Government Communications Security Bureau. (File photo) Photo: RNZ / Samuel Rillstone
The Government Communications Security Bureau says it did not host a foreign spying capability that has come to the watchdog's attention, prior to a system it did host and got castigated for by leading politicians.
The electronic spy agency has also refused to answer questions made under the Official Information Act (OIA) about a third "partner" system that caused concerns four years ago, and what that system did, on security grounds.
In March, the watchdog Inspector-General of Intelligence and Security revealed the GCSB hosted a spy operation under the control and direction of a foreign power without telling the government, from 2013 to 2020.
Its report said there was also a "predecessor" capability that the GCSB was familiar with.
In an Official Information Act response, the GCSB director-general Andrew Clark said: "I can advise that the predecessor capability was not hosted by the GCSB.
"Accordingly, questions of approval or control are not relevant in this case."
Clark withheld further details on the grounds it could prejudice New Zealand's security or defence, or prejudice how information was entrusted to the government by another government or foreign agency.
Inspector-General Brendan Horsley in his report also talked about a third "partner system".
It was internal concerns about this third system in 2020 that led to the hosted system - run since 2013 under foreign orders - being "rediscovered".
There is evidence in GCSB documents that the system run since 2013 was a US one used for targeting in military capture-kill operations, though the agency's own patchy records obscured what went on, the Horsley report showed.
In the OIA response, the GCSB refused to talk about this third "partner system", again on security grounds.
Clark said only that "all systems that require authorisation have the appropriate authorisations in place".
Horsley had noted that a decade ago, the GCSB was authorised to give data to the foreign system it hosted from 2013-20. However, he said: "The authorisation process for intelligence sharing at the time seems manifestly inadequate."
He detailed how it had improved a lot, but also made five recommendations to bolster it further, including:
- that GCSB audit its systems for any foreign partner capabilities - this was under way.
- and compile a register of collection or analysis capabilities operated here by foreign partners, and review and monitor those arrangements.
"A centralised register would provide an important oversight safeguard" currently, Horsley said.
It would have sped up his investigations into other foreign systems operating here, he added.
His report shows the "predecessor" capability was used within the GCSB before; staff there looked into its operation, prior to signing the deal to host the targeting system.
"It is clear from records that from the outset the GCSB recognised legal and policy issues with hosting the capability [from 2013-2020], particularly its potential use for supporting military action. GCSB staff had in-depth knowledge of this and how the capability's predecessor had been used," his report said.
Clark refused to detail how it "had been used", in response to the OIA.
As for the third "partner system", Horsely stated that unidentified concerns with it woke up spy bosses to the other, hosted system:
"After its installation, senior GCSB staff and the bureau's legal team lost sight of the capability and its operation. It was 'rediscovered' at a senior level following concerns being raised in 2020 about another partner system hosted by GCSB."
It remains unclear what those concerns were, or if this partner system is still operating.
