Fiji’s Weak Cybersecurity Exposed by Chinese Hackers

Suspected Chinese state-linked hackers have exposed serious weaknesses in Fiji’s cybersecurity following reports that they gained access to the computer network of a regional organisation based in Suva.

The latest incident has raised questions about Fiji’s ability to detect cyberattacks, after American authorities identified the suspected breach and alerted the Fijian Government, rather than Fiji’s own cybersecurity systems publicly reporting the threat.

The United States Embassy revealed that hackers linked to China had accessed the organisation’s network for several days between July and August this year.

The incident is the latest in a series of cybersecurity concerns involving Fiji, including the major GovNet cyberattack in April 2021, which disrupted several government online services.

At the centre of the latest scrutiny is Director-General for Digital Government, Cybersecurity and Communications, Tupou Baravilala, who has been involved in Fiji’s digital transformation for almost a decade.

Despite millions of dollars being invested in digital infrastructure, questions remain about whether Fiji has the systems and technical expertise needed to detect and prevent sophisticated cyberattacks.

Baravilala, whose publicly listed academic qualifications are in law, has also overseen the development of several government digital services.

However, many government online services remain clunky, outdated, unnecessarily complicated and difficult to use, raising further questions about the progress made after years of investment.

Duavata News has written to Baravilala seeking answers about Fiji’s cybersecurity capabilities, including why the latest suspected intrusion was brought to public attention by American authorities.

Questions have also been sent to former Attorney-General and Communications Minister Aiyaz Sayed-Khaiyum, who led Fiji’s multimillion-dollar digital transformation programme under the former FijiFirst government.

The programme included a partnership with the Singapore Cooperation Enterprise, which brought in Singaporean technical experts to help modernise government services.

In July 2017, Parliament was told that $6 million had been allocated towards digital government transformation, with Sayed-Khaiyum confirming that Fiji was working with Singapore to develop online government services.

Despite these investments, questions remain about how much taxpayers have spent over the years and whether the country has received value for money.

Communications Minister Ioane Naivalurua has also been asked whether Fiji’s cybersecurity authorities independently detected the latest suspected attack or only became aware of it after being informed by the United States.

On 13 October, the Ministry of Policing and Communications confirmed it was investigating the suspected attack and urged government agencies, NGOs and private organisations to strengthen their cybersecurity systems.

However, the Ministry did not explain whether Fiji’s own systems had detected the intrusion.

China has rejected allegations linking it to the cyberattack.

Duavata News is awaiting responses from Baravilala, Naivalurua and Sayed-Khaiyum and will publish their comments when received.