New Zealand Government Debates Signing Budapest Convention with Implications for Privacy and Indigenous Communities

The Budapest Convention is being discussed by the government, and while it has some positive outcomes relating to cybercrime, it also has some negative implications for privacy and Indigenous communities, says Emeritus Professor of Law at the University of Auckland, Jane Kelsey.
 
The Convention is an international treaty wanting to protect signatories from cybercrime – crimes committed or enabled via the Internet - such as cyber fraud, computer related fraud, terrorism, and child pornography. The government is currently discussing whether New Zealand should sign up. If we do, we will be able to cooperate on these important issues with other signatories, but we will also grant them powers to intercept and access our computer networks if they believe a crime has been committed.
 
The Convention provides a legal basis for disclosure of domain name registration information and for direct cooperation with service providers for subscriber information to obtain subscriber information, traffic data, immediate co-operation in emergencies and mutual assistance tools. There are also some personal data protection safeguards.
 
While the benefits are obvious, there are significant implications that need to be considered. For example, Māori have been accused of terrorism by Police in the past and could be at risk of similar unjust accusations in the future, which could be exacerbated by internet connectivity, says Associate Professor of Computer Science at the University of Waikato, Te Taka Keegan. “It will be difficult for Māori to support the Budapest Convention without assurances from the government and protections in legislation for Māori control over Māori data sovereignty,” he says.
 
Professor Kelsey agrees, saying “there is a concern that Indigenous people’s resistance that is organised on the Internet risks being labelled as cyber-crime by governments in their countries, and that their data stored on social media could be trawled. Under the Convention, authorities who have these concerns would be able to access Indigenous people’s data not only in their own country but could also to make requests to trawl through the data of other Indigenous people they have relationships with from other signatory countries.”
 
This raises lots of questions of Indigenous data sovereignty and governance rules. Professor Kelsey is very concerned the Department of the Prime Ministers and Cabinet (DPMC) and Ministry of Justice may not be taking the Crown’s obligations under Te Tiriti seriously with regards to the Budapest Convention.
 
She says the leaked version of a search warrant in the Tūhoe raids shows how easily random dots can be joined to form a narrative that justifies future warrants. Notions of cyber-enabled terrorism could easily get legs and implicate people way beyond what it should. And who is going to know?” says Kelsey. “This can easily happen to Indigenous peoples fighting for self-determination, where those in power can define resistance that is organised online as terrorists.
 
She believes the officials drafting the legislation need to ensure that it protects Māori rights and taonga, including over data, under Te Tiriti, if they choose to sign the Budapest Convention, so that it is of benefit to all New Zealanders.
 
“We will need to pass a domestic law to implement the Convention. There are some exceptions that allow the government to decline to provide the information. But they don’t clearly apply to protect Māori rights over data and effective Māori scrutiny of requests.  There’s nothing to stop us from saying for the purposes of those exceptions in the Convention that in this country they are subject to the Crown’s obligations under Te Tiriti. This needs to be in the Bill when it is introduced because getting stuff into the Bill once it’s before the House is difficult.”