Through a glass darkly, indeed...
(though I'm not sure I can wait until the end of time to find out the truth...)

SPEARGUN
STORMBREW
RICE Hack techniques

EINSTEIN's privacy impact assessment is public (PDF) and even has sections in it about notice to the public being provided through website privacy policies.

For example, presumably an initial inbound email will receive a very high level of scrutiny but, once communication is established, checking is relaxed. For companies ‘protected’ by Cortex, the coverage might apply to communication after…

Yeah, it does, but Cortex doesn't really fit into the NZISM framework because NZISM is aimed at all the things that happen to bits that are not on the public intertubes. Once it's out in…

NZISM, unless it's changed significantly from the last time I looked at it, is the set of rules that apply to the establishment and operation of computer systems within government vis information security. Things like "you shall…

Oh yes. Operating on…

I don't particularly care that an email I have sent the DPMC might be monitored by the GCSB computers systems, or even seen by GCSB employees.

My point is that they have said we would be told if something like this was happening,…

I am not really trying to find out what Cortex does with this blog post. I'm mostly trying to hold (to the extent a blog post and some tweets can) the GCSB and others to account…

The task of developing+documenting security policy is significant in itself.…

The alerting of those who are in contact with your computer systems to the possibility of cyber defence monitoring is supposedly a pre-condition to use of Cortex by an agency. If DPMC haven't got around…

What’s the problem, exactly? Finding out exactly how far Cortex reaches? I don’t have a solution. If it’s further than what seems right to people on the inside, I’d expect we’d find out via a whistleblower. But who knows what kind of people would want…

In terms and conditions of use, for example.

is not the same is "In the terms and conditions of use, period". You can't infer the absence of Cortex from absence of the terms and conditions saying so. That's even if you're going to hold someone's…

I suspect those related to agencies who routinely…

"The Operator and Spark Digital reserve the right to disclose end user information that it believes, in good faith, is appropriate or necessary to take precautions against liability; to protect the Operator and Spark Digital and others…

I'm wondering if Paddy Gower is following this. 'You told me this, but Oh Noes', is pretty much his brand.

You’ll be told that your communications will be screened or may be screened for cyber defence purposes.

and compare that to the phrasing we've seen so far

may be subject to…

there is language sufficient to fulfil the precondition about disclosure of monitoring at the National Infrastructure Unit within treasury, but not Treasury itself.

And the Energy Safety unit within Worksafe NZ says "WorkSafe New Zealand systems to which this website connects and related equipment may be subject to…

Two further possible Cortex-protectees:

The Charities Service!
And
The New Zealand Debt Management Office!

Similar language appears in the Privacy Statement on the website of The Maori Land Court which says "The Ministry of Justice systems to which this web…

3. Sharing your information
There may be times when we need to disclose your personal information to third parties (some of which may be based outside of New Zealand). If we do this, we will only disclose your information…

While the Ministry of Defence has not met the preconditions for protection by Cortex, the New Zealand Defence Force has something. It doesn’t mention monitoring for cyber defence in particular, but I guess we can’t be too picky:

The New Zealand Defence Force systems to which this web…

13.6 We may appoint subcontractors to discharge any of our obligations under our Terms and Conditions
provided that we will at all times remain primarily labile to you for those subcontractors’ acts and omissions.

As a matter of fact, Orcon…

Gore-Tex© also doesn’t work anywhere near as effectively as it’s marketed in typical New Zealand conditions, for what it’s worth. It’s mostly marketed and sold here because NZ just latches onto global demand trends,…

I typed that pretty much every time, and did correct a lot of them, but it was after midnight, and I had to get up at 5:00am!

Cortex sounds similar to Gore-Tex©
– blocks transit of hard water in, yet allows vapour out…
okay, maybe a stretch….
(and we all know John Key swears by PTFEs as well as PPPs.
PTFE expands to Polytetrafluoroethylene – which makes Key’s favourite compound – itself…

More seriously – now look out for these organisations to hurriedly update their terms and conditions…

https://www.courtsofnz.govt.nz/utilities/privacy