8 August 2013

Jacqui Dean Chairperson, Law and Order Select Committee NZ Parliament

Dear Chairperson, This is to provide the Committee with information about the cost impacts of the Telecommunications (Interception Capability and Security) Bill as requested by your letter of 29 July 2013 to us. Mega Ltd. (Mega) will be a service provider under the Bill. As Mega is not covered by the existing legislation, the Telecommunications (Interception Capability) Act 2004, any cost arising out of the Bill will be an additional cost. Network Security Megas understanding is that the provisions of Part 3 of the Bill related to Network Security are not applicable to service providers. This is based on clause 35(1)(b) and 37(3) in relation to any Ministerial Direction as well as clause 38(1)(b) and 38(4) in relation to any regulations made by the Governor-General. Accordingly, there is no anticipated cost to Mega arising from the network security requirements from the Bill. Duty to Assist Clause 24 will impose duty to assist obligations and costs on Mega. The key determinant of the quantum of costs imposed on Mega by the Bill is the interpretation of clause 24(3) generally and clause 24(3)(b)(vi) specifically. As noted in our submission, there is absolutely no way that Mega can, on its own, view or provide the name or content of a file as the service user is completely in control of the decryption key. For Mega, decryption of telecommunications is therefore impossible and it cannot be a reasonable or fair expectation, as the clause is predicated on reasonable assistance and reasonable steps. We note that case law suggests that it is not reasonable to expect action to be taken without regard to cost or proportionality looked at from the point of view of the person being asked to assist.

If the actual requirement under clause 24(3) is to assist the surveillance agency to whom an interception warrant is issued, or any other lawful interception authority is granted, by way of making people with technical assistance available under clause 24(3)(a); providing call associated data; providing general information about decrypting telecommunications within Megas systems under clause 24(4) (but not actually decrypting the telecommunications itself which, as noted above, is impossible for Mega); and the interception is carried out by Mega rather than the surveillance agency under clause 24(5) then, subject to there not being an excessive quantity of warrants/authorities, the net cost imposed on Mega by the Bill in relation to a duty to assist is insignificant. On the other hand, if the actual requirement under clause 24(3) generally and clause 24(3)(b)(vi) specifically requires Mega to decrypt the content of telecommunications within Megas systems, something which it cannot do, then the cost is infinite in the sense that an obligation is being placed on Mega which it cannot meet. Lawful Interception Subpart 5 of Part 2 of the Bill allows for Ministerial direction or regulations that could impose interception capability duties on Mega as if it were a network operator. Clause 10(3)(b) requires a network operator to decrypt a telecommunication if the network operator intercepting the telecommunication has provided that encryption. As noted in our submission and referred to above, Mega provides encryption but cannot decrypt a telecommunication as the decryption key is wholly controlled by the service user. Both for itself and any third party, Mega is unable to view or provide the name or content of a file. Accordingly, the cost to Mega from any requirement to provide interception capability is infinite in the sense that it is an obligation which it cannot meet. Further, it is unclear what interception capabilities surveillance agencies expect from service providers who have the vast majority or all of their services hosted in third party facilities outside New Zealand and are not undertaking the interception on behalf of a surveillance agency under clause 10(2). Mega is therefore unable to estimate costs in this regard (or provide a view on how this obligation may conflict with the laws of various countries where Mega uses third party facilities). Yours faithfully, for MEGA Limited

Vikram Kumar Chief Executive Officer