The government says it won't track you. It just wants to 'bind' your phone and log your metadata

In brief

• OIA documents reveal plans to "bind" Govt.nz users' devices to government agency records.

• The system could handle 27 million messages monthly, logging metadata: information about communications, not their contents, including which agencies contact which devices and when.

• Officials promise not to track users or read messages, but acknowledge concerns about that promise.

• Unanswered questions include whether logs can identify individuals, be linked across agencies or retained long-term.

Editor's note: This is the first in a two-part Centrist investigation into New Zealand's expanding digital government infrastructure, based on documents obtained under the Official Information Act. 

Today, we examine how the Govt.nz app plans to connect devices to agency records and log communications. Part two looks at the digital Kiwi Access Card and its potential role in identity verification and social-media access.

The government promises its Govt.nz app won't track you. But internal documents reveal plans to connect people's phones to government agency records, while keeping detailed logs of the messages those agencies send.

Officials have a word for that connection: binding.

It appears in a 40-page business case Centrist obtained under the Official Information Act, describing a centralized messaging system expected to handle up to 27 million messages a month by June 2027.

The system would allow government agencies to send correspondence directly to people through the Govt.nz app.

But the technology behind that convenience raises questions about the government's privacy promises.

What does the government mean by 'binding'?

Imagine you sign up to receive Inland Revenue messages through the Govt.nz app.

IRD already knows who you are. It has your name, tax number, and financial records. Meanwhile, the messaging system identifies your phone using a unique device identifier.

To ensure IRD's messages reach the correct phone, the system must link your device to your IRD account.

On page 31, the Government Digital Delivery Agency (GDDA) uses this exact wording in its business case:

"Supports 'binding' the user/device to the agency System of Record."

A System of Record is simply an agency's official database.

In other words, the system is designed to connect identifiable government accounts to registered devices.

And it plans to keep records of the process.

What exactly will the government record?

The proposed platform would log device identifiers, dates and times, authentication attempts, agency registration and binding responses, and users' consent decisions.

For every message, it would also record which agency sent it, the receiving device identifier, whether delivery succeeded and how many attempts were required.

This information is called metadata. It doesn't reveal what a message says, but records the activity surrounding it.

Metadata serves legitimate purposes. It helps deliver messages, detect technical failures, and protect against fraud. But information needed to deliver a message is not necessarily information the government needs to retain indefinitely.

Return to our IRD example.

The central system wouldn't know that the message contains your tax assessment. Officials say it cannot read message contents. But it would record that Inland Revenue contacted your device at a particular time.

Now imagine NZTA sends a message about your driver's licence through the same platform. That communication would generate another record.

If those records can be linked to the same device, and the device identifier can be connected to your identity through the agency binding process, it could potentially be possible to reconstruct which government agencies have contacted you, and when.

All without reading a single message.

Currently, identity assurance is expressly outside the messaging project's scope. But the proposed architecture includes both device-to-agency binding and detailed communication logs.

The unanswered question is who can connect those records.

Why does that matter?

Imagine those records fell into the wrong hands and could be linked to people's identities.

A fraudster who knows Inland Revenue has just contacted you could send a convincing fake tax demand. If police or child protection agencies joined the system, records of their correspondence could potentially expose sensitive dealings with authorities, putting victims or witnesses at risk of intimidation.

The GDDA itself acknowledges a serious security risk. Its business case rates the risk of a security breach exposing data to "bad actors" as "extreme", reducing it to "moderate" after proposed safeguards, including security audits and penetration testing.

Separately, an initial privacy screening rated concerns as "low". The documents do not establish that a breach has occurred, but leave unanswered who could access the metadata, how long it would be retained and whether it could be linked to identifiable New Zealanders.

The Snowden precedent

The term metadata entered popular consciousness in 2013, when Edward Snowden exposed the US National Security Agency's mass collection of telephone records: who called whom, when and for how long, without listening to the conversations. The scandal was serious enough that Congress passed the USA Freedom Act in 2015, ending the NSA's bulk telephone metadata collection programme.

New Zealand's proposed messaging service is different. It is intended to deliver official correspondence, not secretly collect telephone records.

But the underlying privacy concern is familiar. Metadata can reveal people's relationships and activities even when the contents of their communications remain private.

Officials anticipated a problem with the tracking promise

The government's public assurances say the app does not track users or their activity and that using it is optional.

Yet the business case acknowledges that the app has been marketed as a service that "does not track users and does not know what they do".

Officials maintain those claims remain true, but recognise that targeted messaging might be perceived as breaking the original promise.

Their response includes ensuring the service is "marketed correctly", with a customer acquisition plan to consider how to manage the concern.

A centralised system by design

Officials considered allowing individual agencies to manage their own connections to the app, but rejected that approach partly because it conflicted with the government's preferred centralised model and digital strategy.

The proposed system instead brings registration, messaging, administration and reporting into shared infrastructure.

That may reduce costs and simplify government correspondence. It also concentrates information about communications from participating agencies in one system.

Receive our free newsletter here