While New Zealand has its own National Cyber Security Centre, the UK National Cyber Security Centre is also a valuable source of information about the global threat landscape. The UK NCSC has just published its annual review, which provides insights that New Zealand organisations should take into account when making decisions that relate to their organisations’ resilience, and their governance of privacy and technology.

Nation-state threats are no longer ‘extraordinary’

Because of the Ukraine war, the threat landscape from the UK is dominated by Russia, with China a rising problem with activity that ‘has become ever more sophisticated’. In New Zealand, the relative risks may be the other way around. Even in the UK, the NCSC evaluates that ‘China’s technical evolution is likely to be the single biggest factor affecting the UK’s cyber security in the future’.

The UK NCSC notes that nation-state threats include information theft of both intellectual property for commercial reasons, and also theft of citizens’ personal information. Attacks on democratic institutions, such as electoral agencies, are also a concern.

The international political climate is unpredictable, and the threat level from nation-state actors may change rapidly. Organisations must maintain robust cyber defences in case the risk becomes even more acute. In 2021, the New Zealand Government noted that 30% of cyber-attacks could be linked to state-sponsored actors.

Ransomware

Ransomware is a pervasive and growing threat. In the year ending 31 August 2022, the UK NCSC co-ordinated the response to 63 ‘nationally significant’ ransomware incidents. 

The NCSC reports that the UK’s new Information Commissioner, our own former Privacy Commissioner John Edwards, joined with the UK NCSC’s CEO in providing a ‘don’t pay ransoms’ message to the UK Law Society and Bar Council.

In New Zealand, official government policy is not to pay ransoms, and private organisations are ‘strongly encouraged’ not to pay – although there is no express statutory prohibition on doing so. Unless and until there is, our view is that when faced with a ransomware demand, New Zealand directors must make a case-by-case decision as to what is in the best interests of the company – taking into account also the risk that payment of a ransom may implicate other legal obligations (such as prohibitions on the financing of terrorism).

See our earlier article here for further commentary on the issues raised by ransomware.

What actions should you take?

New Zealand organisations should:

• Ensure that nation-state attacks are not considered ‘extraordinary events’ under your IT contracts and insurance policies. While public attribution is rare, and may not be conclusive in a contractual setting, our view is that such attacks should now be seen as ‘business as usual’ risks not ‘extraordinary events’.
• Review IT contracts and insurance policies to ensure that responsibility for the costs associated with ransomware are clearly addressed. 
• Ensure your organisation has clear policies, and if possible a ‘play book’, for a ransomware attack. If you find yourself in a situation where the most cost-effective solution is to pay a ransom, but your organisation’s policy prevents that, consider whether your contracts and insurance policies will still recognise that you have mitigated your losses appropriately.
• Audit against industry best practice. Active cyber defence is an important part of information governance, and is likely to be captured within traditional definitions of industry best practice. However, organisations often need to externally audit their suppliers against industry best practice to incentivise change. As a first step, engage with your suppliers and ask them to demonstrate that their cyber defence stance meets current industry best practice.

Start a conversation

Talk to the experts. Our privacy and cybersecurity law specialists, Campbell Featherstone, Hayley Miller, Hayden Wilson and their team are on hand to assist. They have extensive experience advising on technology law and privacy issues for both government and private sector clients, and advise on all aspects of cyber incident mitigation and response.

This article was written by Peter Kelly, a solicitor in our commercial, technology, and privacy team.