The Government is joining an international trend to get tough on hackers. Stephen Revill of Bell Gully argues this could conflict with demands for online privacy

A scene on New Zealand television recently highlighted a serious issue in a humorous way. Two presenters of a youth-oriented programme were filmed in a hotel room with a professional hacker, sifting through the email accounts of a local Internet service provider.

While the feature made good television, it raises some serious questions - not so much in relation to its promotion of the questionable ethics of a teenage computer genius with too much spare time, but as to how ordinary citizens can protect their online privacy.

Online privacy has been an issue since the truth about cookies (files from a web site that are downloaded on to a PC and can monitor online habits) was discovered. It is an issue that will increasingly come under the political and media spotlight in coming weeks as the Government considers Information Technology Minister Paul Swain's proposed draft changes to the Crime Amendments Bill (No 6) 2000.

Mr Swain wishes to exempt police from the provisions of anti-hacking legislation. This is not simply a question of whether or not there's merit in providing police with wider powers in cyberspace (similar to those they have for tapping phone lines and searching private property); it's an issue at the heart of the online economy.

The rise and rise of the Internet has been coupled with increases in our technical skills base and our technology tools base. Hacking - it seems - is relatively simple, so long as you know what you're doing.

Whether police are capable of hacking is not the question because they probably can. But should they be given sweeping powers to legally monitor and intercept email, and to legally force co-operation from suspected criminals to aid with encryption? The issue is not what types of material could be intercepted; but rather how the interception procedure could potentially be set out.

About a million New Zealanders have access to email and the Internet, one of the highest penetration rates in the world. And it's a fairly safe bet that most internet users are not spending their time online organising drug hauls and bank robberies or dealing in pornography. Most of them are doing their banking, chatting to friends and relatives overseas, browsing favourite sites, or downloading new games or software. If the new legislation goes through - giving police the power to tap email and monitor online activity - the online privacy of all internet users will, to some extent, be jeopardised.

We are at the dawn of a new era of technological revolution communication, which will bring with it new ways of both doing business and committing crime. It is absolutely vital that, in drafting legislation, the Government takes into consideration the bigger picture, including the future potential of legitimate online activity and the future of technology.

A framework needs to be developed, but legislating is a potential minefield without proper consultation. If the Government gets it wrong, New Zealand's online economy could be seriously jeopardised before it gets started.

Just about everything, including black box technology that intercepts and scans email at the Internet service provider (ISP) - which is being enforced in the UK - will be suggested in the argument to give police more online power. But it's also the kind of technology that will cost New Zealand a fortune to install and maintain - and who's to say that it won't be side-stepped by smarter hackers who learn to bypass the check points? New technologies such as DSL will enable people to set up their own mail servers on their home PC anyway.

There are also issues surrounding free web-based email services - which are currently virtually untraceable. How will the Government legislate a police mandate to monitor email activity and content from providers such as Yahoo and Hotmail?

Countries such as the US and the UK - where governments have been debating online issues longer than in New Zealand - haven't got the legislation right yet, and the Government must take stock of the fall-out scenarios elsewhere.

In the US, the "Carnivore" email surveillance system has had difficulties. It is run under protest from privacy advocates who say the way it operates has not been clearly communicated and that people have a right to know if and how their email may be monitored. The Privacy Group has even asked for a temporary restraining order while key information is made public.

In the UK, recent criticism over the controversial wiretapping law has resulted in one ISP, Poptel, threatening to move some of its services offshore to protect the privacy and confidentiality of its customers.

Internet wiretapping is prohibited in some countries, including Sweden and Norway. However, as the global community gets smaller, setting up services outside the law is only a matter of making a dial-up connection and doing some technical re-routing.

Deciding to exempt police from the provisions of anti-hacking legislation is not just a question of privacy over wiretapping or steering data traffic through government-monitored systems. The issues are varied and complex. What is the definition of online criminal activity? Do you prosecute where the crime originates, or where it is perpetrated?

The need for international Internet policies has long been touted, and becomes even more apparent as countries fail in their attempts to legislate methods for tracking online criminal activity.

It's clear that police need the power and the ability to move quickly and effectively in the fast-paced world of the Internet. But the Government needs to strike a balance between protecting people's online privacy and finding methods to fight new types of crime. It's obvious that international consultation is needed. The answer does not lie in taking a Big Brother approach even if the technology permits it.

This is a general summary only and should not be taken as a substitute for specific advice.

Stephen Revill is a partner in Bell Gully's Wellington office. He specialises in Internet and online legal issues.

Web site: Bell Gully

Email: stephen.revill@bellgully.com

March 2001