Former NZ military recruited to train China’s army - head of NZSIS

Government Communications Security Bureau director general Andrew Clark and NZ Security and Intelligence director general Andrew Hampton during their appearance at the intelligence and security select committee, Parliament, Wellington, 25 march, 2024. New Zealand Herald photograph by Mark Mitchell.

Seven New Zealanders have been contracted by a third party to support military aviation training for the Chinese army, the head of spy agency NZ Security Intelligence Service Andrew Hampton says.

This follows revelations earlier today of a China-sponsored agent hacking into New Zealand’s parliamentary systems in 2021, though no sensitive or strategic information was stolen.

Hampton told the intelligence and security committee that the seven Kiwis were targeted because they were formerly with the New Zealand army or Defence Force, or the military forces of New Zealand’s partners.

They represented a “major national security risk”, he said, and were part of a wider People’s Republic of China’s strategy to draw in people to strengthen China’s position.

“It’s important to call this out,” he said, and through threat-mitigation as well as legislative change in partner countries, all seven have now left those training roles.

But he warned they could be replaced by those who are lured by high salaries.

Hampton also told the committee that overseas countries had tried to build influence with political parties and political candidates during the election last year. Such behaviour was covert and deceptive, meaning the candidate who received a donation may not be aware of any insidious motivations.

Some individuals have been “worked with” to make them more aware, in cooperation with the relevant political party, Hampton added.

As for terrorism threats in New Zealand, he said that the Christchurch March 15 attack just over five years ago “cast a long shadow ... inspiring identity motivated violent extremists here and overseas”.

While some threats are motivated by faith, identity, or politically-motivated ideologies, he said there was an increasing emergence of those “with no strong allegiance to a specific violent extremist group”.

“They could become most prominent subjects of investigation.”

He said conflicts in Gaza and the Red Sea meant that communities in New Zealand connected to those regions were “feeling vulnerable and threatened”, sentiments that were “compounded by online comments”.

“With increased protest, with increased coming together of different groups with opposed views, there may be spontaneous violence but it wouldn’t meet the threshold of terrorism.”

Earlier

The heads of New Zealand’s spy agencies are appearing before Parliament’s most powerful MPs this evening at the intelligence and security committee hearing.

Andrew Hampton and Andrew Clark, heads of the NZ Security Intelligence Service and the Government Security Communications Bureau respectively, will take questions from committee members.

The committee is made up of seven members including Prime Minister Christopher Luxon, GSCB and SIS Minister Judith Collins, Foreign Minister and NZ First leader Winston Peters, Act Party deputy leader Brook van Velden and Labour leader Chris Hipkins.

It follows Collins’ confirmation this morning that a China-backed agent had hacked into New Zealand parliamentary systems, including the Parliamentary Counsel Office and Parliamentary Service, in 2021. No strategic or sensitive information was accessed.

The Government isn’t looking to introduce sanctions against China, despite it being the first time New Zealand’s Parliament has been targeted in such a way.

Andrew Hampton, NZSIS director general. Photo / Mark Mitchell

The New Zealand response followed reports of United States, British and Australian officials filing charges, imposing sanctions or calling out Beijing over a sweeping cyber-espionage campaign that allegedly hit millions of people, including lawmakers, academics and journalists.

In a statement, a Chinese Embassy spokesperson rejected the “groundless and irresponsible accusations” made by the New Zealand Government, saying the embassy had lodged “serious demarches” with officials to express the country’s “strong dissatisfaction and resolute opposition”.

The GCSB Minister at the time of the cyberattack, Andrew Little, earlier told the Herald: “The attack ended up being mainly on the Parliamentary Counsel Office (PCO) - they’ve got draft legislation and instructions, that sort of thing,” he told the Herald.

“But in terms of, personal information about MPs and ministers, that sort of stuff, I think the risk in relation to that was assessed as very low.”

Clark told the committee there were 316 cybersecurity incidents in 2022/23 involving New Zealand’s most nationally significant organisations.

Of those, 28 per cent were financially motivated, and 23 per cent were state-sponsored, which typically seek intelligence and to remain covert.

Clark said Russia and China had been identified for this type of cybersecurity incident three times each in the past year.

He said the vast majority of Kiwis now had access to malware-free networks, which had disrupted 6.2m malicious cybersecurity attacks.

Earlier today Collins said the GCSB had completed a “robust technical assessment” following “malicious cyber activity” targeting New Zealand’s Parliamentary Counsel Office and the Parliamentary Service in 2021.

The assessment found the Chinese state-sponsored actors known as Advanced Persistent Threat 40 (APT 40) were responsible. They are linked to China’s Ministry of State Security, according to the GCSB, and were the same group that exploited Microsoft Exchange vulnerabilities in 2021, which also led to a condemnation by the New Zealand Government at the time.

Some data from the New Zealand Parliament systems was removed, but based on the GCSB analysis, Collins said the data was not of a strategic or sensitive nature.

“The use of cyber-enabled espionage operations to interfere with democratic institutions and processes anywhere is unacceptable,” she said.

“Fortunately, in this instance, the [National Cyber Security Centre] worked with the impacted organisations to contain the activity and remove the actor shortly after they were able to access the network.

“These networks contain important information that enables the effective operation of the New Zealand government. It is critical that we protect this information from all malicious cyber threats.”

Collins said officials had raised the issue of cyber attacks with China, but the Government didn’t have plans to create legislation to put sanctions on China.

The collective response from the international community to China’s actions served as a “timely reminder” of the importance of strong cyber security measures.

“It’s important liberal democracies stand up for other liberal democracies,” Collins said.

Derek Cheng is a senior journalist who started at the Herald in 2004. He has worked several stints in the press gallery team and is a former deputy political editor.