The Security Intelligence Service has been using a deal set up under outdated laws to surveil people on closed circuit TV or CCTV cameras in Auckland for years.
Photo: pixabay
But the minister in charge of the Security Intelligence Service says he's assured the operations are lawful.
The SIS's use of CCTV has been classified as so secret that even the provider of the camera network it uses has not known much about it.
But now that use has been declassified, and features in a new report by the Inspector-General of Intelligence and Security.
This shows the SIS did a secret deal four years ago to access the camera footage, probably from Auckland Transport, which has neither confirmed or denied this.
Spies use CCTV to track specific people and assess threats, with operations mostly done under proper warrants.
The report shows the SIS can take over the cameras and manoeuvre them remotely.
The city councils in Christchurch and Wellington, and Auckland Council, all say the SIS is not using their camera networks.
But Auckland Transport, which as of last year had about 5000 traffic cameras, did not deny it, instead referring to the mosque attacks as evidence of the threats.
"Auckland Transport cares about the safety and security of the public and like any transport agency in a global city, it's incumbent on us to work with police and security agencies to keep New Zealand safe," its chief executive Shane Ellison said in a statement.
"We note that the Inspector-General of Intelligence and Security finds the current use of CCTV is lawful and conducted in a responsible and proper manner."
The Inspector-General Brendan Horsley said the SIS was not using CCTV to conduct mass surveillance.
But he has also told the agency it should get Crown Law advice on the "difficult and unresolved questions" of the "legal basis" of accessing the footage.
It is not clear what it or Auckland Transport would have to do if the legal basis is found wanting.
The problem is a memorandum of understanding deal (MOU) between the two.
Privacy Commissioner John Edwards, who has talked with the Inspector-General, said that the MOU is outdated.
"The MOU was entered into under an earlier legal authority, and has not been updated to reflect the change," Edwards said.
"I don't know why this one didn't get on to some schedule and get updated in the same way as other kind of instruments."
The old law was looser; before 2017, the SIS could go to any agency to ask for information and assure them they would not breach the Privacy Act by handing it over.
But since 2017, every agency must satisfy itself that it is authorised under the Act to help the SIS with surveillance.
All parties needed to stay updated with current laws - and the Inspector-General's oversight had picked up that this had not happened, Edwards said.
"It demonstrates the system working as it should.
"It's caught out something which ... hasn't been updated. And that's not ideal.
"But as far as I'm aware, it hasn't resulted in any harm, and it hasn't resulted in any unwarranted or disproportionate intrusion into privacy."
Minister Andrew Little said it is correct that the deal has not been updated.
However, he repeated several times the Inspector-General's finding that looking at the CCTV footage was lawful.
"It was a somewhat technical legal issue, but it did not go to the lawfulness of the services operations," Little told RNZ in an interview.
"I can only assume that because that [MOU] predates the current legislation under which the agencies operate, that relates to something to do with that transition between different types of legislation."
The SIS echoes that, adding in a statement it is seeking advice from Crown Law to clarify a "specific aspect" of its operations.
The Inspector-General's report also shows the agency did not do a privacy impact statement before starting to use CCTV, and only did one recently.
The Green Party's human rights spokesperson, MP Golriz Ghahraman, said this fitted with the SIS's track record of "doing things that may breach our rights to privacy, and then checking later if they in fact do".
"In this case, it's a city centre and it's CCTV - that could impact on a whole lot of people," Ghahraman said.
John Edwards said the SIS was not legally obliged to do a privacy impact assessment, and agencies often did such assessments quite competently in-house.
He understood the agency began the assessment after the Inspector-General began his review.
The new report notes CCTV was used in only 15 percent of physical surveillance operations, and that so far the SIS has not retained any footage.
It said the SIS should look again at its operating procedures which assume that anything happening in a public space was fair game for surveillance, which was "incorrect".
An expert in facial recognition surveillance, Associate Professor Nessa Lynch of Victoria University, said the case highlighted "again that the law and regulation of surveillance in a public space is quite an uncertain issue".
At least the SIS had a ministerial policy statement on such surveillance, unlike some other government agencies, she added.
Auckland Council told RNZ it did not provide access to security camera footage to the SIS.
"If agencies like the Police require footage for investigation purposes, they apply to us on a case-by-case basis," it said.