Canada is not immune to cyberattacks

One of the surprises of the war in Ukraine is how small a role cyberattacks have played both in Russia’s actions within Ukraine and against those supporting Ukraine. There had been widespread predictions that this would be the first war in which cyberattacks would play as large a role as kinetic attacks. Russia does continue to carry out cyberattacks against Ukraine but, it seems, only at about the same intensity as before the war and without delivering any measurable advantage. It turns out to be cyberespionage rather than cyberattacks that have been used in new ways; and by the West as opposed to Russia. Now that almost all communication takes place over networks, all countries have developed their skills at interception and decryption, but the West, and particularly the Five Eyes countries, are especially skilled. They, under U.S. leadership, have been leveraging this in two ways. First, they have been disclosing intelligence to warn Ukraine, and the wider world, about Russian plans, and the disinformation that is to accompany them. This has discredited Russia as it carries out attacks following a script that the world already knows, including disseminating “news” that is already known to be disinformation. Widespread advance knowledge of the goals of each Russian operation has also made it starkly obvious when these goals were not achieved. Second, the U.S. has been using detailed intelligence to advise Ukrainians about Russian attack plans, reportedly down to the level of the planned targets of individual missile attacks. Russia has considerable cyber expertise. Working for Russian government intelligence or one of its slightly deniable cyberattack organizations has long been an attractive career path for young Russians with technical skills. It is puzzling, therefore, that the Russian government has not made more use of these capabilities to back up its army’s kinetic attacks, and to threaten or even carry out cyberattacks on those countries supporting Ukraine. That may, of course, change. How vulnerable are we in Canada to a Russian coercive or retaliatory cyberattack? Canada’s cybersecurity strategy has three pillars: secure government systems, partner to secure vital systems outside the government, and help individual Canadians to be secure in cyberspace. Progress on the first and third has been good. Canada’s signals intelligence agency, the Communications Security Establishment, has worked hard over the past decade to secure the government’s presence in cyberspace, with departments themselves motivated by several high-profile attacks (for example, on Global Affairs and the Canada Revenue Agency). Much work has gone into making Canadians aware of how to avoid risky behaviour online, for example the work by the SERENE-RISC knowledge mobilization network. The weakest pillar is the securing of systems outside the federal government, particularly in critical infrastructure such as the financial and banking system, the electricity grid, and oil and gas pipelines. Russia has carried out cyberattacks that have taken out power grids (Ukraine in 2015), hospitals (the U.K.’s National Health Service in 2017), and pipelines (the U.S.’s Colonial Pipeline in 2021) and Canada is not immune to such attacks. There are two difficulties that the federal government faces: first, it has little leverage to force businesses to improve their cyber resilience, and second, there is a natural tendency for businesses to adopt some form of ostriching, regarding cybersecurity solely as a cost. After 20 years of efforts, Canada’s private sector—and especially critical infrastructure—is not protected as it could and should be. Bill C-59 recently authorized the Communications Security Establishment to carry out active (i.e. offensive) cyber operations. This means, at least in theory, that Canada need not take a purely defensive stance against cyberattacks from other countries and creates at least a skeletal kind of cyberdeterrence. The capability is so recent that scholars, those on the front line, and the federal government are still thinking through what effect this might have on the conflicts spinning off from the war in Ukraine. This new capability means that Canada need not rely on hardening cyber defences as our only response—which is just as well in a world that suddenly seems much more dangerous—but we need a strategy and the will to use it. David Skillicorn is a professor in the School of Computing at Queen's University where he heads the NSERC CREATE Queen's/RMC cybersecurity program. His research focuses on adversarial data analytics, applied to areas such as terrorism, law enforcement, fraud, cybersecurity, and money laundering. His most recent book is titled Cyberspace, Data Analytics, and Policing. The Hill Times