Espionage is an ongoing threat to New Zealand’s national security that is directed against organisations in both the private and public sector.
Global competition and insecurity drive the majority of espionage activity against New Zealand. The NZSIS has seen multiple examples of states seeking covert access to information on Government policy positions, security partnerships, technological innovations and research.
Despite our size, New Zealand is seen as a strategically important location, both due to our relationships across the Pacific and as a gateway to the Antarctic. New Zealand is also home to an increasing number of innovators producing niche technology that is targeted by foreign states.
It is almost certain there has been espionage activity from foreign states in New Zealand that has gone undetected. The NZSIS has had some disruptive success, but there is continued targeting of New Zealand’s critical organisations, infrastructure and technology.
The majority of intelligence collection against New Zealand likely occurs through cyber exploitation, however individuals within organisations can be a point of vulnerability. Significant damage can be caused to New Zealand’s national interests if even a small number of trusted insiders are compromised.
The states carrying out espionage against us are sophisticated. It is not just intelligence officers conducting this activity. Some governments take a ‘whole of state approach’ to intelligence gathering, which includes utilising businesses, universities, think tanks, or cyber actors to act on their behalf.
Espionage is inherently covert and difficult to detect. Public and private sector organisations are strongly encouraged to report suspicious activity to the NZSIS. Robust security practices are important too.
Intelligence activity targeting critical infrastructure
Infrastructure becomes critical when it is considered essential for New Zealanders’ security, wellbeing and economic prosperity. This includes businesses in sectors such as telecommunication networks, water services, ports, emergency services, and financial services.
Some foreign states seek access to, or control of, critical infrastructure assets. Suppliers or service providers to these assets can also be targeted due to the amount of harm that can be caused. Access or control could be gained, for example, by creating physical or remote entry points to key assets for later exploitation, creating supply chain dependencies, or compromising significant and sensitive data sets.
The significant harm comes not only for the business who owns or operates the asset, but compromise can lead to major consequences for New Zealanders who interact with or depend on the service provided.
It pays for owners and operators of critical infrastructure to closely consider how security risks are managed around access and control over their infrastructure.