A New Zealand investigative journalist and author says the US spy system hosted by the Government Communications Security Bureau (GCSB) appears to be a controversial intelligence system used in global capture-kill operations.

Writing a commentary for RNZ News today, Nicky Hager, author of Secret Power, a 1996 book on New Zealand’s role in global spy networks, said the controversial and unidentified foreign intelligence operation cited in a report by New Zealand’s Inspector-General of Intelligence and Security (IGIS) last week appeared to be an “intelligence system with a ghostly codename”.

“The IGIS report said the GCSB decision to host a foreign system from 2012-2020 was ‘improper’ and that the GCSB ‘could not be sure the tasking of the capability was always in accordance with… New Zealand law’,” he wrote.

“The Inspector-General said: ‘I have found some of the GCSB’s explanations about how the capability operated and was tasked to be incongruous with information in GCSB records at the time’,” Hager wrote.

But the Inspector-General could not reveal details of the system to the public because they were “highly classified”.

“The name and function of the foreign spy spying equipment, the identity of the ‘foreign partner agency’ and the location of the ‘GCSB facility’ where foreign equipment was hosted all remained secret,” Hager wrote.

Hager argued that the mystery spy equipment appeared strongly to be a top secret US surveillance system that had been installed at the GCSB’s Waihopai base at the same time as the equipment in the IGIS investigation was installed at a “GCSB facility”.

25 years of investigations
Hager has worked as an investigative journalist for the past 25 years, and has been a New Zealand member of the International Consortium of Investigative Journalists for 20 of those years.

In 2018, he was part of a reference group established by the Inspector-General of Intelligence and Security.

Hager wrote that the top secret NSA spy equipment had the ghostly codename “APPARITION” and fitted with all the details presented in the IGIS report.

“APPARITION was owned by and controlled by the US National Security Agency — the world’s largest intelligence gathering agency and head of the Five Eyes intelligence alliance that includes the GCSB,” he wrote.

According to Hager, the NSA internal report, written after the launch of the APPARITION system in 2008, said that it “builds on the success of the GHOSTHUNTER prototype . . .  a tool that enabled a significant number of capture-kill operations against terrorists”.

“Capture-kill operations involve lethal attacks on targeted people using drones, bombs and special forces raids,” wrote Hager.

“Human rights organisations have documented numerous deaths of civilians during capture-kill operations — many of them ‘algorithmically targeted’ by electronic surveillance systems such as APPARITION.

‘Extra-judicial killings’
“They are also criticised as being ‘extra-judicial killings’.”

For decades, protesters had been calling for the GCSB’s iconic radomes at Waihopai Valley spy base in rural Marlborough to be dismantled, saying that when that intelligence was shared with Five Eyes partners — the United States, the United Kingdom, Canada and Australia — it made New Zealand complicit in the military campaigns of those countries, among other criticisms.

However, Anti-Bases Campaign (ABC) organiser Murray Horton said at the time of news of the domes’ redundancy in 2021 was nothing to celebrate, since the base itself would continue to operate at the site, “albeit without its most conspicuous physical features that stick out like dogs’ balls”.

The out-of-date domes were removed in 2022.

Article by AsiaPacificReport.nz

Te Kuaka, an independent foreign policy advocacy group with a strong focus on the Pacific, has called for urgent changes to the law governing New Zealand’s security agency.

“Pacific countries will be asking legitimate questions about whether . . . spying in the Pacific was happening out of NZ,” it said today.

This follows revelations that a secret foreign spy operation run out of NZ’s Government Communications Security Bureau (GCSB) for seven years without the knowledge or approval of the government or Parliament.

RNZ News reports today that the former minister responsible for the GCSB, Andrew Little, has admitted that it may never be known whether the foreign spy operation was supporting military action against another country.

New Zealand’s intelligence watchdog the Inspector-General of Intelligence and Security revealed its existence on Thursday, noting that the system operated from 2013-2020 and had the potential to be used to support military action against targets.

The operation was used to intercept military communications and identify targets in the GCSB’s area of operation, which centres on the Pacific.

In 2012, the GCSB signed up to the agreement without telling the then director-general and let the system operate without safeguards including adequate training, record-keeping or auditing.

When Little found out about it he supported it being referred to the Inspector-General for investigation.

Refused to name country
But he refused to say if he believed the covert operation was run by the United States although it was likely to be one of New Zealand’s Five Eyes partners, reports RNZ.

Te Kuaka said in a statement today the inquiry should prompt immediate law reform and widespread concern.

“This should be of major concern to all New Zealanders because we are not in control here”, said Te Kuaka member and constitutional lawyer Fuimaono Dylan Asafo.

“The inquiry reveals that our policies and laws are not fit for purpose, and that they do not cover the operation of foreign agencies within New Zealand.”

It appeared from the inquiry that even GCSB itself had lost track of the system and did not know its full purpose, Te Kuaka said.

It was “rediscovered” following concerns about another partner system hosted by GCSB.

While there have been suggestions the system was established under previously lax legislation, its operation continued through several agency and legislative reviews.

Ultimately, the inquiry found “that the Bureau could not be sure [its operation] was always in accordance with government intelligence requirements, New Zealand law and the provisions of the [Memorandum of Understanding establishing it]”.

‘Unknowingly complicit’
“We do not know what military activities were undertaken using New Zealand’s equipment and base, and this could make us unknowingly complicit in serious breaches of international law”, Fuimaono said.

“The law needs changing to explicitly prohibit what has occurred here.”

The foreign policy group has also raised the alarm that New Zealand’s involvement in the AUKUS security pact could compound problems raised by this inquiry.

AUKUS is a trilateral security pact between Australia, the UK and the US that aims to contain China.

Pillar Two’s objective is to win the next generation arms race being shaped by new autonomous weapons platforms, electronic warfare systems, and hypersonic missiles.

It also involves intelligence sharing with AI-driven targeting systems and nuclear-capable assets.

‘Pacific questions’
“Pacific countries will be asking legitimate questions about whether this revelation indicates that spying in the Pacific was happening out of NZ, without any knowledge of ministers”, said Te Kuaka co-director Marco de Jong.

“New Zealand’s involvement in AUKUS Pillar II could further threaten the trust that we have built with Pacific countries, and others may ask whether involvement in that pact — with closer ties to the US — will increase the risk that our intelligence agencies will become entangled in other countries’ operations, and other people’s wars, without proper oversight.”

Te Kuaka has previously spoken out about concerns over AUKUS Pillar II.

“We understand that there is some sensitivity in this matter, but the security and intelligence agencies should front up to ministers here in a public setting to explain how this was allowed to happen,” De Jong said.

He added that the agencies needed to assure the public that serious military or other operations were not conducted from NZ soil without democratic oversight.”

Article by AsiaPacificReport.nz

The release of the threat assessment by the New Zealand Security Intelligence Service (SIS) this week is the final piece in a defence and security puzzle that marks a genuine shift towards more open and public discussion of these crucial policy areas.

Together with July’s strategic foreign policy assessment from the Ministry of Foreign Affairs, and the national security strategy released last week, it rounds out the picture of New Zealand’s place in a fast-evolving geopolitical landscape.

From increased strategic competition between countries, to declining social trust within them, as well as rapid technological change, the overall message is clear: business as usual is no longer an option.

By releasing the strategy documents in this way, the government and its various agencies clearly hope to win public consent and support — ultimately, the greatest asset any country possesses to defend itself.

NZSIS’s first unclassified threat assessment targets competition, public trust, technology https://t.co/5wetaOL1oA

— RNZ News (@rnz_news) August 10, 2023

Low threat of violent extremism
If there is good news in the SIS assessment, it is that the threat of violent extremism is still considered “low”. That means no change since the threat level was reassessed last year, with a terror attack considered “possible” rather than “probable”.

It is a welcome development since the threat level was lifted to “high” in the
immediate aftermath of the Christchurch terror attack in 2019.

This was lowered to “medium” about a month later — where it sat in September 2021, when another extremist attacked people with a knife in an Auckland mall, seriously
wounding five.

The threat level stayed there during the escalating social tension resulting from the government’s covid response. This saw New Zealand’s first conviction for sabotage and increasing threats to politicians, with the SIS and police intervening in at least one case to mitigate the risk.

After protesters were cleared from the grounds of Parliament in early 2022, it was
still feared an act of extremism by a small minority was likely.

These risks now seem to be receding. And while the threat assessment notes that the online world can provide havens for extremism, the vast majority of those expressing vitriolic rhetoric are deemed unlikely to carry through with violence in the real world.

Changing patterns of extremism
Assessments like this are not a crystal ball; threats can emerge quickly and be near-invisible before they do. But right now, at least publicly, the SIS is not aware of any specific or credible attack planning.

Many extremists still fit well-defined categories. There are the politically motivated, potentially violent, anti-authority conspiracy theorists, of which there is a “small number”.

And there are those motivated by identity (with white supremacist extremism the dominant strand) or faith (such as support for Islamic State, a decreasing and “very small number”).

However, the SIS describes a noticeable increase in individuals who don’t fit within those traditional boundaries, but who hold mixed, unstable or unclear ideologies they may tailor to fit some other violent or extremist impulse.

Espionage and cyber-security risks

There also seems to be a revival of the espionage and spying cultures last seen during the Cold War. There is already the first military case of espionage before the courts, and the SIS is aware of individuals on the margins of government being cultivated and offered financial and other incentives to provide sensitive information.

The SIS says espionage operations by foreign intelligence agencies against New Zealand, both at home and abroad, are persistent, opportunistic and increasingly wide ranging.

While the government remains the main target, corporations, research institutions and state contractors are now all potential sources of sensitive information. Because non-governmental agencies are often not prepared for such threats, they pose a significant security risk.

Cybersecurity remains a particular concern, although the Government Communications Security Bureau (GCSB) recorded 350 incidents in 2021-22, which was a decline from 404 incidents recorded in the previous 12-month period.

On the other hand, a growing proportion of cyber incidents affecting major New Zealand institutions can be linked to state-sponsored actors. Of the 350 reported major incidents, 118 were connected to foreign states (34 percent of the total, up from 28 percent the previous year).

NZSIS’s first unclassified threat assessment targets competition, public trust, technology https://t.co/5wetaOL1oA

— RNZ News (@rnz_news) August 10, 2023

Russia, Iran and China
Although the SIS recorded that only a “small number” of foreign states engaged in deceptive, corruptive or coercive attempts to exert political or social influence, the potential for harm is “significant”.

Some of the most insidious examples concern harassment of ethnic communities within New Zealand who speak out against the actions of a foreign government.

The SIS identifies Russia, Iran and China as the three offenders. Iran was recorded as reporting on Iranian communities and dissident groups in New Zealand. In addition, the assessment says:

Most notable is the continued targeting of New Zealand’s diverse ethnic Chinese communities. We see these activities carried out by groups and individuals linked to the intelligence arm of the People’s Republic of China.

Overall, the threat assessment makes for welcome – if at times unsettling – reading. Having such conversations in the open, rather than in whispers behind closed doors, demystifies aspects of national security.

Most importantly, it gives greater credibility to those state agencies that must increase their transparency in order to build public trust and support for their unique roles within a working democracy.

Dr Alexander Gillespie, Professor of Law, University of Waikato. This article is republished from The Conversation under a Creative Commons license. Read the original article.

MPs confront Iran’s Ambassador to New Zealand over protest crackdowns https://t.co/Mtqr5OLetS

— RNZ News (@rnz_news) August 3, 2023

Article by AsiaPacificReport.nz

New Zealand’s cyber security agency believes China has been behind numerous hack attacks spanning years.

The government joined Western allies and Japan in calling out Beijing for so-called state-sponsored hacks, including a major incursion in February when Microsoft email servers were targeted.

The US has charged four Chinese nationals — three security officials and one contract hacker — with targeting dozens of companies and government agencies in the United States and overseas under the cover of a tech company.

“What we do is when we see malicious cyber activity on New Zealand networks, that may be through our own capabilities that we have to help protect New Zealand networks or it may be something that’s reported to us, we look at the malware that’s used,” Government Communications Security Bureau Director-General Andrew Hampton told RNZ Checkpoint.

“We look at how the actor behaves. We look at who they might be targeting and what they do if they get onto a network.

“That allows us to build a bit of a picture of who the actor is. We then compare that with information that we receive, often from our intelligence partners who are also observing such activity.

“That allows us to make an assessment, and it’s always a probability assessment about who the actor is.

The APT 40 group
“In this case, because of the amount of information we’ve been able to access both from our own capabilities and from our partners, we’ve got a reasonably high level of confidence that the actor who we’ve seen undertaking this campaign over a number of years, and in particular, who was responsible for the Microsoft Exchange compromise, was the APT 40 group — Advanced Persistent Threat Group 40 — which has been identified as associated with the Chinese Ministry of State Security.

The RNZ National live stream.  Video: Checkpoint

“The actors here are state sponsored actors rather than what we would normally define as a criminal group. What we’re seeing here is a state sponsored actor likely to be motivated by a desire to steal information.”

Hampton said there was a blurring of lines between what a state agency does, and what a criminal group does.

“Some of the technical capabilities that previously only state organisations had, have now got into the hands of criminal groups.

“Also what we’ve seen in a range of countries is individuals who may work part-time in a government intelligence agency, and then may work part-time in a criminal enterprise. Or they may have previously worked in a state intelligence agency and are now out by themselves but still have links links back to the state.

“We don’t know the full detail of the nature of the relationship, but what we do know is the Ministry of State Security in China, for example, is a very large organisation with many thousands of of employees.

“So they are big organisations with people on their payroll but they also would have connections with other individuals and organisations.

Information shared with criminals
“Something else worth noting with regard to this most recent compromise involving the Microsoft Exchange, what we saw there is once the Ministry of State Security actors had identified the vulnerability and exploited it, they then shared that information with a range of other actors, including criminal groups, so they too could exploit it.

“This is obviously a real concern to see this type of behaviour occurring,” Hampton said.

All evidence showed the cyber attacks were all originating from mainland China, Hampton told Checkpoint.

He said such attacks would be aimed at stealing data or possibly positioning themselves on a system to be able to access information in the future.

“A common tactic we see, unfortunately, is there may be a vulnerability in a system,” Hampton said.

“It could be a generic vulnerability across all users of that particular system, and a malicious actor may become aware of that vulnerability, so they would use that to get onto the network.

“That doesn’t mean they will then start exfiltrating data from day one or something like that. They may just want to to sit there in the event that at some point in the future they may want to start doing that.

Malicious actors
“This exploitation of known vulnerabilities is a real concern. This is why all organisations need to keep their security patches up to date, because what can happen is you can have malicious actors use technology to scan whole countries to see who hasn’t updated their patches.

“They then use that vulnerability to get on the network and they may not do anything with it for some time. Or they might produce a list of all the organisations, say, in New Zealand who haven’t updated their patches.

“Then they make a decision – okay these are the four to five we want to further exploit.”

This article is republished under a community partnership agreement with RNZ.

Article by AsiaPacificReport.nz