New Zealand’s Annual China Threat Report: The Three Calculations Behind It

Summary

New Zealand's National Cyber Security Centre (NCSC) released its annual report on 23 September, claiming China is the 'most persistent and capable' state-level cyber threat facing New Zealand. A month earlier, the New Zealand Security Intelligence Service (NZSIS) published a report calling China the only country conducting 'large-scale' espionage in New Zealand. The article argues that New Zealand security agencies' China reports have become a regular product: in 2023 the government released its first National Security Strategy, accompanied by a Defence Policy and Strategy Statement and Future Force Design Principles.

That same year, the NZSIS annual report alleged 'China is a major source of foreign interference. ' The rhetoric has escalated annually: in 2025 China was described as an 'especially assertive and capable actor,' and in 2026 it was directly labelled the 'only country taking large-scale action. ' Meanwhile, in 2025 the government unveiled a multi-billion-dollar Defence Capability Plan aimed at doubling the military budget and fully integrating into US-led military planning against China.

The NZSIS report is seen as providing 'threat justification' for that spending. The article analyses three calculations behind New Zealand's choice of China: China is big enough, targeting China is low-cost, and the US needs New Zealand to take a stance. NCSC data show that in the year to June 2026, New Zealand recorded 369 cyber incidents of potential national security significance, of which 86 were suspected to be linked to state-sponsored actors.

More than three-quarters of incidents were unrelated to 'state actors,' yet the report's core conclusion, media headlines, and parliamentary questions all focused on the word 'China. ' The report mentions 'Salt Typhoon' cyber activity, saying it targeted telecommunications, government, transportation, accommodation, and military infrastructure networks. The attribution is phrased as 'linked to entities in China, including some entities providing cyber-related equipment and services to Chinese intelligence agencies,' rather than 'directly carried out by Chinese intelligence.

' The Chinese Embassy in New Zealand has previously pointed out that the US has been using advanced means to 'frame' other countries for cyberattacks, including 'inserting foreign-language strings, including Chinese, to distort traceback analysis and mislead attribution. ' The article stresses that two-way trade between China and New Zealand totals NZ$42 billion. New Zealand's dairy, meat, and timber sectors are highly dependent on the Chinese market, with exports to China exceeding the combined total to its second and third largest markets.

New Zealand's general election is due in November, and Prime Minister Luxon faces a leadership crisis within his party. Deputy Prime Minister and Foreign Minister Peters, leader of NZ First, has always been vocal on China issues. The timing of the security agencies' China reports objectively provides ammunition for China hawks in the election campaign.

Commentary

The NCSC's latest report listing China as the 'most persistent and capable' state-level cyber threat continues the escalation path of recent years. From the first National Security Strategy in 2023, which labelled China a 'source of foreign interference,' to the 2026 claim that China is the 'only country taking large-scale action,' the security narrative has been ramped up annually, in step with plans to double defence spending. The report's data show that of 369 cyber incidents, only 86 were suspected to be linked to state actors, and the attribution for 'Salt Typhoon' is vaguely worded.

Yet public attention is still directed at China. Behind this selective focus lie three drivers: security agencies' budget needs, coordination pressure from the Five Eyes alliance, and domestic electoral politics. New Zealand's exports to China exceed the combined total to its second and third largest markets, and dairy, meat, and timber are highly dependent on China.

The tension between the security narrative and economic reality is increasingly stark. For New Zealand's small and medium-sized business owners, the potential impact of politicised security reports on the business environment warrants caution. On one hand, if China-New Zealand relations remain strained due to security allegations, trade facilitation, investment screening, and people-to-people exchanges could be affected.

On the other hand, the stability of the Chinese market remains a core concern for New Zealand exporters, especially in advantage sectors such as dairy and meat, where any fluctuation in bilateral relations could affect orders and supply chains. New Zealand businesses should watch whether the government introduces new restrictions on technology exports to China or data security rules, which could raise compliance costs. At the same time, they may consider diversifying market risks, but in the short term it is difficult to find a market of comparable scale to replace China.

If the security agencies' 'threat justification' continues to escalate, the ultimate bill may be borne by exporters and tourism operators who rely on the Chinese market.

Keywords: New Zealand National Cyber Security Centre, China threat report, Five Eyes, New Zealand-China relations, defence spending, Salt Typhoon, New Zealand election, cyberattack attribution, NZ$42 billion, strategic trust

Summary in Chinese | 摘要

新西兰网络安全中心（NCSC）9月23日发布年度报告，声称中国是新西兰面临的“最持久、能力最强”的国家级网络威胁。此前一个月，新西兰安全情报局（NZSIS）刚发布报告称中国是唯一在新西兰开展“大规模”间谍活动的国家。文章指出，新西兰安全机构对华报告正变成定期产品：2023年新西兰政府发布首份《国家安全战略》文件并配套《国防政策和战略声明》《未来部队设计原则》，同年NZSIS年度报告妄称“中国是外国干涉的一大来源”，此后逐年加码，2025年诬称中国为“尤其有进取性和强大实力的行为体”，2026年直接声称中国是“唯一采取大规模行动的国家”。

与此同时，2025年新西兰政府发布数十亿新西兰元的《国防能力计划》，目标将军事预算翻倍并全面融入美国主导的对华军事规划，NZSIS报告被视为为这笔军费提供“威胁论证”。文章分析新西兰选择中国的三笔账：中国足够大、针对中国成本低、美国需要新西兰表态。NCSC报告数据显示，截至2026年6月的一年里，新西兰共记录369起被认为具有潜在国家安全意义的网络事件，其中86起疑似与国家资助的实施者有关，超过四分之三的事件跟“国家行为体”无关，但报告核心结论、媒体标题、国会质询全部集中在“中国”二字上。

报告提到“盐台风”网络活动，称其针对电信、政府、交通、住宿及军事基础设施网络，归因表述为“与中国境内的实体有关，包括一些为中国情报机关提供网络相关设备和服务的实体”，而非“中国情报机关直接实施”。中国驻新西兰使馆此前已指出，美国一直在使用先进手段“栽赃”其他国家发动网络攻击，包括“插入包括中文在内的外语字符串，以扭曲溯源分析并误导归因”。文章强调，中新贸易额达420亿新西兰元，新西兰乳制品、肉类、木材高度依赖中国市场，对华出口占其出口总额比重超过对第二大和第三大市场出口的总和。

新西兰11月即将举行大选，总理拉克森在党内面临领导权危机，副总理兼外长彼得斯领导的优先党在对华议题上一向高调，安全机构此时发布对华报告客观上为大选中的对华强硬派提供弹药。

Commentary in Chinese | 评论

新西兰网络安全中心最新报告将中国列为“最持久、能力最强”的国家级网络威胁，延续了近年来安全机构对华指控的升级路径。从2023年首份《国家安全战略》将中国定性为“外国干涉来源”，到2026年声称中国是“唯一采取大规模行动的国家”，安全叙事逐年加码，与国防开支翻倍计划同步推进。报告数据显示，369起网络事件中仅86起疑似与国家行为体有关，且对“盐台风”的归因措辞模糊，但舆论焦点仍被引向中国。

这种选择性聚焦背后，是安全机构预算需求、五眼联盟协同压力与国内选举政治的三重驱动。新西兰对华出口占其出口总额比重超过第二、三大市场之和，乳制品、肉类、木材高度依赖中国市场，安全叙事与经贸现实之间的张力日益凸显。对于新西兰中小企业主而言，需警惕政治化安全报告对商业环境的潜在影响：一方面，若中新关系因安全指控持续紧张，可能波及贸易便利化、投资审查及人员往来；另一方面，中国市场的稳定性仍是新西兰出口商的核心关切，尤其在乳制品、肉类等优势领域，任何双边关系波动都可能影响订单与供应链。

新西兰企业应关注政府后续是否出台对华技术出口限制或数据安全新规，这些措施可能增加合规成本。同时，可考虑分散市场风险，但短期内难以找到替代中国的同等规模市场。安全机构的“威胁论证”若持续升级，最终账单可能由依赖中国市场的出口商和旅游业者承担。

关键词: 新西兰网络安全中心, 中国威胁报告, 五眼联盟, 中新关系, 国防开支, 盐台风, 新西兰大选, 网络攻击归因, 420亿新西兰元, 战略信任

Source: Times Focus