How New Zealand actually works, surveillance

Surveillance and intelligence, who watches, and who watches them

Two agencies, one station in a Marlborough valley, and a small club of watchers whose job is to make sure the watchers are watched.

What it is

New Zealand runs two intelligence agencies, split by direction:

• GCSB, the Government Communications Security Bureau looks outward: foreign intelligence from intercepted communications, plus the cybersecurity arm (the NCSC) that defends government and significant-organisation networks — GCSB, what we do.
• NZSIS, the Security Intelligence Service looks inward: domestic security, espionage, terrorism, sabotage, foreign interference, with powers to surveil people inside New Zealand — NZSIS, what we do.

The legal line between them matters: GCSB's foreign-intelligence powers are not supposed to reach New Zealand citizens or residents, when the bureau was caught having done exactly that for years, the country changed the law (below).

Waihopai, the ear in the valley

South of Blenheim, in the Waihopai Valley, GCSB ran one of the Five Eyes network's satellite-interception stations for over three decades, the two white radome domes on the valley floor became the most visible intelligence facility in the country. In April 2008 three protesters cut the outer dome in protest. GCSB stopped using the station in 2021 and the dishes were removed in 2022, the interception function moved to newer methods; the site remains — RNZ, April 2022.

Five Eyes itself is the post-war signals-sharing club, the US, UK, Canada, Australia and New Zealand, that pools interception and analysis. Membership is why a country of five million runs a signals-intelligence bureau at all: contribution buys access.

The laws that define it

• 2013, the GCSB Amendment Act. After the bureau was found to have surveilled Kim Dotcom, a New Zealand resident it was legally barred from targeting, a review revealed a pattern of potentially unlawful interceptions of New Zealanders going back years. The government's fix legalised assistance to police and the SIS under warrant, and passed 61–59 with one vote to spare, the closest a security law has come to failing — GCSB Amendment Act 2013; Parliament, the vote record.
• 2017, the Intelligence and Security Act. The first major independent review of the agencies (Cullen and Reddy, 2016) produced a rewrite: one act covering both agencies, the first statutory authorisation for GCSB cybersecurity, a tighter warranting regime, and a new double-lock: warrants touching New Zealanders now need sign-off from the minister and a High Court judge — Intelligence and Security Act 2017; DPMC, the 2016 review.
• Post-2019, counter-terrorism. After the Christchurch mosque shootings, the Royal Commission's 2020 report drove changes: the Terrorism Suppression (Control Orders) Act made control orders available for people returning from conflict zones, and 2021 legislation criminalised planning and preparation for a terrorist act, the gap the attacker had exposed — Royal Commission report, 2020; Control Orders Act 2019; Counter-Terrorism Legislation Act 2021.

Who watches them

The oversight stack is deliberately small and senior:

• Inspector-General of Intelligence and Security (IGIS): an independent statutory office that reviews agency activity, investigates complaints and audits legality, the person whose job is reading what the agencies actually did — IGIS, our role.
• The ministerial-judicial double lock, the 2017 Act's warrant rule: a minister signs, a High Court judge countersigns, for any warrant touching a New Zealander.
• The parliamentary committee, the Intelligence and Security Committee, chaired by the Prime Minister with the opposition leader on it, briefed in secret, reporting in public — Parliament, ISC.
• Independent reviews, the 2016 Cullen–Reddy review rewrote the law; periodic reviews continue under the 2017 Act.

Where the arguments are

• Bulk collection. The Five Eyes model runs on scale; the oversight model runs on warrants. Where the two meet, how much incidental collection of New Zealanders is too much, is the permanent argument.
• Five Eyes. Access to the world's largest intelligence pool versus alignment to partners' priorities, the trade Waihopai was built to buy.
• Post-2019 reach. The control-order and planning-offence powers arrived after the country's worst terrorist attack; whether they over-correct is the argument the Law Commission and civil-liberties groups keep.

Where to read the primary source

• Intelligence and Security Act 2017: the framework law
• The Inspector-General: the oversight office
• The 2016 Cullen–Reddy review: the report that rewrote the law
• The Royal Commission report: 2020; what the agencies missed
• GCSB's own description: what the bureau says it does

Glossary

The Canterbury of it

The city's camera network is council property watched by police. The council funds the "crime prevention cameras"; uniformed staff and a rostered team of volunteers monitor them around the clock. The network predates the rebuild, fourteen central-city cameras in 2008 , and grew with it: a 2014 extension into Riccarton, Addington, Merivale and New Brighton took the count to 68, explicitly "a positive response to changes in the city since the 2010-11 earthquakes" — NZ Police, city crime camera network extended, April 2014; CCC media release, June 2008. Police policy confines them to crime prevention, requires Privacy Act compliance, and destroys footage within two months unless it is evidence — Police manual, CCTV in public places.

Post-attack policing arrived here on trial. The Armed Response Teams, routinely armed patrols, ran a six-month pilot in three districts, and Canterbury was one; the trial ended in April 2020 and the commissioner scrapped the model outright, judging the teams did not align with the policing New Zealanders expect — NZ Police, the ART trial; NZ Police, ARTs will not continue. The instrument that outlasted it carries the city's name: the Christchurch Call, the May 2019 pledge by governments and platforms to keep terrorist content off the open internet — Beehive, the Christchurch Call adopted.

Last reviewed 2 October 2026, sources: GCSB, NZSIS, IGIS, DPMC, legislation.govt.nz, Royal Commission 2020, RNZ. Corrections: /corrections.