Tweaks to telco intercept bill leave catch-all definitions threatening IT sector

Tuesday 15th October 2013

Last-minute tweaks to legislation setting out the obligations for telecommunications firms to provide government surveillance agencies access to their networks has left in catch-all definitions that threaten to impose increased costs on the IT sector.

Communications Minister Amy Adams yesterday introduced a supplementary order paper to the Telecommunications (Interception Capability and Security) Bill offering token concessions to industry to allay fears the law will lead to prohibitive costs, such as dumping a provision that could outlaw foreign services and opening the door to increased oversight and strict timeframes in disputed cases.

The re-jig doesn't address the law's definitions of what constitutes a network operator, something Catalyst IT director Don Christie, with the support of local IT lobby NZRise, says is so broad as to essentially capture anyone in the sector, and wrote to the minister outlining industry's concerns after submissions on the bill closed.

Adams tried to soothe those concerns saying in a Sept. 24 response the definitions were unchanged from the existing legislation and that small operators with 4,000 or fewer end-customers would face reduced obligations.

Still, Christie said that broad meaning "creates huge uncertainty and therefore business and investment risk for anyone in the New Zealand ICT industry or considering entering it."

"The obligations of network operators in the TICS bill are very onerous," Christie said in an Oct. 9 letter to the minister. "Many non-traditional telco businesses will technically and financially be unable to comply with those obligations so will be faced either with being in breach or curtailing their activities."

That broad definition is also picked up in a legal update by law firm Buddle Findlay, which says the meaning might include other bogies that "happen to provide calling services, email or the internet to some part of the public."

Christie's fear is that the uncertainty will erode investment in research and development, create a level of risk aversion that undermines the wider IT sector.

Ministry of Business, Innovation and Employment officials didn't consider the economic impact of the proposals on IT companies, saying no analysis was done specifically on that sector as "the policies do not relate to IT companies unless they are actually providing telecommunications services to end-users in New Zealand," it said in a response to an Official Information Act request lodged by David Robinson and published on the fyi.org.nz website.

Today Christie sent an open letter on behalf of NZRise to Members of Parliament urging them to vote against the bill's second reading and "remove the potential ambiguity and uncertainty that will have a negative impact on our sector's profitability and ability to innovate."

The bill aims to set out the obligations on telecommunications companies to offer interception capabilities on their networks to surveillance units, including the Government Communications Security Bureau, Security Intelligence Service and police, and oblige them to engage with those agencies about potential risks to the country's national security when building and running their networks.

The proposed law defines a network operator as an entity that controls a public telecommunications network, or a wholesale or retail supplier of telecommunications services.

Whereas its predecessor legislation only imposed the obligations on network operators, the rewrite also allows the minister to decide whether over-the-top service providers will have to be intercept-ready.

The re-write aimed to catch up with developments in the wider industry, which MoBIE officials predicted would lead to disproportionate investment by network operators relative to their size, and unnecessary complexity with needless exemption applications if the status quo was retained, according to their regulatory impact statement.

In their department report to the select committee reviewing the bill, MoBIE officials ignored calls to provide greater clarity on the definition, saying the meaning was unchanged, and that "existing obligations on network operators have been successfully implemented by telecommunications companies using the present definition."

The interception legislation was tabled in conjunction with law to iron out definitions of disputed powers for the GCSB in the government's expansive plan to centralise its approach to cyber-security, seen as the most dynamic parts in the intelligence sector, in a bid to reduce the estimated $625 million annual bill stemming from cyber-crime.

That move coincided with growing international unease over US intelligence agencies' data mining of electronic information from third parties. Washington-based think-tank the Information Technology & Innovation Foundation estimates will cost US cloud computing providers between US$21.5 billion and US$35 billion by 2016 as consumers shift their preference to European and Asian competitors.

BusinessDesk.co.nz

Comments from our readers

No comments yet