NZ stands with partners to censure China on cyberattacks

Credit: Original article can be found here

ANALYSIS: New Zealand has stood with its traditional partners in condemning the Chinese government’s role in cyberattacks that impacted people around the globe earlier this year.

The move is an overt one that comes as the Government continues to try to balance a values-based independent foreign policy with maintaining relationships with the country’s largest trading partner, and commentators say it could cause issues.

Late Monday, the Government released a statement condemning China’s state-sponsored cyberattacks in a coordinated move with countries and alliances across the world including the United States, Canada, Australia, the European Union and the North Atlantic Treaty Organisation (NATO).

Andrew Little, the minister responsible for the Government Communications Security Bureau, said the Government condemned cyberattacks by Chinese sponsored-actors both in New Zealand and around the world, including one on Microsoft earlier in the year.

* Prime Minister Jacinda Ardern says global effort needed to confront cyber attacks
* Australia Defence Minister vows to call out China, saying the public supports government’s stance
* Government briefings say threats to New Zealand grow with a ‘receding’ world order

“We call for an end to this type of malicious activity, which undermines global stability and security,” he said.

A number of countries including New Zealand accused the Chinese sponsored cyberattacks of breaching Microsoft systems earlier this year. At the time Microsoft said it had detected hackers inside its servers who had access to not only emails but other sensitive corporate data and intellectual property.

Commentators say that the attack on Microsoft went further than prior Chinese attacks as it was less targeted – rather than hacking for a specific reason such as espionage or intellectual property theft to help Chinese businesses, they were scooping up a lot of information in the hopes of finding something useful.

Microsoft said earlier this year it had detected hackers inside their servers. New Zealand says they were Chinese.

Mark Lennihan/AP

Microsoft said earlier this year it had detected hackers inside their servers. New Zealand says they were Chinese.

Furthermore, the vulnerabilities they found enabled other cyber attackers to exploit the vulnerabilities and access servers for their own purposes, which resulted in further attacks and companies being targeted with ransomware.

A spokesman for the Chinese Embassy in New Zealand said the claims of China’s involvement were totally groundless and irresponsible. New Zealand says it has confirmed the links to Chinese actors.

However, the embassy spokesman says they had already reached out to the Government expressing strong dissatisfaction and firm opposition.

The widespread global condemnation came at a time of heightened tensions between China and the US and its allies on a number of fronts due to concerns about China’s treatment of its neighbours in the South China Sea and disergard for international law, treatment of Uyghurs in Xinjiang, crackdown in Hong Kong and increased use of non-tariff trade barriers.

China has been blamed for significant cyberattacks earlier this year.

Kevin Frayer/Getty Images

China has been blamed for significant cyberattacks earlier this year.

Robert G Patman, a professor of International Relations at University of Otago, said while a number of commentators had called New Zealand’s decision to come out against China’s state sponsored cyberattacks courageous, the country did not really have a choice.

“What was the choice if we didn’t say anything and everyone else did?” he said. “Politics is often the choice between the disagreeable and intolerable.”

Patman said he believed the Government has been cognisant that they were going to have to take a stronger stance with China over the past few months, given Foreign Affairs Minister Nanaia Mahuta recently urged exporters to diversify as quickly as possible.

These were cyberattacks on New Zealand citizens, which made them a direct issue for the country and increased the country’s need to respond, according to commentators.

“Some people say a full scale cyberattack could be almost as bad as an event of mass destruction,” said Alexander Gillespie, an international law professor at Waikato University. He said while it wouldn’t be as instantaneous, the impact of shutting down water and electricity or ATM machines could be significant.

“The risk of this (the attacks) going further means we have to speak up,” he said.

Cybersecurity was an ever-growing problem for New Zealand. In the year ended 30 June 2020, according to the most recent data available, there were 352 cyber incidents recorded here up from 339 in the prior year, the GCSB said. Of those, there were indications that 30 per cent were linked to players sponsored by foreign governments.

Adam Segal, a cybersecurity expert at the Council on Foreign Relations in New York said as cyberattacking escalated it could start to impact people in ways that hadn’t been seen before and the damage that could be extensive.

However, he noted that the statements from countries were uneven and that at this stage it was just words.

“Calling China out on its own is going to do very little,” he says.

China has been found to be involved in cyberattacks prior to the Microsoft Server incident, but the broadness of the recent incident called for stronger actions.

Dmitri Alperovitch, chairman of Silverado Policy Accelerator, a US-based think tank that worked to modernise US cybersecurity policy, said that if China hadn’t been confronted, it would be emboldened to carry out more such attacks, which meant even countries with significant trading relationships felt they had to call out the behaviour.

“This is unprecedented in terms of the coalition that came together,” he said.

The US had also laid charges against four Chinese nationals. Prosecutors said those charges were concerned with working with China’s Ministry of State Security in a hacking campaign that targeted dozens of computer systems, including companies, universities and government entities. But Alperovitch said that sanctions might also follow, given the US has penalised other countries in the past – such as Iran and North Korea – for their cyber activities.

“This activity needs to be confronted,” he said.