GCSB director-general Andrew Clark said the GCSB was confident to publicly attribute the cyber attack to China.
Video / Mark Mitchell
Edward Snowden documents from 2012 match dates in report on GCSB;
Spy kit was likely ‘Apparition’ used by Five Eyes partners in the War on Terror;
GCSB says inquiry found its geographical limits constrained how the rogue spy kit was used.
The Five Eyes spy equipment that was operating out of New Zealand’s electronic spy agency largely without its knowledge appears to be a National Security Agency tool named “Apparition” that has been used to hunt targets in the United States’ War on Terror - and to spy on China.
The Apparition system was among those disclosed by NSA whistleblower Edward Snowden in 2013, including how the system was used to identify internet cafes across a vast geographical area - and the identities of those who were using them to connect to the internet.
The dates of the installation at a Government Communications Security Bureau (GCSB) facility match with information publicly disclosed last week by the Inspector General of Intelligence and Security Brendan Horsley.
While Horsley revealed the existence of the rogue equipment, he did not actually name the system, what it did and who it belonged to.
The discovery of the system came in 2020 after it malfunctioned leading to Horsley’s three-year-long inquiry.
In his report last week, Horsley said he was concerned that an intelligence “capability” controlled by a “foreign partner” had been able to operate without seeking Beehive sign-off or without the bureau’s Minister being told of its existence or purpose.
Horsley said he was also concerned the bureau’s current leadership had no knowledge of the system until they were told in 2020 after it broke down.
The particular concern for Horsley was whether the tool had been directly used to carry out military action of which it was capable. He said there was no direct evidence this had happened - but also identified patchy and sporadic record-keeping and no obvious way for the GCSB to see the purpose for which it was used.
Among the material released by Snowden was a GCSB slideshow from March 2012 to the Comsat Advisory Board - a body which also appeared in a small number of other Five Eyes’ updates relating to satellite-focused intelligence gathering.
The March 2012 slideshow carried updates on a number of existing GCSB systems and tools, along with a recitation of financial pressures facing the bureau.
It also referred to a system called “Apparition” which it said an “MoA” had been signed and that installation was planned for June 2012.
The details are a match for those in Horsley’s report in which he traced the history of the installation of the “capability” at a GCSB site.
Pipitea House in Wellington, which houses the SIS and GCSB. Photo / Mark Mitchell
Horsley traced the genesis of the project from 2009, when New Zealand was identified as having the “potential” to host it.
He said legal and policy concerns were flagged leading to the GCSB seeking more information on the “capability” from the partner agency that ran it and the partner agency that had hosted it.
In late 2010, Horsley said a GCSB officer signed an “agreement in principle” leading to work across 2011 on a “Memorandum of Understanding” which was signed in March 2012.
Horsley said the “capability” was installed in 2012 although the date on which that happened was unclear. He said a GCSB presentation in March 2012 had planned installation for June 2012 - the same dates referenced in the document leaked by Snowden.
He did not link the “capability” to that referenced in the Snowden documents, saying the system was “highly classified” limiting what he could publish in a public report. “Broadly, the capability produced intelligence that could help find remote targets.”
Further Snowden documents provide details on how Apparition worked and the other systems that would incorporate the information it had obtained.
The documents described it as technology that could target Very Small Aperture Terminals (VSAT) which were “an important target because VSATs are often used by internet cafes and foreign governments in the Middle East”.
One document from 2009 was titled “Apparition becomes a reality”, signalling the launch of the system with its “first deployment” at the Misawa Security Operations Centre, codenamed Ladylove, which operated from a United States Air Force base in Japan.
New Inspector-General of Intelligence and Security Brendan Horsley.
It had already captured information about “high-value counter-terrorism targets” in Afghanistan, Indonesia and Pakistan along with non-terrorism targets in China, the briefing said.
It said Apparition “builds on the success of Ghosthunter” - another NSA system - “that enabled a significant number of capture-kill operations against terrorists”. It said Apparition was an advance on Ghosthunter because it allowed “collection from sites worldwide”.
The briefing said Apparition would proactively scan and identify VSAT sites, feeding the information into a system called Mastershake. Further detail in Snowden documents suggested the various combined systems had thousands of VSATs logged and the ability to trace targets to the exact computer they were using.
It said there were plans to install Apparition at “secure collection sites” in India, Turkey and Kuwait by the end of 2009 and at 27 other places in the following two years including “second partners” - the term used to describe Five Eyes members other than the US.
The GCSB is part of a Five Eyes electronic spying network that includes the United States as the “senior” partner, along with Australia, Canada and the United Kingdom.
Horsley said other documents in November 2012 showed the “capability” had been delivered and that the foreign partner had started using it by early 2013. It continued to be used until 2020 when it malfunctioned prompting its discovery and the absence of senior leadership or ministerial knowledge. It did not operate again after its discovery, he said.
GCSB minister Judith Collins did not respond to questions about whether she had asked for assurance that no other rogue systems were operating without New Zealand’s knowledge.
“The agency you see today is not the one reflected in the IGIS report - which covered events from more than a decade ago. It highlighted events which were unsatisfactory operational processes of that time - albeit in line with the legislation of the day.
“I’m satisfied there has been significant change in the Bureau in that time, including how it works with my office, as well as new legislation and a strengthened Office of the Inspector-General that provides robust oversight.”
A spokesman for the GCSB said that the IGIS report found it was “less likely that GCSB data was used to support military action” with the “capability” because of the scope of GCSB signals collection and the geographical area that was covered.
This statement matched with a GCSB slide included in the Snowden papers showing its coverage area across both hemispheres but bounded by India to the West and the Western US to the East.
The IGIS report also reported that the “capability” was not used after it was discovered in 2020, he said.
David Fisher is based in Northland and has worked as a journalist for more than 30 years, winning multiple journalism awards including being twice named Reporter of the Year and being selected as one of a small number of Wolfson Press Fellows to Wolfson College, Cambridge. He first joined the Herald in 2004.
