A quantum computer being built by the start-up IQM, in a data centre in Germany. Shown on 5 December, 2024. Photo: AFP/ DPA - Sven Hoppe
New Zealand's financial institutions are working to address cybersecurity threats posed by quantum computing.
Quantum computers were developing at speed, with an ability to break common encryption systems in place today - which typically used passwords to protect digital assets, such as data, but also critical infrastructure, like the power grid.
- What you need to know: Y2Q and quantum computing
The National Cyber Security Centre (NCSC), the government's lead operational cybersecurity agency, and said it was fully aware of the opportunities and risks posed in a post-quantum world.
"In terms of cyber security, quantum computing could lead to criminals and other actors having the ability to compromise cryptographic systems currently used to keep information secure," an NCSC spokesperson said, adding the agency was monitoring developments and sharing information with international partners.
New Zealand's largest bank ANZ said it was conscious of the opportunities posed by quantum computing as well as the evolving risks posed to traditional cryptography.
"While there is currently no evidence of immediate threat, we are implementing a post-quantum encryption (PQE) programme to stay ahead of potential risks," ANZ Bank said in a written response to RNZ's questions.
"This will include developing a preparedness and implementation plan in line with industry best practices, as well as collaborating with regulators and government cybersecurity agencies on both sides of the Tasman
"ANZ Banking Group continues to invest millions of dollars in cybersecurity every year and will continue to manage emerging threats and the adoption of technologies," it said.
"We are committed to informing our clients and customers about the risks to any services or offerings from ANZ that use public/private key cryptography systems, such as RSA."
RSA was a commonly used encryption system introduced nearly 50 years ago in 1977, which quantum computing will eventually be able to break anytime between now and 2031.
ANZ said it was aware of potential threats and was continuing to provide secure financial services in line with industry best practice and regulatory scrutiny.
The other big banks were less forthcoming about how they were managing risks.
ASB said it could not be specific as the information was commercially sensitive.
"We have systems in place to help mitigate cyber security threats, and we regularly review and improve these systems to ensure we are doing all we can to protect our customers," ASB said.
"In the last financial year, we invested around $100 million in people, technology and awareness initiatives to protect Kiwis against fraud, scams, cyber and financial crime and we expect to spend more than this in the year ahead."
Westpac NZ said it was also investing to stay ahead of cyber criminals and also shared information with the NCSC and other organisations to help keep each other up-to-date on current risks.
"We are aware of threats to existing cryptography, and we have plans and actions in place to manage those threats, however we cannot discuss the details for operational reasons," a Westpac spokesperson said.
BNZ said it was also aware of the emerging technologies and was worked closely with partners to protect customers.
Regulators monitoring risks
The Reserve Bank and the Financial Markets Authority said they were working with financial industry organisations and businesses to ensure they were keeping up with increasing risks to the security of digital assets.
"We are ensuring we have a complete inventory of all cryptographic assets and administrative coverage for certificate and key management so that we are 'crypto agile'," the Reserve Bank said in a written response.
"Our intent is to be ready and able to quickly migrate to post-quantum cryptography (PQC) as this becomes available."
Photo: RNZ / Alexander Robertson
The central bank said it was working with suppliers, the financial industry and other regulators in New Zealand and around the world to address the risks.
"We are engaging with suppliers to understand their plan and road map to implement PQC so that we're able to respond to these changes as needed."
The Financial Markets Authority said it was aware of several emerging technologies, including quantum computing, and the risks and opportunities they posed to the financial sector.
"The FMA's external providers are responsible for ensuring the risks associated with quantum computing and cryptology are sufficiently mitigated and we have ongoing conversations with our providers about this."
However, recent academic research indicates New Zealand's overall cybersecurity maturity level was considered to be low and behind the world's leading economies in protecting sensitive data and digital assets.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
