A Chinese state-backed group targeted New Zealand government services in a cyberattack in 2021, New Zealand’s intelligence agency said.
The Government Communications Security Bureau (GCSB), the government and intelligence agency, confirmed the breach on Tuesday after the UK and US accused China of similar attacks.
“This is the first time we have attributed state-sponsored malicious cyber activity to the People’s Republic of China for intrusions into New Zealand government systems,” GCSB director Andrew Clark said.
Relating to: US imposes sanctions on hackers targeting critical infrastructure of Chinese spy agency
Clark said in August 2021 the GCSB’s cyber security center became aware of malicious activity affecting the parliamentary advice bureau and the parliamentary service. The center determined that the network had been compromised and, after a thorough investigation, was able to “confidently attribute” the attack to China, specifically the Ministry of State Security, and a group known as Advanced Persistent Threat 40, or APT40.
“This link was strengthened by international partners’ analysis of similar events in their jurisdiction,” Clark said.
He said some data was taken during the cyberattack, but none of it was considered sensitive or strategic.
The Guardian has contacted the Chinese embassy in Wellington for comment.
Speaking to the media on Tuesday, Prime Minister Christopher Luxon said New Zealand had a “long-standing, complex relationship with China” but added that the two countries had their differences and “we will address that when we can”.
“We are calling out wherever we see malicious cyber activity by any state attacking our democratic institutions,” Luxon said.
“This is a first for New Zealand; China’s public attribution of malicious cyber activity against our democratic institutions. “This is a big step for us.”
Other cyberattacks linked to APT40 were made public in 2021, but these attacks targeted other unnamed New Zealand networks and Microsoft email servers.
Attacks on parliamentary services have been kept quiet so far to ensure the investigation is thorough, to ensure existing vulnerabilities in the system are fixed and to compare notes with other international partners, Clark said.
“As a country, we want to be able to strengthen the norms of responsible behavior in cyberspace internationally, and this can best be done in the company of other partners,” he said.
Clark did not speculate on what data China was seeking, but said typically such breaches seek to obtain information for strategic advantage, steal intellectual property or facilitate foreign interference.
Clark said there were 316 cyber attacks on New Zealand’s leading institutions last year, with 23 per cent of those attributed to state-sponsored actors.
New Zealand is heavily dependent on China, its largest trading partner. The small country has become more vocal in recent years about concerns about human rights, the international rules-based order and the potential militarization of the Pacific, while generally adopting a more conciliatory tone towards China than other democracies such as Australia. UK and USA.
Asked by reporters on Tuesday whether China was a threat to New Zealand democracy, Luxon avoided publicly naming the country and said: “There are many state actors and criminal actors around the world who pose a threat to our institutions, including liberal democracy.”
Luxon did not raise the cyber intrusion with Chinese foreign minister Wang Yi during a face-to-face meeting in Wellington last week.
“Authorities raised cyber activities with him earlier in the month, but I did not bring up this specific incident in my brief meeting with him because it was a very brief courtesy call,” Luxon said.
Luxon said New Zealand would not impose sanctions on China as the UK and US did.
New Zealand foreign minister Winston Peters said: “Foreign interference of this nature is unacceptable and we have called on China to refrain from such activities in the future.”
He said concerns about cyber activity attributed to groups supported by the Chinese government and targeting democratic institutions in both New Zealand and the United Kingdom had been raised with the Chinese ambassador.
In 2019, Australian intelligence determined that China was responsible for a cyberattack on the national parliament and the three largest political parties ahead of the general election, but the Australian government has never officially stated who was behind the attacks.