Russian Cyber Threat a Heightened Concern for Canada, Says Security Official

A sign for the Government of Canada's Communications Security Establishment (CSE) outside their headquarters in Ottawa in a file photo. (Sean Kilpatrick/The Canadian Press)

With Canada sanctioning Russia for its invasion of Ukraine and supporting the latter with weapons and intelligence, an official with the Canadian Centre for Cyber Security (CCCS) says his agency is closely monitoring for potential retaliation from Russia in the form of cyber threats.

“I’m aware of the fact that the committee is currently concerned with the Russian attack on Ukraine,” said Sami Khoury, head of the CCCS, during a meeting of the Standing Committee on National Defence on March 28.

“I cannot speak about our specific operations within the framework of this presentation, but I can confirm that we are closely monitoring the cyber threat activities related to these military manoeuvres. Today we’re not aware of any specific threats to Canadian organizations in relation to events in and around Ukraine.”

The CCCS is a component of the Communications Security Establishment (CSE), Canada’s signals intelligence agency, similar to the U.S. National Security Agency (NSA) or the British Government Communications Headquarters (GCHQ).

While the Cyber Centre says that cyber crime remains the most likely threat to affect Canadian individuals and businesses, Khoury said the “state-sponsored cyber programs of China, Russia, North Korea, and Iran pose the greatest strategic threat to Canada.”

When asked by Conservative MP Kerry-Lynne Findlay to rate those threats in order of importance, Khoury said it’s difficult to compare the actors against each other, but warned that “in the current context, we have to be mindful of the geopolitical tensions and ... the Russian cyber threat.”

An official from the Canadian Security Intelligence Service (CSIS) also testified before the committee and said the increased reliance on computer networks in daily life, including more people working from home, combined with the advances and proliferation of technology is dramatically changing the cyber threat environment.

“It has become more complex, increasingly fluid, less predictable, and consequently, more challenging,” said Cherie Henderson, an interim assistant director with CSIS.

“Canadian companies and almost all sectors of our economy have been targeted and compromised,” she said, noting that thousands of cyber attacks target Canadian entities every day and the trend is increasing.

Henderson said the national intelligence agency’s two main cyber concerns involve defending against theft of intellectual property and attacks against critical infrastructure, an area she says “could [be] very vulnerable.”

The ability of cyber actors to take control of key infrastructure and wreak havoc has been demonstrated a number of times in recent years.

A Russian cybercrime group hacked into the largest fuel pipeline in the U.S. in April 2021, leading to its shutdown and shortages on the east coast. Colonial Pipeline had to pay a $4.4 million ransom to the hackers to resume operations.

Iran’s Natanz nuclear plant has also been targeted by a number of cyber attacks in recent years.

So far Russia’s known response has been limited to banning entry to most Canadian MPs as well as some members of pro-Ukraine organizations in Canada, but it warned at the time that every attack on Russia, whether on diplomatic missions, the closure of airspace, or the severing of economic ties “will inevitably receive a decisive and not necessarily symmetrical rebuff.”

“We are aware of the connection between the Russian intelligence services and cyber criminal organizations,” Khoury said, noting cyber criminals have been known to “take sides” between Russia and Ukraine during the ongoing conflict between the two countries.

“From a Cyber Centre perspective, we have the task of defending the country, defending Canada, defending critical infrastructure against all sorts of threats, irrespective of whether it is nation-state or cyber criminal.”