[Home] [Databases] [WorldLII] [Search] [Feedback] New Zealand Law Commission

[Database Search] [Name Search] [Previous] [Next] [Download] [Help]

• The Problem
• Comparative Material
• An Obligation To Assist
• The Cost Of Furnishing Assistance
• A Duty To Modify

Part II Assisting searches and interceptions

THE PROBLEM

18 A SEARCH WARRANT is a licence to the constable to whom it is addressed to perform acts that would otherwise be trespasses. It imposes no legal duty on the occupier of premises or on any other person to assist the constable in his search, though no doubt upright citizens will recognise a moral and social obligation so to do. The general rule is that while such other person may not hinder the constable (this would be an offence under the Summary Offences Act 1981 section 23) such a person is under no legal obligation (in the absence of an express statutory requirement) to lift a finger to help. The same rule applies to an interception warrant (discussed in the previous part). In the case of a third class of warrant, a call data warrant issued under the Telecommunications (Residual Powers) Act 1987 section 10B, there is an express statutory requirement to assist (section 10D) to which we will need to refer.

19 It seems clear enough that this rule is insufficiently sophisticated to cope fairly with some circumstances in which legitimate criminal investigation processes encounter contemporary technology. In particular:

• law enforcement access to computer-stored data may be difficult or time-consuming (and so unnecessarily expensive) or impossible unless the searcher is provided with various types of assistance such as passwords and information enabling decryption; and
• to the extent that the law permits access to the contents of telecommunications the co-operation of carriers and providers is needed.

It should be made clear that there is no question of interfering with the rules protecting a person suspected of an offence from self-incrimination. The concern is with the rights and obligations of third parties.

20 It is against this background that we have been asked to advise the Ministry of Justice in the context of police search powers on:

The power to obtain assistance orders for the search of computer systems. These would demand reasonable assistance in locating and downloading information from the person or company concerned. This power would apply to third parties, not the suspects themselves.

21 The points arising are:

• whether the law should impose an obligation on third parties to assist (either in every case or if a court so orders);
• whether the party required to assist should be compensated for his services; and
• whether and to what extent carriers and providers should be required to employ systems that will preserve information that law enforcement officers are likely to require in a readily accessible form.

22 In practice in New Zealand such organisations as Telecom New Zealand Limited and Vodafone New Zealand Limited readily co-operate with the police. No doubt this is from a desire to be good corporate citizens, but there is also the factor expressed in the Explanatory Report to the Convention on Cybercrime adopted by the Committee of Ministers of the Council of Europe at its 109th Session (8 November 2001) in these terms:

This power is not only of benefit to the investigating authorities. Without such co-operation, investigative authorities could remain on the searched premises and prevent access to the computer system for long periods of time while undertaking the search. This could be an economic burden on legitimate businesses or customers and subscribers that are denied access to data during this time. A means to order the co-operation of knowledgeable persons would help in making searches more effective and cost efficient, both for law enforcement and innocent individuals affected. Legally compelling a system administrator to assist may also relieve the administrator of any contractual or other obligations not to disclose the data. (Paragraph 201.)

We understand that in fact the Telecommunications (Residual Powers) Act 1987 section 10D requiring a network operator to assist in the operation of a call data warrant was enacted at the request of operators who wished to be helpful but needed protection from any suggestion of contractual breaches.

COMPARATIVE MATERIAL

23 Part 14 of the Australian Telecommunications Act 1997 imposes on the telecommunications industry obligations to provide necessary assistance for law enforcement purposes. Section 313(3) is in the following terms:

(3) A carrier or carriage service provider must, in connection with:

(a) the operation by the carrier or provider of telecommunications networks or facilities; or

(b) the supply by the carrier or provider of carriage services;

give officers and authorities of the Commonwealth and of the States and Territories such help as is reasonably necessary for the following purposes:

(c) enforcing the criminal law and laws imposing pecuniary penalties;

(d) protecting the public revenue;

(e) safeguarding national security.

Section 313(4) imposes identical obligations on a carriage service intermediary. The effect of section 314(3A) is that the basic cost of providing such assistance is born by the provider. Part 15 imposes an obligation to provide at the expense of the provider an interception capability.

24 Still in Australia, the Cybercrime Act 2001 inserted in the Crimes Act 1914 a new section 3LA as follows:

3LA Person with knowledge of a computer or a computer system to assist access etc.

(1) The executing officer may apply to a magistrate for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow the officer to do one or more of the following:

(a) access data held in, or accessible from, a computer that is on warrant premises;

(b) copy the data to a data storage device;

(c) convert the data into documentary form.

(2) The magistrate may grant the order if the magistrate is satisfied that:

(a) there are reasonable grounds for suspecting that evidential material is held in, or is accessible from, the computer; and

(b) the specified person is:

(i) reasonably suspected of having committed the offence stated in the relevant warrant; or

(ii) the owner or lessee of the computer; or

(iii) an employee of the owner or lessee of the computer; and

(c) the specified person has relevant knowledge of:

(i) the computer or a computer network of which the computer forms a part; or

(ii) measures applied to protect data held in, or accessible from, the computer.

(3) A person commits an offence if the person fails to comply with the order.

Penalty: 6 months imprisonment.

The same statute inserts in the Crimes Act 1914 section 201A as follows:

201A Person with knowledge of a computer or a computer system to assist access etc.

(1) An executing officer may apply to a magistrate for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow the officer to do one or more of the following:

(a) access data held in, or accessible from, a computer that is on warrant premises;

(b) copy the data to a data storage device;

(c) convert the data into a documentary form.

(2) The magistrate may grant the order if the magistrate is satisfied that:

(a) there are reasonable grounds for suspecting that evidential material is held in, or is accessible from, the computer; and

(b) the specified person is:

(i) reasonably suspected of having committed the offence stated in the relevant warrant; or

(ii) the owner or lessee of the computer; or

(iii) an employee of the owner or lessee of the computer; and

(c) the specified person has relevant knowledge of:

(i) the computer or a computer network of which the computer forms a part; or

(ii) measures applied to protect data held in, or accessible from, the computer.

(3) A person commits an offence if the person fails to comply with the order.

Penalty: 6 months imprisonment.

It will be noted that in each of these new sections the effect of the definition of “specified person” in subsection (2)(b) that the provision does impinge on the right to avoid self-incrimination.

25 In the United Kingdom the Police and Criminal Evidence Act 1984 section 20 provides as follows:

20 Extension of powers of seizure to computerised information

(1) Every power of seizure which is conferred by an enactment to which this section applies on a constable who has entered premises in the exercise of a power conferred by an enactment shall be construed as including a power to require any information contained in a computer and accessible from the premises to be produced in a form in which it can be taken away and in which it is visible and legible.

(2) This section applies –

(a) to any enactment contained in an Act passed before this Act;

(b) to sections 8 and 18 above;

(c) to paragraph 134 of Schedule 1 to this Act; and

(d) to any enactment contained in a Act passed after this Act.

Under the UK Regulation of Investigatory Powers Act 2000:

• Section 12 entitles a Minister to require providers of public postal services or public telecommunications services to maintain an interception capability and section 14 contemplates the granting of a contribution to compliance costs;
• Chapter II of Part I imposes a duty on a postal or telecommunications operator to provide on notice certain classes of information, mainly “traffic data” which means broadly data identifying persons, apparatus or the locations of apparatus, and section 24 contemplates the granting of a contribution to compliance costs.
• Part III is a code requiring third parties to provide keys to electronic data inaccessible without the key and section 52 contemplates the granting of a contribution to compliance costs.

26 Articles 18–20 of the Council of Europe Convention on Cybercrime, referred to in paragraph 22, require member states to adopt measures to empower ordering the production of computer data by any person within whose control it is. Such power must extend to the real-time collection of traffic data and interception of contact data. Paragraph 4 of Article 19 reads:

Each Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to order any person who has knowledge about the functioning of the computer system or measures applied to protect the computer data therein to provide, as is reasonable, the necessary information, to enable the undertaking of the measures referred to in paragraphs 1 and 2.

The Convention leaves to member states the question of the incidence of costs.

27 In the United States of America, Title III of the Omnibus Crime Control and Safe Streets Act 1968 established a judicial process by which law enforcement officials could obtain authorisation to conduct electronic surveillance. An amendment of 1970 (Public Law 91–358) inserted in paragraph 4 of the relevant section (18 USC section 2518) the following:

An order authorizing the interception of a wire, oral, or electronic communication under this chapter shall, upon request of the applicant, direct that a provider of wire or electronic communication service, landlord, custodian or other person shall furnish the applicant forthwith all information, facilities, and technical assistance necessary to accomplish the interception unobtrusively and with a minimum of interference with the services that such service provider, landlord, custodian, or person is according the person whose communications are to be intercepted. Any provider of wire or electronic communication service, landlord, custodian or other person furnishing such facilities or technical assistance shall be compensated therefor by the applicant for reasonable expenses incurred in providing such facilities or assistance.

The US Communications Assistance for Law Enforcement Act 1994 imposes on telecommunications carriers the obligation to modify the design of their equipment, facilities and services to ensure that lawfully authorised surveillance can actually be performed, and imposed an affirmative duty on manufacturers of telecommunications equipment and support service providers to make available all features or modifications necessary to meet the assistance capability requirements of the Communications Assistance for Law Enforcement Act. The entire scheme proceeds on the premise that the cost will be compensated by the United States Government.

AN OBLIGATION TO ASSIST

28 We now return to consider, with the assistance of all this comparative material, the three issues identified in paragraph 21. By way of preface to our discussion we note that although the fact has tended to be lost sight of with the retreat from occupational licensing that was part of the economic shift of the 1990s, the rule that the right to engage in certain callings carries with it public obligations is one that has long formed part of the law. A common carrier was, in the absence of lawful grounds for refusal, obliged to accept goods from all comers, and this remained the law of New Zealand until abolished by the Carriage of Goods Act 1979 section 28. Barristers accept an ethical obligation enforceable by statutory disciplinary mechanisms to accept any brief within their field of expertise for which they are available. To assist in the investigation of traffic in stolen goods secondhand dealers must keep certain detailed records (Secondhand Dealers Act 1963 sections 12 and 12A) and retain certain classes of goods for a month before onselling (section 14). Until it was repealed by the Sale of Liquor Act 1989 the Sale of Liquor Act 1962 section 182(2) (like its predecessors) required urban hotel or tavern premises to provide “a place of convenience for the use of the public”, in other words a public lavatory. Traditionally, copyright statutes require publishers to deliver copies of books to particular depositories. The current New Zealand provision is the National Library Act 1965 section 30A. We have already referred to the Telecommunications (Residual Powers) Act 1987 section 10D which provides:

10D. Network operator required to assist in execution of warrant – A network operator that owns or operates a network that is subject to a call data warrant must provide such assistance as is necessary to enable any person who is authorised by the warrant to connect a telephone analyser –
(a) To locate the part of the network to which the analyser is to be connected (including, where necessary, any relevant line, apparatus, or equipment); and
(b) To connect the analyser in accordance with the warrant.

No doubt the law contains other examples. The reasons for these various measures are diverse, but they all support the proposition that the law has never shrunk from imposing, in the community interest, obligations on particular occupational groups.

29 On the general point of an obligation to assist, we recommend that section 198 of the Summary Proceedings Act 1957 be amended to provide for an order imposing:

• An obligation on any person (not being a person suspected of having committed the relevant offence) to provide information and assistance in terms comparable with parts of the Australian Crimes Act section 3LA inserted in the Crimes Act 1914 by the Cybercrime Act 2001 and set out in paragraph 24. Such an order would authorise the judicial officer issuing the warrant either at the time of issuing the warrant or subsequently to order a specified person to provide any information or assistance that is reasonable and necessary to allow the constable to do one or more of the following: namely access data held in, or accessible from, a computer that is on premises defined in the warrant, copy the data to a data storage device or convert the data into documentary form. New Zealand precedents for statutory provision comparable in effect are to found in the Telecommunications (Residual Powers) Act 1987 section 10D (set out in paragraph 28), the Serious Fraud Office Act 1990 sections 5(2)(b), 9(2)(d) and 12(1)(f) (note the definition of “document” in section 2) and the Submarine Cables and Pipelines Protection Act 1996 (section 20(2)(b)) and in the decision of the Cabinet Policy Committee on 12 December 2001 to legislate to “impose a ‘duty to assist’ on all telecommunications service providers to provide reasonable assistance to Police, GCSB and SIS in executing an interception warrant, within their technical capacity and on a cost recovery basis”.
• An obligation on any person (not being a person suspected of having committed the relevant offence) to furnish the key to electronic data that a constable is entitled to search. A suitable definition of “key” is to be found in the Regulation of Investigatory Powers Act 2000 (UK) in section 56(1):

. . . “key”, in relation to any electronic data, means any key, code, password, algorithm or other data the use of which (with or without other keys)–
(a) allows access to the electronic data, or
(b) facilitates the putting of the data into an intelligible form . . .

THE COST OF FURNISHING ASSISTANCE

30 On the second point, that is how the cost of furnishing the assistance is to be borne, it will be seen from the material set out above that in the United States of America those giving the help have an entitlement (perhaps on constitutional grounds) to be fully indemnified, that in Australia, telecommunications carriers and intermediaries must bear the cost themselves and that in the United Kingdom, what has been provided is a middle way, a discretionary contribution to the costs of the party providing the assistance. In New Zealand, the issue has been a live one. Press reports suggest that the communications providers Saturn and Clear did not, but Telecom for some four years and Vodafone for a lesser period have charged for assistance and that the cost to police is between $500 000 and $750 000 per year (“Big bill in police searches” New Zealand Herald, 1 August 2000; “Police want phone search fee dropped” Dominion, 1 August 2000). Telecom charged the police $40 000 to sift through telephone records in the inquiry into the murder of Terri King (“Telecom charges police $40 000 for murder search” New Zealand Herald, 29 July 2000). Telephone record searches were said to be a big part of the cost of the investigation into the disappearance of Gavin Dash (“Police cop big bills for phone probes” Evening Post, 29 July 2000). A High Court judge (Priestley J) has been reported as criticising Telecom for charging $2 400 for telephone intercepts involving drug smugglers Lorraine and Aaron Cohen. Other inquiries were not taken further because of police lack of cash. (“Judge ticks off Telecom for charging for phone tap” Dominion, 17 November 2001). Police confirm to us that these figures are substantially correct.

31 There are a number of options as to how any statute imposing a duty to assist should deal with the cost of furnishing assistance:

• The statute could be silent on the question of cost, as are the Serious Fraud Office Act 1990 sections referred to in paragraph 29, the Submarine Cables and Pipelines Protection Act 1996 section referred to in the same paragraph and the Telecommunications Act 1987 section 10D set out in paragraph 28. This would not preclude ex gratia payments by the police.
• The statute could spell out that the cost of providing the assistance is to be borne by the provider. The arguments in favour of this are the notions of community obligation touched on in paragraph 28 and the fact touched on in paragraph 22 that it is probably in the interests of a third party to provide the assistance rather than having the constable take away the computer or getting underfoot while he tries to access the information unaided. The contrary argument is that such an obligation could cast an unfair burden (in particular on small operators) and that free of any cost obligation police may overuse the obtaining of such orders.
• The statute could spell out that the provision of assistance was to be on the basis of recovery of the cost from the police or other enforcement agency. There is a precedent for this in the decision regarding interception warrants already referred to in paragraph 29.

32 Our recommendation is against adopting any of these three options in favour of a fourth, which would entitle the third party providing the assistance to seek from the District Court, if the provision of the information has imposed extraordinary financial hardship, an order for recompense. The fact that such an application would involve the applicant in legal costs would have the consequence that an application would not be made where the claim was trifling, and the formulation suggested would limit its application in practice to the relief of the hardship to the small operator of long and difficult searches. In practice, we would expect such applications to be resolved by agreement. The provision should expressly provide that the obligation to assist is not suspended pending the determination of any issue of recompense.

A DUTY TO MODIFY

33 The final point is whether, as under the UK Regulation of Investigatory Powers Act 2000, Part 15 of the Australian Telecommunications Act 1997 and the US Communications Assistance for Law Enforcement Act 1994, service providers should be subjected to an affirmative duty to modify their systems if need be to enable them to comply effectively with the obligation to assist that we suggest, and if yes how the cost should be borne. Circumstances of which we have been informed, in which this issue is currently important in New Zealand are:

• The reported technical impossibility of interceptions on the Vodafone network, said to require $1.1 million to correct, an estimate disputed by one expert (“Police close to new deal on bugging cellphones” New Zealand Herald, 22 February 2001). Reports suggest that police paid for a comparable modification by Telecom (“Police want $1 million to tap cellphone criminals” Dominion, 22 February 2001).
• The fact that it is impossible to trace the users of mobile phones with pre-paid calling capacity, and that this is well known to professional criminals (“Pre-paid cellphone a crook’s best mate” New Zealand Herald, 20 March 2000).

34 In relation to the first of these situations, the Cabinet Policy Committee on 12 December 2001 agreed on a policy for the imposition of interception capability requirements and the incidence of the cost and there is no point in the Law Commission discussing this matter further. In relation to mobile phones with pre-paid calling capability, we have discussed the matter with the police. In their view (and we agree), the inconvenience of the current situation is insufficiently great to justify the elaborate mechanisms that would be necessary (identification of buyers of mobile phones, keeping of registers, prohibition of buying by dummy agents and so on) to try to put an end to it.