New Zealand's spy agency secretly hosted an intelligence system "deployed by a foreign agency" without first gaining approval from its minister.
The revelation came to light on Thursday in a damning report from the Inspector-General of Intelligence and Security, the top security watchdog - which has found a plethora of significant failings by the Government Communications Security Bureau (GCSB).
Specific details of what the system could do are being kept classified but the report reveals it could support military action against remote targets.
The signals intelligence system, "deployed by a foreign agency", between 2013 and 2020. That was without sign-off from the Government.
"Some of these people may have gone a bit rogue," said security consultant and former intelligence analyst Paul Buchanan.
"That speaks to a mindset that quite frankly is anti-democratic."
While many details are classified, the Inspector General said the system had the potential to be "used, in conjunction with other intelligence sources, to support military action against targets."
It also found the bureau "could not be sure the tasking of the capability was always in accordance with Government intelligence requirements, New Zealand law and the provisions of the [Memorandum of Understanding agreed between the GCSB and the foreign partner agency]".
The GCSB first considered whether to host the system in 2010 doing what the report calls a "reasonably robust investigation", but there was no evidence the minister was briefed.
While that didn't break the law, the Inspector-General said "it was improper" and "failed to respect and enable ministerial control of the agency".
"There are serious issues of democratic accountability, democratic oversight," said Buchanan.
Multiple failings were identified while the system was operating, including inadequate recordkeeping, negligible awareness of it amongst senior staff and no auditing.
The investigation was only launched after the system was discovered during a 2020 internal audit, which is also when it stopped operating due to equipment failure. The agency's current senior leadership and legal team "apparently knew nothing of the system".
"Obviously our legislation has strengthened subsequently," said Prime Minister Christopher Luxon.
"Also, the practices of the agency have strengthened subsequently since that point as well. We take on board those learnings and I know the agency will take that very seriously as will the minister."
The Inspector-General said those changes have reduced the risk of the failures happening again, but his report makes several recommendations including the GCSB "produces internal guidance to reflect existing requirements that international agreements and arrangements of significance are consulted with the minister" and these systems are audited and reviewed.
In a statement, the GCSB said it accepted the Inspector-General's recommendations.
It accepted there were failings in decision-making processes, particularly in terms of not informing the minister and how this foreign system was managed when it was operating.
The GCSB has transformed significantly and now has much tighter policies, it said.
GCSB Minister Judith Collins has said the agency people see today is not the one reflected in the report.
