A New Zealand intelligence agency which illegally spied on Megaupload boss Kim Dotcom may have also misused its powers in dozens of other cases, an official report found.
Prime Minister John Key said the report into the Government Communications Security Bureau (GCSB) was "sobering reading" and revealed long-standing problems with the agency's practices and culture.
"I acknowledge this review will knock public confidence in the GCSB," said Key, who is the minister responsible for the organisation.
Key ordered a review into the GCSB in September last year after revelations it illegally spied on Dotcom before armed police raided the Internet tycoon's Auckland mansion and arrested him for online piracy in January 2012.
At the time, Key offered a public apology to Dotcom, acknowledging that the German national should have been off-limits to the GCSB because he has residency status in New Zealand.
The GCSB insisted the Dotcom case was an isolated incident.
But the 85-page report, compiled by a top public servant, found there were a total of 88 cases where New Zealand citizens or residents may have been illegally spied on. Details of the cases were not publicly released.
The report identified "issues within GCSB concerning organisational structure, culture, systems and capabilities" and called for more external oversight of the agency.
"I expect the GCSB to always operate within the law," Key said, vowing to implement major changes at the agency.
Dotcom, who has received clearance from the New Zealand courts to attempt to sue the GCSB and police over his arrest, said he was surprised at the scale of the problem.
"The prime minister should apologize to those people too and inform the targets," he tweeted.
Dotcom, 39, was arrested by New Zealand authorities cooperating with a massive US probe into online piracy.
US authorities allege Dotcom's Megaupload and related file-sharing sites netted more than US$175 million and cost copyright owners more than US$500 million by offering pirated copies of movies, TV shows and other content.
Dotcom, a German national who changed his name from Kim Schmitz, denies any wrongdoing and is free on bail in New Zealand ahead of an extradition hearing scheduled in August.