Dotcom Surveillance: GCSB & Police Versus Billy Big Steps

Looking again at the criteria below and the original information provided yesterday by [redacted] would say it is most unlikely that billy big steps can be a permanent resident
– February 23, 2012 email between a Police analyst and GCSB staffer, about the Dotcom surveillance.

In December 2011 and January 2012, the Government Communications Security Bureau (GCSB) intelligence agency intercepted the communications of German multi-millionaire Kim Dotcom, the CEO of data storage site Megaupload.com. It did so at the behest of the Organised and Financial Crime Agency of New Zealand (OFCANZ) who had been asked by the FBI to arrest Dotcom for extradition to the United States, where he has been indicted for alleged criminal copyright infringement, racketeering and money laundering.

Since the police raided his Coatesville mansion on January 20, 2012, Kim Dotcom has dragged members of Parliament, the Prime Minister and New Zealand's courts into a story without any apparent end in sight. What follows is a small portion of that story. It concerns what has turned out to be the unlawful interception of communications by Dotcom and by his colleague Bram Van Der Kolk by the GCSB. It is also a fascinating glimpse into the relationship between two agencies who supposedly act as guardians of New Zealand's security.

The timeline below traces not only the Police/GCSB preparation for the interceptions, but the jubilation and mutual backslapping following the raid, and the mutual re-assurances when serious legal issues began to emerge. At the core of those legal issues was the fact that Dotcom and Van Der Kolk’s residency status meant that the GCSB were not legally allowed to intercept their communications.

At times, the timeline reads as if it were a Boys Own adventure. Judging by their emails, the GCSB and Police seem like two new-found friends engaged in a breathlessly exciting mission (eg “.It was a lot of fun.. We’re are all stoked with the result” and “We can go back to celebrating taking down that criminal mastermind..”) However, after failing to do due diligence on the details, the two agencies lapse anxiously into a 'I'm OK, you're OK, we must be OK “ exchange that is clearly aimed at bolstering their mutual confidence – even though ultimately, things turned out to be not OK at all.

This story is based on documents released under the Official Information Act. It includes email communications between the GCSB and OFCANZ from September 2011 to October 2012, as well as affidavits presented before the High Court last year.

It is the tale of two meetings.

MEETING ONE

On December 14, 2011, Detective Inspector Grant Wormald, police officer in charge of Operation Debut hosted a meeting at OFCANZ. According to Wormald, the meeting had two distinct phases. The first phase was to brief government agencies about the operation targeting Dotcom, and to impress upon them they the scale of the operation, and the need for strict confidentiality. Representatives from Crown Law Office, Ministry of Justice, Police Legal Section, and GCBC attended.

“The investigation had reached a point,” Wormald said, “ where steps were needed to process extradition documents and Mutual Assistance requests from the United States, which might arrive over the Christmas/New Year holiday period,” Detective Sergeant Nigel McMorran, Wormald' s second-in-charge, outlined the investigation. He gave details of the alleged offending and offenders and also briefed on the details of the anticipated United States requests.

Dotcom and Van Der Kolk and their families were both specifically mentioned (during the meeting) as residing in, or near, Auckland. Wormald said he believed reference were made to Dotcom's intention to buy a property, but that this had been deferred on the basis that his application for permanent residency under the overseas investor scheme had been declined.

During the first phase of the meeting, Wormald commented that “the Police and OFCANZ had considered a domestic interception warrant, but were unable to make an application for one.” He said he raised this matter in the first phase of the meeting, so that the police legal team could comment if need be. “This was a brief remark which caused no discussion from the others present,” Wormald said.

The two GCSB staff at the meeting took no part in this first phase, and potential GCSB involvement in the operation was not discussed in the presence of the other agency representatives. McMorran then showed all the attendees the door, while the GCSB representatives remained behind. What followed, said Wormald, was a discussion “about the general viability of, and GCSB assistance in providing intelligence”. He made no notes and does not recall either of the GCSB staff taking notes. The meeting lasted three to five minutes in total.

A general discussion then followed about what the GCSB could achieve, and the parameters of their involvement, with OFCANZ specifically interested in the timing and location of any birthday party for Dotcom - and the locations and likely travel plans of the other suspects being sought by the US. Those persons of interest were: Kim Dotcom, his wife Mona Aquino Verga, Bram Van Der Kolk, (Customer Support) his wife Junelyn Van Der Kolk, Finn Habib Batato (Chief Marketing Officer, Vice President of Business Development,) Mathias Ortman (Chief Technical Officer), Sven Echternach (Secretary of Megaupload, Head of Business Development), Julius Benko (Graphic Designer), Andrus Nomm (Projects Planning, Development and Testing).

At this point, the issue of residency of Dotcom and Van Der Kolk first came up. Wormald recalled there was general consensus that all of the parties of interest were not New Zealand citizens. [N.B. This was not the only relevant criterion : residency was, as well.] The second affidavit from an unnamed GCSB staff member concurred with Wormald's memory of the events. “I had a clear idea of what amounted to a permanent resident, and therefore a protected person, and I believed Mr Dotcom and Mr Van der Kolk were not protected persons.”

Wormald believed he “made a comment that he didn’t think it was possible for the GCSB to intercept either Mr Dotcom or Mr Van Der Kolk on the basis they were living in New Zealand.” However one of the GCSB representatives said interception powers were able to be used if the persons involved were not New Zealand citizens, or permanent residents. He said he was sure that Dotcom and Van Der Kolk were not citizens, but could not advise as to what residency they held. A GCSB staff member explained that “different types of residency existed and this affected what they could regarding people living in New Zealand”. Wormald said both Dotcom and Van Der Kolk must have some sort of residency as they were both living in New Zealand, and were able to come and go from the country. He said he was happy to act as a go-between for GCSB and Immigration New Zealand to clarify this point. “After a brief discussion this did not seem to be necessary at the time.”

The meeting ended with the agreement that OFCANZ would send detailed documents to GCSB to help them determine whether they would be able to assist. “No undertakings or agreements other than that were made at the time.”

A REQUEST WAS MADE

“Have fun on your day off. Hope Dotcom goes down!”
– email by GCSB staff member to Police analyst, January 18, 2012

On December 16, 2011, Wormald, who had flown to Auckland, authorised McMorran to sign a formal Request For Information (RFI) on his behalf. This formally asks for GCSB assistance in providing intelligence on Dotcom. The document was prepared on the Friday afternoon by a GCSB staff member and McMorran, at the GCSB office in Wellington. In his affidavit to the court, Wormald said he did not actually read the RFI until the following February, and that OFCANZ did not have a signed and scanned copy of it on file, until after concerns had been raised about the legitimacy of the interceptions of Dotcom and Van der Kolk.

In an email to the GCSB he explained this was because McMorran had to race off after signing the RFI to pick his kids up from the airport. [Besides everything else, the Dotcom, surveillance fiasco confirms that New Zealand really does go on holiday from before Christmas well into the New Year, including its security services.]

On the same day, Wormald received documents from Immigration NZ which showed Dotcom had been identified as a resident on his last two arrivals into the country. This was confirmed on January 11, when police received the Immigration NZ file showing Dotcom was granted residency on November 18, 2010. However, Wormald did not inform the GCSB of Dotcom's residency status.

In GCSB's second affidavit, the spy agency described receiving the RFI on December 16, 2011, with the bureau's legal advisor approving the assistance request. “At that stage, and throughout the operation, no GCSB employee involved in Operation Debut raised concerns based on information they had seen that protected persons were being targeted.”

[Documents show the GCSB did receive legal advice on December 19, but the substance of that advice was suppressed. We do not know how the GCSB legal team came to the conclusion that the interception was lawful, or whether the legal team had flagged the issue of residency as something which needed to be investigated. The suppression of the legal advice given to the GCSB also occurs in February, after the surveillance legal issues come to light.]

Wormald then went on leave from Wednesday, December 21 - until Monday, January 9, 2012. He was in regular contact with McMorran to receive progress reports on the investigation. In the days leading up to the raid there was some correspondence between GCSB and OFCANZ. A police analyst thanked a GCSB staff member for two reports received on January 18, 2012 and for a meeting the previous day. They described the support they have received from GCSB as “unprecedented and really positive”. The GCSB staff member replied: “Have fun on your day off. Hope Dotcom goes down!”

On January 20, 2012 the raid occurred, and Operation Debut was terminated. Directly after the raid on the Dotcom mansion, the two agencies passed congratulations back and forth on a job well done. GCSB said it was “their pleasure” to be involved and that it was a “lot of fun”. And moreover : “We’re are all stoked with the result, not that we take any credit for any of it”.

In turn, OFCANZ thanked GCSB for “going the extra mile to assist”. They both agreed that a debrief should be arranged to go over what worked well and what could be done better. In an email from OFCANZ to GCSB on February 1, 2012, the staff member discussed the proposed debrief: “I see this as a chance to highlight the success of this op in terms of us seeking your assistance in a fairly unique case and you guys going the extra mile to assist. Also the connectivity to you folks from the field using the [redacted] was a very simple yet effective medium to provide regular updates. I think Debut is a joint model that could be replicated (and built upon) to great effect in future operations with a regional and or wider transnational component.”

MEETING TWO

“We are all very happy that no breach occurred, and we can go back to celebrating taking down that criminal mastermind.”
- Email from OFCANZ to GCSB on February 29, 2012.

This meeting was held at 10am Thursday February 16, 2012 at the GCSB. It was attended by GCSB staff “including director Ian Fletcher, deputy director intelligence, deputy director mission enableman, assistant director production and outreach, global issues unit manager (myself) and ….(redacted) head presenter, an analyst “who joined the team yesterday, and who will be supporting NZ Police and OFCANZ”. From OFCANZ was Superintendent Ray Van Beynen (deputy director) D/Insp Grant Wormald (OC OP Debut), D/Sgt Nigel McMorran 2ic, (myself), and a police analyst.

At the debrief, a GCSB staff member raised a possible issue that Dotcom and Van der Kolk's communications had been intercepted. “It appeared to the GCSB that the interception may not have been lawful because of their [Dotcom and Van Der Kolk's] residency status,” Wormald said. He was surprised that the issue had come up, given it had been three weeks since the termination of the operation and the end of interceptions.

Wormald and the GCSB agreed the issue needed to be dealt with promptly.
A GCSB staff member recalled : “It may have been as a result of this debriefing, or because of repeated references in the media referring to Mr Dotcom as a New Zealand resident, I felt it necessary to revisit the question of his immigration status.”

THE AFTERMATH

“So, all done and dusted. Bring on the next case!"
- GCSB email, February 27, 2012

The following Monday February 20, 2012. and over the next seven days, there was a flurry of emails exchanged between OFCANZ, the GCSB and Immigration NZ to determine the exact residency status of Dotcom, Van Der Kolk and their families, and whether they had been any illegal interceptions.
On February 21, 2012, McMorran sent Wormald and another police analyst screenshots of Immigration NZ documents showing Dotcom and Van Der Kolk did indeed have NZ residency status. In the email McMorran said to “liaise with Grant before releasing, bearing in mind we never got this info until January 1 and 10 and we were under the assumption that we were not doing these two subjects anyway and were only on the offshore ones contacting the other two or each other”.

[N.B.: Wormald had initially received information on December 16, 2011 that Dotcom had been identified as a resident on documents from when he entered New Zealand. This has been confirmed by Immigration NZ documents received on January 11, 2012.]

OFCANZ passed this information onto the GCSB in an email on February 22. In another email that same day, OFCANZ said: "Some OFCANZ staff (including myself) assumed that citizenship/nationality rather than residency is the [illegible]/defining criteria for targeting/exemption, and/or made incorrect assumptions as to what actual status of particular individuals was based on intelligence received. Some OFCANZ staff assumed that certain persons were indeed not being targeted, and that the intelligence received was derived from external, non-resident targets." OFCANZ then accepted responsibility for some errors of process and judgement.

GCSB replied to reassure OFCANZ that “there has not been a major inquiry or witch hunt at GCSB about Dotcom's residency status. A summary document has been given to legal advisor about TF Debut about compliance issues which is to be stored on file for future reference, but they do not expect it to lead to further actions or questions asked. None of us are of the opinion that there needs to be any follow on discussions - certainly at a Deputy Director level. GCSB staff and managers are still viewing TF DEBUT as a very successful collaboration with OFCANZ and we would not want this issue to take a shine off things."

In turn, OFCANZ replied they wanted to assure the GCSB that they had been “ethical and proper in our dealings re this whole RFI and not a bunch of clowns walking roughshod over the law and sound practice. We too are keen on future co-operation and despite DOTCOM getting bail today, still see the shiny side of the operation. Never the less, we will take some good lessons out of this for next time”.

On February 23, 2012 a police analyst emailed a GCSB staff member during a discussion about Dotcom's residency status. “Looking again at the criteria below and the original information provided yesterday by [redacted] would say it is most unlikely that billy big steps can be a permanent resident. Same of the others.” The following day, OFCANZ were still waiting on the final word, and emailed GCSB with this: “Hopefully he was a resident and all will still be positive. But this has definitely been a wake-up call for people here, which is positive.”[During this seven day period, the GCSB received internal legal advice but all correspondence had been suppressed. We do not know how the legal team came to the conclusion that there were no compliance issues.]

By February 27, Wormald had received an email from the GCSB that according to their lawyers, neither Dotcom nor Van der Kolk had been unlawfully intercepted. "[The lawyers] agreed that as the families only had Residence, there was no inadvertent targeting of NZSID7 protected persons - who are only protected when they have Permanent Residency. So all done and dusted. Bring on the next case!"

In GCSB's second affidavit they stated: “The legal advisor confirmed that there was no compliance issue arising from Mr Dotcoms or Mr Van der Kolk's residency status”. That decision was described by an OFCANZ staff member as “more luck than good management but all good all the same. Glad you liked working with OFCANZ, hopefully we will have some more new and exciting things for you soon.”

And in a final email from OFCANZ to GCSB on February 29, 2012:
“Thanks for the [redacted] and I were a bit embarrassed that we may have broken the first and most important rule of SIGINT. And after talking with our Dep Director Ray, he introduced us to make sure you all knew that we took it seriously, and would take responsibility for it, and didn't want to look like we were just hiding away now we got what we needed. We didn't want to look like one of those police that disregard laws for personal gain...you know that ones.[sic] We are all very happy that no breach occurred, and we can go back to celebrating taking down that criminal mastermind.”

THE AFFIDAVITS

In affidavits submitted to the High Court in Auckland after the termination of the surveillance, the GCSB laid out their position. They said prior to agreeing to undertake interception operations, they were informed by OFCANZ that all person of interest were foreign persons and could be intercepted. The GCSB were advised [by whom it is unclear] that none of the relevant persons had New Zealand citizenship or permanent residence. That assurance proved to have been unfounded. “This advice subsequently proved, however, to be incorrect. I learned on 22 February that Immigration NZ had advised OFCANZ (who had not passed on the information to GCSB), that Mr Dotcom and his family and Mr van der Kolk and his family were in fact persons holding residence class visas under the Immigration Act 2009. “The definition of 'permanent resident' in the GCSB Act includes a person holding a residence class visa. Accordingly the interceptions in relation to those persons was not authorised by the GCSB Act.”

In Dotcom's affidavit in the High Court on September 7 2012, he maintains that as a New Zealand resident, he is not susceptible to having his communications intercepted by GCSB personnel. He attached documents which contained his New Zealand returning resident's visa. “I understand that my permanent residency was granted prior to my arrival in New Zealand on 10 December. My arrival on that occasion followed receipt of written advice from Immigration NZ of approval in principle of permanent residency, which would be activated on my arrival in New Zealand. ” He states that he became a New Zealand permanent resident on September 26, 2011.

For the government however, Dotcom has been a permanent headache ever since that morning raid on January 20, 2012.

ENDS

See also: Updated: GCSB's Kim Dotcom Surveillance Timeline

© Scoop Media