Spying, fake personas and rule breaking - MBIE cracks down on its investigators

Immigration investigators have broken the rules on using fake online profiles to spy on people's social media, and been ordered to shape up.

They are allowed to use fakes, and their use has been increasing, RNZ inquiries show.

But shortfalls came to light just last month in the controls over the use by the Ministry of Business, Innovation and Employment (MBIE).

Most of the social media it spies on is of travellers and refugees, to see if what they tell officials matches what their social media shows.

Fake persona use has grown from about 20 times a month in 2021, to 30 a month now - or almost 1500 times since 2021.

"False personas are used by a range of business areas across MBIE, including but not limited to MI [MBIE Intelligence], to support regulatory compliance, law enforcement and protective security activities," the ministry's chief data officer Puawai Wereta said in a new OIA response.

Read the Official Information Act response from MBIE here.

It has been mostly used in the immigration section (538 times since 2021) and refugee section (633 times since 2021).

By contrast, the Ministry of Social Development has this month, in a new policy for the first time, banned the use of false personas, after pausing it in 2021 when a review said it appeared "deceptive and underhanded".

MBIE got into trouble in 2019 when media revealed it had used a private security firm to train its staff on using fake personas. The Privacy Commissioner told the ministry off, commenting, "Social media data can help create a surprisingly comprehensive picture of a person or group."

Even so, since 2021, MBIE had not done a single audit of its use, Wereta told RNZ.

Trained staff are allowed to register an account on Facebook or the like, using a fake name and other details, to harvest information that "may be considered publicly available" but is subject to personalised privacy settings that require an account login to view. This was "to investigate and/or verify a specific individual", Wereta said.

It had to be authorised, and follow the rules.

But last month, a "rapid review" found that immigration section investigators were breaking the rules by not getting approval or registering the use properly, and on top of that, it found gaps across the ministry.

Immigration was told on 2 September to stop using false personas, till it can prove it adheres to the rules, the ministry told RNZ.

"The [Immigration] leadership team has instructed staff to stop using false personas following issues identified with the misapplication of the false persona levels, and corresponding approval requirements, by Investigators," they said.

In addition, it has begun an "expedited review into the procedures, to remedy some of the gaps into the centralised record keeping of false persona usage outside of business unit records, and the annual approvals process to use false personas".

However, other parts of MBIE have carried on using false personas.

In 2019, Shane Jones, who was at the time the Regional Economic Development Minister, said: "Kiwis should be able to go about their daily business without the fear of bureaucrats peering into their social media."

He declined to comment on Tuesday on its increased use since then.

The ministry says it uses false personas to protect its staff's identities, in investigations that included:

• Looking at the social media of temporary visa holders to check if their reasons for travelling match what they say in their applications. "Open source data is vital to building a picture of the risk that some passengers pose," the ministry said.
• In investigations of criminals engaged in human trafficking or exploiting migrants. "Investigations can be complex, and false personas are a tool that help identify and prevent exploitation."
• To check a person's back-story in the country they come from, for decisions about refugees, including giving them protection status.

Most temporary visa holders would not need a risk review, but if a risk was identified, "that's where a false persona may be one of the investigative techniques used", Wereta said.

Two other units used the personas: Data, insights and intelligence (218 times since 2021), and corporate and finance (69 times in that period). The other user, MI (MBIE Intelligence), has an agreement to share classified information with the SIS spy agency.

The ministry refused to release records of any individual false personas used.

Wereta said it was sometimes necessary to collect information this way "where other means of information collection would prejudice the purposes of collection, including an ongoing investigation".

Another two lesser levels of online investigating do not involve the fakes. [www.mbie.govt.nz/dmsdocument/14003-procedures-for-mbie-staff-using-social-media-for-verification-and-investigation-purposes-to-support-regulatory-compliance-and-law-enforcement-work-july-2019 The most invasive method], at level four, involved using a false persona to actively engage with a target, but that had been used just once since 2021, it said.

The practice was authorised, had three layers of checking-off, and internal rules.

Yet the rapid review found "misapplication" in the immigration section. "Staff acted in good faith," said Wereta, adding they had recorded the use in official journals, just not in the register as they should.

"The information collected by investigations staff misapplying the procedures will not be used as part of any prosecution into criminal offending."

RNZ has asked if this could jeopardise legal action.

The ministry is also required to live up to model standards set up by the Public Service Commission.

It could give broad assurance false personas were used properly, though "with some room to improve", Wereta said.

The ministry told RNZ in August it was setting up an automated register to keep track of what fake personas it used, as an "accountability tool".

It had not used a private firm for training since the contract expired in 2021, it said on Tuesday.