An Immigration NZ team dealing with mass arrivals of asylum seekers paid for spyware for two years without using it.
The Ministry of Business, Innovation and Employment began paying for Israeli-born US company Cobwebs Technologies in March 2020, but did not use it in a live case until April 2022.
“MBIE began paying for the Cobwebs tools in March 2020 and has continued to pay for the licences since the start of the contract period,” the ministry told RNZ in an Official Information Act response.
It began testing the web-scraping tools, and in December 2020 began developing “a robust assurance framework and processes to mitigate any risks” associated with their use.
However, an earlier OIA showed that the tools were still used three times after 2022, when the department had no one trained to monitor them.
It was not until February 2023 that an oversight group was set up; after its first reviews in April, it concluded that the previous uses of Cobwebs were justified.
The department refuses to say what it spends on Cobwebs, and for months refused to say what it is used for, until last month when it told the RNZ it wanted to reassure the public that the service was procured and used solely to detect and prevent mass arrivals of asylum seekers – boat people.
There has never been a significant risk of mass arrivals by boat here, but Cobwebs has been used six times since April 2022.
The government’s use of the tools is outside the controls and scrutiny imposed on New Zealand’s security and intelligence agencies, the Security Intelligence Service (SIS) and the Government Communications Security Bureau (GCSB).
It is part of a global trend of government agencies contracting with private spyware companies.
“Demand for spyware technology remains extraordinarily high, whether from government customers or private companies,” says a March 2023 paper for the Carnegie Endowment for International Peace.
Commercial spyware allows governments to break the kinds of encryption that might hamper their own systems, the paper says.
“The proliferation of spyware in Europe, both as an export and a domestic surveillance tool, is a stark reminder that surveillance abuses are not unique to authoritarian regimes.”
Authorities in Greece, Hungary and Spain have been implicated in spyware scandals targeting Catalan independence activists.
Cobwebs shares its origins with the Israeli Defence Force and the most controversial spyware-for-hire technology, Pegasus, which investigations have shown has been used to target politicians, human rights activists and journalists.
Cobwebs tools are used in New Zealand by a second agency, unnamed in the MBIE documents, but believed to be the police, although they would not confirm this.
In July, Cobwebs Technologies joined forces with PenLink, a Nebraska-based company, both owned by investment firm Spire.
“The combination of our solutions will enable law enforcement and national security agencies to bring all digital intelligence domains onto a single, unified platform to achieve new levels of insight and efficiency,” PenLink said.
MBIE said it had no contract with PenLink.
“Both companies are owned by the same parent company, but we do not believe this links MBIE to Penlink,” it told RNZ.
It attributed the lack of use of the new tools in 2021 to April 2022 to “negligible demand for work related to the prevention and/or detection of mass arrivals at sea during this period, due to the global Covid-19 pandemic and associated health risks to irregular migrants attempting maritime ventures”.
“The limited use of Cobwebs will resume from 11 April 2022 due to increased activity within Immigration New Zealand’s Irregular Migration Programme.”
The team using Cobwebs is part of MBIE Intelligence, or MI, which was previously confined to Immigration NZ but has recently spread across the ministry and “established a dedicated intelligence capability focused on national security and intelligence”. The government denied that MI had a national security focus.
The Ministry refused to even provide a “ballpark” figure for what Cobwebs is costing the taxpayer.
“We have specifically considered the need for the government to provide information to promote transparency and accountability for the use of public funds in the use of the Cobwebs tools,” it told the RNZ.
“While we consider that there is merit in releasing information for these reasons, on balance we consider that the impact of releasing this information at this time outweighs the need to promote transparency and accountability for the use of public funds. This is because release is likely to have a significant impact on MBIE’s ability to prevent and detect mass arrivals by prejudicing the commercial position of Cobwebs Technologies and MBIE’s ability to negotiate effectively for the provision of tools to enable it to meet its obligations in this area, given that the contract ends in April 2024.”
