Prime Minister John Key has apologised to internet millionaire Kim Dotcom in the wake of a surveillance scandal that will see the country's spies re-checking all cases going back to 2009.

The Government Communications Security Bureau (GCSB) carried out surveillance on Dotcom, but did not check out his residency status. Instead, it relied on information from the Organised and Financial Crime Agency New Zealand, a damning report found.

The GCSB was not allowed to spy on New Zealanders.

It emerged the GCSB illegally spied on Dotcom and his co-accused Bram van der Kolk.

"If things had been done properly it would have been quite clear [Dotcom] was protected," Key said

"It is quite a basic error. They have failed at the lowest hurdle. It's quite frankly not good enough."

Key apologised to Kim Dotcom and all New Zealanders.

"They have let themselves down. They have let New Zealand down."

He said the GCSB would have to do its own investigation and take appropriate action.

"If they had done their job properly they should have worked it out," Key said.

"I'm personally disappointed. New Zealanders should be very disappointed. They have failed on the most basic of levels."

He said he had made his disappointment "quite clear" to the director of the GCSB.

He said New Zealanders were to protection from the law when it came to the GCSB.

"I'm pretty appalled by what I've seen. The organisation should be able to get this right."

"Of course I apologise to Mr Dotcom. I apologise to New Zealand."

INSPECTOR-GENERAL'S FINDINGS

Inspector-General Paul Neazor had been conducting an investigation into the illegal spying.



The investigation was launched on Monday September 17, when Prime Minister John Key learned of the unlawful activities, and he announced them publicly a week later.

Neazor found there was confusion between the agencies about changes to the Immigration Act in 2009 and the subsequent effect on the GCSB legislation.

Neazor wrote: ''Dotcom...is however one of a category of people who is treated in New Zealand as if he ought to have protection against collection of his information.''



He held a residence-class visa and was by definition a permanent resident.



However a change in the law in 2009 left GCSB agents confused - agents believed he had to take another step in the immigration process before he was not considered a ''foreign national''.

Inquiries were made by the bureau to ensure its activities were not illegal.



''The illegality arose because of changes in the Immigration Act wording and some confusion about which category Dotcom was in thereafter.''



The report did not say when GCSB discovered they had broken the law. However, Neazor said the collection of intelligence ''had in fact stopped before it was recognised that he did fall within a protected category.''

The spying was related to the whereabouts of Dotcom and his co-accused, Neazor said. ''It did not relate to the details or merits of his dispute in the US.''

GCSB CASES TO BE REVIEWED

Key released the report this afternoon.

He said the spies' reliance on another agency was "unacceptable".

Key said he was personally disappointed in the GCSB - for which he had ministerial responsibility - because it failed to understand the law.

"At the time in question, Kim Dotcom was not a New Zealand citizen,'' Key said. ''He was, however, classed as the holder of a residence class visa, but it was not interpreted by the police or GCSB at the time that he fell into the protected category of permanent resident.''



"GCSB had a responsibility to fully understand what the change to the immigration legislation in 2009 meant for its own operations, including whether individual visa holders were protected or not,'' Key said.



"It is the GCSB's responsibility to act within the law, and it is hugely disappointing that in this case its actions fell outside the law. I am personally very disappointed that the agency failed to fully understand the workings of its own legislation."

GCSB director Ian Fletcher had apologised to Key and said he would ''take every step to rebuild public confidence in his organisation".

Fletcher issued a statement apologising to Key and deputy prime minister Bill English, who was left red-faced when it emerged he knew about the GCSB's role in the case and signed a document to prevent it becoming public.

"I am very sorry for the way the Bureau has handled its part in the Dotcom case. I have apologized [sic] on behalf of the Bureau to the Prime Minister and the Deputy Prime Minister, and the Prime Minister's own statement has made clear his views,'' Fletcher wrote.

"We got this wrong. Both factual errors and unacceptable errors of legal interpretationwere compounded, most especially by our treating those interpretations as fact for toolong. It should not have happened."

Key sought an assurance there would be no other unlawful snooping. They would report back to him on the review of cases as soon as possible.



The GCSB would also:

* Establish new approval processes in the support of police and other law enforcement agencies. This type of operation was halted meanwhile.

* Agree with police and other law enforcement agencies how to confirm immigration status, before operations in support of law enforcement activity were undertaken within New Zealand.

'THE BUCK STOPS WITH THE PM'

Labour deputy leader Grant Robertson said the report showed there had been a lack of detail and attention to what were seriously security matters.



"This is only part of the story here. The Prime Minister has overall oversight for the security agencies that were involved here. He is the person with responsibility, the buck should stop with him."



The law was clear about what the GCSB could do, he said.



"The level of incompetence that has been shown here has been staggering and that incompetence starts at the top with the Prime Minister."



Police Minister Anne Tolley refused to comment, saying she had only just received the report and it was a matter for the prime minister, who ordered it.

Green Party co-leader Russel Norman said those responsible at the GCSB should be stood down.



"We need to find out who did it and they should be stood down and held accountable for what they did," he said.



But the ultimate responsibility rested with Key, Norman said.



"John Key has manifestly failed to do his job given that he did not even know that they were spying on Kim Dotcom for eight or nine months," Norman said.

LABOUR CALLS FOR BROAD INQUIRY

Labour is calling for an independent ''wide-ranging'' inquiry into the illegal spying.

Leader David Shearer said Neazor's report - released today - is ''very narrow and focuses on the minor issue of what has gone on here.''

''We are dissatisfied for a couple of reasons. One is the report is only looking at the lower levels - it is very narrowly focused. Secondly, it doesn't deal with the real accountability which goes right to the very top - which is John Key's accountability; he is in control of this agency which seems to have been acting without that proper control.''

He said Neazor, as watchdog of the security agencies, had a conflict of interest.

''He was the watchdog that oversees some of the intercepts that are being made by the agency. In effect, he is potentially looking into his own actions.''

Labour is taking advice on how a review could take place. ''It would have to be of a high level.''