Updated: GCSB's Kim Dotcom Surveillance Timeline

Timeline compiled from affidavits relating to the GCSB's surveillance of Kim Dotcom and others released to the Labour Party. Updated to include more recently released documents. [Earlier version of timeline here.]

The surveillance by the GCSB (Government Communications Security Bureau) at the request of OFCANZ (Organised and Financial Crime Agency New Zealand – an agency hosted within the New Zealand Police) was publically revealed in September 2012 and admitted to be illegal as Dotcom, his colleague Bram van der Kolk and their families were New Zealand residents.

Updates include a GCSB summary of intercepted communications from the operation.

Key: AFF= affidavit. DN= document number

1 November 2010- DN 354
Kim Dotcom and family's application for residence under under Investment category 1 is approved in principal.

21 September 2011- (Wormald AFF para 5)
Mr Wormald takes command of advancing investigation.

2 December 2011 DN 353
Bram Van Der Kolk and family's application for New Zealand resident visa is approved.

9 December 2011 – 16:12pm Email- Grant Wormald to.[redacted] File Document 00542
A formal request for information Dol has on subjects named in application. Asks for no online searches to be made of the subjects as they “may have the capability to trace who's looking at them online”.

Actions were being planned for the New Year so “there is not too much time to put things in place”.

14 December 2011 (Wormald aff beginning para 18)
Mr Wormald hosts meeting at OFCANZ attended by representatives from Crown Law Office, Ministry of Justice, Police Legal Section and representatives from GCBC. Meeting was intended to “convey information about the operation to several more representatives of government departments”. All representatives were then shown out of the room with the exception of the GCSB staff. There was then a discussion as to the viability of GCSB becoming involved. The meeting lasted three to five minutes and nobody present took any notes. Mr Wormald’s recollection was that the discussion focussed on “intelligence around the timing and location of any birthday party for Mr Dotcom, and the location and likely travel plans of the other suspects sought by the USA.

Mr Wormald recalled that the conversation turned to issue of whose communications could be intercepted.

“There was general consensus that all of the parties under discussion were not New Zealand citizens.”

Mr Wormald said he thought it was not possible for GCSB to intercept either Mr Dotcom or Mr van der Kolk because they were living in New Zealand. However, a GCSB representative said they were able to intercept, provided the persons involved were not New Zealand citizens.

Mr Wormald said they were sure that Mr Dotcom and Mr Van der Kolk were not citizens, but were uncertain what type of ‘residency’ they held. He offered to act as a go between for GCSB and Immigration NZ to clarify their status, but after a discussion this was deemed unnecessary at that time.

16 December 2011 (Wormald aff para 50)
Mr Wormald authorises Detective Sergeant McMorran to sign a Request For Information (RFI)to the GCSB on Wormald’s behalf.
16 December 2011 (Wormald aff para 58)
“To the best of my recollection, I did not see a copy of the RFI submitted to GCSB until late February 2012 after some concerns had been raised about the legitimacy of the interception of Mr Dotcom and Mr Van der Kolk.”

16 December 2011 (Wormald aff para 11)
Mr Wormald receives documents from Immigration NZ concerning Mr Dotcom’s travel arrangements, of which, in his last two arrivals(15 December 2010, and 26 September, 2011, Mr Dotcom is identified as a ‘Resident’.

16 December 2011 to 20 January 2012 (GCSB AFF para 8)
GCSG intercepted communications from and between persons of interest, and “information of relevance” was passed onto OFCANZ staff.

January 2012 (Wormald AFF para 4)
FBI Advises that Dotcom may hold birthday party on 20th or 21st.

“If that occurred, and all the named suspects were there, we were asked whether we would be able to arrest and extradite them.”

11 January 2012 (Wormald AFF para 13)
Police receive Dotcom immigration file confirming he was granted residence 18 November 2010.

17 January 2012- DN 289- OFCANZ to GCSB
Thanks the GCSB team for its ongoing assistance with Operation Debut.

“I can confirm- as of about 10 minutes ago- that termination remains set for Friday 20 January, timing TBC (but likely early morning).

18 January 2012- 3:49pm – DN 288- Police analyst to GCSB
Thanks for two reports received that day, and a meeting the previous day.

“The support TF Debut has received from the GCSB is unprecedented and really positive. Our management is very happy. Hopefully all goes well this weekend. I will make sure you get a debrief of how it went down in the next week or so.”

18 January 2012- 4:10 pm- Reply to previous email- DN 288- GCSB to OFCANZ
Chat between GCSB and OFCANZ was found to be very useful.

Email writer is keen for a debrief as well and would offer a trade of “a run through of the tools we used and the way we used the selector leads and initial information pack provided” in return for a “OFCANZ/Police spiel”.

“Have fun on your day off. Hope Dotcom goes down!”

20 January 2012 -Operation Debut carried out.

26 January 2012- DN 291- GCSB to OFCANZ
GCSB role in the operation was “our pleasure and a lot of fun. We’re are all stoked with the result, not that we take any credit for any of it”.

Mentions they are keen for a debrief, and will need to work it into to schedule when those involved are back from leave.

Suggests new director Ian Fletcher who starts after Waitangi Day would be very interested in the case “given his extensive background in intellectual property”.

“In fact, i've suggested your seniors that Ian perhaps even sit in on the debrief. They think this is a good idea.

“This would strengthen OFCANZ/GCSB interactions and ensure that the new boss actually gives a damn about [redacted] and doesn't just turn us into [redacted] analysts.

30 January 2012, 2:38pm OFCANZ to GCSB File Document 191
Thanks GCSB team for assistance on Operation Debut.

“The reporting you were able to provide often helped to confirm or refute other sources, and assisted in providing situational awareness and context to (appropriately cleared) operational planners.”

Proposes topics of discussions for debrief to include summary of operation, what worked well and what could be done better.

30 January 4:09pm GCSB to … [redacted] File Document 190,191
Congratulates on success of operation on the 20th which they had followed closely in the media.

“We all thoroughly enjoyed being involved in this case and were happy to provide what assistance we could.”

Confirmed that they would be keen to have a debrief “at some time in the not too distant future”.

1 February 8:29am GCSB to OFCANZ File Document 189
Aim to present tactical/operational level material at debrief, with analysts running through their SIGINT tools and how they used the[redacted] that OFCANZ provided. The director and senior management would be interested in seeing material, especially the director as he started in the office after Waitangi Day and had not seen SIGINT tools in action yet.
Wanted seniors to take a “back seat” position and have let the analysts lead the discussion.

1 February 3:16pm OFCANZ to GCSB File Document 188
Outlines who will speak and the order of speakers. Mr Wormald to lead from police/investigative side. A short roundup of the operation from conception to termination/court proceedings

“McMorran will hopefully attend and explain some of the dynamics and legal aspects of the cooperation with (mainly) the FBI”.
“I see this as a chance to highlight the success of this op in terms of us seeking your assistance in a fairly unique case and you guys going the extra mile to assist. Also the connectivity to you folks from the field using the [redacted] was a very simple yet effective medium to provide regular updates.”

“I think Debut is a joint model that could be replicated (and built upon) to great effect in future operations with a regional and or wider transnational component.”

1 February 2012, 4:05pm GSBC to OFCANZ File Document 188
Makes pitch for 16 February meeting, 10am. Said it is shaping up to be a good session, and agrees it will likely provide a “solid model for future collaboration”.

15 February OFCANZ to GCSB 8:42am. File Document 325
Confirming meeting and attendees: Superintendent Ray Van Beynen (deputy director) D/Insp Grant Wormald (OC OP Debut), D/Sgt Nigl McMorran 2ic, myself, and a police analyst. All are “BCD”
Will send PP through that day.

15 February GSBC to OFCANZ 8:59am. File Document 325
Confirms 10am. Staff looking forward to PP presentation. In attendance from GCSB will be director Ian Fletcher, deputy director intelligence, deputy director mission enableman, assistant director production and outreach, global issues unit manager, (Myself)and ….(redacted) head presenter, an analyst “who joined the team yesterday, and who will be supporting NZ Police and OFCANZ”.

16 February 2012 (Wormald aff para 86)
Mr Wormald attends debrief of OFCANZ and GCSB staff in Wellington. Mr Wormald was surprised when a GCSB staff member points out potential issues with the interception of Mr Dotcom and Mr van der Kolk’s communication as at that stage the project had been terminated for three weeks.

Mr Wormald and the GCSB agree the matter needs to be dealt with promptly.

17 February 2012- DN 01042 OFCANZ to GCSB
GCSB briefing the previous day was well received by OFCANZ staff. People commented that GCSB analysts were “professional and technologically savvy”.

“Also, OFCANZ management intends to organise a meeting with your senior management at some point to ensure this relationship continues to build.”

17 February 2012- DN 01042- Reply to email above- GCSB to OFCANZ
“Should have gotten [redacted] to do the presentation. Stupid [redacted] making us look intelligence [sic] and encouraging better cooperation.
“Ha, but seriously. We were very pleased with how it all went as well [redacted] were happy to have been able to get things more lined up with OFCANZ.
“I'm very pleased to [redacted] hand to throw at rebuilding relations with police an OFCANZ as well.
“Hopefully 2012 will be a good year.
“P.S I hope you and [redacted] are both well, and digging lots of holes.”

20 February 2012- DN 73- GCSG 1 to GCSB 3
Asks GCSB 3 to ask OFCANZ the exact residency status of Mr Dotcom and his wife and Mr Bram van der Kolk.

20 February (GCSB AFF para 15)
“In response to a query made by a GCSB colleague at my direction to OFCANZ, after interception operation had been completed, and I had become aware of media reports that Mr Dotcom was a New Zealand resident.

21 February 2012- 3:32pm- DN 258-259- Police analyst to 'other agency'.
Asks other agency to check exact residency status and qualifying/effective dates of Mr Dotcom, his wife and Mr van der Kolk.
“Is there a difference between resident/residency and permanent resident/residency? If so, what is the difference? Is there a special investor category? What are the implications of this?

21 February 2012- DN 352- Nigel McMorran to Grant Wormald and a police analyst
Screenshots of Immigration NZ documents showing NZ resident status for Mr Dotcom and Mr Van Der Kolk.
Says to “liaise with Grant before releasing, bearing in mind we never got this info until January 1st and 10th and we were under the assumption that we were not doing these two subjects anyway and were only on the offshore ones contacting the other two or each other”.

22 February (GCSB Aff para 15)
“I learned on 22 February that Immigration NZ had advised OFCANZ (who had not passed on the information to GCSB), that Mr Dotcom and his family and Mr van der Kolk and his family were in fact persons holding residence class visas under the Immigration Act 2009.”

22nd February 2012, 12.11pm, OFCANZ to GCSB File number 237
OFCANZ inform GCSB that several serious issues had arisen regarding residency status.

"Some OFCANZ staff (including myself) assumed that citizenship/nationality rather than residency is the [illegible]/defining criteria for targeting/exemption, and/or made incorrect assumptions as to what actual status of particular individuals was based on intelligence received."

“Some OFCANZ staff assumed that certain persons were indeed not being targeted and that the intelligence received was derived from external, non-resident targets."

OFCANZ then accept responsibility for some errors of process and judgement.

22 February 2012, 3.02pm. GCSB to OFCANZ. File number 230
GCSB reassure OFCANZ that there has not been a major inquiry or “witch hunt” at GCSB about Dotcom's residency status.

“A summary document has been given to legal advisor about TF Debut about compliance issues which is to be stored on file for future reference, but they do not expect it to lead to further actions or questions asked.”

"None of us are of the opinion that there needs to be any follow on discussions - certainly at a Deputy Director level. GCSB staff and managers are still viewing TF DEBUT as a very successful collaboration with OFCANZ and we would not want this issue to take a shine off things"

22nd February 2012, 3.53pm. OFCANZ to GCSB File number 230
Responding to above email

"We just wanted you to be assured that we had been ethical and proper in our dealings re this whole RFI and not a bunch of clowns walking roughshod over the law and sound practice. We too are keen on future cooperation and despite DOTCOM getting bail today, still see the shiny side of the operation. Never the less, we will take some good lessons out of this for next time.”

22- 24 February – A series of email exchanges between GCSB, OFCANZ and Immigration NZ
Many emails between agencies seeking to clarify the exact residency status of Mr Dotcom and Mr Van der Kolk and advice on how to interpret the immigration law concerning the path permanent residency.

23 February 2012- DN 248- Police analyst to GCSB
“Looking again at the criteria below and the original information provided yesterday by [redacted] would say it is most unlikely that billy big steps can be a permanent resident. Same of the others.”

24 February 2012- 2:45pm- DN 360 – OFCANZ to GCSB
Still waiting to hear from immigration for a definitive answer on whether Dotcom was a resident or a permanent resident.

“Hopefully he was a resident and all will still be positive. But this has definitely been a wake-up call for people here, which is positive.”

27 February 2012 11.41am GCSB to OFCANZ File number 262
GCSB officer informs OFCANZ of update on opinion of GSCB layers regarding DEBUT:

"[lawyers] agreed that as the families only had Residence, there was no inadvertent targeting of NZSID7 protected persons - who are only protected when they have Permanent Residency. So all done and dusted."

"Bring on the next case!".

OFCANZ to GCSB, Date illegible but email classified on 28th February 2.46pm File Number 356
[illegible] talked to [redacted] and he said [redacted] happy, so it turned out ok. More luck than good management but all good all the same. Glad you liked working with OFCANZ, hopefully we will have some more new and exciting things for you soon. "

29 February 2012- DN 359- OFCANZ to GCSB
“Thanks for the [redacted] and I were a bit embarrassed that we may have broken the first and most important rule of SIGNT. And after talking with our Dep Director Ray, he introduced us to make sure you all knew that we took it seriously, and would take responsibility for it, and didn't want to look like we were just hiding away now we got what we needed. We didn't want to look like one of those Police that disregard laws for personal gain...you know that ones.[sic]

“We are all very happy that no breach occurred, and we can go back to celebrating taking down that criminal mastermind.”

GCSB to OFCANZ 4.35on Date illegible, February 2012. Document 356.Reply to the email above.
GCSB wanting to give correct impression of how Residency status issue was being treated.

"[redacted] wrote up a brief document to catalogue the nationality issues and submitted it to [redacted] was pretty relaxed."

"People here have been pretty relaxed about it all.”
“Yeah I think [redacted] was getting pretty excited to start sinking his teeth into things. He will be happy to help out whatever they throw at him.”

28 September 2012- DN 97- OFCANZ to GCSB
Analyst has been tasked with coordinating a COMINT briefing for two Crown Law representatives that are required to review the Operation Debut file.
The meeting between Crown Law and AC Burgess/DSupt Van Beynen had been scheduled for that day.
“Due to the short notice of the tasking, and the urgency for access, would it be possible for me to conduct a COMINT briefing on your behalf prior to the discussion, and have Crown Lae arrange subsequent briefings that you may deem necessary later. Conversely, would it be better to have them visit you for a brief prior to coming here?

11 October 2012- DN 00662- Grant Wormald to GCSB
As he is required to furnish an affidavit for the High Court by 18 October, Mr Wormald asks to get a copy of the RFI which [redacted] worked up with Nigel McMorran.
“My understanding is that Nigel signed off on Friday afternoon 16 December 2012 [typo, 2011] with [redacted] down at GCSB. For that reason we didn't get a signed and scanned copy for our records as Nigel was racing off to pick his kids up from the airport.”

All notes redacted due to information which would divulge tradecraft.
Synopsis of intercepted communications by GCSB.

20 December 2011- DN 0 1025
1. Dotcom instructs Ortmann to provide phone number of associate.
2. Ortmann provides details of own location (NZ 17 Dec). Named individual provides details of own location and travel plans.
3. Ortmann advised him he woud see him in January. He was leaving Hong Kong.

5 January 2012- DN 01026
One paragraph report:

This report contains a New Years greeting between two associates of Kim Dotcom not named in the affidavit. One associate was probably Australian.

12 January 2012- DN 01027
This report contains flight details and passport details of a named associate (not listed on the affidavit). This individual planned to travel to New Zealand in January from Melbourne, Australia.

16 January 2012- DN 01028
Ortmann suggests that a named associate (not listed in the affidavit) visit Auckland in late January 2012. Ortmann notes Dotcom's birthday as 21 January and suggests that the associate attend.

16 January 2012- DN 01029
1. A named individual (not listed in the affidavit) notes his intentions to attend a conference in the US on 31 January and seeks confirmation from a possible New Zealander of their intention to attend the conference.
2. Both individuals discussed a plan to hire an aircraft apparently on behalf of Kim Dotcom and to meet Kim Dotcom over the New Year period.
3. The first named individual planned to travel from Hong Kong to New Zealand prior to the New Year, then on to Australia in early January with a named female associate (not listed in affidavit). Subsequently Kim Dotcom was in contact with this associate discussing travel to associate.
4. Kim Dotcom learnt from the first individual that a named UK individual associated with the entertainment industry was planning to travel to New Zealand and would be welcome to stay with Kim Dotcom.

18 January 2012- DN 01030
This report notes Kim Dotcom's planning of new music projects and wish to discuss these with an unidentified individual. Dotcom probably planned to travel to see that individual, probably with Ortmann.

18 January 2012- DN 01031
1. This report notes that a named individual (not identified in the affidavit) would not attend Dotcom's birthday party.
2. The report goes on to note that the individual had been in contact with Van Der Kolk. An unspecified matter had been discussed with the individual and Van Der Kolk. The named individual expected Ortmann and Dotcom to react badly when they learnt of the unspecified matter.

19 January 2012- DN 01032
1. Paragraph one redacted as disclosure would reveal tradecraft.
2. Two unidentified individuals note the third unidentified individual was located in Bangkok.
3. Two partially identified individuals noted that Batato had arrived.

20 January 2012- DN 01033
Kim Dotcom learnt that an associate had been provided with an Audi. Dotcom would be located at an unspecified studio on 19 January [sic].

© Scoop Media