By Hannah Brown
Could New Zealand suffer an act of cyberwar? Hannah Brown explores.
As multilateral institutions like the United Nations and NATO move to define cyberwar and develop legal frameworks to regulate it, the word cyberwar has still never been uttered in New Zealand’s parliament.
This, despite the fact cyberweapons and cyberwarfare are now considered by the FBI to be the number one threat to American national security, and New Zealand’s own Strategic Defence Policy Statement, released in July, mentions cyber issues an unprecedented 31 times and suggests threat levels have increased.
What is cyberwar? Former White House counterterrorism chief Richard Clarke defines it as “actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption.” This definition identifies the perpetrator, the victim, malevolent intent and the crucial idea that cyberwar occurs between governments – distinguishing cyberwarfare from common cybercrimes like hacktivism, identity theft, cyber espionage and cyber terrorism carried out by groups or individuals who are non-state actors.
Conversely, Singer and Friedman believe cyberwar doesn’t need its own definition or law – because traditional war law can apply. Their view is that no matter where or how a war is fought, “it always has a political goal and mode and always has an element of violence.” It could be argued this is too broad – encompassing acts perpetrated by individuals and groups as well as governments.
Could New Zealand suffer an act of cyberwar? Let’s first look at examples of cyberwarfare that have already occurred in the world.
In 2007, apparently offended by Estonia’s removal of a Soviet-era statue, Russia is alleged to have sponsored a cyberattack against Estonia, which used state hackers to bring down the internet and banking records in a 24-hour denial-of-service attack. This is widely considered the debut of cyberwar as a tool to further foreign policy objectives.
A year later, Russia used cyberwar in a more physical way against Georgia: scrambling the internet in advance of a traditional warlike attack, according to du Fresne, in a way that sowed confusion, and “gave the advancing Russian offensive significant military advantage. The cyberattacks weren’t violent but they increased the capacity of the advancing Russian forces to undertake violent offensives.”
In 2010, the Stuxnet attack was discovered: a computer worm released by Israel and the US against Iran, capable of physical destruction. The New York Times described it as “achieving with computer code what until then could be accomplished only by bombing a country or sending in agents to plant explosives.”
There is a growing belief cyber-physical attacks will be next: the destruction of government data; the internet replaced with an error message; cars or public transport taken over by remote-control and crashed; bank records deleted; hospitals closed; the power grid and water systems turned off, causing danger, illness and civil unrest.
In his book Cyber Physical Attacks: A Growing Invisible Threat, Loukas extends this view, suggesting that the idea cyberattacks exist only in cyberspace is outdated. “Modern automobiles, smart buildings, wireless implants, intelligent traffic lights, full-body scanners, and industrial control systems are realistic targets for an attacker who wants to cause damage in physical space. An autonomous vehicle that has been compromised electronically can be used to intercept communications, transmit false data, launch a cyberattack from a convenient location, or even drive or fly itself into a crowd.”
When considering New Zealand’s likelihood of suffering such an act we need to consider its international relationships. Put differently: to what extent does New Zealand have enemies?
In 2015 New Zealand sent troops to Camp Taji in Iraq to train soldiers in the war against Islamic State (ISIS) – and was criticised domestically at the time for risking provocation of the cyber-savvy ISIS and Islamist states.
New Zealand’s Foreign Minister Winston Peters has criticized China’s policies in the South China Sea and been unrepentant when rebuked. According to du Fresne, “Both the US and China are preparing to fight wars in cyberspace and their national security establishments are fully invested in developing offensive cyber-attack capabilities” – as such, provoking these nations may carry extra risk of a cyber response.
Still, postcolonial New Zealand has not attracted any serious warlike attacks, cyber or traditional. Its compliance with international law, relative irrelevance globally, and efforts to maintain friendly relationships internationally probably provide useful protection against them.
Further, it is possible that New Zealand’s membership of the Five Eyes intelligence partnership with Australia, Canada, Britain, and the US lend it some protection against acts of cyberwarfare: if attacked, its partners may intervene so their cyber networks are not similarly compromised.
That is not to say New Zealand is immune: cyber threats are increasing. The Government Communications Security Bureau (GCSB) – the lead agency monitoring cyberwarfare in New Zealand – released a report in 2017 revealing that its national cyber security centre had recorded 122 “serious incidents” with likely links to international governments.
In response to these increasing threat levels, over the past decade New Zealand has taken a whole-of-government approach to cyberwar defence, meaning several government agencies and ministries have overlapping responsibilities for cyberwar vigilance. Kim explains why it’s current international best practice: “cybersecurity needs to be baked into every corner of every government organisation…everyone needs to play a part in keeping government infrastructure safe and secure.” Australia and the UK are doing the same.
This approach, combined with adherence to international law, the Five Eyes partnership, relative global unimportance, and general reputation as a good global citizen suggest New Zealand is, on balance, an unlikely target for cyberwar if current conditions continue.
Hannah Brown is a postgraduate student in Politics and International Relations at the University of Auckland.
Disclaimer: The ideas expressed in this article reflect the author’s views and not necessarily the views of The Big Q.
You might also like:
Why is New Zealand trailing Australia in cyber security?
New Zealand Defence Force prepares for cyber threats
