GCSB Minister Andrew Little surprised by 'shout out' to NZ over indictment of alleged Russian hackers

Tuesday, 20 October 2020

US assistant attorney-general John Demers displayed a poster identifying the six Russian military intelligence officers the Department of Justice has accused of hacking.

GCSB Minister Andrew Little says he was surprised the US Department of Justice gave New Zealand special mention after a federal jury indicted six Russian spies for a series of worldwide hacking offences.

Little said he had been briefed in advance on the indictments but did not know what assistance the US had been referring to.

The Department of Justice (DoJ) accused the six Russians of being behind “some of the world’s most destructive malware”, including the NotPetya ransomware attacks in 2017.

Those attacks crippled the operations of businesses around the world, including the New Zealand arm of Danish shipping company Moller-Maersk.

The DoJ singled out New Zealand among a small group of countries which it credited with providing assistance in its investigations in a statement announcing the indictments.

* GCSB cites links between Russian government and series of 'malicious' cyber activities

* Report confirms the GCSB was spying on the Pacific - but it's legal

The New Zealand arm of Moller-Maersk was among the businesses knocked offline by the NotPetya malware in 2017.

It thanked “Ukrainian authorities, the governments of the Republic of Korea and New Zealand, Georgian authorities, and the United Kingdom’s intelligence services” as well as other unnamed foreign agencies.

Little said the Government had been told in advance that an announcement would be made by the DoJ but “it wasn’t expected that there would be a reference to New Zealand”.

“To be honest, it is not quite clear what that reference is to,” he said. “I have not been given any advice or briefing on what that might be.

“There are a number of state agencies in New Zealand that deal with cyber-crime and cyber issues; the GCSB and also police and other agencies too,” he said.

The reference to New Zealand had come as surprise in the context it was made, he said.

“There were very few countries named and a lot of countries cooperate on these sorts of issues.

“As I understand it, some inquiries have been made about what exactly that reference is to, but I haven’t heard anything back at this point,” he said.

The DoJ said the Russian hackers engaged in attacks intended to support Russian government efforts to “undermine, retaliate against, or otherwise destabilise” Ukraine, Georgia, elections in France and efforts to hold Russia accountable for its use of a weapons-grade nerve agent, Novichok, overseas.

It said the accused also attempted to disrupt the 2018 PyeongChang Winter Olympic Games after Russian athletes were banned from participating because of a “government-sponsored doping effort”.

GCSB Minister Andrew Little has been briefed on the indictments.

The NotPetya attacks caused almost US$1 billion (NZ$1.5b) in losses for just three of its victims, it said.

Little said he had no information to suggest the Russian group might have been behind recent denial-of-service attacks on the NZX.

There was also no information in the DoJ’s statement to suggest the six accused were not still in Russia, or that they were likely to be apprehended.

US assistant attorney-general John Demers said no country had weaponised its cyber capabilities “as maliciously or irresponsibly as Russia, wantonly causing unprecedented damage to pursue small tactical advantages and to satisfy fits of spite”.

“Today the department has charged these Russian officers with conducting the most disruptive and destructive series of computer attacks ever attributed to a single group, including by unleashing the NotPetya malware.

“No nation will recapture greatness while behaving in this way,” he added.

The GCSB in 2018 took the rare step of directly naming Russia as being involved in state-sponsored hacks that impacted New Zealand.

Hampton said then that there were indications “Russian state and state sponsored actors” were behind some of the 122 serious incidents identified in a GCSB annual report that had “indicators of connection to foreign intelligence agencies”.

“Such behaviour is unacceptable – it is counter to New Zealand’s vision for an open, safe and secure cyberspace,” he said at the time.

Little said it was “always disappointing to see state-backed operators seeking out vulnerabilities, to cause harm and disruption”.

“It wouldn’t be the first time the allegation has been made about Russia and I doubt it will be the last,” he said.