25. The nature of the threat is illustrated by case studies in the NCSC’s annual threat report. An example is the compromise of a New Zealand organisation’s network by a state sponsored threat actor which then used the network to mount a cyber attack on a foreign organisation. 26. In its latest quarterly report (July – September 2017), CERT NZ received 390 incident reports – with 43% from businesses and organisations. This involved losses of $1.1 million, with 29% of those people who reported to the CERT experiencing financial loss. 27. Globally, notable examples include the reports of Russian interference in the United States 2016 elections; the theft of 21 million personnel details from the United States Office of Personnel Management (attributed in the media to Chinese espionage) and cybercrime data breaches such as the revelation in October 2017 that 3 billion Yahoo user accounts had been breached in 2013. 28. Accordingly, New Zealand must increase the momentum of its cyber security efforts to manage the cyber security risk and keep pace with this threat trajectory. D an d ns ic at io un m om C g, st in Our international partners have intensified their cyber security efforts. The United Kingdom released an ambitious £1.9 billion Cyber Security Strategy in November 2016, (its third Strategy in seven years), aimed at defending the UK, deterring and disrupting hostile action, developing an innovative cyber industry and talent pipeline, and international action to shape approaches to cyberspace. 30. Australia’s 2016 Strategy is now accompanied by a comprehensive international cyber engagement strategy released in October 2017. The latter emphasises the value of an open, free and secure cyberspace, aims to harness the opportunities of the digital age and is clear about action to deter unacceptable behaviour in cyberspace. 31. Canada is about to announce its new Strategy. s6(a) th e M in is te ro fB ro ad ca 29. se d by Singapore, basing its Strategy on New Zealand’s model, is investing heavily in cyber defences. It is appropriate to examine whether New Zealand is making an appropriate contribution, alongside our partners, to address the cyber security challenge. R el ea 32. ed ia The National Cyber Security Centre (within the Government Communications Security Bureau), which focuses on countering sophisticated cyber threats and protecting New Zealand’s networks of national importance, recorded 396 incidents over the 2016-17 year, including providing hands-on intensive incident response on 31 occasions1. ig ita lM 24. 1 National Cyber Security Centre, “Cyber Threat Report 2016-17”, 22 November 2017: https://www.ncsc.govt.nz/newsroom/2016-17/ 4iz7hypmdw 2018-04-04 16:36:02 Page 5