Quantum computers are rapidly developing and will soon be able to break most common encryption systems in place today, which typically use passwords to protect personal data. Photo: 123rf
Inland Revenue says plans are well underway to protect taxpayer information from the security risk posed by quantum computing's power to break through commonly used encryption systems, such as passwords.
RNZ asked the four biggest banks, government organisations, including Inland Revenue and the regulators, the Reserve Bank of New Zealand, and the Financial Markets Authority, about the steps they were taking to address the emerging security risks, known as Y2Q.
In a written response, IRD said quantum computing was a key development in technology.
"Inland Revenue is closely watching the developments and preparing to take advantage of the possibilities offered by it, as well as protecting the tax and social policy system from the dangers of bad actors using it to cause damage to New Zealand and its economy," it said.
The department said it was in the process of updating its technology and security strategies to include risks to digital assets.
"This refresh will lead to appropriate investments in digital technology and people capability to take advantage of the opportunities and address risks," it said, adding it was working with big tech, tax and security agencies in other jurisdictions as well as NZ government institutions.
It said the following steps were critical at this stage:
- Awareness and education
- Maintain an inventory of sensitive and critical datasets, and of systems using cryptographic technologies
- Strengthening current cryptography
- Monitoring standards development
- Transition planning
- Consulting experts.
Ministry of Business, Innovation and Employment chief information security officer David Harbershon said the cyber security team was keeping abreast of developments, with its business-as-usual approach in line with that outlined in IRD's checklist.
Harbershon said post-quantum cryptography (PQC) standards were still in development and nearing completion, though MBIE did not have a specific timeframe for implementation.
"Cyber security - and ensuring our people have an awareness of how to keep safe online - is key to keeping MBIE's information safe and secure," he said, adding MBIE was unable to release specific information publicly about its cyber security initiatives or capabilities.
The National Cyber Security Centre, the government's lead operational cyber security agency, said it was fully aware of opportunities and the risks posed in a post-quantum world.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
