On 25 May 2023 the Five Eyes intelligence alliance, comprising Australia, Canada, New Zealand, the United Kingdom and the United States, issued a joint Cyber Security Advisory (CSA) warning of alleged hacking by a China-backed group called Volt Typhoon. According to Microsoft, which claims to have uncovered the attack, this group has since mid-2021 ‘targeted critical infrastructure organizations in Guam and elsewhere in the United States’, and is possibly ‘pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises’.
Unfortunately, the irony of ‘the world’s most complete and comprehensive’ intelligence alliance issuing such warnings seems to have been lost on many Western commentators. Not so, however, in China: Foreign Ministry spokesperson Mao Ning called the report ‘a collective disinformation campaign’ orchestrated by the ‘champion of hacking’, i.e., the United States. Australia and New Zealand, in backing the advisory, are implicated in this charge.
The joint CSA articulates concerns that Volt Typhoon can gather information by gaining remote access to servers, with home and small office routers being particularly vulnerable, and blending in with normal network and Windows operations, making its activity difficult to track. However, whistleblower Edward Snowden’s disclosures revealed that the National Security Agency (NSA) has gone much further, to the point of intercepting shipping deliveries to install back-doors on electronics being delivered to NSA targets. These back-doors, according to professor of international and political studies Clinton Fernandes, provide the NSA with ‘potential access to an entire country’s core communication infrastructure’.
Such hypocrisy makes it difficult not to view the joint CSA as a PR exercise, regardless of the veracity of its allegations. This point was implicitly acknowledged in national security correspondent David E. Sanger’s comparison of the advisory with the farcical US response to the purported Chinese spy balloon: ‘unlike the balloon … the computer code could not be shot down on live television. So instead, Microsoft on Wednesday published details of the code’. Supporting this view is the fact that recent multi-state joint CSAs have frequently identified some of the West’s favourite enemies: Russia earlier in May, Iran in February and September last year, and Russia again in April last year.
As members of the Five Eyes alliance, investigative journalist Nicky Hager has explained, Australia and New Zealand support US hacking activity by gathering secret communications information from nearby friendly countries and feeding it into the NSA’s surveillance network. Australia’s area of operations starts at Papua New Guinea and continues up to South-East Asia, including Indonesia, Malaysia and Singapore. New Zealand’s surveillance zone, focusing particularly on military and government targets, is to the east of Australia’s, covering the south-west Pacific: Bougainville, Solomon Islands, Vanuatu, Fiji, Tuvalu, Tonga, Samoa, Niue and French Polynesia.
Part of New Zealand’s surveillance is conducted during aid and training deployments, and navy ships collect intelligence during port calls. These tactics, Hager has shown, are not new. For example, Kiwi Base, which housed New Zealand’s Provincial Reconstruction Team in the Bamiyan province of Afghanistan from 2003 to 2013, contained a CIA base and an NSA intelligence unit. Moreover, the frigate HMNZS Te Kaha, on its way to the 2001 Stardex exercise hosted by Malaysia, tested its surveillance capabilities by intercepting Indonesian communications. It later collected intelligence, including perhaps on nearby countries, in the Persian Gulf, the Strait of Hormuz and the Gulf of Oman in the lead-up to the 2003 invasion of Iraq.
Such activity may also have been conducted using the first of the Royal New Zealand Air Force’s Boeing P-8A Poseidons to arrive, NZ4801. The P-8A, which is also used by the US Navy, the UK Royal Air Force, and the Royal Australian Air Force, is equipped with advanced surveillance technology, including signals intelligence, ‘for exploitation by the joint intelligence community’. In New Zealand, according to the August–October 2022 Defence-led Projects Status Report (acquired under the Official Information Act), the Poseidon is part of the Joint Intelligence Project, which includes the Frigate Systems Upgrade and the Network Enabled Army and has an objective to acquire ‘knowledge mastery of our near region’. NZ4801, according to the website Flight Aware, flew to or near to the Cook Islands, Tonga and Fiji between 17 and 29 May 2023, with the latter two countries included in New Zealand’s aforementioned area of surveillance.
The reason for Australia’s and New Zealand’s intelligence collection, Hager explains, is not that ‘everyone does it’, as the targeted South Pacific countries do not have the same capabilities. Nor is it simply part of the US’s anti-China pivot, although China’s activity in the region will undoubtedly be a focus. Rather, the spying constitutes their ‘long-term duties in an old alliance, and would be happening whatever the official “enemy of the day” was doing’.
The good news is that this situation presents Australia and New Zealand with the opportunity to reduce spying in the Pacific such as that alleged to have occurred in Guam, by choosing not to participate in it. Conversely, while the Five Eyes members continue to do so, their joint warnings about other countries’ spying will ring hollow.
Safe Space for Spying: What remains unsaid by the Signals Directorate
Clinton Fernandes, 10 Sep 2020
In government, neither side of politics has ordered an inquiry into the Iraq War, and the most obvious question is not asked in the NSC’s safe spaces: do Australia’s expeditionary military campaigns raise or lower the threat to domestic security? If you fear the answer, better not ask the question.