Hon Amy Adams
Minister for Communications
10 December 2015
“Our plan to keep New Zealand Cyber Secure”
Launch of the New Zealand Cyber Security Strategy
Good evening,
You are here because we share a common belief – that cyber security is a critical issue for New Zealand.
I want to start out by saying that the Government is as committed to a secure, resilient and prosperous online New
Zealand as you are.
And I’m here tonight to announce a step-change in the way we combat cyber threats.
It is particularly pleasing to be here in front of such a wide ranging audience, including leaders from the business
sector, key government agencies, and a range of non-government organisations involved in the information technology and
communication area.
Many of you are Connect Smart partners – and I want to make special mention of those Connect Smart partners who are here
and commend you for your ongoing support.
I’ve said it before, but to me it’s a “no brainer” that the government and the private sector need to work together to
improve the country’s cyber security.
We are all in this together.
This is what the Connect Smart partnership is all about.
Launched in 2014, Connect Smart is a rejuvenated government-led cyber security awareness campaign.
But it relies on the Connect Smart partnership to maximise the delivery of cyber security messages to staff, customers,
supply chains and through a variety of channels to as broad an audience as possible.
I want to thank Paul Ash and his dedicated team for all the work in getting the cyber smart message out there.
Our vibrant ICT sector
After the last election, I felt extremely privileged to be reappointed as Communications Minister which includes
responsibility for our cyber policy.
It’s a fascinating portfolio; innovative and complex. Connectivity crosses over all portfolios and nearly every part of
our lives. It’s at the forefront, and a key driver, of transformational change.
But there are some big challenges facing us – both in the way our laws and regulations try to keep up with the rapid
pace of change, and the risks technology poses to our society and economy when used for mischievous or sinister means.
As business and community leaders, you will understand the increasing role that technology plays in New Zealand’s
economic growth and prosperity.
Technology is a significant source of jobs and expanding exports.
The Government’s ICT report, released in May this year, revealed that technology software and services now contribute
1.7 per cent to GDP.
And exports in this sector have more than doubled since 2008. And that’s just the IT sector, every sector of our economy
and our lives is being revolutionised by digital technologies.
90 per cent of households and 96 per cent of businesses in New Zealand have an internet connection.
And Research recently released by the Innovation Partnership suggested that, if businesses made effective use of the
internet, we could add a $34 billion dividend to the economy in productivity and efficiency gains.
We are building better connectivity
This importance to New Zealand’s economic prosperity is why the Government has invested more than $2 billion in building
faster, reliable broadband.
We want to lift the connectivity of virtually every New Zealander.
Internet speeds have already tripled since 2008 – and we are looking at this speed more than doubling again even before
we move into the expansion of our flagship UFB and RBI programmes.
In 2014, the average New Zealand household used more data each month than the entire country did in 1995..
And we have the fastest growth in fibre penetration in the OECD at 272 per cent.
Making the most of the digital economy
This leap ahead in the quality and scope of our connectivity will enable New Zealand to make the most of the
opportunities out there.
We're not rolling out UFB to boost Netflix viewership.
We're investing billions into building new digital infrastructure because we want more New Zealanders to engage online
and seize the benefits of the digital economy.
Among these benefits, connectivity helps businesses save time, increase productivity and extend their reach into
international markets.
The National-led Government has a strong and proud record of opening new markets and expanding the reach of New Zealand
goods and services.
The digital space is our next big marketplace.
And it's bigger than the economies of the US or China, and even the Trans-Pacific Partnership.
The digital marketplace is one of endless possibilities.
Connectivity removes the tyranny of distance and places New Zealand farmers, producers and businesses at the heart of
some of the world biggest, richest and hungriest markets.
It allows us to connect to smartphones in China and Brazil and to consumers in South Africa and the Middle-East.
Korean stores can buy New Zealand-made clothes and Americans are able to download the latest Kiwi-created content.
We want New Zealanders to be able to take full advantage of the opportunities the digital economy brings.
But like all marketplaces, there are risks.
The need for cyber security
Our increasing connectedness to the world – while rich with benefits and opportunities – has a dark side.
It provides new opportunities for those with criminal or hostile intentions.
Vicious, anonymous attacks can spring from anywhere and disrupt, shut down or even destroy your business. And all from
the other side of the world.
Due to increased connectivity, our geographical isolation – which once protected us – is no long a barrier and we find
ourselves exposed to attacks from anywhere around the globe.
Malicious cyber actions can be perpetrated from anywhere.
This week the GCSB revealed that there were 190 significant incidents the 12 months to June 2015. Of these, 114 targeted
government networks and systems and 56 targeted the private sector.
A recent Norton report noted that almost $257 million was lost to cybercrime in the past year, affecting around 856,000
New Zealanders although the full cost is almost impossible to quantify.
PwC Research revealed that 56 per cent of New Zealand businesses experience an IT security attack at least once a year.
Grant Thornton found that only 50 per cent of New Zealand businesses have a person specifically tasked with cyber
security and 62 per cent of businesses did not have an IT privacy and security strategy in place.
Connect Smart research shows that New Zealanders are increasingly being affected by cyber incidents – but worryingly,
are not changing their behaviour as a result.
These figures are just the tip of the iceberg.
It’s difficult to maintain a comprehensive defence against the diverse and evolving tactics and techniques of malicious
cyber actors. They just need to find one weak spot in the system and exploit it.
But cyber security is not just about protecting us from Nigerian email scammers.
Reports of hackers stealing personal details from Ashley Maddison in a way trivialises the issue. It's more than
revealing embarrassing affairs or spamming our inboxes with offensive material – as damaging or personally humiliating
as these can be.
Cyber attacks can and do damage our economy.
One attack could wipe hundreds of millions from the NZX in a single action or steal commercially-sensitive IP directly
from a laptop.
As a Government, growing the New Zealand economy is our number one priority.
Right across the cabinet we’re working hard to create the right environment and incentives to grow jobs and incomes.
But while we’re building a stronger economy, it’s essential that we protect our $231 billion GDP against cyber-attacks
and intrusions.
From the boardroom to the front desk, we need businesses to be cyber-savvy.
We can’t afford to be complacent or naïve about how the world now works.
New Zealanders must be awake to the massive economic harm a potential cyber intrusion can cause.
Take, for example, our ports which are largely fully automated. A hostile attack against their systems could shut down
port operations – putting people out of work and causing millions of damage in lost productivity.
Consider the economic blow for farmers and our rural economies of an anonymous cyber hacker disrupting one of New
Zealand’s milk processing plants and spoiling millions of litres of milk.
Or the devastating impact of a cyber attack wreaking havoc with our electricity network, or wiping billions off our
stock exchange through stealing and publicising high-value intellectual property from key companies.
These are all hypotheticals but the potential impacts are sobering.
These industries are critical to New Zealand’s economic success.
Cyber security goes further than just updating your software & changing your password regularly.
As the saying goes: “Prevention is the best medicine”.
Protecting our companies and businesses that operate online and in the digital marketplace is far better than picking up
the pieces.
My message to boardrooms throughout New Zealand is to consider your cyber vulnerabilities as a key business risk and
have a conversation about how you’re going to address them as part of your risk management processes.
Strong cyber security practices will enable businesses to be productive, profitable and competitive. It’s also important
for the country’s international reputation as a safe place to do business and store data.
How Government is protecting New Zealanders
For our part, the Government is well aware of these risks and the need to protect businesses and New Zealanders.
We also acknowledge that cyber security needs are different in some parts of the economy than for others, and therefore
require different responses.
At the highest levels, for certain organisations of national significance who may, for example, operate critical
national infrastructure or hold high-value information, the Government Communications Security Bureau helps to counter
sophisticated cyber threats through Project Cortex.
This initiative, in partnership with organisations that agree to participate, has a significant focus on countering
foreign-sourced malware that is particularly advanced and not adequately mitigated by commercially available tools.
But mindful of the fact that it is not just the large or significant businesses that could benefit for the specialist
cyber knowledge of GCSB, we are investigating through a pilot project where and how these kinds of advanced protections
could be extended on a voluntary basis to a wider range of businesses through their ISPs.
In addition, the National Cyber Policy Office, through its consumer-facing Connect Smart brand, is tasked with spreading
awareness and practical solutions to being smart online to New Zealanders and small businesses.
We’re helping NGOs like Netsafe provide useful advice about keeping kids safe online and the NZ Police continue to be
the strong arm of the law for dealing with cyber criminals.
Ultimately, it’s up to individuals, businesses, organisations and government agencies to take responsibility for their
online security.
But the Government has an important part to play and we’re committed to doing our bit.
In 2011, we launched New Zealand’s first ever Cyber Security Strategy.
It was a good start and provided a solid foundation to build upon.
But there is more work to be done.
Since 2011, both our reliance on networked technology and the complexity and sophistication of cyber threats have grown.
There is a growing range of sinister actors, cyber harms and targets, and a number of public and private sector
organisations involved in response.
At the moment though it isn’t always clear who does what or where to go when you face an issue. There are considerable
overlaps and gaps.
What is clear is that we need a joined up response.
As I said at the outset, the private and public sectors must find ways to share information and expertise if we are
going to properly address cyber security risks.
A strategy to build cyber resilience
And it’s a public-private partnership that is at the heart of the Government’s refreshed Cyber Security Strategy.
Today I’m unveiling that new strategy, along with an Action Plan and a National Cybercrime Plan.
Guided by four principles, the new Cyber Security Strategy sets out a clear high level framework for the government and
private sector to work hand-in-hand to improve New Zealand’s cyber security.
It’s accompanied by an Action Plan which details the specific steps to be taken and pulls together existing and new
initiatives. It will provide a means to measure progress.
Given that technology and threats are constantly evolving, the Action Plan will not be set in concrete.
It will be reviewed annually in close collaboration with Connect Smart partners and others.
Establishing a CERT
What I hope is clear from all this is that there is no silver bullet for cyber security and it’s not a technical issue
that the IT department can be left to fix.
We need a variety of tools in our tool box.
A key initiative in this area is the Government’s intention to establish a national CERT.
This new institution will endeavour to deal with the complexity of the cyber landscape.
Government agencies and businesses need to have timely, actionable cyber security information and advice and be able to
deal with a trusted agency when they have a cyber security incident.
A national CERT will act as a single front door for New Zealanders.
It will be the place where everyone can report cyber incidents, including small and medium size businesses.
As a result we will be able to build a better picture of the cyber security threat facing New Zealand.
The CERT will also provide trusted advice about current cyber threats so that people and organisations can take action
to avert incidents.
A threat analysis tool will gather information about threat patterns and techniques to help New Zealanders and
organisations handle cyber threats.
The national CERT will be solely dedicated to cyber security – it will be the central component of New Zealand’s cyber
security architecture.
Cyber security is about partnerships and so over the coming months we want to work with you to determine how best to
structure the CERT to ensure the right blend of public and private collaboration.
Building Cyber Capability
In addition to ensuring we have the right tools in place, we also need to build cyber capability to make sure that New
Zealanders, businesses and organisations at all levels have the knowledge and skills to protect themselves online.
We must grow our cyber security expertise and digital literacy at all levels if we are going to make it harder for
malicious cyber actors to steal data, commit fraud or do other damage to our information systems.
Connect Smart will continue to be an on-going cyber security awareness and capability campaign.
In particular, I have highlighted the need to ensure that small businesses have the capability to secure their
information systems – not least because of the contribution they collectively make to the New Zealand economy.
In addition to the existing Connect Smart SME toolkit, a new online questionnaire has been launched today.
It will assist businesses to understand some basic steps that could make a big difference to the security of the
information that is critical to their commercial success.
This is a first step towards the development of a “cyber credentials” scheme.
The scheme will provide a “cyber security tick” to businesses with good cyber security practices – in a similar way to
schemes that acknowledge, for example, healthy food choices or energy efficient appliances.
We’ll be announcing more details on this in the New Year.
Addressing Cybercrime
Finally, we’re also launching a new National Plan to Address Cybercrime.
A recent report put the annual cost of cybercrime to the global economy at more than NZ$600 billion.
The internet provides a new tool for criminals.
This technology can be used to commit offences such as theft, fraud, the spread of offensive material, and the
intimidation of people.
It can also be used to inflict damage or disrupt computer systems and services.
Addressing cybercrime involves lifting the government’s capability, particularly that of the Police, to deal with
cybercrime.
Our new interagency plan focuses on prevention through building awareness and helping Kiwis and businesses to protect
themselves, while also building the capability of Police and other agencies to deal with crimes committed online.
We will also take a look at our legislative settings with a view of checking whether they are fit for the new challenges
posed by the digital age and a global internet.
Hosting New Zealand’s first Cyber Security Summit
All of this, taken as a whole package, demonstrates our commitment to improving New Zealand’s cyber security,
recognising that this will be an ongoing journey.
Our vision is for a New Zealand that is secure, resilient and prosperous online.
To that end, I am inviting you all to New Zealand’s first ever Cyber Security Summit next year.
At the Summit in Auckland in the first half of 2016, I hope to be joined by business leaders from across New Zealand
where we will continue our consideration and conversation towards a cyber secure New Zealand.
While I will host the summit, spearheaded by Connect Smart, I intend it to be a tangible example of collaboration
between the public and private sectors.
Closing remarks
Thank you for being part of the launch tonight. I look forward to working with you all further toward making New Zealand
a prosperous and secure economy.