New Zealand Prime Minister John Key declassified documents on Monday (after The Intercept published a story about the NZ government’s secret plan to access data from the country’s main internet cable.) that outlined a project called “CORTEX.” Key seemed to think — or perhaps hope — that these documents would kill off any concerns and put the controversy to a swift end. But they fail to address a number of crucial issues — critics have already dismissed them as a “red herring” — and in fact only seem to cloud matters further.
In a radio interview on Monday morning, Key described Project CORTEX as a toned down version of what he called “mass cyber protection.” What’s now in place, he said, is a “bespoke functionality which an individual company or agency could deploy,” apparently to mitigate cyber attacks.
The Cortex files show that the government signed off on a new “proactive” cybersecurity effort aimed helping government agencies and other organizations detect malware attacks. But what Key has not mentioned in any of his interviews is that the monitoring that was enabled by this system also, by design, has to filter through private communications to identify malware in the first place. The documents Key declassified clearly state that under CORTEX “technology can be used to separate personal communications from other data, so that privacy issues associated with GCSB activities to be proportionate to cyber threats.” (Emphasis added.) In the United States, the cybersecurity bill CISPA was opposed by privacy advocates and eventually killed because of widespread concerns associated with the type of activity CORTEX appears to enable.
To function, the CORTEX project must have some degree of access to New Zealand’s internet cables. What we still do not know is how broad that access is or the practical restraints in place preventing the system from being misused to collect citizens’ private data. Key has insisted, of course, that no large-scale “cable access” project like Speargun was completed. But the CORTEX documents certainly do not prove it — so thus far Key is expecting citizens to take him at his word.