'Organised crime is organised. We are not', ministers told

• Advisory group suggests info sharing network to tackle organised crime
• Pacific countries and businesses could access some of the data, and share their own in return
• AI could be used to help look for patterns and identify criminal behaviour
• Group also calls for change to Privacy Act so agencies that request information would be liable, not those providing it

A ministerial advisory group is calling for a nationwide information sharing network, or "data lake", along with a new sharing framework to help combat organised crime.

The group says government agencies typically avoid the risk of sharing secure data, but a more proactive sharing approach could help target crime groups.

They want a tech company to build the new "data lake" - a secure platform that would allow agencies like police and Customs to share the data they already collect with each other, in a usable format.

It would automatically reformat encrypted data to make it standardised and usable by enforcement agencies, and would be hosted in a secure government-controlled cloud platform with data partitioned to ensure only those with appropriate clearance could access it.

Artificial intelligence could also be used, helping identify patterns across things like financial transactions, travel records, corporate structures, and identity data to potentially help map criminal networks, match people with aliases, and provide real-time alerts.

"This architecture can be scalable, privacy-conscious, and legally compliant. It creates a future-proof platform for secure and governed information sharing, enabling agencies to act with a unified view of organised crime," the report said.

Chair Steve Symon told RNZ most of the data involved was already collected by various government agencies, so it would mostly be a tool to help use that data to find international criminals.

"We don't want a situation where we we open up the floodgates of information sharing, but we do want to make sure the information is getting [to] the right places," he said.

"Whether that be information by Customs about travel movements or information held by the companies office about companies or how companies have been registered, there's a variety of different pieces of information that are currently held by government agencies.

"The idea of the data lake is to bring together those bits of data that might assist with tackling organised crime, and then have some oversight in terms of who can access that data and for what purpose."

The group found government agencies typically avoided data sharing, as it was seen as risky - what the report described as an "extreme level of risk aversion" - but this needed to be changed to keep up with organised crime making more use of technological advances.

"Organised crime is organised. We are not," the report said.

The group had looked at potential costs of getting a data lake set up, he said, but that was all subject to commercial sensitivities and he refused to give an estimate.

"There have been discussions and we have been aware of an approach that might be made, but we can't discuss it because, of course, we don't want to prejudice the outcome of those discussions.

"It is a difficult one for me to answer without prejudicing the communications that the government would have to have with a provider like Microsoft."

He said the decision on whether to proceed given the potential cost would be made by the government.

Tackling crime across Pacific, looping in businesses

He said the group wanted to strike a balance between privacy and the rise of organised crime in New Zealand, which it had highlighted in another report in March - pointing to rising drug use showing up in wastewater testing and increasing levels of cyber fraud.

The group also wanted more cooperation with other countries - particularly Pacific Islands - and with businesses like airports, ports, banks and telecommunications companies for tracking things like fraud and drug smuggling.

Symon said he saw first-hand the extent of the drug problems affecting Fiji a couple of weeks ago on a trip with Associate Police Minister Casey Costello.

"A lot of those drugs are destined for New Zealand or Australia ... there is a lot of information, a lot of data we could use and work with them to share, to help them in their fight which wouldn't be a significant privacy concern for New Zealanders."

The group also suggested government agencies working more closely with the private sector - businesses - in specific high-risk areas - like an airport having problems with baggage handlers.

He said in that example, information shared between the airport, the private businesses working within the airport, and enforcement authorities could identify things like when staff had called in sick but their access cards were still being used.

"We see it in border areas such as airports, our sea ports, we also see it in high-risk in industries such as banks and telcos in the respect that they hold critical data which would be relevant to the fight against organised crime."

The report noted that businesses wanted to be involved, and would benefit from being able to avoid effects of organised crime, like fraud.

"That is the carrot ... there also needs to be a stick - a legislative mechanism for requiring the less than willing segment of the private sector to come to the table."

The group suggested making the failure to report certain suspicious activities to the police commissioner an offence.

Other suggestions for cooperating with businesses included creating dedicated liaison roles within Customs, police and other relevant agencies to deal with the groups involved in the data sharing, as well as encouraging the establishment of organised crime prevention roles within businesses themselves.

Another option would be an "organised crime supply chain rating system" which would rate and accredit businesses based on their organised crime resilience and information sharing maturity, to encourage good behaviour.

Privacy concerns

Symon said the aim would be to ensure zero data breaches.

"We're not naive. There have been occasions where for example police officers have accessed [data] for inappropriate reasons and those have been publicised and dealt with, but what we are talking about here is data held by enforcement agencies.

"The benefit of a data lake would be that you would have that information held in one repository, and you could have controls and information about who accesses that data and when, and have a electronic paper trail."

He acknowledged there were risks with sharing sensitive data with an AI tool, but said the options for protecting that data would need to be examined in commercial negotiations.

The report also called for a minor legislative change to the Privacy Act which would aim to simplify the process of information sharing between agencies. It would mean that when information was shared for the purposes of tackling organised crime, the agency requesting the data would be held responsible, rather than the agency providing the data.

"This would simplify the process, ensure that the relevant belief is held by a person who holds sufficient information to make that belief properly informed and it would transfer the privacy risk from the provider to the requestor (usually an enforcement agency)," it said.

If the model proved workable and valuable, however, it could be expanded.

"If there is success with that sharing, and we can show the public and the gain public confidence in the way we're approaching it, then it's certainly something where you could explore going further," Symon said.

A new framework

The report highlighted a plan to also set up a new legal framework to help support more data sharing.

"Under current settings, there is no clear and transparent framework that authorises the sharing of sensitive information with private sector partners," the report said.

"For example, in the border security space, there is no clear and transparent framework that enables the two-way sharing of sensitive information between Customs and private sector partners such as operators of Customs Controlled Areas and other supply chain partners."

The framework would:

• Confirm the general principles and legal frameworks for information sharing between agencies
• Identify the specific information sharing principles applicable to each agency and how they would be applied
• Establish protocols for the development (or amendment) of Approved Information Sharing Agreements under the Privacy Act
• Embed an expectation of proactive, as well as reactive, information sharing, possibly supported by a provision which makes it an offence for a reporting entity to fail to report certain suspicious activities to the Commissioner of Police

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.