Watchdog assessing spy agency’s response to hacking
New Zealand’s spy agency watchdog is assessing whether to launch an inquiry into how the Government Communications Security Bureau knew former MPs and an academic had been targeted in a China-backed cyber attack but didn’t tell them.
It comes as the Parliamentary Service acknowledges it too knew a former MP was hacked but hasn’t explained what “preventative actions” it took in response.
Former Labour MP Louisa Wall and former National Party MP Simon O’Connor are calling for an independent investigation into the spy agency’s handling of the matter after it was revealed the agency (GCSB) was told about the 2021 attack in 2022 but didn’t tell Wall or O’Connor, who were targeted because of their links to the Inter-Parliamentary Alliance on China (Ipac).
Now, Inspector-General of Intelligence and Security Brendan Horsley has confirmed he is conducting “preliminary inquiries” and will receive a briefing from the GCSB next week before deciding whether any further inquiry is necessary.
O’Connor welcomed Horsley’s decision, saying it was a positive first step. “Those of us affected, as well as current MPs, are calling for greater transparency so it is our hope this leads to a fuller investigation to understand who knew and then why those targeted were not informed.
“Ultimately, we want to see change so that in the future any parliamentarians and public figures are told of such cyber attacks.”
Wall said it was reassuring to see the matter was being looked into.
“I trust that the Inspector-General will carefully evaluate the information gathered to determine the need for any further inquiry.”
University of Canterbury professor Anne-Marie Brady, who was the sole academic out of the more than 120 Ipac members across the globe to be targeted in the attack, said she was glad Horsley was taking the situation seriously.
“[The] New Zealand Government has known since 2022 that China’s Ministry of State Security had targeted me and two NZ MPs for cyber attacks and they chose not to tell us. Now that the matter has become public, the Government has an opportunity to improve its practices around cyber security and foreign interference.”
Current Ipac New Zealand co-chair and Taieri MP Ingrid Leary expected Horsley to make his findings public.
“We think having an understanding of when he will make his findings known will provide assurance to impacted MPs and the public that this issue is of high priority and that the best interests of our democracy are paramount.”
Wall and O’Connor’s anger at not being informed of their link to the cyberattack — which targeted parliamentarians in various Governments in other countries — prompted the GCSB on Wednesday to acknowledge it learned the information from the United States Federal Bureau of Investigation (FBI) in 2022.
Wall’s parliamentary email address and Brady’s university email address were on the FBI’s verified list of addresses targeted in the cyber attack. O’Connor’s was not on the list but it was likely he was targeted, given he had received emails linked to the attack.
The GCSB didn’t explain why the agency didn’t inform Brady or the MPs, but said in a statement it “took action” on the information, including “engagement with Parliamentary Service”.