Despite a stern warning from one of Canada’s security review bodies, most Crown corporations, smaller government departments and agencies haven’t heeded the call to use specialized cyber defence sensors to protect their networks from state-sponsored attacks, says a recent report.
The committee wrote that Crown corporations and small government departments and agencies (SDAs) — defined as those with fewer than 500 staffers and annual budgets of less than $300 million — are not required to follow the same cyber policies as other government departments. The report warned this state of affairs could pose “a security risk to government networks.”
“Those organizations receive, hold and use the sensitive information of Canadians and Canadian businesses, information that is at risk of compromise by the most sophisticated of cyber actors, including states,” the report said.
“Moreover, unprotected organizations potentially act as a weak link in the government’s defences by maintaining electronic connectivity to organizations within the cyber defence framework, creating risks for the government as a whole. These challenges are well known to the government.”
NSICOP’s report — which was submitted to Prime Minister Justin Trudeau in August 2021 and tabled in Parliament in February 2022 — said that while China and Russia are the most sophisticated cyberthreat actors targeting the federal government, Iran and North Korea have “moderately sophisticated” capabilities.
The committee has recommended that the cyber defence sensors of the Communications Security Establishment (CSE) be extended to cover all federal entities.
But new numbers from the CSE, Canada’s cyber intelligence and security agency, show that less than half of Crown corporations and smaller departments and agencies “whose IT infrastructure is outside the government’s network defences” followed that recommendation.
“Since March 2020, the number of Crown corporations and SDAs signed up for our sensors has grown from 12 to 37 (out of 86),” says the CSE’s 2022-2023 report.
“The Cyber Centre continues to view this sector as a high priority and is working to onboard more federal institutions to our services.”
CSE sensors process over 200K events per second
Robyn Hawco, CSE spokesperson, said the agency uses its own in-house technology — called Host-Based Sensors, or HBS — on government servers, laptops and desktops.
“To put it simply, each sensor securely gathers system data, while protecting the privacy of those using this service. That data is fed back to our experts for analysis. They map any malicious activity, such as malware trying to download, and document the recipe to inoculate other devices from being infected in future,” said Hawco.
“The HBS technology is user-friendly and not only detects but also neutralizes malicious activity, automatically.”
The sensors process over 200,000 host events per second, she said.
The Communications Security Establishment complex in Ottawa on October 15, 2013. CSE said it encourages Crown corporations “to opt into the full range of cyber security services we offer.” (Sean Kilpatrick/Canadian Press)
In a media statement, the Treasury Board said Crown corporations and smaller agencies are ultimately responsible for their own cyber defence decisions.
“All federal organizations, including Crown corporations, can access the government’s cyber defence services and TBS continues to encourage them to take advantage of the full complement of the government’s cyber defence services,” says the statement.
Treasury Board said Shared Services Canada is working to provide an initial group of 43 small departments and agencies with advanced cyber defence services, using funding earmarked in the 2022 federal budget.
“In addition, all federal organizations, including Crown corporations, can enter into agreements in order to align with TBS cyber defence policies, or to seek cyber defence services from the Cyber Centre,” says the statement.
Testifying before a Senate committee earlier this year, NSICOP member Sen. Frances Lankin said government inertia is the reason why the committee’s recommendation was meant to be compulsory.
“In this report, we saw very clearly that there are gaps and those gaps are dangerous for Canadians and dangerous for our national security, personal data,” she said.
“I think that there is a willingness to move, but there’s great reluctance and inertia at times within large departmental structures and the interdepartmental relations.”
NSICOP has been ignored before
It’s not the first time government departments and agencies have failed to act on recommendations from NSICOP, a special committee made up of MPs and senators.
The committee released a report back in 2019 that urged Ottawa to take the threat of foreign interference more seriously.
“Canada has been slow to react to the threat of foreign interference,” wrote the committee in a 2019 report looking at the government’s response to foreign meddling.
“The government must do better.”
After at first not responding to the report, Trudeau acknowledged his government should be doing a better job.
“We have to do a better job on following up on those recommendations. I fully accept that,” he told a news conference back in March.
Those comments came as Trudeau announced he was asking NSICOP to review the state of foreign interference in Canada’s democratic processes since 2018.
NSICOP has since agreed and the review is ongoing.
FREDERICTON – A look at David Coon, leader of the Green Party of New Brunswick:
Born: Oct. 28, 1956.
Early years: Born in Toronto and raised in Montreal, he spent about three decades as an environmental advocate.
Education: A trained biologist, he graduated with a bachelor of science from McGill University in Montreal in 1978.
Family: He and his wife Janice Harvey have two daughters, Caroline and Laura.
Before politics: Worked as an environmental educator, organizer, activist and manager for 33 years, mainly with the Conservation Council of New Brunswick.
Politics: Joined the Green Party of Canada in May 2006 and was elected leader of the New Brunswick Green Party in September 2012. Won a seat in the legislature in 2014 — a first for the province’s Greens.
Quote: “It was despicable. He’s clearly decided to take the low road in this campaign, to adopt some Trump-lite fearmongering.” — David Coon on Sept. 12, 2024, reacting to Blaine Higgs’s claim that the federal government had decided to send 4,600 asylum seekers to New Brunswick.
This report by The Canadian Press was first published Sept. 19, 2024.
FREDERICTON – A look at Blaine Higgs, leader of the Progressive Conservative Party of New Brunswick.
Born: March 1, 1954.
Early years: The son of a customs officer, he grew up in Forest City, N.B., near the Canada-U.S. border.
Education: Graduated from the University of New Brunswick with a degree in mechanical engineering in 1977.
Family: Married his high-school sweetheart, Marcia, and settled in Saint John, N.B., where they had four daughters: Lindsey, Laura, Sarah and Rachel.
Before politics: Hired by Irving Oil a week after he graduated from university and was eventually promoted to director of distribution. Worked for 33 years at the company.
Politics: Elected to the legislature in 2010 and later served as finance minister under former Progressive Conservative Premier David Alward. Elected Tory leader in 2016 and has been premier since 2018.
Quote: “I’ve always felt parents should play the main role in raising children. No one is denying gender diversity is real. But we need to figure out how to manage it.” — Blaine Higgs in a year-end interview in 2023, explaining changes to school policies about gender identity.
This report by The Canadian Press was first published Sept. 19, 2024.
OTTAWA – The pressing issues of climate change and food security join more familiar ones like violent extremism and espionage on a new list of Canada’s intelligence priorities.
The federal government says publishing the list of priorities for the first time is an important step toward greater transparency.
The government revises the priorities every two years, based on recommendations from the national security adviser and the intelligence community.
Once the priorities are reviewed and approved by the federal cabinet, key ministers issue directives to federal agencies that produce intelligence.
Among the priorities are the security of global health, food, water and biodiversity, as well as the issues of climate change and global sustainability.
The new list also includes foreign interference and malign influence, cyberthreats, infrastructure security, Arctic sovereignty, border integrity and transnational organized crime.
This report by The Canadian Press was first published Sept. 19, 2024.
