Cabinet papers released yesterday show the government rejected the State Services Commission (SSC) as home for its newly created "cyber-threats" unit partly because it was perceived as "bureaucratic".
The new Centre for Critical Infrastructure Protection (CCIP) is to be run out of the Government Communications Security Bureau (GCSB).
In the GCSB Bill, currently before parliament, no mention of the CCIP is made. However, the GCSB will be responsible for CCIP and cabinet papers show the SSC was rejected as a possible host for being "perceived as bureaucratic" and "not currently an operational organisation".
Questions were also raised about security issues surrounding the handling of classified material and in the end it was agreed that GCSB was the logical host for the CCIP.
"The CCIP function is closely aligned to the GCSB's Information Systems Security role,” says the paper, but doesn't explain what the information systems security role is.
The paper also claims Canada, the UK and the US all have established their own versions of the CCIP and Australia is planning to do so. However while the US centre is part of the FBI, which could be considered an intelligence gathering agency, neither Canada nor the UK has placed their "cyber-threat" centres in their "foreign signals intelligence" departments.
The paper cites a number of alleged security issues that have arisen in the last few months as rationale for the CCIP's existence.
"Since early this year a major New Zealand infrastructure company has been under sustained attack over the internet, degrading service on the internet in New Zealand." The paper doesn't say which provider this is.
It also points to the "US and Chinese hackers engaged in a 'cyber-war' defacing numerous government and business websites in China and the US". However, it fails to note that many observers, including Wired magazine in the US, think the war didn't take place to the extent that was later reported and may have been started by a report in Wired in the first place.
Despite costing over $250,000 to establish and $847,000 a year to run, the government is not talking about the new centre.
"They're not really talking about it. Because it's going to be in the GCSB they decided to announce it but not go on and on about it," says Moerangi Vercoe, press secretary to state services minister Trevor Mallard.
When asked why the CCIP will be located inside an organisation that has "no formal terms of reference" and was established to gather signals intelligence on foreign organisations, Vercoe replied: "where else would it go?"
The GCSB has no statutory authority in New Zealand. The introduction to the GCSB Bill says the absence of any definition of the GCSB's foreign intelligence functions has led to criticism. It is hoped however, that the adoption of legislation covering the bureau will put the position of the agency "beyond doubt as a legitimate agency of government" by making it clear the GCSB is "focussed on foreign intelligence needs".