Director-General remarks: Justice Committee Inquiry into the 2020 General Election and Referendums

The following is a submission by the Director-General of Security, NZSIS and Acting Director-General of the GCSB on the Justice Committee Inquiry into the 2020 General Election and Referendums.

Kia ora koutou

Thank you for inviting us to appear before you to assist with your inquiry into the 2020 General Election and referendums. We welcome this opportunity.

Our briefing to you during this open session runs for about 10 minutes – leaving 50 minutes for questions.

Director-General of Security

Introductory remarks

We will begin by introducing ourselves and outlining our roles in relation to the protection of New Zealand’s elections, democratic processes, and institutions more broadly.

I am Rebecca Kitteridge, the Director-General of Security of the New Zealand Security Intelligence Service. The NZSIS is New Zealand’s security intelligence agency. Our purpose is to protect New Zealand and New Zealanders from threats to national security. We do this by detecting threats, investigating and assessing those threats and then advising and working with others to protect from national security harm.

The NZSIS’s role in relation to threats to elections and democratic institutions and processes is fourfold:

• We collect, analyse and assess intelligence about foreign interference and espionage activities in New Zealand. A particular focus here is on identifying and understanding the covert activities of foreign state actors operating in, or seeking to influence, New Zealand institutions, processes and individuals;
• We provide intelligence to decision-makers;
• We, in conjunction with the GCSB, provide protective security services, advice and assistance to a wide range of individuals and entities, including Members of Parliament and Ministers; and
• We administer the security clearance system that helps to protect New Zealand’s Government against insider threat risks and espionage.

Both agencies are politically neutral public service agencies and this is reinforced in our governing legislation, the Intelligence and Security Act 2017. We have a statutory obligation to brief the Leader of the Opposition on matters relating to our functions.

Our activities are guided by the National Security and Intelligence Priorities, set by Cabinet.

There are two specific National Security and Intelligence and Priorities that are of direct relevance to the subject of the Committee’s inquiry.  These are:

• Foreign influence, interference and espionage. Acts of interference, influence and espionage in and against New Zealand that would erode New Zealand’s sovereignty, national security or economic advantage; and
• Malicious cyber activity.  Cyber threats to New Zealand from state-sponsored and other malicious actors.

It is worth noting that while this submission focuses on foreign interference and malicious cyber activity, the NZSIS and the GCSB contribute to the management of other national security threats that have the potential to prejudice the delivery of the General Election and referendums.  This includes, for example, the threat of terrorism.

Acting Director-General of the GCSB

Hello, I am Bridget White, the Acting Director-General of the Government Communications Security Bureau, the GCSB.  I am here on behalf of Andrew Hampton.

The GCSB is the Government’s Signals Intelligence agency, and cyber and information security authority. Our role is also set out in the Intelligence and Security Act.

We use our intelligence collection capability to support government agencies in their operations, decision-making, and carrying out their mandated functions.

We also provide cyber security and information assurance advice and services to organisations of national significance.

In relation to foreign interference in our Elections, the GCSB’s key roles are:

• To provide cyber security and information assurance services and advice to a range of individuals and entities. This includes Members of Parliament, Ministers, political parties and other entities involved in the conduct of the General Election process;
• To develop and provide intelligence (primarily foreign intelligence) and cyber assessments on the intentions, activities and capabilities of threat actors, including in relation to the General Election process; and
• To do everything, within the bounds of our mandates and authorizations, that is necessary (or desirable) to protect the security and integrity of communications and information infrastructures of importance to the Government, including identifying and responding to threats to those communications and information infrastructures. This includes the Electoral Commission’s core systems.

Constraints on the GCSB and the NZSIS when talking publicly about intelligence and security matters

Before covering the detail of our submission, we would like to briefly outline the constraints we operate under when speaking publicly about our intelligence and security functions.

We are constrained in what we can say in an unclassified setting about specific foreign interference activities. This is for two main reasons:

• Firstly, we need to protect our capabilities, sources and methods. We have a longstanding practice of not commenting on matters that may or may not be operational; and
• Secondly, the GCSB and the NZSIS do not tend to publicly name foreign states that have, or have attempted to, engage in foreign interference activities in New Zealand. The exception to this is when the Government takes a deliberate decision to attribute an activity to a particular state. This has occurred in relation to some cyber security campaigns.

At the conclusion of this open session, we will provide a classified briefing to the Committee in a closed session.

We last presented to this Committee on the threats to the General Election in June last year. We also presented twice to the Committee in 2019. This Committee’s membership has substantially changed since our last briefing so for thoroughness, we will be covering some of the same material again. Apologies to those members who have heard parts of this material before.

Director-General of Security

Thank you Bridget.

I will start the substantive part of our briefing by talking broadly about how we view foreign interference threats to New Zealand’s democracy. We will then talk about the roles of our agencies in relation to the General Election.

The first point I would make is that foreign interference is a growing threat globally and domestically, with potentially wide-ranging impacts on New Zealand’s democratic norms and values, and economic wellbeing.

The scale and aggressive nature of this activity is on the rise around the world and in New Zealand. For example, the recently declassified United States Intelligence Community Assessment on foreign threats to the 2020 US Federal Elections identified a range of foreign government activity aimed at influencing support for candidates, undermining public confidence in the electoral process, and exacerbating socio-political divisions in the US.

While the NZSIS did not observe an overall sustained or coordinated foreign interference campaign conducted by a state actor that changed the outcome of the General Election, New Zealand needs to remain alive to these sorts of risks, which we see playing out in many democracies around the world.

Many states possess the capability to conduct foreign interference activities in New Zealand. We know that certain states work with real perseverance, often over many years, to seek outcomes that are in line with their strategic objectives but run counter to New Zealand’s democratic values and interests. 

Foreign interference vs legitimate foreign influence

All states engage in legitimate foreign influence activity in seeking to shape perceptions and decision making in other countries.  All engage in normal diplomatic activities, open lobbying or persuasion, and we do not have any national security concerns about that. 

What we are concerned about is foreign interference. We use the term “foreign interference” only to describe an act by a foreign state, or its proxy, that is intended to influence, disrupt or subvert a New Zealand national interest by covert, deceptive or threatening means.  

The NZSIS and the GCSB are mindful of the need to ensure that efforts to prevent foreign interference in New Zealand do not hinder democratically protected rights of political expression, or the ability of states to openly engage and negotiate with each other.

International trends, and why they matter to New Zealand

Foreign interference has the potential to impact democracies in many ways. With respect to elections themselves foreign interference internationally has included:

• Circulating disinformation, particularly via social media, that skews the public discussion, sows discord and potentially affects the way the public vote;
• Affecting the election campaign agenda and the discussion of party policies by releasing damaging information hacked from political parties;
• Suppressing or artificially amplifying narratives to suit the interests of foreign states;
• Causing members of ethnic communities to feel less safe, secure and free, thereby impacting their ability to exercise their democratic freedoms.

Some authoritarian states have a strong interest in discrediting democracy itself, because successful democracies provide a beacon of freedom to which their citizens may aspire.  So although a foreign state may prefer a particular outcome in an election, that state may have an even greater interest in making the free contest of political ideas look chaotic, and democratic outcomes untrustworthy. 

The discrediting of democracy itself goes to the very foundation of our values as a country: our respect for human rights such as freedom of speech and freedom of association, and the democratic right of the citizenry to determine the makeup of our Parliament and our government. 

NZSIS and GCSB’s work prior to the 2020 General Election

I turn now to our work to prepare for the last General Election.

New Zealand has a robust electoral system and invests a lot of effort in ensuring the integrity of our voting systems. It would be very difficult to compromise them and thankfully we have not seen any significant efforts to manipulate voting outcomes.

We are never complacent, however. The NZSIS and the GCSB contributed to multi-agency support for the General Election and referendums in a range of ways, including as part of multi-agency effort led by the Electoral Commission.

Our support to the security and integrity of the General Election and referendums included:

• Helping to update the principles and protocols for the GCSB and the NZSIS in managing foreign interference and cyber security threats to the 2020 General Election;
• Producing intelligence assessments of threats to the General Election informed by the global context, information from New Zealand’s international security partners, and domestic intelligence holdings;
• The GCSB’s National Cyber Security Centre working with the Electoral Commission to help protect its core systems and online presence; and
• The NZSIS, along with the GCSB’s National Cyber Security Centre, providing protective security and cyber security advice to political parties and candidates in the lead-up to the election.

Principles and protocols

I’d like to briefly come back to the principles and protocols work I mentioned at the start of that list. 

These protocols, which are available online, were developed by the Department of the Prime Minister and Cabinet in consultation with the NZSIS, the GCSB, the Ministry of Justice and other relevant agencies.  They set out the processes that would guide any response by the GCSB and the NZSIS to a foreign interference or cyber security threat to the election.

The protocols did not alter the roles or obligations of agencies. They emphasise the fact that the agencies are politically neutral, and that the agencies will follow established escalation processes as much as possible.

The protocols helped to establish a threshold for escalating incidents for a broader national security system response, noting that intelligence would need to meet a threshold to require action. For example, it’s unlikely that one foreign actor tweeting about New Zealand politics would justify activation of the national security system.

The protocols also stated that the intelligence and security agencies would generally avoid making any public comment on security threats to the election and that any public disclosure of a foreign interference or cyber threat would first be discussed by the Officials Committee for Domestic and Security Coordination (ODESC).

During the pre-election period, NZSIS and GCSB put in place a specific assessment process to assess intelligence that was relevant to the General Election against the protocol. This was a useful discipline for the agencies and gave assurance to the national security system.

While we saw some limited activity of interest relating to the 2020 General Election, this did not reach the threshold requiring activation of the protocol.   

Vectors for foreign interference in New Zealand’s elections

During the remainder of this session, Bridget and I will outline the main ways in which a foreign state could interfere in New Zealand’s General Election or democracy more broadly. We will link that back to the work we did last year, and the work we do every day, on business as usual basis.

The interference methods we will discuss are:

• Cyber-enabled threats to the General Election;
• Shaping public discourse including through the spread of disinformation;
• The exertion of pressure on communities within New Zealand; and
• Building influence and leverage over elected representatives and political parties, including through donations.

These categories remain the same as those we briefed the Committee on in 2019 and 2020.

I will now handover to Bridget to provide an overview of cyber-enabled threats to New Zealand’s Election.

Acting Director-General of the GCSB

Cyber-enabled threats

Thank you Rebecca.

Cyber-enabled threats to the Election include threats to core electoral systems as well as compromises of the systems of Members of Parliament, candidates and political parties. 

Maintaining the integrity of the electoral process is a vital part of safeguarding New Zealand’s democratic society. Throughout 2020, the GCSB’s National Cyber Security Centre provided cyber security services in support of the delivery of the General Election, to a number of organisations.

The GCSB’s National Cyber Security Centre has worked closely with New Zealand’s overseas security partners on their experiences of elections, and is constantly considering threats and vulnerabilities.

In the lead up to, and during the election period, the GCSB’s National Cyber Security Centre monitored for malicious cyber activity affecting New Zealand’s nationally significant organisations that may have impacted the delivery of the General Election.

Prior to and during the election period, the GCSB’s National Cyber Security Centre did not observe activity suggesting a network compromise or sophisticated malicious cyber activity associated with the General Election, or indications of attempts to alter the results or otherwise disrupt electoral processes.

As the primary agency responsible for delivering the General Election, the Electoral Commission was a potential target for malicious cyber activity. The GCSB’s cyber security support included working directly with the Electoral Commission to provide cyber security advice and assistance to increase its resilience. This included support for incident response planning.

As you know, candidates, Members of Parliament and political parties engage with a wide range of people and organisations. As a result, their networks must be adaptable and open to accept communication from a wide variety of sources. This presents a large “attack surface” for an adversary.

At the time of the General Election, one of the main concerns was candidates and political parties being targeted through cyber operations and potentially information taken would be disclosed with the intent of influencing the outcome of the election.  We did not see any activity like this on behalf of a foreign state – but high profile international examples serve as a reminder of the importance of good cyber and information security practices. 

The GCSB’s National Cyber Security Centre worked in partnership with our NZSIS colleagues to provide protective security briefings to Members of Parliament and all caucuses on cyber and foreign interference threats.  We also provided cyber security advice to political parties through the Electoral Commission.  This was in line with the protocols developed for the agencies on managing these threats in the context of the General Election.

As we have briefed previously, there are practical and immediate steps MPs – and for that matter, members of the public – can do to protect their cyber security and improve their cyber resilience. Strong passwords, updating security patches, limiting administrator access and “white listing” (which is allowing only identified users to access a particular privilege) are all important first lines of defence. Human error remains the most common cyber threat vulnerability. 

These safeguards will help Members of Parliament, and others, to protect against both state and non-state cyber threats.

I will now hand back to Rebecca.

Director-General of Security

Thank you Bridget.

As I mentioned earlier, the NZSIS did not observe an overall sustained or coordinated foreign interference campaign conducted by a state actor that changed the outcome of the General Election.

The threat of foreign interference in New Zealand’s democracy is not, however, limited to the election period or what happens at the ballot box.

Foreign interference efforts in New Zealand are more likely to be directed at influencing political processes and decision making.  Such activities occur over time and operate in a grey zone where specific actions may seem innocuous but cumulatively can create national security risks.

I will now provide some detail regarding specific vectors.

Disinformation

I would like to touch briefly on disinformation campaigns.

Disinformation is false or misleading information that is designed to achieve a strategic purpose.  Misinformation, however, is false or misleading information that is not produced and distributed in pursuit of an underlying strategic purpose.  Our concern is with state-sponsored disinformation.

In the foreign interference context, state actors pursuing their strategic goals through disinformation is an area of growing international concern. While misinformation and disinformation are serious problems generally, there have been a number of high profile publicly reported cases of disinformation relating to democratic processes.  Examples include the 2016 United States Presidential Election and the 2017 French Presidential Election. 

How intelligence and security agencies investigate or respond to disinformation, or “fake news” and social media manipulation is potentially fraught as it could be perceived as interference in political debate, individuals’ freedom of expression or privacy. Issues relating to disinformation are not solely for the intelligence and security agencies or indeed government agencies to solve. 

Our agencies’ roles are therefore limited in this area and conservative. If we were to receive information from security partners, political parties or the public, however, suggesting a state-sponsored disinformation campaign, we would assess it for further investigation.

We assess that New Zealand has not been the direct target of widespread state-backed disinformation campaigns.  But given the nature of global online content, members of the New Zealand public are highly likely to encounter disinformation. This means that disinformation campaigns occurring overseas may affect levels of trust in the media and government here.

Exertion of pressure on communities in New Zealand

Manipulation of communities is also a vector for interference. 

As we stated at our last appearance before the Committee, foreign states engage with their diaspora communities for a range of reasons. This can be facilitated by shared culture, language or familial connections and much of it is completely harmless.

The NZSIS is aware, however, of efforts by some foreign states to covertly monitor or obtain influence over communities in New Zealand. 

Foreign language media is another way through which communities can be influenced or mobilised towards particular issues, including issues relevant to elections. Some foreign governments attempt to shape the information available to speakers of foreign languages in New Zealand – including through foreign language media and technology-enabled censorship. 

I will discuss this vector in more detail in the closed session.

Building influence and leverage over elected representatives and political parties, including through donations

Moving now to the issue of foreign actors building influence and leverage over elected representatives and political parties, including through donations.

Political donations are a legally sanctioned form of participation in New Zealand politics.  The NZSIS only has a legitimate security interest when we learn about a donation in relation to which the foreign origin of the donation is obscured.  This can involve, for example, funds originating overseas, and being channelled through New Zealand citizens and permanent residents acting on behalf of foreign states. They are proxies for the foreign state and we assess that they are aiming to build their leverage and influence with the political party through the donation.

I have already commented on the constraints we face in talking about specific intelligence, but I can say that we have seen activities by state actors and their proxies of this kind that concern us.

In the time since the agencies submitted on the inquiry into the previous General Election, there has been legislative change to address concerns relating to foreign donations, which we acknowledge.  We also acknowledge efforts to raise awareness of some of the risks associated with such donations.  It is, however, important to note that some state actors will look to find weaknesses or “grey areas” to help them to covertly build and project influence.

We have a role in equipping those on the front line of our democracy – Members of Parliament, Ministers, political parties and relevant government agencies – with the ability to identify and protect themselves from foreign interference threats. The NZSIS and the GCSB do this through our outward-facing security functions (the NZSIS’s Protective Security Requirements Team and the GCSB’s National Cyber Security Centre).

An example of this work is the publicly available security advice for Members of Parliament and Locally Elected Representatives regarding espionage and foreign interference threats.  This advice is available on the Protective Security Requirements website.

The NZSIS and the GCSB are available to speak with any Member of Parliament who has concerns about foreign interference in our democracy or elections, or about their own personal protective security practices.

Given the high interest in this issue, we seek the Committee’s permission to publicly release this statement immediately after this hearing.

We are happy to answer your questions.