The Budapest Convention is being discussed by the government, and while it has some positive outcomes relating to
cybercrime, it also has some negative implications for privacy and Indigenous communities, says Emeritus Professor of
Law at the University of Auckland, Jane Kelsey.
The Convention is an international treaty wanting to protect signatories from cybercrime – crimes committed or enabled
via the Internet - such as cyber fraud, computer related fraud, terrorism, and child pornography. The government is
currently discussing whether New Zealand should sign up. If we do, we will be able to cooperate on these important
issues with other signatories, but we will also grant them powers to intercept and access our computer networks if they
believe a crime has been committed.
The Convention provides a legal basis for disclosure of domain name registration information and for direct cooperation
with service providers for subscriber information to obtain subscriber information, traffic data, immediate co-operation
in emergencies and mutual assistance tools. There are also some personal data protection safeguards.
While the benefits are obvious, there are significant implications that need to be considered. For example, Māori have
been accused of terrorism by Police in the past and could be at risk of similar unjust accusations in the future, which
could be exacerbated by internet connectivity, says Associate Professor of Computer Science at the University of
Waikato, Te Taka Keegan. “It will be difficult for Māori to support the Budapest Convention without assurances from the
government and protections in legislation for Māori control over Māori data sovereignty,” he says.
Professor Kelsey agrees, saying “there is a concern that Indigenous people’s resistance that is organised on the
Internet risks being labelled as cyber-crime by governments in their countries, and that their data stored on social
media could be trawled. Under the Convention, authorities who have these concerns would be able to access Indigenous
people’s data not only in their own country but could also to make requests to trawl through the data of other
Indigenous people they have relationships with from other signatory countries.”
This raises lots of questions of Indigenous data sovereignty and governance rules. Professor Kelsey is very concerned
the Department of the Prime Ministers and Cabinet (DPMC) and Ministry of Justice may not be taking the Crown’s
obligations under Te Tiriti seriously with regards to the Budapest Convention.
She says the leaked version of a search warrant in the Tūhoe raids shows how easily random dots can be joined to form a
narrative that justifies future warrants. Notions of cyber-enabled terrorism could easily get legs and implicate people
way beyond what it should. And who is going to know?” says Kelsey. “This can easily happen to Indigenous peoples
fighting for self-determination, where those in power can define resistance that is organised online as terrorists.
She believes the officials drafting the legislation need to ensure that it protects Māori rights and taonga, including
over data, under Te Tiriti, if they choose to sign the Budapest Convention, so that it is of benefit to all New
Zealanders.
“We will need to pass a domestic law to implement the Convention. There are some exceptions that allow the government to
decline to provide the information. But they don’t clearly apply to protect Māori rights over data and effective Māori
scrutiny of requests. There’s nothing to stop us from saying for the purposes of those exceptions in the Convention that
in this country they are subject to the Crown’s obligations under Te Tiriti. This needs to be in the Bill when it is
introduced because getting stuff into the Bill once it’s before the House is difficult.”