New Zealand Intelligence: History, Structure, and the Headlines

New Zealand is a country of about five million people at the far end of the South Pacific, and it has one of the smallest intelligence communities in the democratic world. It is also a full member of the Five Eyes, the signals intelligence partnership it shares with the United States, the United Kingdom, Canada, and Australia. Its agencies have watched an ally’s spies bomb a ship in Auckland harbor, had a listening station broken into by peace activists, been caught spying unlawfully on a famous resident, faulted by a royal commission after the country’s worst terrorist attack, and, in 2025, secured the first spying conviction in New Zealand’s history. Those cases explain a great deal about how small democracies handle large intelligence problems.

This page is a working overview of New Zealand’s intelligence agencies: where they came from, how they are organized today, and the cases that have put them in the news. It relies on official agency and government publications, legislation, oversight reports, court-reported facts, and named reporting, and it notes where a claim comes from a party with an interest in the outcome.

New Zealand intelligence at a glance

• Security service: the New Zealand Security Intelligence Service (NZSIS), which began in 1956 as the New Zealand Security Service and took its current name under a 1969 Act (NZSIS).
• NZSIS head: Director-General of Security Andrew Hampton, appointed for five years from April 17, 2023, after seven years running the GCSB (Public Service Commission, via Scoop).
• Signals intelligence and cyber security: the Government Communications Security Bureau (GCSB), formed in 1977, which includes the National Cyber Security Centre (NCSC) (GCSB).
• GCSB head: Andrew Clark, a former Chief of Air Force, appointed for five years from October 30, 2023 (Public Service Commission; GCSB).
• Assessment: the National Assessments Bureau (NAB), an all-source assessment unit in the National Security Group of the Department of the Prime Minister and Cabinet (DPMC) (DPMC).
• Ministers: Prime Minister Christopher Luxon holds the National Security and Intelligence portfolio (DPMC ministerial list). Chris Penk became Minister Responsible for the NZSIS and the GCSB on April 7, 2026, taking over from Judith Collins, who is leaving politics to head the Law Commission (New Zealand National Party; Prime Minister’s office, via Scoop).
• Oversight: the Inspector-General of Intelligence and Security (IGIS), an independent office that investigates complaints and reviews whether the agencies act lawfully and properly (IGIS), and Parliament’s Intelligence and Security Committee, which receives both the classified and unclassified versions of the agencies’ annual reports (NZSIS).
• Relationship with the United States: close, through the Five Eyes, but not unbroken. After New Zealand turned away a U.S. warship in 1985 over its nuclear-free policy, the United States ended intelligence sharing for a time (Wilson Center).

History: from the police Special Branch to the Five Eyes

Until the mid-1950s, New Zealand had no civilian security service. As the NZSIS puts it, “apart from a brief period during the Second World War, national security had been handled by the Police.” That changed in 1956: “The NZSIS was established in 1956 as the New Zealand Security Service.” For its first 13 years it had no statute at all. “Between 1956 and 1969, we existed without a legislative base,” the service says. The New Zealand Security Intelligence Service Act 1969 gave it its present name and a mandate to protect the country from espionage, sabotage, and subversion; terrorism was added to that mandate in 1977 (NZSIS).

Signals intelligence has a longer pedigree. The GCSB traces its roots to wartime codebreaking and to the 1946 UKUSA Agreement between Britain and the United States: “Over the next 10 years New Zealand, Australia and Canada formally joined the partnership,” which “eventually became known as the Five Eyes.” The modern bureau dates from 1977, when “Prime Minister Robert Muldoon approved the formation of the GCSB.” It sat within the Ministry of Defence until it became a stand-alone agency in 1989 (GCSB). It opened interception stations at Tangimoana, in Manawatū, in 1982, and in Marlborough’s Waihopai valley in 1989 (Te Ara, the Encyclopedia of New Zealand).

The 1980s tested the alliance from both sides. In February 1985, New Zealand refused entry to the destroyer USS Buchanan under its nuclear-free policy. The government’s own history site records that “Washington severed visible intelligence and military ties with New Zealand” and that the United States would no longer guarantee its security, though the ANZUS treaty formally remained (NZHistory, Ministry for Culture and Heritage). Five months later, French agents sank the Rainbow Warrior in Auckland, an attack by a Western ally on New Zealand soil, described below.

The legal framework has been rebuilt twice in this century. The Government Communications Security Bureau Act 2003 took effect on April 1, 2003; after the 2012 Dotcom affair, amendments took effect on September 27, 2013; and the NCSC was created inside the GCSB in September 2011. A 2015–2016 independent review by Sir Michael Cullen and Dame Patsy Reddy recommended clearer and more consistent laws (GCSB). The result was the Intelligence and Security Act 2017, which received Royal Assent on March 28, 2017, and placed both agencies under a single statute (NZSIS). In July 2024, the government’s computer emergency response team, CERT NZ, was folded into the NCSC (NCSC). And in November 2025, Parliament passed the Crimes (Countering Foreign Interference) Amendment Act 2025, which took effect on November 27, 2025, and created new offences for covert, deceptive, coercive, or corrupt conduct on behalf of a foreign power, with penalties of up to 14 years in prison (Ministry of Justice).

How New Zealand intelligence is organized today

New Zealand’s core intelligence community is small enough to list in a few lines, and all of it is governed by the 2017 Act.

• The NZSIS is the domestic security and human intelligence agency. It investigates espionage, foreign interference, and violent extremism, provides security vetting and protective security advice, and since 2023 has published an annual unclassified report on New Zealand’s security threat environment.
• The GCSB collects foreign signals intelligence as part of the Five Eyes and, through the NCSC, is the government’s lead operational cyber security agency. Its Director-General is also the Government Chief Information Security Officer (NCSC).
• The National Assessments Bureau, part of DPMC since 1990 and known as the External Assessments Bureau from 1988 to 2010, writes all-source assessments for ministers. It collects nothing itself, and it says plainly, “we do not provide policy recommendations” (DPMC).
• Oversight runs through the Inspector-General of Intelligence and Security, who can investigate complaints and review operations, and Parliament’s Intelligence and Security Committee.

The system is designed around ministerial control and outside review rather than size. Both collecting agencies answer to a single Minister Responsible, the Prime Minister holds the national security portfolio, and the assessment function sits in the Prime Minister’s own department, so that ministers hear an assessment that is not written by the agencies doing the collecting.

A small Five Eyes partner

New Zealand’s agencies are a fraction of the size of their partners, and the Five Eyes relationship shapes nearly everything they do. Asked before a parliamentary committee in March 2026 about cooperation with those partners, Hampton said, “We cannot ask them to do anything we couldn’t legally do ourselves, and vice versa.” At the same session, as the United States and Israel carried out strikes on Iran, Clark said the GCSB’s team “has been providing round-the-clock threat intelligence updates to our customers” (RNZ).

Since 2023, the NZSIS has also named names in public. Its first unclassified threat report, in August 2023, said that “the most notable case of foreign interference is the continued targeting of the nation’s diverse Chinese communities,” that Iran was “engaged in societal interference by monitoring and reporting on Iranian communities and dissident groups,” and that “Russia’s international disinformation campaigns have not targeted New Zealand specifically” but had influenced some New Zealanders (AP via WSLS). Hampton said at the time that “NZSIS is very clear that those responsible for the foreign interference threat are the states themselves and the people who act on their behalf” (1News). The September 2024 report called China a “complex intelligence concern,” said groups acting for Beijing hid “their true affiliation, direction and funding sources,” and named Russia among the countries seeking more influence in the Pacific (AFP via Arab News, a Saudi-owned outlet). The August 2025 report said China had shown a “willingness and capability” to carry out intelligence activity against New Zealand’s interests, and that it was not the only state of concern, though it declined to name the others (RNZ). The fourth report, in August 2026, described an attempt by China’s Purple Mountain Observatory, which it said has “close links to the Chinese Government,” to install ground-based space infrastructure in New Zealand, and a Russian state-owned organization’s effort to obtain specialized components through a New Zealand company’s overseas subsidiary (IT Brief; NZSIS). That coverage did not include a response from China.

The Pacific is where those warnings meet diplomacy. In March 2025, Hampton said China sought to “create competing regional architectures and expand its influence with Pacific Island countries.” China’s embassy in Wellington called his remarks “totally baseless, all fabrication, and amount to spreading false information,” adding, “For someone holding a hammer, everything looks like a nail” (RNZ). For New Zealand, Pacific security is close to home, and the NZSIS says it now routinely shares intelligence and protective security advice with Pacific partners (NZSIS).

New Zealand intelligence in the news

Most public knowledge of New Zealand’s intelligence agencies comes from seven cases. Several of them led directly to new laws or new oversight, which is the pattern worth watching.

The sinking of the Rainbow Warrior (1985–1987)

On July 10, 1985, two bombs sank the Greenpeace ship Rainbow Warrior in Auckland harbor, killing the crew member Fernando Pereira. New Zealand police arrested two agents of France’s foreign intelligence service, the DGSE, Alain Mafart and Dominique Prieur. On November 4, 1985, they pleaded guilty to manslaughter and willful damage and were sentenced to ten years in prison. In September 1985, France’s defense minister resigned and the DGSE’s director was dismissed (New Zealand Herald), and Prime Minister Laurent Fabius acknowledged that French agents had sunk the ship on orders. Under a UN-assisted agreement, the two agents were moved to France’s Hao atoll for three years, but France brought them home within two years; in 1987 an arbitration tribunal ordered France to pay Greenpeace damages (Greenpeace Australia Pacific, a party to the case). The French side of the story is told on our French intelligence page.

Waihopai and the Ploughshares (2008–2022)

Waihopai, near Blenheim, has drawn protests since before it was built (Te Ara). In 2008, three activists calling themselves the Waihopai Ploughshares broke into the station and slashed one of its two inflatable domes. A jury acquitted them in 2010. The government then sought more than NZ$1.2 million in damages from the three in a civil claim, which the Crown later abandoned (Northland Age, New Zealand Herald). In 2021, the government announced that the domes would be dismantled, though then-minister Andrew Little said, “The facility will remain” (Otago Daily Times). The GCSB says it decided to retire the satellite dishes because “the two dishes represented near-redundant technology” (GCSB).

Kim Dotcom and the Kitteridge report (2012–present)

In 2012, New Zealand police raided the Auckland home of Kim Dotcom, the founder of the file-sharing site Megaupload, in an FBI-ordered operation (Reuters via The Star). It later emerged that the GCSB’s surveillance of Dotcom was unlawful (RNZ); the GCSB itself says that “in September 2012, intelligence collection activity for one investigation was found to be unlawful” (GCSB). A review by the Cabinet Secretary, Rebecca Kitteridge, leaked in April 2013, questioned the legality of 56 GCSB operations involving 88 people between 2003 and 2012 and recommended clearer law (RNZ). Prime Minister John Key, then minister for the GCSB, called the report “pretty damning” and rejected calls to abolish the bureau (NBR). Police decided in August 2013 not to prosecute, saying “it cannot be established that any GCSB staff had the necessary criminal intent” (police letters, via Scoop). Kitteridge later led the NZSIS. Dotcom still faces U.S. criminal copyright charges over Megaupload; his lawyers have argued that responsibility lay with users who chose to pirate material, not the site’s founders (CBS News). On July 1, 2026, the Court of Appeal dismissed his latest challenge to extradition, leaving him one final appeal to the Supreme Court (Reuters via The Star).

The Christchurch mosque attacks and the Royal Commission (2019–2020)

On March 15, 2019, a gunman killed 51 Muslim worshippers at two mosques in Christchurch. The Royal Commission of Inquiry reported on December 8, 2020. It found that the security agencies had been almost exclusively focused on the threat of Islamist terrorism, an “inappropriate concentration of resources,” but also that there was no plausible way the attacker’s plans could have been detected except by chance, and it made no finding that the failings it identified would have stopped the attack. Prime Minister Jacinda Ardern said, “But these were both failings and for that, I apologise,” and the government accepted all 44 recommendations, including a call for a new national intelligence and security agency (Reuters via Dawn). The NZSIS’s then Director-General, Kitteridge, rejected the suggestion that the service had spied on Muslim communities (Newshub via Stuff).

A public warning to a foreign state’s collector (2021–2022)

In mid-2021, the NZSIS took the unusual step of warning a New Zealander it assessed was working for a foreign state and collecting intelligence on people in New Zealand to stop. The person, who has not been named, had appeared as a case study in the NZSIS’s 2020 annual report. In an October 2022 review, the Inspector-General found the operation reasonably well planned but identified gaps in consultation with other agencies, and said, “The Service can issue warnings but has to be careful about when and how it does so” (IGIS). The case showed the limits of the law as it then stood: before the 2025 Act, much foreign interference was not a crime.

APT40 and the Parliamentary Counsel Office (2021–2024)

In March 2024, the government disclosed that the NCSC had attributed a 2021 compromise of the Parliamentary Counsel Office and the Parliamentary Service to “a PRC state-sponsored group known as APT40” (RNZ). Collins, then the minister responsible, said “the use of cyber-enabled espionage operations to interfere with democratic institutions” was unacceptable, and New Zealand raised its concerns with China’s ambassador. China’s foreign ministry rejected the allegations as “typical political manipulation” (AP via KSAT), and its embassy called them “groundless and irresponsible accusations” (RNZ). New Zealand’s announcement followed similar accusations by the United States and the United Kingdom, and in July 2024 the GCSB joined Australia and other partners in a multinational advisory on APT40 (Australian Cyber Security Centre).

The soldier who tried to spy (2019–2026)

A New Zealand Army soldier who had founded a far-right group before the Christchurch attacks was arrested at Linton Military Camp in 2019 after contacting a third party about defecting. An undercover officer posing as a foreign agent then received material from him, including maps of defense bases, his Defence Force password, and phone directories. In August 2025, he pleaded guilty at a court martial to attempted espionage, accessing a computer system dishonestly, and possessing objectionable material, in what RNZ described as the “first spying conviction in the country’s history.” He was dismissed and sentenced to two years’ military detention. In an affidavit he complained, “The investigators were incredibly aggressive towards me” (RNZ; RNZ). After an appeal by the Defence Force, the Court Martial Appeal Court in May 2026 replaced the detention with 15 months in a civilian prison, ruling that “a sentence of imprisonment was required” as a proportionate response. His name remains suppressed pending any further appeal, and the foreign country involved is still secret (Newstalk ZB).

How to read coverage of New Zealand intelligence

New Zealand is easier to research than most countries. Its agencies publish annual reports and threat assessments, IGIS reports are public, ministers answer questions in Parliament, and its courts publish judgments. That openness has limits. The NZSIS threat reports describe cases without naming the people involved, and the 2025 report declined to name every state of concern, so readers should treat them as the agency’s assessment, not as a court finding. Some of the most important facts, such as the country behind the soldier’s case, remain under suppression orders. Chinese denials come from a government with every reason to deny, and some coverage of New Zealand reaches international readers through state-linked or state-owned outlets on every side.

The discipline is the one taught in our guides to trend analysis and cognitive bias: climb toward primary records. For New Zealand, that means the statutes on the New Zealand Legislation website, IGIS reports, NZSIS and GCSB annual reports, royal commission reports, court and court-martial decisions, and DPMC’s ministerial list. For foreign governments lobbying in Washington on Pacific issues, the U.S. Justice Department’s public database of foreign agents registered under the Foreign Agents Registration Act (FARA eFile) is the primary record. When a story rests on a single unnamed official, treat it as a lead, not a finding.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Qatari Intelligence: History, Structure, and the Headlines
• Australian Intelligence: History, Structure, and the Headlines
• Cognitive Bias: A Field Guide for Leaders

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and New Zealand and the Pacific; details are on the services page.