It was revealed yesterday that a group of Chinese state-sponsored hackers managed to breach Parliament’s IT system back in 2021 and access and swipe data relating to New Zealand MPs.
Without going into too much detail about the incident [you can read all about it on page 15], although the ‘exploit’ – as such actions are called in cyber security circles – by a group known as Advanced Persistent Threat 40 did succeed in taking information, it was judged to be “not of a strategic or sensitive nature”.
Reportedly there isn’t any question of New Zealand imposing sanctions on China – which should surprise precisely no one, given how reliant we are on that country for trade, although it might prompt some pondering about why we’ve blithely put so many export and import eggs in that particular basket over recent decades – and the Chinese ambassador has merely been issued with what amounts to a sternly worded letter.
One might wonder exactly why we waited so long to make this incident public three years after the fact – as the Government Communications Security Bureau [GCSB] director-general has noted, it is uncommon to attribute such cyber attacks to “state-sponsored actors” – but it would appear to be because three of our fellow Five Eyes partners [United States, Britain, and Australia] have just gone public about a Chinese cyber-espionage campaign that’s allegedly targeted millions of people in those countries over several years [you can read about that on page 22].
All for one and one for all, seems to be the principle at play and fair enough – as GCSB minister Judith Collins has noted, “It’s important liberal democracies stand up for other liberal democracies.”
That said, there is a certain degree of hypocrisy in the pearl-clutching that accompanies the announcement of such incidents, given liberal democracies certainly aren’t in any way adverse to cyber snooping on other countries when they get the opportunity to.
In case it’s escaped your attention, the aforementioned Five Eyes of which NZ is a member [Canada is the fifth] is what’s politely referred to as a ‘signals intelligence network’. In other words, we’re a signed-up member of a global spying operation. Not that this is necessarily a terrible idea – given the state of the world, and the variable relations between nation states, being part of a group of larger mates is a sensible policy, even if those who like to believe foreign affairs should be conducted like a rousing rendition of “We Are the World” may find that reality unpalatable.
On the upside, this belated acknowledgement of the 2021 incident has noted that the GCSB picked up on the hacking in a timely manner and shut it down, which is comforting, given this is what the organisation exists to do.
Of rather more concern is last week’s stonking NZ Herald story by David Fisher about how, for the best part of a decade, the GCSB was hosting the “signals intelligence system” of an unnamed foreign partner – almost certainly the United States – within its own technology infrastructure; a system that was used to “locate remote targets” and “was likely used to kill people”.
Even worse, for much of the time it was operating between 2013 to 2020, GCSB’s leaders and the ministers responsible for the organisation weren’t aware of its existence.
Now that’s the kind of egregious oversight that makes one wonder whether the term “intelligence service” really is a contradiction in terms.
