Bad GCSB

A quite stunning report by the Inspector-General of Intelligence. He has found that the GCSB hosted in New Zealand a signals intelligence system controlled by a foreign partner agency, and failed to even mention it to their Minister, or indeed their incoming Director!

He finds that the capability operated at GCSB:

• without adequate record keeping;
• without due diligence by GCSB on the capability tasking requests;
• without full visibility for GCSB of the capability tasking;
• without adequate training, support or guidance for GCSB operational staff;
• with negligible awareness of the capability at a senior level within GCSB after the
  signing of the MOU in 2012 and until the system was shut down in 2020;
• with no apparent access for GCSB to the outcomes of the capability’s operation at
  GCSB;
• without any auditing;
• without the required review of the MOU;
• without due attention to the possibility, recognised within the Bureau, that
  support for the capability could contribute to military targeting; and
• without clarity, in consequence, as to whether data supplied by the GCSB to the
  capability did in fact support military action.

How did this happen. Some extracts:

Late in 2011, the then Director-General, Simon Murdoch, noted in an email that GCSB legal
would need to be closely involved in the matter and that it would potentially require the
awareness or consent of the Minister, as well as consultation with the IGIS. This inquiry
found no record that the legal analysis, consultation and engagement with the Minister or
IGIS contemplated by Mr Murdoch occurred.

So Murdoch correctly said the Minister and IGIS should be consulted and a legal analysis done. It never happened.

Simon Murdoch’s tenure as Acting Director-General ended the week before Christmas 2011. On 3 February 2012 Ian Fletcher took over as Director-General.

The MOU was signed in March 2012 by a GCSB Deputy Director. My inquiry found no
records to indicate the Director-General was involved. Mr Fletcher advised the inquiry that
he did not recall being briefed on the capability when he started at the GCSB, and has no
recollection of the capability operating at GCSB or of Simon Murdoch’s concerns.

So a Deputy Director signed the MOU without doing what the Director had asked, and didn’t even mention it to the new Director.

I think it would be appropriate for the Deputy Director responsible to be named. Not briefing the Minister, the IGIS or the new Director undermines accountability.