New Zealand businesses urged to boost security against rising cyber threats

New Zealand's intelligence chief has warned that foreign actors are intensifying their campaign of cyber espionage and state-sponsored interference, urging the private sector to step up security as part of a broader national effort to safeguard the economy and the country's reputation.

"National security is not something the intelligence and security agencies can do alone," said Andrew Hampton, Director-General of the New Zealand Security Intelligence Service (NZSIS), in an exclusive interview following his address at this year's Aspen - Otago National Security Forum. He noted that today's volatile threat environment means "we need the public, including business, to report to us the threats that they see so that we can work together to deter and disrupt."

The increasingly porous boundary between public and private sector vulnerabilities has sharply elevated the stakes for corporate New Zealand, particularly as foreign espionage grows more sophisticated. According to Hampton, the NZSIS sees "multiple examples of foreign states conducting espionage to seek covert access to a range of information from Government policy positions to technological innovations and research." These threats, he emphasised, are no longer abstract risks. Methods now run the gamut-"cyber-attacks, obfuscation through cover companies and investment opportunities, targeting delegations travelling overseas, and exploiting insiders within organisations are all vectors for espionage against New Zealand."

What is known, he cautioned, may be just the tip of the iceberg: "It is almost certain there is espionage activity going undetected at both public and private organisations." The traditional insularity that once insulated New Zealand, both geographically and psychologically, is no longer reliable. "I still come across directors and executive leaders...who think being tucked down in the south Pacific protects us from these kinds of activities. 'Why would a foreign state be interested in us?' is a common refrain."

According to intelligence reports, areas of greatest vulnerability include science and technology sectors, especially those with dual-use applications. "Your intellectual property may be sought for its potential use in military applications even if that wasn't its intended purpose. Certain foreign states see stealing innovation as a legitimate means of gaining an edge over their competitors, including New Zealand." Hampton stressed that data-rich firms are also at risk: "Many companies hold significant amounts of data about their customers...Identity information is highly sought after by foreign state actors."

This intelligence insight is already affecting government policy. Recent attempts by foreign actors to leverage New Zealand's geographic position and burgeoning space industry forced Parliament to introduce urgent countermeasures. "We have seen a foreign state persistently and covertly try to take advantage of our geographic location...by trying to establish ground-based space infrastructure through third-party companies," Hampton said, noting that swift legislative action was necessary to counter this threat.

But Hampton is clear: overcoming the security challenge does not require prohibitively expensive countermeasures. "Simple, cost-effective measures can go a long way to protecting your ideas, reputations and future success. It begins with adopting a strong security mindset." He pointed to the Secure Innovation Principles recently released by NZSIS and its Five Eyes partners, which offer a pragmatic roadmap: "Know the threats...secure your business environment...secure your products...secure your partnerships...secure your growth."

One of the most insidious risks comes from within, as foreign states attempt to exploit insiders. "A holistic security programme in any organisation should consider the risk that threats could emanate from an insider," Hampton explained. He advocates for the establishment of insider threat programmes across both public and private sectors and emphasises that security vigilance is especially vital during overseas travel, when business delegations may become targets for foreign intelligence services.

For the business community, the perception that security and growth are in conflict is an outdated myth. "The reality is that you can't have one without the other," said Hampton. He cited a recent Australian assessment pegging espionage losses at $NZ13.7 billion annually-a sobering figure. Even assuming New Zealand suffers a fraction of that amount, "it is worth paying greater attention than we currently are."

Artificial intelligence, a key technology shaking up business and government alike, is both an opportunity and risk multiplier, Hampton said. "Artificial intelligence is important to us...We need to help New Zealand organisations and New Zealanders use AI safely through practical advice and guidance. We need to know how our adversaries are using it to undermine our national interests. AI has the significant potential to help our agencies undertake our work more effectively."

He warned, however, that AI advances are already amplifying the threat landscape: "The use of AI to facilitate violent extremism and state-sponsored interference activities is increasing. AI [makes] harmful propaganda appear more authentic...Attack plans and capabilities are now much easier for terrorists to research. Vulnerable people are being radicalised by chatbots. States are using it more often in their intelligence collection operations and cyber attacks."

The shifting technological landscape also presents new possibilities for public-private collaboration, particularly in harnessing local expertise. "One of the strengths of the New Zealand technology sector is the small, niche and high quality applications that our size and scale allows businesses to specialise in," he noted, adding that homegrown solutions could find receptive markets among New Zealand's international partners. "There are examples of technology produced here...that hasn't been built with the intention of disrupting national security threats but which can have that effect. We have enjoyed working with those small businesses who may in the future have a significant market in the form of our Five Eyes partners. We are interested in exploring more opportunities of this nature."

The intelligence chief's message to New Zealand's business and technology sectors is unequivocal: "Addressing that variance will need to begin with a recognition that the espionage threat is real and happens here, and that security is not an inhibitor to innovation or our future prosperity, but an enabler."