The Government and spy agencies waited to be aligned with like-minded partners before revealing China’s cyberattack on New Zealand’s Parliament.
One of the country’s top spy bosses defended the decision, saying more voices would have a greater impact while noting the Government was ultimately responsible for publicly attributing an attack to another country.
It comes after details emerged throughout the day about how a Chinese state-sponsored cyber espionage effort in 2021 led to data within the Parliamentary Service and the Parliamentary Counsel Office being accessed, including information about MPs.
It was the first time New Zealand’s Parliament had been targeted in such a way.
The Chinese Embassy has rejected the “groundless and irresponsible accusations”, but Government Communications Security Bureau (GCSB) Director-General Andrew Clark is confident his agency’s assessment of who is responsible is correct.
It follows reports of United States, British and Australian officials filing charges, imposing sanctions or calling out Beijing over a sweeping cyber-espionage campaign that allegedly hit millions of people, including lawmakers, academics and journalists.
Clark, and NZ Security Intelligence Service security Director-General Andrew Hampton, fronted Prime Minister Christopher Luxon and other members of the Intelligence and Security select committee yesterday evening to speak to the matter and New Zealand’s wider threat environment.
In response to Luxon asking why the GCSB was going public now, Clark said he’d wanted to “link up” with other like-minded countries who were willing to speak out on “international norms of responsible behaviour” in cyberspace.
He later told journalists he’d been engaging with “partners” since last year and argued having multiple voices speaking publicly on the issue of Chinese-linked cyberattacks would have more impact than if New Zealand went public alone.
Clark did clarify that the decision ultimately sat with the government of the day as to whether a foreign power was publicly named.
In a press conference earlier in the day, Clark said the data that was targeted in 2021 was “technical” and not “sensitive or strategic” in nature. He would not go into further detail for security reasons.
Clark’s belief was endorsed by Andrew Little, who was the GCSB Minister at the time of the cyberattack. He said the data might have included “draft legislation and instructions” but was unlikely to have pertained to personal information about MPs and ministers.
In a statement, Parliamentary Service chief executive Rafael Gonzalez-Montero said “significant investment” had been made to strengthen cybersecurity since the incident.
“We will continue to bolster our capability to retain public confidence and preserve the integrity of Parliament’s digital systems.
“While some information was taken as part of the compromise, we addressed the implications at the time.”
GCSB’s assessment following the cyberattack found the Chinese state-sponsored actors known as Advanced Persistent Threat 40 (APT 40) were responsible. They are linked to China’s Ministry of State Security, according to the GCSB, and were also tied to other New Zealand cyberattacks in 2021.
Clark explained the nature of the APT groups could include public-private partnerships or people targeting deliberate infrastructure for specific customers or agencies.
Prime Minister Christopher Luxon said calling out China for the hacking is an important step in protecting liberal democracies around the world.
Luxon said he did not raise the issue when he spoke with Chinese Foreign Minister Wang Yi last week, however, government officials had raised malicious cyber activity with China earlier in the month.
Current GCSB minister Judith Collins revealed the hack in a statement yesterday morning that also condemned China for its “malicious cyber activity” aimed at the UK’s Electoral Commission and members of its Parliament.
In a statement, Foreign Minister Winston Peters confirmed senior foreign affairs officials spoke to China’s ambassador to New Zealand Wang Xiaolong yesterday to urge China to “refrain from such activity.
“New Zealand will continue to speak out - consistently and predictably - where we see concerning behaviours like this.”
Peters refused to speak further on the matter when asked by reporters, instead choosing to only answer questions relating to a recent Court of Appeal ruling concerning his New Zealand First party.
A Chinese Embassy spokesperson said New Zealand was “barking up the wrong tree” by accusing China of foreign interference and suggested New Zealand was being influenced by other countries making similar allegations.
“We hope the New Zealand side can practice the letter and spirit of its longstanding and proud independent foreign policy, independently making judgments and decisions in its best interests rather than blindly following other’s words and actions at the expense of New Zealand’s own credibility and interests.”
Adam Pearse is a political reporter in the NZ Herald Press Gallery team, based at Parliament. He has worked for NZME since 2018, covering sport and health for the Northern Advocate in Whangārei before moving to the NZ Herald in Auckland, covering Covid-19 and crime.