17 Sep 2020

Zhenhua Data leak may be typical contacts list - tech expert

6:58 am on 17 September 2020

The Zhenhua Data leak is "business as usual" for data collection, a technology commentator says.

Teenage Hacker Girl Attacks Corporate Servers in Dark, Typing on Red Lit Laptop Keyboard. Room is Dark

Photo: 123RF

Details of at least 800 New Zealanders - politicians, judges, business leaders, journalists and even criminals - have been collected by the China-based company, which has been linked to Chinese military and intelligence.

Those named on the list have expressed both concern and indifference about being identified by Zhenhua, but it may not be as sinister as some would think.

Technology commentator Paul Brislen said it sounded little more than "building a dossier on people you might want to talk to or engage with at some point, using publicly available sources".

"If that's the case, I've got to say it's business as usual I would have thought, for all kinds of organisations, not just government spy agencies but pretty much anybody who wants to meet with people and engage with them.

"If you look at the information available about most MPs on their party websites, they usually do have a little bit of a bio - where they went to school, what they studied, and a little bit about their family.

"It's quite common. I was doing it earlier this week - pulling information down from the Beehive website about recent speeches a minister had given, a little bit of a bio about the minister, and comments that they had made in public - for a client. So it's all publicly available."

Brislen said the fact the leak was linked to China - and the Chinese Communist Party - had fuelled much of the attention it's been given.

"I think you probably have to assume that if it's publicly available, that someone is going to have a look at it at and read it at some point, and potentially put it altogether in a dossier about you. And that includes names of family members, ages, previous relationships, all kinds of things - whatever is available online really."

"I don't think a lot people realise just how much data is available about them online even in public searches. Everybody should be out there on a regular basis Googling themselves to see what is written about them. I think you'd be amazed at how often your name pops up."

Paul Brislen

Paul Brislen Photo: Supplied / Paul Brislen

That message was echoed by the Security Intelligence Service (SIS).

Its director Rebecca Kitteridge said the leak was a timely reminder for people to check their security settings and consider the amount of information they share on the internet.

The SIS is reviewing the data leak for any potential risks and security concerns, but Kitteridge said it seemed the information collected had primarily been drawn from the public domain.

New Zealanders on the list react

Pasifika health leader Dr Collin Tukuitonga was unaware he made the list until he was contacted by RNZ yesterday afternoon.

"I'm annoyed to be honest, but then again, not surprised... I have no idea what their intentions are and I'm hoping that it's all honourable and above board, and I'm hoping that our government gets to the bottom of this and what it's about and what the implications are."

SPC Director-General, Colin Tukuitonga.

Pasifika health leader Dr Collin Tukuitonga. Photo: Pacificwomen.org

He didn't know why his name was on the list.

"I do know that I am in the media a lot. I make statements not just around Covid ... policy mainly, technical statements, not political.

"Even before that I've been in the public domain quite a bit. I was the director of public health here... I was chief executive of the Ministry of Pacific Affairs, so inevitably those roles are going to have you in the public eye, but that's really as far as I know."

New Zealand First MP Tracey Martin

New Zealand First MP Tracey Martin. Photo: VNP / Daniela Maoate-Cox

New Zealand First MP Tracey Martin - also on the list - wasn't pleased.

"It's a bit disconcerting. Although... my understanding is that everything that is there about me, it's not hard to find because it's in the public domain. But it's always disconcerting to be on a list when you don't know why."

Martin did not know why she was on the list but suspected her internal affairs portfolio may have positioned her to be a person of interest.

"From that perspective, there may be a level of interest in me more than somebody else... but I'm just one on a list of 800 others."

The attention was to be expected - even if unwanted - but her family and the families of others was an entirely different thing, she said.

"What would be more concerning to me would be if I found out that any of my family members were on there, and that if for some reason my job had made them any more interesting, that would give me greater cause for concern."

She hadn't seen the list and was not sure if indeed any of her family members were on the list.

But peppered through the list were family members of those who have worked - or are working - in the public eye.

They included Prime Minister Jacinda Ardern's mother, father and sister, and the son of former Prime Minister Sir John Key.

Co-leader of the Māori Party, John Tamihere.

John Tamihere. Photo: RNZ

Māori Party co-leader John Tamihere's son and daughter were also on the list, but he was not too worried.

"In this world of Google searches and the like, if you wanted to search anyone in the world you could look it up and keep drilling in and looking at everything from electoral rolls ... to credit ratings in certain jurisdictions."

Get the RNZ app

for ad-free news and current affairs