NZ cyber security Tsars lay down rules for network operators

New Zealand's National Cyber Security Centre and the Government Communications Security Bureau have released guidance for telecommunications operators after the passage of a controversial security law.

New Zealand's two leading communications security agencies have defined the new working environment for network operators in the country.

Guidance (pdf) released recently follows the controversial passage into law of the Telecommunications (Interception Capability and Security) Act (TICSA) last November.

Among other matters, the law established new obligations on network operators to report details of their operations and infrastructure.

The guidance fleshes this out, saying network operators are required to engage with Government Communications Security Bureau (GCSB) through the National Cyber Security Centre (NCSC) about changes to their networks.

"The GCSB will work cooperatively and collaboratively with network operators on how the GCSB and network operators will interact to fulfil each otehr's responsibilities inder TICSA," the guidance says.

The guidance defines the term "network operator" and the process for operators to register as well as their notification requirements. These focus on identifying and addressing risks arising from the "design, build or operation of public telecommunications networks and their interconnection to other networks both domestically and overseas".

Network operators may apply for some employees to be granted "Secret" level security clearances from GCSB to allow risk information to be shared. The guidance suggests those staff should be citizens who have lived in New Zealand for at least 10 years.

Network operators must notify GCSB when changes to their networks are proposed and GCSB may need to be involved ahead of any network infrastructure purchases.

"These requirements are to ensure GCSB has sufficient time to consider proposals and take action if needed," the guidance says.

The guidance does not deal with obligations under part 2 of the Act, which came into effect on 11 May, requiring networks to be open for lawful interception.

New Zealand, along with Canada, the UK, Australia and the USA, is part of the "Five Eyes" signals intelligence alliance of English speaking countries.

Show Comments