Slashdot Mirror
New Zealand Spy Agency To Vet Network Builds, Provider Staff
Bismillah (993337) writes "The new Telecommunications (Interception Capability and Security) Act of 2013 is in effect in New Zealand and brings in several drastic changes for ISPs, telcos and service providers. One of the country's spy agencies, the GCSB, gets to decide on network equipment procurement and design decisions (PDF), plus operators have to register with the police and obtain security clearance for some staff. Somewhat illogically, the NZ government pushed through the law combining mandated communications interception capabilities for law enforcement, with undefined network security requirements as decided by the GCSB. All network operators are subject to the new law, including local providers as well as the likes of Facebook, Google, Microsoft, who have opposed it, saying the new statutes clash with overseas privacy legislation."
It's not illogical at all. You just mandate that all traffic goes through a room controlled by the government for "Lawful Intercept." That way you can say that it's done for law enforcement, but the reality is they're emulating the USA and keeping everything while also MITMing anything they feel like.
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
I have permanent residency (and thus voting rights), and I think tha**THE GOVERNMENT OF NEW ZEALAND IS DOING THE RIGHT THING**his is a load o**JOHN KEY IS A GREAT MAN**ollocks.
... why NZ is seen as a hot bed of terrorism, naughtiness and general mayhem. The lead item on the news last night was a political hopeful having to pay back about $350 after claiming on a flight for a friend. Wow. This isn't a country where much happens.
"The greatest lesson in life is to know that even fools are right sometimes" - Winston Churchill
If you have to have software that's designed to meet a required lowness of confidentiality, you'll be the only country writing it. You probably won't trust another tin-pot country's software, and will have to keep doing it all yourself.
Vendors want to sell software that meets the highest standards, so they can sell it into lots of countries, not write individual specials for every tin-pot dictator on the planet.
Image how much fun it will be, trying to write your own routers, your own google, your own facebook, etc, etc. All so you can lower the quality.
davecb@spamcop.net
Her tits are covered....
As with the United States and Australia, the people of New Zealand (and other democracies and democratic republics) elect their government and thus have control over their politics.
One must assume that in all of these places, the majority agree with these policies.
Shocking? To me, but apparently, I'm not in the majority.
If you want news from today, you have to come back tomorrow.
When Jefferson said "Where governments are afraid of the people, there is freedom" he obviously didn't take into account the possibility that governments could preemptively terrorize its people to avoid having to be scared of them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
User privacy? Fuck that, they're afraid of a loss of revenue. Why pay them for it when you can get the info yourself?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
There's no obligation for ISP's to have staff go through security clearances - in fact plenty wont pass the requirements (citizenship/residency for >10 years). ISP's can nominate staff to be vetted and those that're vetted, can be given more background as to why some information is being sought or why a particular issue is being flagged.
Important to note that the GCSB focus here is 'national security' and this isn't quite the same as lawful intercept for other purposes.
-.-. --.-
The guidance document as published at http://ncsc.govt.nz/assets/TICSA/NCSC-Guidance-for-Network-Operators.pdf states:
> To assist the GCSB and network operators to work together on network security risks, network operators
> may nominate a suitable employee (or employees) to apply for a SECRET level GCSB sponsored security
> clearance.
> Network operators may also, upon request, be required to nominate an individual for security clearance
> (section 75).
> Having cleared staff within network operators allows the GCSB to share certain information about network
> security risks that is classified. While these individuals cannot pass classified information to un-cleared
> colleagues, they will be able to give informed guidance on identifying and addressing network security
> risks.
> If a network operator does not have cleared staff, the GCSB will still seek to engage with them, and share
> what information it can about network security risks.
The legislation itself states:
A network operator must, within 10 working days _after being required to do so_ under subsection (2), (3), or (4),—
(a) nominate a suitable employee to apply for a secret-level government-sponsored security clearance (a clearance); and
(b) notify the employee of the nomination; and
(c) give written notice of the name and contact details of that employee to the Registrar.
- so the vetting obligation isn't an obligation until the Network Operator is 'required'. The rationale for putting staff up for vetting seems sound, but as you can see from the last part of the quote from the guidance, they can still work with service providers that don't have cleared staff.
-.-. --.-