Canadian authorities are investigating a prolonged data security breach following the “detection of malicious cyber activity” affecting the internal network used by Global Affairs Canada staff, according to internal department emails viewed by CBC News.
The breach affects at least two internal drives, as well as emails, calendars and contacts of many staff members.
CBC News spoke to multiple sources with knowledge of the situation, including employees who have received instructions on how the breach affects their ability to work. Some were told to stop working remotely as of last Wednesday.
CBC News has also seen three internal emails sent to Global Affairs staff.
“Forensic work has also progressed to help us understand the scope of the data breach,” one email said. “The work is ongoing, but early results suggest that many (Global Affairs Canada) users may have been affected.”
Another email said the internal systems were vulnerable between December 20, 2023 and January 24, 2024. It informed anyone who connected remotely using a SIGNET (Secure Integrated Global Network) laptop that their information may be vulnerable.
The “compromised” system was the virtual private network (VPN) staff use to access Global Affairs’s Ottawa headquarters. The VPN system was managed by Shared Services Canada, the GAC notice said.
Shared Services Canada is a federal department created in 2011 to take over the delivery of email, data centres and network services for many government departments and agencies.
Global Affairs Canada confirms breach
In a statement issued Tuesday, Global Affairs Canada said an “unplanned IT outage” is affecting remote access to its network. The department said the partial outage was activated intentionally on Jan. 24 to “address the discovery of malicious cyber activity.”
“Early results indicate there has been a data breach and that there has been unauthorized access to personal information of users including employees,” the statement said, adding that the department is investigating the matter and contacting those affected to ensure their information is secure.
The statement also said connectivity in GAC buildings is fully functioning and that employees working remotely in Canada have been provided with workarounds.
“The department’s critical services and external communication channels remain accessible and operational.”
No word yet on scope of data breach
According to Global Affairs, SIGNET is the department’s secure computer network. One part of the network holds personal information on shared drives, including employees’ personal information. Another part holds classified information.
It’s not clear whether secret information was lost in the breach, which lasted longer than a month. It’s also not clear who was behind the breach.
Email traffic and files on personal and shared drives “may have been compromised,” a GAC memo to staff said. GAC also said it’s looking into whether “sensitive corporate information,” such as credit cards and banking data, may have been breached.
Authorities investigating massive security breach at Global Affairs Canada
Authorities are investigating a major data security breach Global Affairs Canada that included ‘unauthorized access to the personal information of users, including employees.’
Shared Services Canada and the Canadian Centre for Cyber Security — which is part of the Communications Security Establishment, Canada’s cyber-security organization — are investigating the breach, GAC’s email to staff said.
“Forensic work, including with these partners, is ongoing to help us understand the impact on our networks and any potential changes in the scope and in the time frame of the data breach,” the GAC email to staff read.
The office of the Privacy Commissioner said Global Affairs Canada informed it of a data breach on Jan. 26.
“We are in ongoing communication with the department to gather more information,” a spokesman said in a media statement. “Following a breach notification, our office will work with federal institutions to better understand privacy risks related to the breach and ensure that the department undertakes appropriate steps, including notification of affected individuals.”
Global Affairs is a ‘natural target’
“A breach of that duration is bound to be serious,” said Wesley Wark, a national security expert at the University of Ottawa.
“Global Affairs Canada holds a lot of classified and sensitive information … It is a natural target for hacking but it’s also vulnerable and holds important data.”
Although sensitive diplomatic cables are sent using an encrypted system, a source told CBC News that some drafts of sensitive correspondence and some intelligence may have been stored in the affected drives.
The Lester B. Pearson Building on Sussex Drive in Ottawa, headquarters of Global Affairs Canada. (CBC)
“We know this information may be unsettling for many of you,” said the email sent to staff. “This is an evolving situation and further information and guidance will continue to be shared as quickly as possible.”
The email offers suggestions on how to safeguard “sensitive information” and encourages employees to monitor financial accounts in case of unauthorized activity.
In the interim, some Canada-based Global Affairs employees with security clearance are not able to work from home.
“This is not a permanent change to the hybrid work model, just a temporary situation until this crisis passes,” the email said.
A senior diplomatic source told CBC News that on several occasions in the past year, staff were told to immediately change passwords or reboot software but were not given any further details.
Global Affairs said it’s working with Shared Services Canada and the Canadian Centre for Cyber Security, which is part of the Communications Security Establishment, to restore full connectivity “as soon as possible.”
VANCOUVER – Contract negotiations resume today in Vancouver in a labour dispute that has paralyzed container cargo shipping at British Columbia’s ports since Monday.
The BC Maritime Employers Association and International Longshore and Warehouse Union Local 514 are scheduled to meet for the next three days in mediated talks to try to break a deadlock in negotiations.
The union, which represents more than 700 longshore supervisors at ports, including Vancouver, Prince Rupert and Nanaimo, has been without a contract since March last year.
The latest talks come after employers locked out workers in response to what it said was “strike activity” by union members.
The start of the lockout was then followed by several days of no engagement between the two parties, prompting federal Labour Minister Steven MacKinnon to speak with leaders on both sides, asking them to restart talks.
MacKinnon had said that the talks were “progressing at an insufficient pace, indicating a concerning absence of urgency from the parties involved” — a sentiment echoed by several business groups across Canada.
In a joint letter, more than 100 organizations, including the Canadian Chamber of Commerce, Business Council of Canada and associations representing industries from automotive and fertilizer to retail and mining, urged the government to do whatever it takes to end the work stoppage.
“While we acknowledge efforts to continue with mediation, parties have not been able to come to a negotiated agreement,” the letter says. “So, the federal government must take decisive action, using every tool at its disposal to resolve this dispute and limit the damage caused by this disruption.
“We simply cannot afford to once again put Canadian businesses at risk, which in turn puts Canadian livelihoods at risk.”
In the meantime, the union says it has filed a complaint to the Canada Industrial Relations Board against the employers, alleging the association threatened to pull existing conditions out of the last contract in direct contact with its members.
“The BCMEA is trying to undermine the union by attempting to turn members against its democratically elected leadership and bargaining committee — despite the fact that the BCMEA knows full well we received a 96 per cent mandate to take job action if needed,” union president Frank Morena said in a statement.
The employers have responded by calling the complaint “another meritless claim,” adding the final offer to the union that includes a 19.2 per cent wage increase over a four-year term remains on the table.
“The final offer has been on the table for over a week and represents a fair and balanced proposal for employees, and if accepted would end this dispute,” the employers’ statement says. “The offer does not require any concessions from the union.”
The union says the offer does not address the key issue of staffing requirement at the terminals as the port introduces more automation to cargo loading and unloading, which could potentially require fewer workers to operate than older systems.
The Port of Vancouver is the largest in Canada and has seen a number of labour disruptions, including two instances involving the rail and grain storage sectors earlier this year.
A 13-day strike by another group of workers at the port last year resulted in the disruption of a significant amount of shipping and trade.
This report by The Canadian Press was first published Nov. 9, 2024.
The Royal Canadian Legion says a new partnership with e-commerce giant Amazon is helping boost its veterans’ fund, and will hopefully expand its donor base in the digital world.
Since the Oct. 25 launch of its Amazon.ca storefront, the legion says it has received nearly 10,000 orders for poppies.
Online shoppers can order lapel poppies on Amazon in exchange for donations or buy items such as “We Remember” lawn signs, Remembrance Day pins and other accessories, with all proceeds going to the legion’s Poppy Trust Fund for Canadian veterans and their families.
Nujma Bond, the legion’s national spokesperson, said the organization sees this move as keeping up with modern purchasing habits.
“As the world around us evolves we have been looking at different ways to distribute poppies and to make it easier for people to access them,” she said in an interview.
“This is definitely a way to reach a wider number of Canadians of all ages. And certainly younger Canadians are much more active on the web, on social media in general, so we’re also engaging in that way.”
Al Plume, a member of a legion branch in Trenton, Ont., said the online store can also help with outreach to veterans who are far from home.
“For veterans that are overseas and are away, (or) can’t get to a store they can order them online, it’s Amazon.” Plume said.
Plume spent 35 years in the military with the Royal Engineers, and retired eight years ago. He said making sure veterans are looked after is his passion.
“I’ve seen the struggles that our veterans have had with Veterans Affairs … and that’s why I got involved, with making sure that the people get to them and help the veterans with their paperwork.”
But the message about the Amazon storefront didn’t appear to reach all of the legion’s locations, with volunteers at Branch 179 on Vancouver’s Commercial Drive saying they hadn’t heard about the online push.
Holly Paddon, the branch’s poppy campaign co-ordinator and bartender, said the Amazon partnership never came up in meetings with other legion volunteers and officials.
“I work at the legion, I work with the Vancouver poppy office and I go to the meetings for the Vancouver poppy campaign — which includes all the legions in Vancouver — and not once has this been mentioned,” she said.
Paddon said the initiative is a great idea, but she would like to have known more about it.
The legion also sells a larger collection of items at poppystore.ca.
This report by The Canadian Press was first published Nov. 9, 2024.
