Two years ago, the Royal Commission of Inquiry into a terrorist attack in Christchurch challenged the government to build a conversation with New Zealanders about national security challenges.

An expert discussion on cybersecurity at the University on 24 October was a contribution to that goal. “We need the sorts of conversations that we’re having now,” Tony Lynch, a top national security official, told the audience.

Fellow panellists in the Taumata Rau Conversation, hosted by Vice-Chancellor Professor Dawn Freshwater, were:

• Professor Giovanni Russello, the head of the University’s School of Computer Science
• Lisa Fong, deputy director-general, National Cyber Security Centre
• Amber McEwen, the chief executive officer of Research Education Advanced Network New Zealand, which runs a data network for researchers and educators collaborating across New Zealand and the world.

The background included cyber-attacks which have targeted nationally significant organisations including Parliament and universities. A ransomware assault crippled the Waikato District Health Board in 2021 and last month electronic ticketing for Auckland public transport was similarly taken out of action.

Lynch, the head of the National Security Group in the Department of the Prime Minister and Cabinet, walked the audience through the nation’s first national security strategy Secure Together – Tō Tātou Korowai Manaaki, issued in August by the Ministry of Defence.

Malicious state and non-state actors are a persistent cyber threat to all New Zealanders,

Individuals and private organisations are key in fending off the assaults since the bulk of cybersecurity capability and effort lies outside of the government.

Asked about his biggest concerns, Lynch highlighted the increasing interconnectedness of critical infrastructure, as powerfully demonstrated in Hawke’s Bay during Cyclone Gabrielle when electricity and communications failed after the flooding of a power station, impeding emergency responders and cutting services such as EFTPOS and ATMs.

Critical infrastructure needs more of a “system” approach, sharing information across sectors, he said. Likewise, Fong was focused on vulnerabilities from the intertwining of physical and digital infrastructure and reliance on the global digital supply chain.

In Russello’s view, New Zealand is “not where we should be” on cybersecurity for reasons including a lack of investment, a shortage of cybersecurity specialists, including in academia, and businesses treating digital security as a late-stage add-on.

Burnout of cybersecurity workers was a topic and moderator Tim McCready prompted a discussion about the potential for minimum standards and mandatory reporting.

Issues with critical infrastructure seemed to support a regulatory move in that direction, away from New Zealand’s traditional principles-based approach, according to Lynch. However, Fong cautioned there were no “silver bullets.”

The audience learned from McEwen of issues facing a digital network linking our scientists to the world.

The Research Education Advanced Network New Zealand, which she heads, is a Crown-owned company operating a network which lets researchers collaborate on data-intensive projects and is used by entities including universities and Crown Research Institutes.

In instances such as Russia’s invasion of Ukraine or the Taliban’s grab for power in Afghanistan, should the global community of research and education networks cut off those nations’ scientists and researchers?

“That’s been the big debate for us,” said McEwen. “We’ve come to the point where we keep collaboration going but we pull off research programmes where necessary.”

In Europe, Russian scientists were cut off from the Large Hadron Collider, the world’s most powerful particle accelerator, because research could be weaponised, she said.

Another conversation in McEwen’s world is the balance between security and information flow.

“How far do we lock down New Zealand and stop that free flow of information?” asked McEwen. “You can go too far and then you end up with the Great New Zealand Firewall.”

Taumata Rau Conversations will continue into 2024. The series aims to spark meaningful discussions from multiple perspectives on the major issues confronting Aotearoa New Zealand.

The cybersecurity event was the second in the series, following a discussion of the future of the health workforce.