The intelligence agency says data is becoming more important to its work, but it doesn't have a data ethics framework to guide decision-making after more than 18 months of policy work, Marc Daalder reports
The New Zealand Security Intelligence Service (NZSIS) wants to make it easier to access data from other agencies and doesn't have a data ethics framework in place at least 18 months after beginning work on the policy, internal documents show.
In comments to Newsroom, a spokesperson for the agency said its use of data is "subject to robust oversight" by the intelligence watchdog and internal procedures. But leading data ethics experts say the SIS should put principles for the ethical use of data in place sooner rather than later.
The debate comes in the context of a significant expansion in the amount of data managed by the agency. In the past year, the Inspector-General of Intelligence and Security (IGIS) found, the SIS' total data holding "rapidly expanded" to multiple times more than its previous collection.
The service is gathering much more data than it used to in an effort to bolster its target discovery operations - finding its own leads to investigate rather than relying on leads from the public or other agencies. This was one of the recommendations from the Royal Commission of Inquiry into the March 15 terror attack.
'Warming the public up'
One of the internal documents released under the Official Information Act, recounting an August 2020 meeting between the agency's director-general Rebecca Kitteridge, Statistics NZ chief executive Mark Sowden and the then-chair of the Data Ethics Advisory Group Juliet Gerrard, has raised further concerns for University of Auckland statistician Andrew Sporle about the SIS approach to transparency and engagement.
The memo showed the SIS had begun work on a data ethics framework and Kitteridge had asked "whether our guests felt we should wait until we have a more robust ethics framework in place".
However, "it wasn't felt this was necessary - the entire NZ government approach to data ethics has been about transparency and warming the public up gradually to where we are at - none of our government mechanisms to address data issues and ethics were operating in a mature capacity yet. Public engagement on the issues and the work that is underway is important, and when one government agency speaks, it will benefit all of government."
Sporle said this showed the SIS was going about engagement the wrong way.
"Transparency isn’t empowerment, isn’t change and doesn’t necessarily build trust. It may actually erode trust when people find out that, actually, you’re doing what?" he told Newsroom.
"Transparency in and of itself isn’t enough, they need to do that kind of prior engagement. The idea of constructing social licence is not going with public attitudes and public expectations, it’s creating those attitudes and expectations. I’m a fan of engagement and shared decision-making, but the idea that we can construct goodwill to enable people to do stuff that we’re then transparent about ... The transparency comes after the open engagement."
Tim Dare, a professor of philosophy at the University of Auckland who advises the Ministry of Social Development and the Ministry of Education on data ethics, said he was "sceptical" about social licence as a guiding concept. Just because people support something doesn't necessarily mean it's ethical.
The SIS spokesperson said the agency "has been quite open about the importance of data to detect and mitigate threats, including violent extremism and foreign interference. The most critical challenge faced by all intelligence agencies is accessing and analysing the right information at the right time. It’s about joining the crucial dots - but we have to find the right dots in the first place to discover unknown threats.
"The NZSIS is very aware of the need for public discussion on access to data, and ensuring we do this in a way which is consistent with New Zealand’s laws and values. We have engaged with the Office of the Privacy Commissioner and the Office of the Inspector-General of Intelligence and Security, as well as the Data Ethics Advisory group convened by the Government Chief Data Steward."
Checks and balances
Dare said some universal principles could apply to the SIS' work, but that it might need special permissions as well.
"A set of plausible principles is accuracy, ensuring the data is fit for purpose, this is all in the algorithm charter. They might get a pass on some levels of transparency, I suppose, because they’re spies, but there would be some alternative check on what they were doing," he said.
"It's not clear to me that the public has to know everything they’re doing, but someone should - presumably someone at ministerial level."
The agency's spokesperson said it is "subject to robust oversight by the Office of the Inspector-General of Intelligence and Security. To this effect we are confident that we have always approached our collection, handling and management of data and information in an ethical manner."
Andrew Little, the minister responsible for the NZSIS, also backed the agency.
"The main point is that all of the agency’s data and intelligence-gathering work is governed by statutory duties and obligations as well as all statutorily mandated policies which are underpinned by ethical principles of needing to be justified in accordance with the national security and intelligence priorities consistent with human rights obligations and in accordance with oversight by the Inspector General," he said in a statement to Newsroom.
Brendan Horsley, the Inspector-General, said he was aware that the SIS was using big datasets for target discovery.
"The NZSIS’s work on a data ethics framework is a positive development. The service has identified the need for it at an early stage of a shift to holding and analysing bigger volumes of data," he told Newsroom.
"The service is required to act lawfully and with propriety in the exercise of all of its functions. A data ethics framework should provide some useful ‘big picture’ guidance, but law and policy will continue to be the critical day-to-day controls on how the service acquires and uses data. It’s good to see the service being reasonably open with its data strategy and information about its work on data ethics."
A 2021 report from Horsley revealed that the SIS has "round-the-clock" access to a network of CCTV cameras. While the report found they were used in a targeted and lawful manner, it raised questions about the legality of the arrangement with the network's owner and said no privacy impact assessment had been completed before Horsley began his investigation.
Data ethics timeline
Some government agencies are further along in their data ethics work than the SIS, Dare said. The two big, cross-agency frameworks are the Algorithm Charter, which binds signatories to ethical and transparent use of algorithms, and the Data Protection and Use Policy, which provides a set of principles that agencies can apply to their own circumstances.
The SIS spokesperson said the agency was working with Stats NZ to determine how to participate in the charter.
"NZSIS sees good benefit of the principles and the purpose of the charter and we are considering how we might adopt it while working through the realities of our operating environment, particularly how NZSIS would participate effectively when much of our algorithms and outputs would be classified in nature because of the extent to which they would reveal capabilities we need to protect to be effective."
The spokesperson also said that work on the data ethics framework raised in August 2020 was still not complete. A "set of internally agreed NZSIS Data Ethics principles" has been drafted, but it is still being checked to ensure "Te Tiriti and Te Ao Māori are well reflected within the principles". Only then will the next step of actually operationalising the principles begin, which could include a data ethics advisory board.
"While no specific timeframe has been set for the completion of this work, it is important to us and well progressed, and we expect for it to be implemented in the near future."
Sporle agreed that work on a data ethics framework was needed but said he would have liked to see it in place before the SIS began expanding its data use.
"The benefits of doing something [on data ethics] are really large in terms of supporting public goodwill and engagement. The cost of not doing it is extraordinary, because not only will you undermine trust, you’ll actually undermine the very data," he said.
"If you’re just collecting data from people all the time or analysing data that is routinely collected and not giving anything back and not having a transparent process, then after a while that starts to smell like surveillance. Which is not only undermining in terms of trust but it will also eventually undermine the very quality of the data, because people won’t be honest, they won’t be up-front, they won’t be so generous with their time. That is a really clear reason why the SIS has to have their own rules and they absolutely have to be transparent."
Dare disagreed, saying that it was hard to develop an ethics framework because data had so quickly become such an important part of agencies' work.
"It hasn’t really been possible to say, ‘We just won’t do this until we’ve got the ethics sorted out’. It’s been necessary to do it in tandem - you don’t actually have much choice about whether these things are being used," he said. "You can just say, no, you can’t use the technology. But the technology is so attractive and so powerful and actually so good. It really does some jobs extremely well. We had the capacity in these areas long before we worked out the ethics, so it’s necessarily been a process of trying to work out the ethics as we go along, building the ship at sea."
The SIS spokesperson said the service had to make use of new data tools as they became available to keep up its work.
"The amount and type of information relevant to our work has increased exponentially in recent years. NZSIS must increasingly make use of data processing and assisted decision making to assist us in processing this data to give us the greatest chance of identifying information that is more likely to be of intelligence interest," the spokesperson said.
"Finding high quality intelligence leads is a core job of the NZSIS. Data is playing an increasing role in providing intelligence leads as a greater proportion of people’s lives move online. Our work to implement a data ethics framework is an aspect of our longer term data strategy."
Sporle remained concerned that the SIS hasn't learned the lessons from past privacy ethics debacles. He said he hoped it won't take something going wrong for the agency take data ethics seriously.
"The ethics system comes first. The ethics system that we have in health ethics was set up after the Cartwright inquiry, after people died, after a disaster and a public inquiry. It would be nice to learn from history, wouldn’t it?"
