Juha Saarinen: The chilling effect of tech law

The Telecommunications (Interception Capability and Security) Act, pushed through last year, creates uncertainty to the point that it's denting innovation and scaring off overseas investment. Photo / Mark Mitchell

Over the years I've come to despair over how badly our politicians understand technology.

Look at the telco regulation that hobbles awkwardly along in multiple directions at the same time for example.

Our abandoned anti-file sharing law that thinks Internet Protocol addresses identify copyright infringers on the internet, and which cost internet providers big bucks to comply with is another.

It's become worse though. We now have law that creates uncertainty to the point that it's denting innovation and scaring off overseas investment.

That law is the Telecommunications (Interception Capability and Security) Act, known in the business as TICSA and which was pushed through last year.

TICSA mandates that telecommunications service providers and public network operators must register with the Government Communications Security Bureau (GCSB) and its sidekick, the National Cyber Security Centre (NCSC).

Furthermore, telcos and network providers must notify the agency which is tasked with upholding the country's IT security if they make significant changes to their networks.

Thanks to TICSA, and this really isn't the fault of GCSB, New Zealand has lost an important foot in the door of a billion dollar IT business, as the law isn't compatible with the technology.

Good intentions aside, TICSA introduces a layer of bureaucracy and delay for network operators who want to be nimble and fleet-footed, but face ten to twenty days' of waiting as the NCSC ponders on whether or not to approve of network configuration changes.

Being able to quickly change and even create new network configurations is actually really useful. So much so that it's become big business that large companies overseas are pouring megabucks and resources into as the Internet of Things market develops.

It's called Software Defined Networking and Network Functions Virtualisations (SDN/NFV) and it will become a necessary technology over the next few years, and a billion dollar industry.

Normally, building new networks and making even small changes to them can be a costly, tedious, long winded process.

SDN/NFV changes all that, making it easy to create and edit virtualised networks. What's more, New Zealand was at the forefront of SDN/NFV.

I spoke to the head of our academic network provider REANNZ, Steve Cotter, not long ago about their impressive work on SDN.

That work resulted in United States vendor Corsa Technology, Google's research deployment at Victoria University and the US government Energy Sciences Network in Berkeley, California, REANNZ scaling SDN to Internet level with a trans-Pacific network in November last year.

It was a world first, cutting edge project.

No more though. Steve Cotter tweeted that TICSA has put a sizeable spanner in the SDN/NFV development wheel in New Zealand:

Trying to do the same in NZ, but govt's TICSA legislation makes deploying SDN/NFV in backbone networks challenging http://t.co/91MUpxfOnw

— Steve Cotter (@SteveCotter) February 22, 2015

Victoria University senior lecturer of network engineering at the School of Engineering and Computer Science, Ian Welch, confirmed that the Google-sponsored testbed had been moved out of New Zealand.

As network operators have a duty under TICSA to ask GCSB if they need to notify the agency of configuration changes, but the guidance given is vague and hard to interpret.

The testbed operators volunteered and asked GCSB if they needed to notify the agency and to seek authorisation for changes - that could be as frequent as one each second - but didn't get a response beyond "fill in the form".

GCSB said it had not requested REANNZ to notify and seek authorisation from the agency, but Welch said the uncertainty around what is covered and what isn't meant it was safer to move the project to Australia and the United States which don't have such intrusive legislation.

It's important to remember that TICSA has real teeth: if you don't comply with the law, the fines range from $50,000 to $500,000. That's per day, by the way.

"This is bad because researchers such as our group and our friends at Waikato University WAND Network Research Group and REANNZ have the chance to do something really innovative in our own backyard.

We can keep developing the software, and will, but we lose access to a testbed with real traffic with the project leaving New Zealand which is very important for validation in the local context.

For REANNZ it limits their ability to innovate in terms of new types of services for the research community and their ability to conduct research again that is specific to NZ," Welch told me.

We've missed the boat now because changing TICSA would take a long time. By then, SDN/NFV will be established business, earning some other country than New Zealand billions of dollars and kudos.

The government and Parliament were warned by submitters as well as Microsoft, Google and other internet companies that TICSA was unclear and would be bad for the country.

That's now been proven and it really mustn't happen again.