill does not change or broaden the existing powers of the police and surveillance agencies to intercept telecommunications.

In the Bill, interception includes the ability to hear, listen, record, monitor, acquire or receive a telecommunication. The network operator must ensure that its system is able to, and that it assists with, obtaining call associated data and the content of telecommunications in a form that is able to be used by the surveillance agency.

The network operator is also required to decrypt encrypted communications, if it provided that encryption. The Law and Order Committee has recommended that this obligation be clarified, carving out the network operators' responsibility to decrypt where the network operator simply provided an "off the shelf" encryption product to a customer, to which the network operator does not have the private key.

In carrying out any interception on behalf of the surveillance agencies, the network operator is under an obligation to ensure that such interception is unobtrusive, does not unduly interfere with telecommunications and protects the privacy of telecommunications that are not authorised to be intercepted by the warrant.

Telecommunications network operators must ensure that public telecommunications networks have operational interception capability within 18 months of the date of commencement of the legislation, and that public data networks have operational interception capability within five years of the date of commencement of the legislation.

The Government will pay all costs related to the provision of interception capability for fixed and mobile voice networks that were operational on 12 November 2002. Network operators providing fixed or mobile voice networks that were not operational on that date will need to meet their own costs of the provision of interception capability. Network operators will need to meet their own costs of providing interception capability for internet and email services.

The Bill currently provides that the actual and reasonable costs incurred by a network operator in providing interception assistance to a surveillance agency must be paid for by that surveillance agency. This is similar to the system in the United States but such a requirement is not part of the legislative regime in the United Kingdom.

The Law Commission, in its report on new legislation, recommended payment in some cases but not merely as a matter of right, so it will be interesting to see whether this provision remains in the legislation in its current form.

Whilst it will be beneficial for network operators to receive payment for the costs incurred in assisting with the interception of telecommunications, the costs in installing and maintaining systems that enable the interception of telecommunications in an industry in which technological advances are continuously being introduced could be a significant financial burden.