Spy bosses hone in on China, publicly confirming foreign interference and cyber attacks

Tuesday, 26 March 2024

GSCB Director-General Andrew Clark gives details on how China accessed government systems in a 2021 hack.

The country’s spy chiefs have both raised concerns about China, in a rare move to name a nation and publicly accuse it of acting against New Zealand’s interests.

The public allegations came on Tuesday, starting with Security Minister Judith Collins and GCSB boss Andrew Clark publicly accusing state-backed hackers in China of launching a cyber attack against the New Zealand Parliament.

Then that afternoon, the other spy chief, SIS boss Andrew Hampton, named China in two examples of foreign interference happening in New Zealand.

Hampton said China and Iran - the only other nation he referred to during Tuesday’s select committee hearing - had been working to intimidate New Zealand-based critics of those regimes.

“That is simply unacceptable in a country like New Zealand,” Hampton told the committee.

The other issue was related to China’s Peoples Liberation Army hiring seven former New Zealand Defence Force staff to train its armed forced, via a third party. Hampton said SIS agents had “a range of engagements” with the seven trainers to get them to stop doing that work.

Prime Minister Christopher Luxon, Foreign Minister Winston Peters and Security Minister Judith Collins have been responding to the revelation China-backed hackers targeted Parliament.

Why it matters

China is New Zealand’s largest trading partner, but its human rights record and invasive approach to foreign relations stress that relationship.

The revelations from New Zealand’s spy agencies on Tuesday followed similar statements from Five Eyes partners in the US and UK.

But unlike those nations, which have imposed sanctions and are looking to lay charges against people accused of similar cyber attacks, the New Zealand Government has ruled out any sanctions.

Andrew Hampton leads the SIS, as director general of security.

On Tuesday, Foreign Minister Winston Peters issued a statement saying he asked diplomats to call in China's ambassador, Wang Xiaolong, to express serious concerns about the hacking. But then he refused to comment further about the issue, even declining to comment after leaving Parliament’s Intelligence and Security Committee meeting.

The breakdown

The spy bosses have publicly named China in three incidents:

1. Intimidating New Zealand based critics of the Chinese Communist Party (CCP).

“The monitoring and harassment of ethnic communities is becoming more sophisticated and even more insidious. Foreign states, like the People's Republic of China or the Republic by Iran have always had ways to make life difficult for those who hear speak out against those governments,” Hampton told the committee.

2. Hiring ex-NZDF staff to train the People’s Liberation Army (PLA)

Hampton said seven former NZDF staff, most of whom had also worked with “Five Eyes partners”, were hired via a third party to train the PLA during excercises in South Africa.

He said “they made their own choices”, but through “a range of activities” they were told these actions were not within New Zealand’s interests.

3. Cyber attacks against the NZ Parliament

Clark, the GCSB boss, said a hacking group associated with China's Ministry of State Security targeted Parliament in 2021.

He said the group, known as APT40, hacked into the Parliamentary Service and Parliamentary Counsel Office - which writes New Zealand’s laws.

GCSB National Cyber Security Centre Director Lisa Fong said China’s hackers had accessed the data of some MPs.

GCSB director-general Andrew Clark and the deputy director Lisa Fong talk about cyber attacks against Parliament.

“To the extent that the threat actor had access to information, it was a reasonably small amount of information,” she said.

Clark said he was confident China was to blame for the cyber attack.

Who said what

SIS boss Andrew Hampton, speaking to reporters on Tuesday night, said the SIS had particular concern about the Government of China trying to influence New Zealand.

“They [China and Iran] are the two countries that we are particularly concerned about in terms of societal interference,” he said.

“The PRC [China] is one of several countries undertaking foreign interference activity in New Zealand and in our region, and it is a key focus for us.”

In a statement, a spokesperson for China's Wellington embassy said the Government was 'completely barking up the wrong tree'.

We reject outright such groundless and irresponsible accusations and have lodged serious démarches to New Zealand’s relevant authorities, expressing strong dissatisfaction and resolute opposition,' the unnamed spokesperson said.

Prime Minister Christopher Luxon said naming China was “a first for New Zealand”.

“I think this is a first for New Zealand: publicly attributing a malicious cyber activity on our democratic institutions by China. It’s a big step for us. And obviously, we’ll be underscoring our message today with the embassy as well,” he said.

In other news

Hampton said the SIS monitored foreign interference during the 2023 election and found any attempts at interference were “highly unlikely” to have impacted the election result.

Instead, he said the SIS identified foreign states conducting “long-term influence building” during the campaign.

He said 'deceptive, covert, corruptive' actions of foreign state actors attempted to gain influence from political candidates. He said those candidates tended to be targeted “because of their ethnicity”.

He did not specifically mention Chinese in relation to that comment, but was asked later if he was alluding to foreign actors attempting to influence NZ-Chinese politicians. Asked about that, he said he was “not going to talk about specific cases”.

In some instances, he said the SIS had worked with candidates to help them become aware of these interference attempts.