The GCSB & Police Versus Billy Big StepsTracing the spy agency’s dawning awareness of its Kim Dotcom screw-ups
by Hamish Cardwell
Looking again at the criteria below and the original information provided yesterday by [redacted] would say it is most
unlikely that billy big steps can be a permanent resident
– February 23, 2012 email between a Police analyst and GCSB staffer, about the Dotcom surveillance.
In December 2011 and January 2012, the Government Communications Security Bureau (GCSB) intelligence agency intercepted the communications of German
multi-millionaire Kim Dotcom, the CEO of data storage site Megaupload.com. It did so at the behest of the Organised and
Financial Crime Agency of New Zealand (OFCANZ) who had been asked by the FBI to arrest Dotcom for extradition to the
United States, where he has been indicted for alleged criminal copyright infringement, racketeering and money
laundering.
Since the police raided his Coatesville mansion on January 20, 2012, Kim Dotcom has dragged members of Parliament, the
Prime Minister and New Zealand's courts into a story without any apparent end in sight. What follows is a small portion
of that story. It concerns what has turned out to be the unlawful interception of communications by Dotcom and by his
colleague Bram Van Der Kolk by the GCSB. It is also a fascinating glimpse into the relationship between two agencies who
supposedly act as guardians of New Zealand's security.
The timeline below traces not only the Police/GCSB preparation for the interceptions, but the jubilation and mutual
backslapping following the raid, and the mutual re-assurances when serious legal issues began to emerge. At the core of
those legal issues was the fact that Dotcom and Van Der Kolk’s residency status meant that the GCSB were not legally
allowed to intercept their communications.
At times, the timeline reads as if it were a Boys Own adventure. Judging by their emails, the GCSB and Police seem like
two new-found friends engaged in a breathlessly exciting mission (eg “.It was a lot of fun.. We’re are all stoked with the result” and “We can go back to celebrating taking down that criminal mastermind..”) However, after failing to do due diligence on the details, the two agencies lapse anxiously into a 'I'm OK, you're
OK, we must be OK “ exchange that is clearly aimed at bolstering their mutual confidence – even though ultimately,
things turned out to be not OK at all.
This story is based on documents released under the Official Information Act. It includes email communications between
the GCSB and OFCANZ from September 2011 to October 2012, as well as affidavits presented before the High Court last
year.
It is the tale of two meetings.
MEETING ONE
On December 14, 2011, Detective Inspector Grant Wormald, police officer in charge of Operation Debut hosted a meeting at
OFCANZ. According to Wormald, the meeting had two distinct phases. The first phase was to brief government agencies
about the operation targeting Dotcom, and to impress upon them they the scale of the operation, and the need for strict
confidentiality. Representatives from Crown Law Office, Ministry of Justice, Police Legal Section, and GCBC attended.
“The investigation had reached a point,” Wormald said, “ where steps were needed to process extradition documents and
Mutual Assistance requests from the United States, which might arrive over the Christmas/New Year holiday period,”
Detective Sergeant Nigel McMorran, Wormald' s second-in-charge, outlined the investigation. He gave details of the
alleged offending and offenders and also briefed on the details of the anticipated United States requests.
Dotcom and Van Der Kolk and their families were both specifically mentioned (during the meeting) as residing in, or
near, Auckland. Wormald said he believed reference were made to Dotcom's intention to buy a property, but that this had
been deferred on the basis that his application for permanent residency under the overseas investor scheme had been
declined.
During the first phase of the meeting, Wormald commented that “the Police and OFCANZ had considered a domestic
interception warrant, but were unable to make an application for one.” He said he raised this matter in the first phase
of the meeting, so that the police legal team could comment if need be. “This was a brief remark which caused no
discussion from the others present,” Wormald said.
The two GCSB staff at the meeting took no part in this first phase, and potential GCSB involvement in the operation was
not discussed in the presence of the other agency representatives. McMorran then showed all the attendees the door,
while the GCSB representatives remained behind. What followed, said Wormald, was a discussion “about the general
viability of, and GCSB assistance in providing intelligence”. He made no notes and does not recall either of the GCSB
staff taking notes. The meeting lasted three to five minutes in total.
A general discussion then followed about what the GCSB could achieve, and the parameters of their involvement, with
OFCANZ specifically interested in the timing and location of any birthday party for Dotcom - and the locations and
likely travel plans of the other suspects being sought by the US. Those persons of interest were: Kim Dotcom, his wife
Mona Aquino Verga, Bram Van Der Kolk, (Customer Support) his wife Junelyn Van Der Kolk, Finn Habib Batato (Chief
Marketing Officer, Vice President of Business Development,) Mathias Ortman (Chief Technical Officer), Sven Echternach
(Secretary of Megaupload, Head of Business Development), Julius Benko (Graphic Designer), Andrus Nomm (Projects
Planning, Development and Testing).
At this point, the issue of residency of Dotcom and Van Der Kolk first came up. Wormald recalled there was general
consensus that all of the parties of interest were not New Zealand citizens. [N.B. This was not the only relevant
criterion : residency was, as well.] The second affidavit from an unnamed GCSB staff member concurred with Wormald's
memory of the events. “I had a clear idea of what amounted to a permanent resident, and therefore a protected person,
and I believed Mr Dotcom and Mr Van der Kolk were not protected persons.”
Wormald believed he “made a comment that he didn’t think it was possible for the GCSB to intercept either Mr Dotcom or
Mr Van Der Kolk on the basis they were living in New Zealand.” However one of the GCSB representatives said interception
powers were able to be used if the persons involved were not New Zealand citizens, or permanent residents. He said he
was sure that Dotcom and Van Der Kolk were not citizens, but could not advise as to what residency they held. A GCSB
staff member explained that “different types of residency existed and this affected what they could regarding people
living in New Zealand”. Wormald said both Dotcom and Van Der Kolk must have some sort of residency as they were both
living in New Zealand, and were able to come and go from the country. He said he was happy to act as a go-between for
GCSB and Immigration New Zealand to clarify this point. “After a brief discussion this did not seem to be necessary at
the time.”
The meeting ended with the agreement that OFCANZ would send detailed documents to GCSB to help them determine whether
they would be able to assist. “No undertakings or agreements other than that were made at the time.”
A REQUEST WAS MADE
“Have fun on your day off. Hope Dotcom goes down!”
– email by GCSB staff member to Police analyst, January 18, 2012
On December 16, 2011, Wormald, who had flown to Auckland, authorised McMorran to sign a formal Request For Information
(RFI) on his behalf. This formally asks for GCSB assistance in providing intelligence on Dotcom. The document was
prepared on the Friday afternoon by a GCSB staff member and McMorran, at the GCSB office in Wellington. In his affidavit
to the court, Wormald said he did not actually read the RFI until the following February, and that OFCANZ did not have a
signed and scanned copy of it on file, until after concerns had been raised about the legitimacy of the interceptions of
Dotcom and Van der Kolk.
In an email to the GCSB he explained this was because McMorran had to race off after signing the RFI to pick his kids up
from the airport. [Besides everything else, the Dotcom, surveillance fiasco confirms that New Zealand really does go on
holiday from before Christmas well into the New Year, including its security services.]
On the same day, Wormald received documents from Immigration NZ which showed Dotcom had been identified as a resident on
his last two arrivals into the country. This was confirmed on January 11, when police received the Immigration NZ file
showing Dotcom was granted residency on November 18, 2010. However, Wormald did not inform the GCSB of Dotcom's
residency status.
In GCSB's second affidavit, the spy agency described receiving the RFI on December 16, 2011, with the bureau's legal
advisor approving the assistance request. “At that stage, and throughout the operation, no GCSB employee involved in
Operation Debut raised concerns based on information they had seen that protected persons were being targeted.”
[Documents show the GCSB did receive legal advice on December 19, but the substance of that advice was suppressed. We do
not know how the GCSB legal team came to the conclusion that the interception was lawful, or whether the legal team had
flagged the issue of residency as something which needed to be investigated. The suppression of the legal advice given
to the GCSB also occurs in February, after the surveillance legal issues come to light.]
Wormald then went on leave from Wednesday, December 21 - until Monday, January 9, 2012. He was in regular contact with
McMorran to receive progress reports on the investigation. In the days leading up to the raid there was some
correspondence between GCSB and OFCANZ. A police analyst thanked a GCSB staff member for two reports received on January
18, 2012 and for a meeting the previous day. They described the support they have received from GCSB as “unprecedented
and really positive”. The GCSB staff member replied: “Have fun on your day off. Hope Dotcom goes down!”
On January 20, 2012 the raid occurred, and Operation Debut was terminated. Directly after the raid on the Dotcom
mansion, the two agencies passed congratulations back and forth on a job well done. GCSB said it was “their pleasure” to
be involved and that it was a “lot of fun”. And moreover : “We’re are all stoked with the result, not that we take any
credit for any of it”.
In turn, OFCANZ thanked GCSB for “going the extra mile to assist”. They both agreed that a debrief should be arranged to
go over what worked well and what could be done better. In an email from OFCANZ to GCSB on February 1, 2012, the staff
member discussed the proposed debrief: “I see this as a chance to highlight the success of this op in terms of us
seeking your assistance in a fairly unique case and you guys going the extra mile to assist. Also the connectivity to
you folks from the field using the [redacted] was a very simple yet effective medium to provide regular updates. I think
Debut is a joint model that could be replicated (and built upon) to great effect in future operations with a regional
and or wider transnational component.”
MEETING TWO
“We are all very happy that no breach occurred, and we can go back to celebrating taking down that criminal mastermind.”
- Email from OFCANZ to GCSB on February 29, 2012.
This meeting was held at 10am Thursday February 16, 2012 at the GCSB. It was attended by GCSB staff “including director
Ian Fletcher, deputy director intelligence, deputy director mission enableman, assistant director production and
outreach, global issues unit manager (myself) and ….(redacted) head presenter, an analyst “who joined the team
yesterday, and who will be supporting NZ Police and OFCANZ”. From OFCANZ was Superintendent Ray Van Beynen (deputy
director) D/Insp Grant Wormald (OC OP Debut), D/Sgt Nigel McMorran 2ic, (myself), and a police analyst.
At the debrief, a GCSB staff member raised a possible issue that Dotcom and Van der Kolk's communications had been
intercepted. “It appeared to the GCSB that the interception may not have been lawful because of their [Dotcom and Van
Der Kolk's] residency status,” Wormald said. He was surprised that the issue had come up, given it had been three weeks
since the termination of the operation and the end of interceptions.
Wormald and the GCSB agreed the issue needed to be dealt with promptly.
A GCSB staff member recalled : “It may have been as a result of this debriefing, or because of repeated references in
the media referring to Mr Dotcom as a New Zealand resident, I felt it necessary to revisit the question of his
immigration status.”
THE AFTERMATH
“So, all done and dusted. Bring on the next case!"
- GCSB email, February 27, 2012
The following Monday February 20, 2012. and over the next seven days, there was a flurry of emails exchanged between
OFCANZ, the GCSB and Immigration NZ to determine the exact residency status of Dotcom, Van Der Kolk and their families,
and whether they had been any illegal interceptions.
On February 21, 2012, McMorran sent Wormald and another police analyst screenshots of Immigration NZ documents showing
Dotcom and Van Der Kolk did indeed have NZ residency status. In the email McMorran said to “liaise with Grant before
releasing, bearing in mind we never got this info until January 1 and 10 and we were under the assumption that we were
not doing these two subjects anyway and were only on the offshore ones contacting the other two or each other”.
[N.B.: Wormald had initially received information on December 16, 2011 that Dotcom had been identified as a resident on
documents from when he entered New Zealand. This has been confirmed by Immigration NZ documents received on January 11,
2012.]
OFCANZ passed this information onto the GCSB in an email on February 22. In another email that same day, OFCANZ said:
"Some OFCANZ staff (including myself) assumed that citizenship/nationality rather than residency is the
[illegible]/defining criteria for targeting/exemption, and/or made incorrect assumptions as to what actual status of
particular individuals was based on intelligence received. Some OFCANZ staff assumed that certain persons were indeed
not being targeted, and that the intelligence received was derived from external, non-resident targets." OFCANZ then
accepted responsibility for some errors of process and judgement.
GCSB replied to reassure OFCANZ that “there has not been a major inquiry or witch hunt at GCSB about Dotcom's residency
status. A summary document has been given to legal advisor about TF Debut about compliance issues which is to be stored
on file for future reference, but they do not expect it to lead to further actions or questions asked. None of us are of
the opinion that there needs to be any follow on discussions - certainly at a Deputy Director level. GCSB staff and
managers are still viewing TF DEBUT as a very successful collaboration with OFCANZ and we would not want this issue to
take a shine off things."
In turn, OFCANZ replied they wanted to assure the GCSB that they had been “ethical and proper in our dealings re this
whole RFI and not a bunch of clowns walking roughshod over the law and sound practice. We too are keen on future
co-operation and despite DOTCOM getting bail today, still see the shiny side of the operation. Never the less, we will
take some good lessons out of this for next time”.
On February 23, 2012 a police analyst emailed a GCSB staff member during a discussion about Dotcom's residency status.
“Looking again at the criteria below and the original information provided yesterday by [redacted] would say it is most
unlikely that billy big steps can be a permanent resident. Same of the others.” The following day, OFCANZ were still
waiting on the final word, and emailed GCSB with this: “Hopefully he was a resident and all will still be positive. But
this has definitely been a wake-up call for people here, which is positive.”[During this seven day period, the GCSB
received internal legal advice but all correspondence had been suppressed. We do not know how the legal team came to the
conclusion that there were no compliance issues.]
By February 27, Wormald had received an email from the GCSB that according to their lawyers, neither Dotcom nor Van der
Kolk had been unlawfully intercepted. "[The lawyers] agreed that as the families only had Residence, there was no
inadvertent targeting of NZSID7 protected persons - who are only protected when they have Permanent Residency. So all
done and dusted. Bring on the next case!"
In GCSB's second affidavit they stated: “The legal advisor confirmed that there was no compliance issue arising from Mr
Dotcoms or Mr Van der Kolk's residency status”. That decision was described by an OFCANZ staff member as “more luck than
good management but all good all the same. Glad you liked working with OFCANZ, hopefully we will have some more new and
exciting things for you soon.”
And in a final email from OFCANZ to GCSB on February 29, 2012:
“Thanks for the [redacted] and I were a bit embarrassed that we may have broken the first and most important rule of
SIGINT. And after talking with our Dep Director Ray, he introduced us to make sure you all knew that we took it
seriously, and would take responsibility for it, and didn't want to look like we were just hiding away now we got what
we needed. We didn't want to look like one of those police that disregard laws for personal gain...you know that
ones.[sic] We are all very happy that no breach occurred, and we can go back to celebrating taking down that criminal
mastermind.”
THE AFFIDAVITS
In affidavits submitted to the High Court in Auckland after the termination of the surveillance, the GCSB laid out their
position. They said prior to agreeing to undertake interception operations, they were informed by OFCANZ that all person
of interest were foreign persons and could be intercepted. The GCSB were advised [by whom it is unclear] that none of
the relevant persons had New Zealand citizenship or permanent residence. That assurance proved to have been unfounded.
“This advice subsequently proved, however, to be incorrect. I learned on 22 February that Immigration NZ had advised
OFCANZ (who had not passed on the information to GCSB), that Mr Dotcom and his family and Mr van der Kolk and his family
were in fact persons holding residence class visas under the Immigration Act 2009. “The definition of 'permanent
resident' in the GCSB Act includes a person holding a residence class visa. Accordingly the interceptions in relation to
those persons was not authorised by the GCSB Act.”
In Dotcom's affidavit in the High Court on September 7 2012, he maintains that as a New Zealand resident, he is not
susceptible to having his communications intercepted by GCSB personnel. He attached documents which contained his New
Zealand returning resident's visa. “I understand that my permanent residency was granted prior to my arrival in New
Zealand on 10 December. My arrival on that occasion followed receipt of written advice from Immigration NZ of approval
in principle of permanent residency, which would be activated on my arrival in New Zealand. ” He states that he became a
New Zealand permanent resident on September 26, 2011.
For the government however, Dotcom has been a permanent headache ever since that morning raid on January 20, 2012.
ENDS