by Alex Stewart

For an increasing share of rural New Zealand, one foreign company now carries the broadband, the cellular backhaul, the school connection, the emergency hub, and the mobile service. The New Zealand Defence Force examined what depending on that company meant for itself and tightly bound its use accordingly. Nobody asked the equivalent question for civilian critical infrastructure or any of the systems that rely on it. The Minister holds the advice on what to do. He has refused to release it.

A platform, not a service

Most commentary and reporting of Starlink has treated it as a product. In the communities where copper is gone or going, where fibre was never going to arrive, and where the local wireless provider has exited, that framing is incomplete. Starlink is no longer one option among several. It is the medium on which the rest of the infrastructure runs.

At least 40 rural schools were connected through the Network for Learning programme using Starlink services as of 2023[1][2]. Many of those schools also double as community civil defence emergency hubs[3]^*. Some of the rural cell towers operated through the Rural Connectivity Group are backhauled over Starlink[4].

Spark uses Starlink for emergency cell-tower backhaul[5]. Farms, milk processors, and rural health services increasingly depend on the same connection. The National Emergency Management Agency (NEMA) has confirmed in writing that Starlink was deployed during Cyclone Gabrielle and the broader 2023 cyclone response[6].

Follow the chain in a community where copper is retired, fibre was never built, and the local operator has closed. The homes are on Starlink. The cell tower that serves those homes may also be on Starlink. The school, which doubles as the emergency hub, is on Starlink. And from December 2024 onwards, the mobile coverage that fills the gaps where there is no terrestrial cellular service runs through Starlink as well.

That last layer matters because it changes the scale.

On 18 December 2024, as many will remember, One NZ launched the world’s first nationwide Starlink Direct-to-Cell service[7]. Over 700,000 One NZ customers are eligible. The service covers approximately 40 per cent of New Zealand’s landmass that has no conventional mobile coverage[8]. On 1 April 2026, Spark launched its satellite-to-mobile service on the same Starlink platform, becoming the second New Zealand carrier to route Direct-to-Cell traffic through SpaceX[9][10]. 2degrees has partnered with a different satellite operator, AST SpaceMobile, and is building a ground station at Marton[11][12]. All three carriers have moved to satellite Direct-to-Cell as the primary mechanism to fill rural mobile coverage gaps. Two of the three route through Starlink.

Separately, between 2022 and 2023, all three mobile carriers divested their passive tower assets. One NZ to Fortysouth[13]. Spark and 2degrees to Connexa[14][15]. The carriers no longer own the towers they transmit from.

That set of dependencies and handover of control has compounded in parallel through commercial decisions made one at a time. No single agency was asked to consider what it would mean once they were stacked.

What SpaceX and One NZ told Parliament

While that consolidation has been unfolding, the public has not had to imagine what regulatory environment Starlink would prefer to operate inside. They wrote it down.

In its January 2026 submission to the Economic, Science and Innovation Committee on the Telecommunications Amendment Bill, Starlink stated, in its own words, that “the light touch approach to regulation of telecommunications in New Zealand has had a range of positive outcomes for the industry and consumers. It has eased the way for Starlink to enter the market and offer significant benefits to New Zealanders across the country. Any change to this approach should be avoided unless there is a clear and demonstrated justification for doing so[16].”

That is the position from which the company is engaging with New Zealand’s parliamentary process. Less scrutiny. A higher bar before any regulatory change. On the basis that the existing settings are working. The submission was filed against the backdrop of everything documented in Parts 1 and 2 of this series, and everything that follows.

One NZ, the country’s largest mobile carrier, and the same company that partnered with Starlink to deliver Direct-to-Cell, lodged a submission on the same Bill. Its position was different. One NZ described the Bill as “a missed opportunity to undertake a more comprehensive and strategic review of the Act,” noting that the telecommunications sector was “undergoing significant and ongoing transformation, driven by changes in technology, consumer expectations, market structures and regulatory practice[17].”

Two views from inside the industry, lodged with the same committee in the same week. One asks for less scrutiny. The other claims the work needed has not been done.

What the Defence Force did for itself

While the regulatory machinery has not been examining what the consolidated dependency means for civilian New Zealand, one part of the state examined what the platform meant for itself.

The Defence Technology Agency (now called the Defence Science and Technology (DST) unit) within the New Zealand Defence Force (NZDF) assessed Starlink in April 2023. The document was released later under the Official Information Act and reported on by Newsroom. It covered performance, configuration, and security vulnerabilities. The security vulnerabilities section was withheld in full under the OIA’s national security provisions. The unredacted conclusion in the Defence Force’s own words was that Starlink was ‘unlikely to be used as a Primary or Contingency solution.’ The original briefing recommended its use be ‘restricted to humanitarian aid and disaster relief’, and prohibited from handling classified information. Seven classified intelligence products related to satellite megaconstellations were withheld in full alongside that conclusion[18].

Two years later, that boundary was tested in practice. The Navy was procuring Starlink terminals for two new Bluebottle uncrewed surface vessels, the drone boats used for maritime patrol. The vessels themselves had already completed a seven-month trial period in 2024. Despite that, the question of whether Starlink was the appropriate connectivity platform for them was not formally raised until two weeks before the Defence Minister was due to announce the procurement. The Defence Force’s Director of Information Assurance flagged “issues with the approach and assumption” eight minutes after the project reached his desk. A Colonel with a cybersecurity background separately escalated the same concern under his own initiative two days later. Five weeks of urgent senior-level review followed, with multi-page emails between officials fully redacted under the OIA. The Chief Information Security Officer eventually approved a narrowly bounded use case. Unclassified traffic only. On slow-moving uncrewed drones. Procured through One NZ as the only viable pathway for a military Starlink contract in New Zealand. Defence Minister Judith Collins declined to comment on the subject when approached by Newsroom, calling it an operational matter[19].

This is the Defence Force, working with classified assessments that the public is not privy to, processing a single Starlink deployment for unclassified traffic on solar-powered, uncrewed vessels. You could argue that this is what doing the work properly looks like.

What no one did for the rest of us

No equivalent process governs the rural schools, civil defence emergency hubs, farm operations, or cellular backhaul running on the same platform. None of those connections were procured through anything resembling the senior security review the Bluebottle contract triggered. They were procured organisation by organisation, on commercial terms, without national security input.

The Government Communications Security Bureau (GCSB) confirmed in writing on 31 March 2026, in a response personally signed by the Director-General, that it holds no unclassified threat assessments regarding satellite internet provider security[20]. No scenario assessments covering service withdrawal or foreign government interference. No correspondence with other agencies on the security implications of satellite dependency. No information on whether GCSB security assessments have informed telecommunications policy development. All of that was refused under section 18(e) of the OIA, the formal confirmation that the work does not exist[21].

The GCSB has formal regulatory hooks into the telecommunications sector. Under Part 3 of the Telecommunications (Interception Capability and Security) Act 2013, network operators that meet prescribed thresholds must engage with the GCSB[22]. The GCSB also provides national security advice on the issuing of satellite ground station licences administered under the Radiocommunications Act 1989[23][24]. Those are point-in-time approvals at the licensing gate. They are not the same as the in-depth, ongoing strategic assessment of the kind that the Defence Force conducted for itself.

The Bureau noted it cannot provide information at the classified level. That qualification matters because classified work may exist. But the people writing the ministerial briefings that inform decisions about copper deregulation, levy frameworks, and the future of terrestrial infrastructure are working from the unclassified system. Whatever the classified system knows, it does not appear to have crossed into the system where these decisions are being made.

The same pattern holds across the agencies whose remits cover the civilian dimensions of this dependency.

The Ministry of Foreign Affairs and Trade (MFAT) was asked about the diplomatic implications of New Zealand’s reliance on infrastructure controlled by a foreign individual who has publicly intervened in geopolitical events using that infrastructure. MFAT refused the request in full. No diplomatic assessments exist[25].

The Privacy Commissioner was asked whether the routing of New Zealand internet traffic through foreign jurisdictions had been assessed for compliance with the Privacy Act, including consideration of the United States CLOUD Act. The Privacy Commissioner confirmed awareness of the issues but has no assessments, guidance, or correspondence with Starlink regarding compliance with New Zealand privacy law. Refused under section 18(e)[26].

NEMA was also asked. It holds no centralised, validated picture comparing the performance or resilience of specific communications systems. It holds no risk assessment for what happens if a satellite provider becomes unavailable[27].

The pattern painted here is consistent enough to become worrying. The agencies with constitutional and regulatory remits that touch this issue have not done the work. The Defence Force, with no remit for civilian critical infrastructure, did its own work for its own narrow operational purposes.

Without any formally documented risk, no civilian agency has been told to ask questions or plan for failure. These agencies are not setting aside known concerns. They are operating without them.

What the platform is exposed to

What happens when the assumption is tested?

There is enough on the public record to answer that without speculating.

In April 2026, SpaceX Vice President for satellite policy David Goldman told an Australian Senate committee that SpaceX might withhold its satellite-to-mobile service in Australia if the government proceeds with plans to auction the 2 GHz mobile satellite spectrum rather than allocate it directly to SpaceX[28]. His exact words on the record were: “If Australia proceeds with an auction, it will make Australia a major outlier in the international community, and Australians will bear the burden in the form of higher costs or worse: total lack of service[29].”

Australia is Starlink’s fourth-largest market with approximately 200,000 Starlink broadband customers[30]. The Australian government has committed to delivering mobile voice and SMS coverage across nearly the entire landmass by late 2027 under legislation already passed[31]. Making such bold claims as that service could one day be withdrawn is not industry rumour or a competitor’s interpretation. It is the company’s own statement to our partner nation’s parliament.

SpaceX filed confidentially for its IPO on 1 April 2026, targeting a June 2026 listing at a valuation Bloomberg has reported as approximately US$1.75 trillion [32]. The controlling shareholder retains voting control through a dual-class share structure that survives the IPO. Ultimately, control remains in the hands of the same individual.

A separate but connected exposure is also on the public record. SpaceX is a US-headquartered company subject to US jurisdiction. Under the CLOUD Act of 2018, US law enforcement can (and routinely does) compel US-based technology companies to produce data in their possession, custody, or control, regardless of where that data is stored or whose data it is[33][34]. The United Kingdom and Australia have negotiated bilateral executive agreements with the United States to constrain and formalise that access[35][36]. New Zealand has not. Data flowing through a US-headquartered satellite provider’s network is therefore subject to US legal process, with no reciprocal New Zealand framework to constrain access or require notification. That is not a future risk. It is the current legal position.

The most useful comparator I’ve heard for what this kind of exposure looks like in practice isn’t from the satellite sector at all. At the National Cybersecurity Summit in Wellington earlier this year, the Canadian cyber attaché based in Canberra spoke of France’s experience with Microsoft. He described how France discovered that Microsoft would share French government data with the United States government without notifying France in advance. The attaché’s broader point was that neither New Zealand nor Canada has the economic scale to build entirely sovereign infrastructure, and that the practical response is allied collaboration rather than retreat into self-sufficiency. The conversations are happening among allies. But New Zealand has not been spotted at any of those tables.

Then there is the operational record. In May 2024, a G5-class geomagnetic storm, the most intense since 2003, struck Earth[37]. Starlink itself acknowledged degraded service during the event[38]. Terrestrial networks in New Zealand were largely unaffected. The point here is not that satellites began falling out of the sky. They did not. It is that an ordinary space weather event, of a class that recurs on roughly two-decade cycles, produced acknowledged degradation on the extra-terrestrial platform a growing share of rural New Zealand depends on. A larger or more sustained storm might produce a more significant interruption. The potential compounded effect across the multiple critical services now running on the same platform has not been formally examined.

During the October 2025 Southland outages, message traffic on Starlink Direct-to-Cell rose by approximately 300 per cent[8]. When the terrestrial cellphone network was down, satellite was the only path home. The assumption that the two layers could fail in parallel, on the same day, in the same region, has not been tested by any agency. What that would look like is concrete. With no outside comms, a dairy operation cannot file the morning’s sample report or confirm the next pickup. A rural medical practice that has moved to telehealth as its after-hours model loses it. A school cannot run online assessments for its senior students or contact whānau through the cloud system it also uses for everything else.

These dependencies are not new in themselves. Rural New Zealand has long accepted that digital business, schooling, and healthcare are subject to occasional outages. What is new is that they run through a single foreign-controlled platform, and that platform’s value as a target now scales with how much depends on it.

The NZDF separately documented, in the OIA covered earlier in this part, foreign state efforts to build satellite interference capabilities[18]. The people least able to absorb a failure are the ones most exposed to it.

Then there is the political record. In 2022, the controlling shareholder of the constellation refused a Ukrainian request to activate Starlink coverage for a planned attack on Russian forces at Sevastopol. Later that month, according to a Reuters investigation published in July 2025, sourced to three people with direct knowledge of the command, the same shareholder ordered live Starlink service to be deactivated over Kherson during an active Ukrainian counteroffensive. SpaceX called the Reuters report inaccurate but did not specify the inaccuracy[39].

Neither decision involved advance notification or any legal or diplomatic process. Starlink access has since been altered for commercial and political reasons across multiple jurisdictions, without any external authority able to prevent it or compel reversal[40][41][42][43]. In a stable rules-based international order, those incidents are anomalies. In a less stable one, they become precedents.

What allies are doing

The response defenders of the current trajectory are likely to give is that our country cannot reasonably set its own course on satellite policy. I say, nobody is asking for that. The point is that other comparable countries are doing the work that has not been done here.

Australia’s NBN Co, the government-owned wholesale broadband operator, signed a wholesale agreement with Amazon’s Project Kuiper in August 2025[44][45]. In February 2026, NBN Co published proposed wholesale pricing of $35.84 AUD per month for a 50/10 Mbps service, with receiving equipment provided at no cost to eligible customers[46]. The commercial terms have been agreed upon before Amazon’s Australian service becomes operational. The leverage was an anchor tenancy of approximately 300,000 transitioning premises[47]. Commercial terms are most productively settled before a constellation is live in a market. New Zealand has no comparable arrangement in place for either Starlink or Amazon LEO, and no announced intention to pursue one.

The European Union is building its own LEO constellation, IRIS², at a cost of approximately €10.6 billion, explicitly to reduce security risk and dependence on US satellite operators for critical communications[48][49][50]. The United Kingdom and Australia have both negotiated CLOUD Act executive agreements with the United States. New Zealand has done neither.

This is not a fringe response, and none of it is anti-American. It is what allied governments do when they treat control of critical infrastructure from outside the country as a question worth asking.

What New Zealand can and cannot do about it

The response to all of this, within New Zealand’s existing legal framework, is thin.

The Radiocommunications Act and its 2001 Regulations allow cancellation of radio licences, including those under which satellite ground stations operate, for breach of conditions[51][52]. The Telecommunications (Interception Capability and Security) Act 2013 (TICSA) provides for enforcement notices where providers fail to meet interception or network security obligations[53]. The Telecommunications and Other Matters Amendment Bill, recently reported back to the house by the Economic Development, Science and Innovation Committee, would extend these by enabling the Secretary of MBIE to revoke or restrict radio and spectrum licences where a provider fails to comply with specific telecommunications obligations[54][55]. These are the formal mechanisms. Technically, none are yet in force in their extended form.

If New Zealand were to theoretically exercise those powers to shut down Starlink’s domestic ground stations, the network would simply instantly reroute traffic via inter-satellite laser links through ground stations in neighbouring Pacific jurisdictions or the United States. The satellites would continue to transmit. The legal mechanism is tangible. The practical compulsion is not.

That is the position New Zealand currently holds. If a foreign satellite operator acted contrary to the national interest, the Government could send a strongly worded letter.

There is also no structural lever. The closest historical comparator is the Ultra-Fast Broadband programme. The Crown made participation contingent on structural separation, and Telecom shareholders voted in 2011 to split the company into two, with Chorus taking the wholesale network[56][57]. The Crown shaped the market by controlling access to public investment that the company wanted in on[58]. That leverage worked because Telecom needed to do business here on New Zealand’s terms. SpaceX has no such need.

What the Minister holds and will not release

In November 2025, I asked the Minister for Media and Communications, Paul Goldsmith, four questions under the OIA. The questions covered whether forecast Telecommunications Development Levy (TDL) revenue had been pre-budgeted within Vote Communications, what the Minister’s plans were for any unallocated portion of current or future levy rounds, whether TDL funding could be directed to non-MNO providers, including smaller regional and fixed-wireless operators, and what advice the Minister had received on the market impact of LEO satellite services. In other words, what is the plan for the money, and what does the Government know about the market it is now levying.

All four were refused under section 9(2)(f)(iv)[59].

That section is not the same as section 18(e). The s18(e) refusals from the Commerce Commission, MBIE, the GCSB, MFAT, the Privacy Commissioner, and NEMA mean the information does not exist. Section 9(2)(f)(iv) means the information exists, and the Minister has chosen not to release it on the basis that release would prejudice the confidentiality of advice tendered by officials. The agencies do not have the analysis. The Minister has at least some, but is not sharing it.

At the Rural Connectivity Symposium in Rotorua in May 2024, the Minister joined by video link and took questions from the audience. Asked directly whether he was concerned about Starlink’s rapid growth, he answered, “Well, not necessarily.” Asked whether the Government would commit to continued rural broadband investment, he said there were no commitments being made at that time. Asked whether there was a level playing field for domestic operators competing against Starlink, he acknowledged the question was fair and said he would need to get advice^†.

A year after that 2024 symposium, at the 2025 Connecting Aotearoa Summit, the Minister framed the Government’s record on rural connectivity in more settled terms. “Government investment in rural connectivity programmes totals more than $770 million over the last 10 years,” he told attendees, “resulting in improved broadband for 85,000 households and mobile coverage along thousands of kilometres of state highway and at Marae[60].”

Between those two statements, twelve months passed. Across that period, MBIE officials had been documenting the monopoly risk internally and writing to Treasury about it. The Commerce Commission commissioned and published a report from its own handpicked expert that articulated the risk in its sharpest terms. A regional wireless provider was liquidated four days after that report was published. The rural share of connections held by a single foreign satellite provider rose from 19 per cent to 27 per cent[61][62]. None of that appeared in the Minister’s public framing.

Starlink’s qualifying revenue in New Zealand for the year to June 2025 was $100.99 million. Its Telecommunications Development Levy contribution for that year is approximately $250,000, proportional to its share of qualifying industry revenue[63]. Those funds flow into the consolidated fund. They are not currently ring-fenced for rural connectivity, which is what the development levy has historically existed to support.

The TDL is being extended. The Minister has not said where the additional revenue is to be applied. That is not a procedural omission. A levy has a stated purpose, by definition. A levy without a stated purpose is a tax. The choice between those two things is a policy decision that belongs on the public record. It is not there.

The Minister was asked. The advice exists. It was withheld under section 9 of the Official Information Act.

The window narrows

In March 2026, the Government introduced the Commerce Commission Reform Amendment Bill. Among its provisions, the Bill phases out the Telecommunications Commissioner as a separate statutory role from July 2027[64]. The Telecommunications Commissioner is the statutory appointee who has historically monitored the telco market, published the annual monitoring reports, and signed off on the later contradicted copper deregulation recommendation covered in Part 2 of this series.

The independent governance review by Dame Paula Rebstock, which preceded and informed the Bill, did not recommend abolishing the role[65]. The Commerce Commission, asked which governance option it supported, did not support the option chosen[64]. The decision to abolish the role was the Minister’s.

Though the effectiveness of the dedicated commissioner roles has been questioned by some, if the Bill passes in its current form, the specifically dedicated regulatory role that carries the closest thing New Zealand has to institutional memory on telecommunications competition will be gone by July 2027. In a separate bill put forward by the same Minister, a standalone prohibition on predatory pricing is introduced[66].

There is an active Commerce Act predatory-pricing complaint before the Commerce Commission against a satellite internet provider[67]. No analytical framework for assessing it has been disclosed. The new legal tool becomes usable in 2027; in the same year, the dedicated role with the institutional capacity to apply it ceases. The window for regulatory action on the market structure documented in these three parts is narrower at the end of this Bill than at the beginning, right now, when action is most needed.

The Minister’s individual decisions on this market do not have to be coordinated to be consistent in their effect. Less regulatory attention. Advice held and not released. A governance review disregarded. A specialist oversight role abolished. A predatory pricing complaint sitting before a Commission with no framework to assess it. The direction is visible across all of them.

The bigger picture

New Zealand has spent more than $770 million on rural broadband programmes since 2011[68]. Phases 1 and 2 of the Rural Broadband Initiative and the Mobile Black Spot Fund built infrastructure. The Rural Capacity Upgrades extended it. The Remote Users Scheme subsidised satellite hardware for households that the terrestrial programmes could not reach[4]. From a distance, the pattern looks like policy continuity. Up close, it is five different programmes, each serving a different theory of rural connectivity.

None of those programme decisions was necessarily wrong individually. The Remote Users Scheme connected people who had nothing. But the sequence, taken as a whole, represents the kind of reactive, programme-by-programme approach that produces the position New Zealand now occupies. Hundreds of millions of dollars on terrestrial infrastructure, followed by quiet acceptance of a market structure in which that infrastructure is being replaced, followed by a levy on the replacement whose proceeds are not earmarked for what it replaces. Are you still with me?

Based on current growth trajectories, Starlink’s cumulative revenue from New Zealand will exceed the total historical public investment within the next five years^†.

Questions Parliament could answer

I did not write this series because I think the situation is irreparable. I wrote it because the cost of recovery rises each month without action.

The documentary record raises these questions. None requires new powers or new appropriations. All would materially change the trajectory.

Will the Commerce Commission update its August 2025 copper deregulation recommendation in light of the Feasey Report? The two documents are in visible tension in the Commission’s own published record. No public reconciliation has been produced.

Will the Government commission the inter-agency assessment of satellite dependency risk that no agency currently holds? That work does not require new statutory powers. It requires the question to be asked.

What is the plan for the Telecommunications Development Levy proceeds now flowing from foreign satellite providers? Those funds currently flow to the consolidated fund. The policy intent behind that extension has not been released.

Will the Minister release, in summary form, the advice he holds on rural broadband consolidation? The specific advice can remain confidential. The framing and the conclusions do not need to.

Will the Government reconsider the abolition of the Telecommunications Commissioner role, given that the governance review it commissioned did not recommend abolition and the Commerce Commission did not support the option chosen?

Why this series exists

This is the part of the series where I have to say something about my own position, because the series ends here and the question of who I am to be writing it has been on the page since the start.

I am a direct competitor to Starlink. WombatNET has never received direct government funding. I am 21. I started the company when I was 14 because the answer I kept getting to the question of why my community had no workable connection was that nobody with the means was willing to do the work.

Starlink works. For countless rural households, it has been the first connection that actually did. Nothing across these three parts argues that it should not exist or be restricted in any way. The argument is that, depending on it, the way New Zealand increasingly does, is a question the official system should have been asked to consider, and was not.

The conflict of interest here is real. So is the lived knowledge. The two are one and the same. The reason I knew which questions to ask is the same reason I have a commercial position in the answers.

For a long time, I assumed that what I was running into was simply the result of my commercial nous not being sharp enough. The constant feeling of pushing against settings that did not seem to want to move was, I told myself, the cost of doing this work, at my age, and without scale or capital. The OIA record I collected drastically changed that assumption. So did the wider industry’s response to the publication of Parts 1 and 2. Operators with decades more skin in the game than I do have written to say they have been raising versions of these concerns for many years, only to repeatedly watch them fall on deaf ears.

The people best placed to tell this story are the ones whose livelihoods depend on it, but that also makes them the easiest to dismiss. Industry bodies have raised these concerns in submissions. Independent experts have raised them in commissioned reports. None of it has produced visible change. If the only people left willing to set it all out in one place are those closest to the consequences, then that is what has to be done.

I am not an academic. I am not a policy analyst. I have never worked in or for government. What I do have is seven years of running a rural ISP, and the habit of being in the rooms where the consequences of these decisions are discussed, but never the rooms where the decisions are made. For most of those seven years, I assumed the people in those other rooms were doing the work. The OIA record shows they were not.

In practice, that means the work that should have been done by people qualified to do it is falling on the operators serving rural households. We are also the people those households can ring directly when something goes wrong. The settings under which we do that work have changed. They have not been examined. The risk to my business is mine to carry. The risk to the communities we serve is not. That is what worries me the most.

There is a pattern across New Zealand’s infrastructure of recognising that it matters only after it has stopped working. The fix, when it comes, will cost more than the analysis would have. The damage, if it comes, will be borne by the communities least able to absorb it.

The OIA record across these three parts will, in any future review, answer the question of whether the system saw it coming. It has now been clearly warned. The question that might remain is why nothing was done with what was seen.

Infrastructure does not just fail. It is allowed to fail.

Read Part 1: Nobody Checked and Part 2: They Were Warned.

References