Want to put a bounty on the head of a cyber criminal? Now you can

A new international programme has put a $40,000 bounty on a group of hackers that attacked the health system in New Zealand last year.It is the first bounty issued under Crime Stoppers International's scheme to help police crack down.Glenn Maiden, who helped set it up, says the first target is a prolific group Inc Ransomware - if the criminals in it are prosecuted, the bounty can be paid to the informant."In the case of Inc Ransomware, they will get US$22,000 (NZ$37,000)," Maiden told RNZ."The bounty isn't limited to that US$22,000. So if you've got more or less than that you want to post a bounty, we'll absolutely look at it."Inc Ransom has been hacking in Australasia and the Pacific, and last year raided data from a Wellington medical centre. The national cyber watchdog warned against the group.Immediate warningHackers have grabbed worldwide attention this week by going after the FBI and after a break-in on Australian government agencies by an OpenAI swarm on its own volition.The extortion group 'ShinyHunters' claimed to have breached the Federal Bureau of Investigation and stolen data on a huge number of its employees. ShinyHunters was named by Maiden as a group they wanted to go after.In Australia advanced models broke out of OpenAI testbeds to get into health, justice and other government sites off their own bat, in what some researchers say is the first autonomous hack of government sites.But OpenAI did not tell the government for weeks, and it is reported to be looking at legal options to punish OpenAI.The NZ Government initially said only it was well aware of the issues of frontier or advanced AI and the National Cyber Security Centre (NCSC) was working on it.Digitising Minister Paul Goldsmith.RNZ / Samuel RillstoneWhen asked again by RNZ if he had considered what the Australia attack meant for New Zealand and if he would approach the big AI developers, Digitising Minister Paul Goldsmith said, "NCSC is in contact with its Australian counterparts about the Open AI incident."The NCSC is in contact with frontier AI companies and will be seeking assurance that any incidents affecting New Zealand government agencies are immediately reported to the affected agency and to the NCSC."How bounties workMaiden said the CyberCrime Bounty Programme could take the offer of a bounty from anyone - after some vetting - not necessarily a hacking victim but, say, from someone wanting to do a bit of good, as is the case with the Inc Ransom offer.The programme then received anonymous tipoffs to identify the cyber criminals personally, and if they are prosecuted it paid out the tipster.A company supporting it, Fortinet - Maiden is chief security officer for Fortinet Australia - pulled the tips together and assessed them before they go to police.The scheme had echoes of FBI 'Most Wanted' posters but went further so that the likes of New Zealand organisations targeted by hackers had a means to support bounties to hit back, Maiden said."It raises some interesting questions for New Zealand," said Crime Stoppers."International ransomware groups can operate across borders and jurisdictions that local authorities cannot easily follow - will this kind of public-private model help close those gaps?"Prosecuting criminals in some countries might prove tough, said Maiden.But it was already working with Europol and Interpol against non-cyber criminal groups in eastern Europe, so had experience."So it's not always a failure but it definitely is difficult."As to the OpenAI Australia hack, RNZ asked the NCSC and Health NZ if they knew of similar incidents here. The NCSC did not say.Goldsmith said the Government was already working with a number of partners and companies on the application of advanced AI tools, and was "actively strengthening our defences".Health NZ said it was not aware of any instances of autonomous AI agents or AI companies gaining unauthorised access to Health NZ systems."Artificial intelligence is a rapidly evolving area, and we continually review our cyber security posture and defences to ensure they remain appropriate to the changing threat environment."Health New Zealand has not had any engagement with OpenAI regarding the matters raised. More broadly, we work closely with our cyber security partners and relevant government agencies to monitor emerging cyber security risks and respond to threats as they evolve."