Tēnā tātou katoa,
Ki te reo pōhiri, kei te mihi,
He taura tangata, he taura kaupapa e hono ana i a tatou katoa,
Ko nga take whakamarumaru, take tiaki, ki tā te Kawanatanga mahi,
te kaupapa o te ra,
Mauri ora ki a tātou katoa.

Ngā mihi nui to the Victoria University of Wellington-Te Herenga Waka Centre for Strategic Studies for hosting this evening’s event.

Tonight I speak with three of my ministerial hats. I am the Minister Responsible for our two intelligence agencies, the New Zealand Security Intelligence Service (or NZSIS) and the Government Communications Security Bureau (the GCSB). I am also the Lead Coordination Minister for the Government’s Response to the Royal Commission’s Report into the Terrorist Attack on the Christchurch Mosques, which means I work with other Ministers as we implement all of report’s recommendations.

I bring with me the greetings of our Prime Minister, Jacinda Ardern, who is also the Minister for National Security and Intelligence.

INTRODUCTION

The nature of the threats New Zealand faces is changing. Consider just the last few years. There have been two recent terrorist attacks. Great powers are focussed on our Pacific neighbourhood, which was once described as an incredibly benign strategic environment. The COVID-19 pandemic has dramatically accelerated changes to the ways we work with connected technologies, but the cyber threats we face are growing.

These changes have been rapid. But the quality of our national security conversation has not evolved at the same pace.

Discussions about our intelligence agencies up until now are reflected in the following observation. Much of the correspondence about intelligence and security issues that I received prior to the March 2019 terrorist attack was predicated on a fear of the agencies’ supposed capabilities to know everything about everyone. Literally overnight it switched to outrage that our agencies did not know everything about everyone.

It is possible the secrecy that surrounds intelligence work means flipping between these extremes is understandable. But it is not a sound basis for rational discussion about what we want and what is reasonable to expect from our national security and intelligence function.

And that brings me to the purpose of my address this evening.

We need to be able to have robust and mature conversations about national security. The security environment will change and events will happen. These will cause us to reflect on capabilities – what we are doing, what we can do, and what we should do.

I should start by grounding that conversation about national security, and particularly the role of intelligence agencies, on four premises initially:

1. New Zealand faces threats to physical and economic security, and social institutions from forces and interests that would do us harm;
2. Those threats are foreign and domestic;
3. We need the means to, as best as possible, identify and evaluate those threats in order to prevent harm;
4. The efforts required must generally be carried out in secret. They also require relationships with trusted partners overseas, as well as with communities at home;

PART ONE: A CONVERSATION ABOUT NATIONAL SECURITY

WHAT IS NATIONAL SECURITY?

The four premises I just mentioned explain why we have a national security and intelligence function. The purpose of national security is to protect those fundamental values which bind us together. Democracy, the rule of law, universal human rights, and the wellbeing of our people.

It is about protecting our ability to go about our lives free from fear and able to make the most of opportunities to advance and prosper. It is also about playing our part to uphold the international rules-based order on which small states rely.

Other countries talk about these things far more confidently than us. In Australia the Lowy Institute runs an annual poll about that country’s intelligence agencies. Most recently it found a clear majority of respondents believe:

• Australia's intelligence agencies are effective at protecting Australia's national security; and
• Agencies have got the balance right between protecting national security and being transparent about their activities.

A KIWI CONVERATION ABOUT NATIONAL SECURITY, WHICH INCLUDES SOCIAL COHESION

This is not to say we should emulate anyone else. Kiwis should have this conversation in our characteristically empathetic and considerate way. What we do in New Zealand should be right for us, and reflective of our national character.

Indeed, one of the most important things to come out of the Royal Commission is its findings on social cohesion.

The report found that societies that are polarised around political, social, cultural, environmental, economic, ethnic or religious differences will more likely see radicalising ideologies develop and flourish. In short, social cohesion is an important contributor to national security.

Obviously there is never any excuse to mobilise to violence.

But risks do emerge when we have individuals and communities that are marginalised, alienated, subjected to gross inequality, and left with some sense that they have no stake in their community or an interest in collective well-being. Those feelings can propel vulnerable people to subscribe to groups that provide a sense of belonging but which are destructive.

This new focus on social cohesion in our national security is a somewhat novel approach internationally. It is, perhaps, a uniquely New Zealand response to a tragedy on our soil. It recognises that our increasing diversity in recent decades can be a source of strength when our collective goals and aspirations are aligned.

I want to give a specific example of how national security can be harmed by discounting social cohesion. I do this because it might demonstrate the challenge of starting this conversation from a low information base.

Earlier this year I travelled the country to meet with Muslim and ethnic communities. In every one of the 33 hui I heard how offensive Kiwi Muslims find media commentary and political polemic which conflates them with acts of offshore terrorism.

They find the term “Islamic terrorism” particularly distressing when used as a shorthand for the atrocities of Daesh and Al Qaeda. Time and again I heard about children crying and afraid to go to school because of the relentless bullying by those who label those children as “terrorists”.

We have seen this before. In New Zealand in the 1970s slurs were thrown at people with Irish accents. Young people today have probably never even heard about the Troubles.

It is no more valid, or acceptable, for our Muslim community - who have been have been a settled part of the New Zealand people since the 19th century - to be stigmatised, and even securitised.

So words matter and we’re not going to get it right all the time. But we can and must try. A good start is that our language should reflect actual threats from specific individuals, not whole communities.

I talked earlier about four premises to national security. The Royal Commission report’s urging to open up our national conversation gives us a fifth premise. It is this:

1. The government and our intelligence agencies must be as open and transparent as possible in order to maintain the social licence.

OPINION LEADERS HAVE A ROLE

If we agree that more openness is needed, and because government doesn’t have all of the answers, then we need informed voices to be in the public debate.

In that we rely heavily on the academy. That is why this government has established scholarships on countering terrorism and violent extremism through the new National Centre of Excellence. That is why we have established He Whenua Taurikura which is an annual hui to bring together experts in the field.

But the conversation must be wider than that. We need to see national security being more routinely discussed in mainstream news media, in our work places, amongst our iwi, and in our homes.

In this respect, the group we established on the recommendation of the Royal Commission’s report, the oversight group now known as Kāpuia, has a vital role to play. This group comprises 32 representatives of a range of faith, ethic and other under-represented communities. They have a crucial role in developing and overseeing initiatives to improve social cohesion and our national security setup.

PART TWO: WHAT WE HAVE TODAY

THE GOVERNMENT HAS RESPONSIBILITIES FOR NATIONAL SECURITY

Let me turn now to some of the architecture of how national security works in practise, and what some of the main threats are.

We have a state national security apparatus which encompasses much more than intelligence.

We have an ‘all hazards – all risks’ framework which is fed into by a range of agencies and Ministers. Collectively it gives effect to the Government’s seven key objectives of:

1. Ensuring public safety;
2. Preserving sovereignty and territorial integrity;
3. Protecting lines of communication;
4. Strengthening international order to promote security;
5. Sustaining economic prosperity;
6. Maintaining democratic institutions and national values; and
7. Protecting the natural environment.

There is a necessary tension in a liberal democratic state between the obligations on government to keep our people safe and the rights of individuals and communities to speak, and organise, and act to effect change as they see fit. How we draw those lines should be, as much as possible, informed by the realities of the risks we face and be a matter of broad social and political consensus.

Let’s be clear. In a liberal democracy there must be limits on our security apparatus. Our intelligence agencies do not have the means, nor the social licence, nor the legal authority to behave like the Hollywood imagining of spy craft. As the Royal Commission’s report says – and I quote here – “the idea that intelligence and security agencies engage in mass surveillance of New Zealanders is a myth”.

Put more formally, the NZSIS and GCSB have the same financial and other constraints as other public service departments. The Intelligence and Security Act 2017 is a robust legal framework which has many safeguards particular to entities who must conduct much of their operational work in secrecy.

We need New Zealanders’ awareness and input to ensure our intelligence agencies have the proper legislative framework to do the jobs we expect of them, without compromising the freedoms we cherish and the facts of what capabilities can be delivered with the resources we choose to devote. Public input will be critical in the upcoming review of the Intelligence and Security Act.

THE TERRORIST THREAT

In our ‘all hazards – all risks’ framework there is lively debate about some threats, such as climate change, and this is a good thing.

But when it comes to the intelligence agencies I think it’s fair to say the terrorism threat is currently most prominent.

It wasn’t always that way of course. During the Cold War fears of Soviet totalitarianism often had more prominence in the public imagination and political debates. And yet in the 1980s alone we experienced events that would now be described as terrorism, including the Wanganui Computer and Wellington Trades Hall bombings, and the many letter bomb threats received by MPs supporting homosexual law. Of course we also had the Rainbow Warrior bombing which turned out to be espionage.

The Royal Commission said that we should not shy away from talking about terrorism, because if people knew what to look out for, then there’s a chance - only a chance - that someone may have noticed signs of the terrorist’s attack planning or his extremist views in the lead up to the awful events in Christchurch. We owe having this conversation to the 51 Shuhada and their families because it enriches our democracy with a more widely shared understanding of the challenges we face and the means we have to deal with them in order to uphold other important values and freedoms.

Fundamentally March 15 was a case of an attack by an unknown unknown.

But the second recent terrorist attack, in a supermarket on 3 September this year, was the opposite. Not only did intelligence agencies know the perpetrator and the threat he posed. So too did Police, Immigration, the Courts, and many others. And yet, despite the very best efforts of so many, we exhausted the means to keep him behind bars pending review of his legal status. This resulted in seven innocent shoppers being stabbed and a police officer was forced to take a human life.

If March 15 didn’t make it clear then September 3 should make it undeniable that New Zealand is not immune from the terrorist atrocities that happen in our world. There remains a small number of individuals that the security intelligence agencies know about, and who give cause for concern because of their potential to mobilise to violent extremism. But there are likely other unknown unknowns that the agencies don’t yet know about. The international experience shows us terrorist threats will continue to evolve, including online radicalisation and increasingly sophisticated lone actor threats.

That is the reality of national security, and the powers we grant to the state and the capabilities we procure to detect those threats are at the heart of the conversation we need to be having.

BUT WE ARE NOT IMMUNE TO ANY OTHER NATIONAL SECURITY THREATS

As we necessarily step up our protections against the terrorist threat we must remain focussed on the other threats our intelligence agencies are grappling with.

The threats of foreign interference and espionage are equally real.

Let me say that again as the Minister who signs off every intelligence warrant – the threat of malign state activity directed against our country is equally real to the terrorist threat.

Threats to our democratic institutions, including by placing pressure on ex-patriate communities and foreign language media, are real.

Cyber attacks are increasing in frequency and magnitude. Critically important organisations are frequently the targets. Earlier this year we saw an entire District Health Board forced offline. Private organisations are equally vulnerable, as we saw last year with the NZX. The ability to ‘hack’ or disrupt critical services might once have only been within the capabilities of states, and some states do engage in malicious cyber activities. But every day new tools and methods are developed and exploited by criminals seeking financial gain, as well as those who might consider extreme disruption is justified in pursuit of ideological goals, or by ‘hackers’ who simply see disruption as a game without thinking about the real world effects.

New Zealand has robust conversations with states who attempt to carry out malicious activities against our interests or protect those who do, and in some circumstances we have called them out publicly. We reserve the right to continue to do this.

PART THREE: OUR INTELLIGENCE AGENCIES

SECRECY

Now I will turn to what, actually, our intelligence agencies do.

As I said earlier about the premises that underpin national security, secrecy is an important element.

NZSIS and GCSB are not prosecutorial authorities. They are not a part of the defence force. They do not have the right to use force against anyone.

But I acknowledge the paradox that on the one hand I am calling for a more open discussion about intelligence, while on the other I am responsible for agencies that conduct operations in conditions of absolute secrecy.

Areas of operational focus and the identities of sources must remain secret. That is a fact of life because those who would do harm will not speak candidly if they know they are being listened to, and those who could expose them will be fearful to do so if we cannot keep them safe.

But there is much more in the public domain that people can know about what they do. It’s the kind of information that serves to demonstrate some of the important work that happens to promote our national interests and wellbeing.

It is true that information gathered through intelligence work which might be useful in court proceedings creates challenges for the government and the judicial system. The use of intelligence in legal proceedings was the subject of a report by the Law Commission and is being considered by the government at the moment.

THERE HAVE BEEN SUCCESSES

I have found that a discomfort with the existence of our intelligence agencies is often based on apocryphal anecdotes from the distant past. It is a fact that once upon a time the NZSIS routinely refused security clearances to people it suspected might be gay.

Today the legal safeguards, oversight, and the culture of the agencies is entirely different. And, for what it’s worth, I’m proud that our agencies have the Rainbow Tick.

Discomfort with the agencies can also be informed by their perceived failures, which are of course more likely to make the newspapers.

But the secrecy of their operations means many of the agencies’ successes are not known. Here are just some of those successes:

• Security intelligence investigations have seen potential terrorists identified and imprisoned or put on a different path.
• Intelligence collected by our agencies have disrupted terrorist attack planning overseas.
• International drug smuggling syndicates have been busted for trafficking drugs with the help of signals intelligence.
• The activities of an individual with links to a foreign intelligence agency and who was covertly attempting to form relationships with New Zealanders holding senior and influential positions were disrupted.
• People have been removed from trusted positions based on intelligence of the proven insider threat they posed.
• Serious harm to strategically significant organisations in New Zealand has been averted because of the CORTEX malware detection and disruption service.
• And we some of New Zealand’s most valuable intellectual property has been protected because of the security best practices the agencies have helped other organisations to implement.

MUCH OF WHAT THE AGENCIES DO IS MUNDANE

If the above sounds a bit ‘James Bond’, then actually what our intelligence agencies do is mostly quite mundane. When talking with agents as I drafted this speech they told me ‘mundanity is the essence of intelligence’.

The NZSIS’s mission statement is to keep New Zealand and New Zealanders safe and secure. The GCSB’s mission focus is to protect and enhance New Zealand’s security and wellbeing.

To inform their security investigations the NZSIS primarily collects human intelligence, while the GCSB collects signals intelligence and is primarily externally focused.

The agencies collect information that they are permitted to collect; sift through that information – which is often in fragmentary form – pull the relevant threads together, fill the missing gaps and report back to decision makers.

As one of these decision makers, I rely on this intelligence heavily, as do my cabinet colleagues; a range of public service leaders in MFAT, MBIE and Defence; the Police; and other law enforcement agencies.

The outcome is decision makers have what is called ‘insight advantage’ to our decision making. The intelligence might allow us to better direct resources or put appropriate mitigations in place when managing risk.

New Zealand would be worse off without these intelligence insights.  They keep us safe and enhance our national interests.

THERE ARE RIGOROUS PROTECTIONS

All of the work the agencies do is in support of the Government’s National Security and Intelligence Priorities, or NSIPs (pronounced en-sips).

The NSIPs extend beyond counter-terrorism to include:

• foreign interference and espionage;
• protecting the country’s information and information systems from cyber attacks;
• providing support to military operations;
• geostrategic competition, including in our own region; and
• the pandemic response.

All of the agencies activities must be lawful, proportionate, appropriately targeted and subject to independent oversight.

The agencies target individual threats, not whole communities.

Every exercise of intrusive powers in secret must be authorised under a warrant. These warrants are issued in accordance with New Zealand law and meet our human rights obligations. Each must make a strong case that the activity is necessary and proportionate given the intelligence outcome that is being sought. Each must detail specific operational activity and often includes an obligation to destroy any information collected that is not within scope.

Warrants concerning a New Zealand citizen must additionally be approved by one of our Commissioners of Security Warrants, which is always a serving or retired High Court judge.

Further oversight is also provided by the Inspector-General of Intelligence and Security who has wide ranging powers to monitor the agencies and investigate complaints into them.

In terms of Parliamentary oversight the agencies have a statutory duty to regularly consult the Leader of the Opposition to keep them informed of relevant matters – and they do not relay what is discussed back to Ministers.

There is a statutory Parliamentary Committee, the Intelligence and Security Committee, to carry out the functions that ordinary select committees carry out in relation to government departments. The membership of that Committee is voted on in each Parliamentary term by the whole House of Representatives so cannot be modified for reasons of political convenience by parties or the Government without reference back to the House. The Prime Minister, as Chair, has recently expanded the remit of that Committee by having the agencies provide more thorough briefings on specific themes so government and opposition can work from shared information and insights.

I believe the protections we have in place are highly robust. Nevertheless, I hope that the upcoming review of the Intelligence and Security Act will be well informed by the public and find improvements we can make.

MUCH OF WHAT THE AGENCIES DO ISN’T INTRUSIVE

If the above dealt with the ‘secret’ aspects of spy craft, much of what the agencies do is neither intrusive nor carried out covertly.

The NZIS manages the Protective Security Requirements which is the manual of the government’s expectations for security governance and for personnel, information, and physical security. I understand that a number of private sector organisations use the PSR, which is freely available online, as the best practise guide from which to build their own policies.

Similarly, the GCSB publishes the New Zealand Information Security Manual which is best practise for the secure networks. Private organisations can adopt the NZISM requirements and recommendations to protect their networks and comply with international standards.

The GCSB additionally houses the National Cyber Security Centre which is focused on detection, disruption, advice and deterrence to help New Zealand’s nationally significant public and private sector organisations to protect their information systems. Over the past five years the NCSC has prevented over $284 million of harm to organisations of national significance. The new Malware Free Networks service is partnering with the private sector to extend malware detection and disruption capabilities to many more organisations.

GOVERNMENT ALONE CANNOT KEEP US SAFE

I come back to the fifth premise I talked about earlier – the need for public engagement as a national security setting.

Understanding threats and being aware of them can assist our national security.

Any one of us has the ability to mitigate a potential national security threat by being alert to it and telling someone when we see something that doesn’t feel right.

The public should be encouraged to report threats of violent extremism that they see online. That should be seen as a strength of our system and our society.

In fact the NZSIS is skilled at distinguishing between threats with real intent and capability to follow through and those put out by keyboard warriors without real world intent or capability to carry out an attack. Real terrorists do not generally operate in open online forums where they can be easily discovered.

THE FIVE-EYES

Perhaps nothing about intelligence is more misunderstood or mythologised than our membership in the UKUSA Agreement, which is a multilateral agreement for signals intelligence cooperation and is better known as the ‘Five-Eyes’.

The Five-Eyes is a partnership of sovereign nation states. It is not a supranational organisation. No partner is superior or inferior to the others.

Everything New Zealand’s intelligence agencies do is in accordance with this country’s national security and intelligence priorities and our own laws, including our international human rights obligations.

When we share information with our Five-Eyes partners we do so in accordance with our own strict policies, which includes conducting human rights risks assessments of each of the countries we work with.

Both the GCSB and NZSIS make unique and highly-valued contributions to these arrangements. I have previously said tonight that New Zealand intelligence has contributed to the disruption of terrorist attack planning overseas.

I have seen the contribution New Zealand makes to the partnership. Our partner countries know this and value what we do; and the periodic opinion pieces claiming otherwise are just incorrect.

I should also note that New Zealand does not solely engage through the Five-Eyes. The Christchurch Call to Action, championed by the Prime Minister, is about stopping terrorist use of social media. After March 15 we received many offers of information and support from intelligence agencies around the world.

PART FOUR: WHERE TO FROM HERE

So that is probably more detail than you’ve ever heard from a New Zealand Minister responsible for the intelligence agencies.

Tonight I’ve signalled the need to take a new approach to conversations about the threats we face and how we counter them.

I would like to see us working as a nation towards a place where we can confidently and inclusively deal with the threats we face and accept that those threats will evolve and change all the time.

Security and social cohesion are intrinsically linked. We all contribute to each other’s security.

There is a challenge in how we have this conversation. Language is important. We must not casually securitise communities through careless mis-associations.

We have to be realistic about what government and our intelligence agencies can do alone. As a simple product of the size of our population we will never have the capacity to read everything that happens on line – and nor should we. We will never prevent every hateful act. Foreign states will continue to exploit the openness of our institutions and society, and use our freedoms against us.

But we have to be careful to ensure we keep a clear focus on the balance between the means to keep us safe and protecting our freedoms, including the right to privacy and the freedom from overweening state power.

I started by saying that the nature of the threats is evolving. The changes are rapid. It’s important that our system is kept fit for purpose and as prepared as possible. Next week I will make an announcement on a change to one of our security platforms related to this very point – and I expect that reporting on that announcement will be a test for some commentators.

We have clear choices about how we respond to the terrorist attacks in Christchurch and West Auckland. We have choices in how we respond to the other national security threats we face, whether it be cyberattacks, foreign interference, espionage, or geostrategic competition in our region.

The threats we face touch all our lives so let’s turn fear, anxiety and exclusion into confidence, resilience and inclusion. Let’s face the twenty first century and set ourselves up for a safer Aotearoa New Zealand – and safer and ultimately more free world.

This speech finishes here but the conversation has only just started.

Ngā mihi nui. Tēnā kotou, tēnā kotou, tēnā tatou katoa.