"They worked with a local company that was likely unaware of the equipment’s capability to collect intelligence of military value and would have no idea who was receiving the data," the New Zealand Security Intelligence Service (NZSIS) wrote in its annual threat environment assessment, describing an attempted space-based intelligence collection effort linked to China.
Purple Mountain Observatory and Ground Based Space Infrastructure
The NZSIS singled out a China-based organisation named Purple Mountain Observatory as a case study in the assessment. The document says the organisation has "close links" to Beijing and attempted to install Ground Based Space Infrastructure (GBSI) in New Zealand. The agency states that GBSI can be used "to track satellites and space debris, as well as for collecting a range of other scientific data," but that the same infrastructure is "attractive for foreign states seeking to advance military capabilities and intelligence operations."
The report adds that Chinese laws create a risk that Purple Mountain could be compelled to provide information to the Chinese government, and that NZSIS believes Purple Mountain "would have … willingly passed on" any data it collected. NZSIS also reports that, working with other agencies, it was "able to disrupt this activity," but notes this was not Purple Mountain's first attempt and the organisation "is unlikely to be the last."
NZSIS assessment: China is the only country targeting New Zealand at scale
In the assessment, Director-General of Security Andrew Hampton presented the conclusion that China is the only country currently targeting New Zealand "at scale," based on the activity the agency has observed. The report states: "We have observed increased targeting of professional networking sites and online job platforms for espionage purposes by China’s military intelligence services."
The language in the document frames these actions as systematic: the assessment names specific techniques used to identify and vet potential targets and suggests the scale and persistence of activity informed the agency’s country-by-country judgements.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadOnline recruitment, deception, and the lure of lucrative job offers
NZSIS details a recruitment pattern it attributes to PRC intelligence officers or their affiliates. According to the report, operators "pose as consultants or employees of think tanks, or recruitment firms" and place online job advertisements seeking analysts in "foreign policy, international relations, defence or security." Candidates are vetted "to determine what information they have had access to and whether they would divulge it."
Importantly, the agency says the approach often includes lucrative job offers while encouraging applicants to "keep their government jobs both to keep the information tap running and to open up opportunities to recruit their colleagues." That combination of financial incentive and preservation of official access is presented as an intentional method to sustain and expand information collection.
Domestic violent extremism, encrypted apps, and gaming platforms
Beyond foreign intelligence activity, the NZSIS assessment devotes attention to violent extremism within New Zealand. The agency describes its remit as narrow — "to work out whether someone’s vitriolic and violent online pronouncements have any link to New Zealand" — but says the volume and variety of online content have made that task far harder.
NZSIS warns that encrypted messaging services and online gaming platforms are being used by New Zealand violent extremists to circulate violent material, including "weapon tutorials and objectionable content." The report stresses that algorithms on social platforms can link non-violent content to progressively more extreme material and that extremist actors exploit mainstream platforms to find like-minded individuals or supporters.
What this means for technologists, policymakers, and the public
- Technologists and security teams: Expect heightened scrutiny of any proposed GBSI projects and partnerships with foreign-linked organisations; the NZSIS case study suggests vetting should cover data flows, partner ownership and legal obligations in the partner’s home country.
- Policymakers and regulators: The assessment points to the need to balance a growing space sector — which NZSIS describes as "booming" because of New Zealand's location — with safeguards against dual-use infrastructure that could be repurposed for intelligence collection.
- The public and civil society: The report highlights that online recruitment and encrypted communications are vectors for both foreign espionage and domestic radicalisation, underscoring the difficulty of distinguishing illicit intent from legitimate activity in vast online spaces.
NZSIS’s account links a concrete attempt to install space-tracking infrastructure to broader patterns of online recruitment and cyber activity. The agency says it disrupted the Purple Mountain effort but adds a warning: attempts will likely continue. The assessment leaves a clear question for New Zealand’s leaders and private-sector partners — how to foster a booming space sector while preventing foreign intelligence exploitation of the very assets that make the country attractive for space infrastructure.
