New Zealand anti-hacking law hits further snags

New Zealand Lawyers and Internet users are finding ever more problems with the proposed “anti-hacking law.”

The measure, contained in the supplementary order paper to Crimes Amendment Bill (No 6), seeks to prevent interception of “private communications” by an “interception device”. The inclusion of this concept is mistaken, commentators say. Emphasis should be on the actions performed rather than the device used.

“The issue is in my view correctly the act of interception for the purpose of possession,” says lawyer Craig Horrocks of Clendon Feeney. “A radio scanner could be an interception device but a log of broadcast data is generally useless unless the receiver has both the intention to possess and the intention to use.”

Don Stokes, founder of the Victoria University’s Netlink ISP (Internet service provider) and now running Daedalus Consulting Services, says the “interception device” concept produces legislation that is not technology-neutral.

“And worse, (it) fails to recognize that with digital communications, most interception is done by using the very communications equipment that is carrying the traffic in the first place. The (clause) should be a technology-neutral prohibition on the act of interception and control of the use of intercepted information, not a prohibition on the use of a specific class of hardware.”

David Elson, of systems integrator gen-i, fears the law could prevent the very acts of “interception” necessary to guard against hackers’ intrusion.

“If I cannot use port-scan detectors, packet sniffers, anti-intrusion software and similar tools to prevent hackers, then the job of the hacker has suddenly become much easier,” he says.

The planned statute, whose next step will be public submissions early next year, applies only to interception of “private communications”. The definition of “private communication” excludes “a communication occurring in circumstances in which any party ought reasonably to expect that the communication may be intercepted by some other person not having the express or implied consent of any party to do so.”

So it appears any communication that the communicator suspects might be intercepted falls outside the protection of the law and may be intercepted with impunity.

“I admit the definition of ‘private communication’ seems almost circular,” says Michael Sage, head of law firm Simpson Grierson’s IT specialist X-Tech team. “But I don’t think the drafters could have done much better. Privacy is a subjective thing, and it’s up to the parties to the communication to say whether they expected the communication to be private or not.

“It’s a problem,” he says, “but not an avoidable problem.”

With regard to the “interception device” clause, the drafters seem to have been trying to make minimal changes to the existing act by simply substituting that phrase for “listening device”. “It’s like painting over an existing layer of paint on a door rather than sanding back to the wood; after a while, it takes on a layered appearance . But I don’t see a serious problem in the way it’s been done.”

Sage, however, points to other problems that have emerged under British legislation, some of which (the Computer Misuse Act) is ten years old. One key question is who pays when a government agency requires an ISP or telco to intercept – perhaps installing special equipment to do it. This still has not been dealt with in British law, and is certainly not addressed in the proposed New Zealand amendments. He also cites the risk to the reputation of ISP and telco staff through their users regarding them as “spooks” for the government.

Sage’s colleague, Sean Murphy, highlights other issues that have arisen in Britain:

– whether people would be required to disclose keys to encrypted material

– whether certain material, such as medical information, should have special protection

– whether people whose traffic has been intercepted should be notified of that fact at a later date.

“All this is not intended necessarily as a criticism of the proposed law,” Sage adds. “Law needs to evolve continually. This is not the end of the road. As (snags) become apparent, the legislation should be amended to deal with them.”

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now