Canadian public and private computer networks daily.” CSIS REPORT

Cyberattacks on economic, political targets threaten to overwhelm spy agency, report says

“Hostile state-sponsored actors (are targeting) Canadian public and private computer networks daily.” CSIS REPORT
OTTAWA— Canada’s spies admit they can’t keep up with daily cyberattacks from state-sponsored hackers, according to an internal report obtained by the Star.

A heavily censored “threat overview” prepared by CSIS last September stated hostile “state-sponsored” hackers are targeting everything from political positions and trade strategies to commercial data and personal information.

“Hostile state-sponsored actors (are targeting) Canadian public and private computer networks daily to advance their economic, military, (and) political agendas,” reads the report, prepared for Public Safety Minister Steven Blaney’s office. “Offensive cyber operations (are) employed with more traditional methods in support of strategic and economic objectives.”
A separate overview of CSIS operations, also prepared for Blaney and obtained under Access to Information law, stated CSIS is being overwhelmed by the sheer number of attacks. CSIS reported the “scale of the threat has fast outpaced (its) capacity,” and the agency has been required to “prioritize” its efforts. That document rates cyber security as an “operational pressure,” along with terrorist travel.

Ottawa recently named China as the state sponsor behind a 2014 hack of the National Research Council’s network — an attack that CSIS and Canada’s electronic spy agency, the Communications Security Establishment, monitored for some time before quarantining the agency’s network from government servers. But while that high-profile attack made headlines, the September 2014 threat overview shows Canada’s public and private networks are targeted more often than most people realize.

CSIS also identified more traditional methods of espionage in the threat assessment, including “political espionage targeting government officials and systems.”
The CSIS threat assessment indicated traditional foreign influence “threatens” diaspora communities in Canada, but did not elaborate on the nature of that threat.

The Star requested an interview with both CSIS and Blaney’s office, and sent a detailed list of questions. CSIS did not return the Star’s call. Blaney’s office declined the interview request.
In an emailed statement, Blaney spokesman Jeremy Laurin said he could not comment on specifics of security cases. “We have made significant investments in a Cyber Security Strategy to defend against electronic threats, hacking and cyber espionage,” Laurin wrote. But a December 2014 memo from CSIS Director Michel Coulombe to Blaney, obtained by La Presse and shared with the Star, said previous “one-time” funding increases did not increase the agency’s “operational capacity.”
“In the face of a dynamic threat environment and a climate of fiscal restraint, CSIS will continue to seek out efficiencies and prioritize efforts,” Coulombe wrote in a highly censored briefing note.
NDP public safety critic Randall Garrison accused the Conservatives of “sleight of hand” in pointing selectively to budget hikes, while ignoring ongoing belt-tightening since 2012.
“(CSIS) is still behind, without accounting for inflation, without accounting for new duties, without accounting for the increased threat level,”

Garrison said. “They’ve got less money.”
Garrison noted CSIS operational challenges are likely to be even more pronounced with the new mandate to “disrupt” threats proposed in Bill C-51, the Conservatives new terrorism legislation.
Christopher Parsons at University of Toronto’s Citizen Lab said the documents point to a larger conflict that’s largely been taking place behind the scenes — the militarization of the Internet.

“Canada is hardly alone as the target — or originator — of state-sponsored hacking,” Parsons said.
As countries continue to develop both offensive and defensive Internet capabilities, he said it’s become urgent to come to an international consensus of what counts as legitimate targets in the Internet age.
“The internet has become militarized behind the backs of most citizens, and I think that if we’re not going to roll back that militarization entirely . . . at the very least principled agreements about what are legitimate and illegitimate modes of militarization have to be established.”

http://www.thestar.com/news/canada/2015/05/14/csis-cant-keep-up-with-daily-state-sponsored-cyber-attacks.html