Police cyber crime capabilities weak, official reports show | #cybercrime | #infosec

Cyber crime is becoming the new front line for police, but official reports show they have weak capability to fight it.

This remains the case five years after the landmark cyber attack on Waikato Hospital, and as a new race is underway to prepare for cyber criminals getting their hands on advanced artificial intelligence (AI) within months.

RNZ can reveal a 2024 assessment by Australian Federal Police (AFP) of cyber crime capabilities here found many weaknesses and gaps.

“NZPol lacks the capability and capacity to undertake high-level cyber-dependant crime investigations,” said the assessment, newly released under the Official Information Act (OIA).

This meant officers were quick to drop cyber investigations or to leave them to “technology enthusiasts amongst the ranks and those few with ‘an interest’ in technology”, it said.

Two years on, the threats have worsened – yet an internal review in April 2026 said police still lacked the tools to tackle what many stakeholders called “the new front line” of crime.

Police told RNZ they have been developing initiatives and exploring what capabilities they need.

When RNZ asked for more details late last week, and an interview, police said this would be an OIA request that takes at least 20 working days to respond to. RNZ’s original request in June took till late September to get a response.

Police’s cyber weaknesses extend way back to before the 2019 mosque terrorist attack, when they lacked proper IT systems for monitoring the internet for extremist talk or plots.

They called in the AFP in late 2023 to look particularly at investigations into cyber crime or that relied on cyber skills.

“Few crimes nowadays do not involve some prominent use of technology,” the AFP inquiry said.

Police did not make the report public, but RNZ came across reference to it in the April 2026 review: “The recent review of police’s cybercrime capability by the Australian Federal Police highlighted gaps in structure, skills, and strategy.

“It found that police lacks a formal cybercrime strategy, clear performance indicators, and sufficient specialist capability to investigate high-level cyber-dependent crime.”

“Police will not keep pace with the volume of traditional crime and expanding digital and borderless crime with their current tools, systems, and data capabilities,” the April report said.

Police as the primary agency for investigating and prosecuting cyber crime face a threat that has been ramping up very quickly and obviously.

“Historically you could avoid dangerous places, but online every user is exposed to risk,” said April’s performance review.

“New Zealanders are already more likely to suffer fraud or cybercrime than interpersonal violence – and this trend will continue to intensify.”

A new threat has just emerged globally with experimental AI models breaking out of testbeds and hacking companies and governments on their own volition. This prompted computer legend Bill Gates to warn the threat of a bio-attack is very real now.

The AFP inquiry report in 2024 said the public expected police to be skilled and knowledgeable in cyber crimes and “prepared to investigate such matters”.

The reality it found was different.

They missed crimes: “The fractured nature of cybercrime reporting in NZ leaves the cybercrime team without knowledge of many incidents and potential referrals.”

They dropped investigations: “Officers look for opportunities to terminate cybercrime matters when certain triggers are reached i.e. need for overseas enquiries, reduced chance of a result.”

They got little training. “Cybercrime elements and general technology concepts are not incorporated into current internal training.”

Overall, “recent exposure of NZPol to cyber-dependant crime investigations is very limited”, the assessment concluded.

NZ police districts usually led cyber investigations but largely did not see it as a priority when they were focused on violent or other high-profile crimes. The 105 reporting system gave reports, even of cyber crime “against the national interest”, a low priority.

The districts “falling behind” turned to rely on the high tech crime group (HTCG). Some of that group’s support was effective but its expertise was “dispersed decentralised”.

This was “not sustainable”.

The AFP report referred to an existing cybercrime team, though one with no key performance measures or target for how it should be set up.

Yet it also stated, “NZPol should strongly consider the primary role of the cybercrime team to be the investigation of a range of cyber-dependant crimes.

“A local cybercrime team dedicated to cyber-dependant crime will need to be in place before any real gains can be made” on international capability.

Internationally, efforts were “ad hoc” and police contributions to investigations offshore were “limited”.

Estimates were that over 70 percent of cybercrime targeting locals originated offshore and the cyber threat was not just personal but society-wide, the April 2026 report said.

“Police need to work closely with these networks to counter the growing threat of foreign interference, where unfriendly states use cybercrime and organised crime to pursue their goals.

“Other jurisdictions are adopting aggressive transnational prevention approaches, including disrupting cybercriminals ‘on their own turf’ through joint operations with foreign law enforcement. Police must follow this path.”

Five years ago, the ransomware attack on Waikato Hospital was widely seen as a lesson and a wakeup call.

Though that attack sparked a three-year, $75 million cyber security uplift programme in health, this did not extend to a cyber crime investigation uplift among police. And cyber is not an outlier. The April report found police investigation skills generally had been declining over time.

But cyber crime threats are on their own fast track.

The National Cyber Security Centre recently warned cyber criminals would have access to advanced AI models with hacking superpowers by early next year.

The reports showed police repeatedly identifying the cyber gaps and suggesting fixes.

The AFP in 2024 made some obvious suggestions – plug the strategy, targets and training gaps – and some more novel ones, like put police bosses through a “specially designed masterclass” in cybercrime investigations, and put a cybercrime officer into Europol or the joint cybercrime centre in Sydney.

This year, a performance improvement plan that accompanied April’s report said, “An initial review of police cybercrime and fraud capability has been completed to establish a baseline of current strengths and gaps.”

Last month police told RNZ they had explored an integrated and phased approach to addressing demand for cyber investigations through development of a future-focused cybercrime operating framework. RNZ asked for the framework but has not received it.

“This work has focused on identifying the capabilities required to strengthen police’s response to cyber-dependent and cyber-enabled offending.”

Wellington police headquarters has now put the uplift work on a two-year track.

Initiatives mostly remain in the planning or start-up phase, or tied to a future capability plan or to a review of the investigations operating model. The overall police tech uplift programme has not been fully funded.

The current performance improvement plan included an increase in specialist training in cyber crime “supported by better technology tools and international partnerships”. This was “under action”, as was a new workforce strategy.

Police were poised in April to set up a 15-strong National Economic Crime Team to coordinate online fraud and digital harm investigations.

At the same time, they were still trying to make clear who was in charge when they worked with other justice, intelligence, defence, and regulatory agencies.

“Police recognises these challenges and has begun laying the foundations for change” said April’s report.

RNZ asked police to detail what the most significant cyber crime capabilities they still needed were, but they have not.