MBIE began paying Israeli-turned-US firm Cobwebs Technologies in March 2020 but first used it on a live case in April 2022. Photo:
An Immigration NZ team targeting mass arrivals by asylum-seekers paid for spyware for two years without using it.
The Ministry of Business, Innovation and Employment began paying Israeli-turned-US firm Cobwebs Technologies in March 2020 but first used it on a live case in April 2022.
"MBIE began paying for the Cobwebs tools in March 2020 and has continued to pay for the licences since the beginning of the contract term," the ministry told RNZ in an Official Information Act response.
It started off by testing the web-scraping tools, then in December 2020, began developing "a robust assurance framework and processes to mitigate any risks" around using them.
Yet an earlier OIA showed that even after 2022, the tools were used three times when the ministry had no one trained to monitor them.
A monitoring group was not set up till February 2023; it concluded after its first checks in April, that the previous uses of Cobwebs had been justified.
The ministry refuses to say what it spends on Cobwebs, and also refused for months to say what it was used for, until last month, when it told RNZ it wanted to reassure the public the service was procured and used exclusively to detect and prevent mass arrivals by asylum-seekers - boat people.
There has never been a substantive risk of a mass arrival here by boat but Cobwebs has been deployed six times since April 2022.
The government's use of the tools occurs outside the controls and scrutiny imposed on the New Zealand Security Intelligence Service (SIS) and Government Communications Security Bureau (GCSB) security and intelligence agencies.
It is part of a global trend of public agencies contracting in private spyware companies.
"Demand for spyware technology remains extraordinarily high, whether from government clients or private companies," said a March 2023 paper for the Carnegie Endowment for International Peace.
Commercial spyware allowed governments to break the types of encryption that might stymie their own systems, the paper said.
"Spyware's prevalence in Europe, both as a tool of export and as an instrument of domestic surveillance, is a powerful reminder that surveillance abuses are not unique to authoritarian regimes."
Authorities have been embroiled in spyware scandals in Greece, Hungary and Spain, which targeted Catalan independence activists.
Cobwebs shares its origins in Israeli Defence Force operatives, with the most controversial spyware-for-hire tech, Pegasus, that investigations showed had been used to target politicians, human rights activists and journalists.
Cobwebs tools are used in New Zealand by a second public agency, unnamed in MBIE documents, but believed to be the police, though they would not confirm this.
Cobwebs Technologies was linked up in July with PenLink, a Nebraska firm, both owned by an investment firm, Spire.
"Combining our solutions will empower law enforcement and national security agencies to bring all digital intelligence domains into a single unified platform to drive new levels of insight and efficiency," PenLink said.
MBIE said it had no contract with PenLink.
"Both companies are owned by the same parent, however, we do not consider that this links MBIE with Penlink," it told RNZ.
It put the lack of use of the new tools in 2021 up until April 2022, down to "negligible demand for maritime mass arrival prevention and/or detection-related work during this time due to the global Covid-19 pandemic and the associated health risks to irregular migrants attempting any maritime ventures".
"Limited use of Cobwebs restarted from 11 April 2022 as activity increased within Immigration New Zealand's Irregular Migration Programme."
The team that uses Cobwebs is part of MBIE Intelligence or MI, which used to be confined to Immigration NZ but has recently spread throughout the ministry, and "established a specific intelligence capability which focuses on national security and intelligence". The government denied MI had a national security focus.
The ministry refused to even provide a "ballpark" figure for what Cobwebs costs taxpayers.
"We have specifically considered the need for the government to provide information to promote transparency, and to promote accountability for the use of public funds in using the Cobwebs tools," it told RNZ.
"While we consider there is merit in releasing information for these reasons, on balance, it is our view that the impact of the release of this information at this time outweighs the need to promote transparency and accountability for the use of public funds. This is because release is likely to have a substantial impact on MBIE's ability to prevent and detect a mass arrival, by prejudicing the commercial position of Cobwebs Technologies, and MBIE being able to effectively negotiate for the provision of tools that allow it to fulfil its obligations in this area, due to the contract ending in April 2024."