New Zealand Prime Minister John Key has apologised to internet tycoon Kim Dotcom over an "unacceptable" bungle by government spies leading up to the arrest of the Megaupload boss.

Mr Key also ordered agents from the Government Communications Security Bureau (GCSB) to review their cases over the past three years to check whether there were other instances of communications being intercepted unlawfully.

The apology came as a report into the illegal monitoring of Dotcom blamed the agents for not being aware of New Zealand immigration laws and relying on erroneous information from the police.

"I'm pretty appalled by what I've seen. The organisation should be able to get this right," Mr Key told reporters.

"Of course I apologise to Mr Dotcom. I apologise to New Zealand."

The GCSB, which is forbidden from spying on New Zealanders or permanent residents, had been asked by the police last year to monitor Dotcom who is wanted in the United States on internet piracy charges.

When they questioned the police if they could legally monitor Dotcom, the report said they were assured they could even though the German national held a New Zealand residence visa at the time.

"If things had been done properly it would have been quite clear (Dotcom) was protected," Mr Key said.

"It is quite a basic error. They have failed at the lowest hurdle. It's quite frankly not good enough."

Key had ordered the report into the spying debacle after it was learned the DCSB had unlawfully intercepted communications for a month in the lead up to Dotcom's arrest in January.

"It is the GCSB's responsibility to act within the law, and it is hugely disappointing that in this case its actions fell outside the law," Mr Key said.

"I am personally very disappointed that the agency failed to fully understand the workings of its own legislation."

Mr Key said he had sought an assurance that there were no other cases of communications being intercepted unlawfully and "the GCSB will be reviewing past cases back to 2009".

Dotcom is fighting extradition to the United States where the US Justice Department and FBI claim Megaupload and related sites netted more than $US175 million in criminal proceeds.

They also claim the 38-year-old, who legally changed his name from Kim Schmitz, had cost copyright owners more than $500 million by offering pirated copies of movies, TV shows and other content.

AFP