C-59 CSE hacking powers could put Canadians at risk: OpenMedia

OTTAWA — The Canadian Security Establishment (CSE) could inadvertently be putting Canadians at risk by engaging in active cyber operations, advocacy group OpenMedia told a House committee studying new national security legislation on Thursday. Bill C-59, tabled last year, looks to give the CSE greater powers and the ability to be more active in attacking potential cyber threats from abroad. That includes the ability to test or evaluate products, software and systems that could be used to destabilize those foreign targets. “I think that there are a lot of abilities that CSE already has, but I believe that the active cyber operations, particularly the ones geared at deploying tools abroad, pose a large security risk for Canada in the way they could be exploited,” said OpenMedia executive director Laura Tribe, who appeared before the House national security committee Thursday. Activities the CSE would have the ability to engage in, OpenMedia says on its website, could include disabling account or network access, large-scale denial-of-service attacks and interference with critical infrastructure, such as electricity grids. It said that the bill fails to “reign in” the CSE’s ability to acquire malware, spyware and hacking tools. While defensive operations include finding and fixing vulnerabilities in digital infrastructure, active operations could involve exploiting those vulnerabilities for strategic gain, the Canadian Civil Liberties Association said in a blog post from September. The operations could involve introducing new vulnerabilities into networks, infiltrating computer systems and acquiring, changing or deleting information, the CCLA added, calling it state-sponsored hacking with little oversight. Tribe said the possible fallout from these abilities is a “cyber arms race” where bigger and better hacking tools are developed, even as they could potentially be used against those who build them. Last year, one of the world’s most widespread cyber attacks involved more than 200,000 computers in at least 150 countries, with the culprit being a stolen hack tool created by the United States’ National Security Agency (NSA). A New York Times report from November found the group behind the leak, known as the Shadow Brokers, has caused serious problems at the NSA through its disclosures of the organization’s tools since 2016, raising questions about the NSA’s “ability to protect potent cyberweapons and its very value to national security.” Tribe added these are the kinds of exploitations that Canadians are looking for the government to proactively prevent. And while she said it may seem more simple to try and build the tools to take down hostile entities before they attack, doing so just creates more tools that Canadians don’t want out there. “It just perpetuates that environment with those malicious actors on that other side that we’re fearing and perpetuates a culture of fear,” she said. “As much as we would love to believe that if Canada builds these tools, we can keep them safe, we have seen that’s not the case.” “I’m sure the NSA felt the same way,” she added. “What we’re looking for,” Tribe said, “is to increase our security to build up our protections to make sure we are safe from those types of threats without building the vulnerabilities and the tools that can be actively captured and misused by other governments or other malicious actors who are trying to build those tools themselves.” Last year, the CSE released an anti-malware tool for use and improvement by the public to further protect themselves from attacks. The cyber defence tool, known as Assemblyline, can be used to detect and analyze malicious electronic files. And last week, Telus Corp. and Japanese cyber security company Trend Micro Inc. agreed to create a cybersecurity research centre in Toronto to protect against cyber threats. Tribe said Canadians still don’t have strong enough protections against cyber attacks, as data breaches affecting Canadians continue to raise the issue. She also mentioned some concerns outlined in a joint report about the bill by the University of Toronto’s Citizen Lab and the University of Ottawa’s Canadian Internet Policy and Public Interest Clinic (CIPPIC) released in December. Issues identified in the report include the potential for the CSE to monitor domestic infrastructure, including telecom networks, and the difficulty the CSE has in avoiding directing its activities toward Canadians because of the nature of the online world. OpenMedia’s concerns are just the latest to be put before parliamentarians about the bill, adding to those already expressed by civil rights groups and academics. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

C-59 CSE hacking powers could put Canadians at risk: OpenMedia

News | February 9, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

C-59 CSE hacking powers could put Canadians at risk: OpenMedia

News | February 9, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us