GCSB wants to give ISPs more power to block cyber threats

The GSCB wants to give internet service providers more information and power to block cyber threats. Photo / Getty

The Government Communications Security Bureau wants to give internet service providers more information and power to block cyber threats which are increasing, its director told the intelligence and security select committee yesterday.

The communications-focussed spy agency has recorded 338 cyber security incidents in the last year, from 109 a year earlier, which director Andrew Hampton said was due to both the number of threats increasing and the improved system picking up more threats.

Cyber threats to New Zealand are "becoming more complex and their sources more diverse" with a "growing range of international threat actors targeting New Zealand organisations for financial gain," Hampton said.

Public and private organisations are targeted for their intellectual property for new technology, customer data, business and pricing strategies, and government positions on sensitive topics, Hampton said.

The agency is also looking to increase the information it gives to ISPs from Cortex, the system which aims to disrupt advanced cyber threats to organisations of national significance in both the public and the private sector.

"We've increased cyber security services to organisations of national significance through Cortex, with the consent of the organisations involved," Hampton said, adding the agency had responded to 69 notifications of network changes within areas of security interest in the year. "More broadly Cortex is a big focus, but our regulatory role under the TICSA Act (the Telecommunications Interception Capability and Security Act 2013) is important because that helps us with telcos to ensure they're not inadvertently introducing vulnerabilities into the system.

"Where we're wanting to evolve Cortex is where we can provide more information to other parties such as ISPs so they can do some of the blocking on our behalf," Hampton said. "An obvious benefit of that is it gets the security agency out of there which deals with any public concern about privacy, but also increases the ability to scale."