Photo: RNZ / Samuel Rillstone
The government does not plan to launch sanctions against China after confirming a cyberattack targeted two Parliamentary agencies in 2021.
Foreign Minister Winston Peters said concerns had been conveyed directly to the Chinese government, with senior officials at the Ministry of Foreign Affairs and Trade asked to speak with China's Ambassador.
A spokesperson for the Chinese Embassy in New Zealand rejected what they called "groundless and irresponsible accusations" that China was behind the malicious cyber activity.
The hack
The spy agencies' minister Judith Collins revealed in a statement on Tuesday New Zealand's Parliamentary Service and Parliamentary Counsel Office had been targeted in a China-linked 2021 cyberattack.
The Parliamentary Service provides administrative and support services to Parliament and its MPs, while the Parliamentary Counsel Office (PCO) is responsible for drafting and publishing legislation.
"The GCSB's National Cyber Security Centre (NCSC) completed a robust technical assessment following a compromise of the Parliamentary Counsel Office and the Parliamentary Service in 2021, and has attributed this activity to a PRC state-sponsored group known as APT40," she said.
APT is a common term in cybersecurity for identifying groups carrying out attacks like this, and stands for Advanced Persistent Threat.
"Fortunately, in this instance, the NCSC worked with the impacted organisations to contain the activity and remove the actor shortly after they were able to access the network."
Collins told reporters at Parliament New Zealand's democratic institutions were "sacrosanct" and said New Zealand was working alongside partners and supporting the UK.
"We've come out to say this because there is clearly a pattern of behaviour and attacks on democratic institutions. We believe it's really important from New Zealand's point of view that we acknowledge and attribute that."
She said this was the first attack on New Zealand's democratic institutions she was aware of.
GCSB director-general Andrew Clark said New Zealanders could be reassured the hack was detected quickly, and action was taken before sensitive data was taken.
He said there had been 316 "cyber events" involving nationally significant organisations in the past year, and about a quarter of these - 23 percent - could be linked to state-sponsored actors.
GCSB director Andrew Clark Photo: RNZ / Samuel Rillstone
He was confident China was behind it.
"Our analysis enabled us to confidently link the actor to the People's Republic of China - specifically to the Ministry of State Security ... this link has been reinforced by analysis from international partners of similar events in their own jurisdictions."
Some information was removed from the networks, but the GCSB believed it was of a technical nature and information of a sensitive or strategic nature was not taken, he said. The PCO and Parliamentary Service had made changes to their networks to increase their security resilience since the attack, he said.
Collins' office said the hack - identified in August 2021 - was different from the one revealed by then-minister Andrew Little.
Little had in July 2021 linked a separate attack to APT40, which he said at the time was a Chinese-backed group.
Labour leader Chris Hipkins confirmed he had been made aware of the attack after it happened, and was given more information when he became prime minister.
Asked why he had not revealed it at the time, he said there was a process that needed to be followed.
"You've got to make sure you're protecting sources ... also if there's a loophole that it's exposing you've got to make sure that loophole is closed before you start talking about it publicly ... there are diplomatic considerations too in managing relationships."
Prime Minister Christopher Luxon said officials had raised concerns about malicious cyberactivities with Chinese counterparts earlier in the month, but he did not speak about the matter with China's Foreign Minister Wang Yi when he visited Wellington last week.
Asked what further actions could be taken, he said calling out the attack was important.
"Calling it out and putting sunlight on it and calling it out is actually a very good thing."
'No plan' for sanctions
The news follows the United Kingdom and United States announcing sanctions against China over its alleged cyber activity.
They claimed a sweeping cyberespionage campaign targeting millions of people - including White House staffers, US Senators, British parliamentarians, government officials across the world and lawmakers, academics, journalists.
The US and UK said the attack was led by the APT31 hacker group, which they said was an arm of China's Ministry of State of Security.
In her statement, Collins said New Zealand stood with the UK, and the "use of cyberespionage operations to interfere with democratic institutions and processes anywhere is unacceptable".
Asked why New Zealand had not announced sanctions, she said it was not part of the government's planning. Because New Zealand does not have broader law allowing for autonomous sanctions, legislation would be required before sanctions can be laid.
"I think the public attribution from New Zealand's point of view is quite significant and that is where we are. Also the other countries that you've mentioned have legislation that enables them to apply those [sanctions] - we don't, we have no plans to put that in place, we have a very full legislative agenda."
Trade Minister Todd McClay said successive governments had also looked at the possibility of legislation to enable autonomous sanctions, but "with few exceptions, largely these things are best done through the UN, it's the system that New Zealand relies upon".
He said he did not have concerns about the trade relationship with China. While trade was important to both countries, trade diversification was important to New Zealand as well.
"We have a very broad and long-standing relationship with China and it's important New Zealand is able to express those views on the world stage.
"We diversify trade anyway to give New Zealanders choice of the markets that they go into, not for reasons of that - but we cast our mind back to when most of our trade went to the United Kingdom and they joined the European common market it wasn't helpful to the New Zealand economy.
"Successive governments have had a desire to broaden opportunities for Kiwis and we'll continue doing that."
China responds
In a statement, the Chinese Embassy said they had "lodged serious démarches to New Zealand's relevant authorities" and expressed "strong dissatisfaction and resolute opposition".
"We have never, nor will we in the future, interfere in the internal affairs of other countries, including New Zealand," the statement said.
"Accusing China of foreign interference is completely barking up the wrong tree.
"We hope the New Zealand side can practice the letter and spirit of its longstanding and proud independent foreign policy, independently making judgments and decisions in its best interests rather than blindly following other's words and actions at the expense of New Zealand's own credibility and interests."
Peters said foreign interference of this nature was unacceptable and he urged China to refrain from such activity in the future.
"New Zealand will continue to speak out - consistently and predictably - where we see concerning behaviours like this," Peters said.
"As discussed during last week's visit by Foreign Minister Wang Yi to New Zealand, our two countries have a significant and complex relationship. We cooperate with China in some areas for mutual benefit. At the same time, we have also been consistent and clear that we will speak out on issues of concern."
Collins was asked if she could unequivocally say the Chinese government was behind the attack.
"I trust our security agencies," she said.
"It's very important though that we have a very consistent and predictable relationship with China, so we will speak about human rights issues for instance, in China, and we will call out the sort of behaviour we find unacceptable."
"I think we are very aware that China is a very good friend and we obviously have a long-term relationship with them. But what we are also never going to accept [is] people attacking our democratic institutions."
"New Zealand and China have been very good friends for a very long time," she said, adding they "absolutely" still were.
