CSE: Russian cyber threat to Canada worse than earlier reported

The Communications Security Establishment (CSE) has revealed that the cyber operations of Russia after it invaded Ukraine have “almost certainly” been worse than what has been reported publicly, and Canada is part of the targeted countries.

In a threat bulletin issued recently, the CSE’s Canadian Centre for Cybersecurity said “the scope and severity of cyber operations related to the Russian invasion of Ukraine have almost certainly been more sophisticated and widespread than has been reported in open sources.”

Christopher Parsons, a senior researcher at University of Toronto’s Citizen Lab, made it known that the CSE’s warning should be handled with seriousness. He said: “Anyone who has critical infrastructure under their control or is interfacing with it, needs to take what they’re saying seriously. They’re not in the habit of trying to spook Canadians.”

According to Stephanie Carvin, an associate professor of international relations at Carleton University, “CSE is trying to flag-wave here to a certain extent and show that there is an increased risk to Canadian infrastructure.”

The CBE warned that Russia is “in the process of developing cyber capabilities against targets” in the E.U., NATO, and Canada.

Just before Russia invaded Ukraine, the CSE warned that Canadian critical infrastructure could be targeted by Russia. It said since then, its cybersecurity centre has liaised with critical infrastructure sectors in Canada to “reinforce the need to enhance vigilance and follow Cyber Centre advice.”

The threats listed by CSE include spying by Russian-backed actors, that have “almost certainly increased cyberespionage targeting of North Atlantic Treaty Organization (NATO) countries in response to NATO’s support for Ukraine.”

Carvin said Russia wants to know the intentions of Western countries. She said: “They want to know what our plans are. They want to know our diplomatic coordination. They want to know if more sanctions are coming. They want to know what military equipment we’re talking about sending Ukraine and they want to know our discussions with Ukraine as well.”

According to CSE, that’s in addition to Russia’s major focus of targeting Ukraine itself, where Russia has “sought to degrade, disrupt, destroy, or discredit Ukrainian government, military and economic functions, secure footholds in critical infrastructure, and to reduce the Ukrainian public’s access to information.”

Canada discovered a huge interruption to its critical infrastructure recently when a service outage at Rogers made millions lose internet and wireless service and closed down Interac debit payments across the country.

Parsons said both the government and Rogers have disclosed that the interruption was not due to an attack. “So at least to date, there is no indication that this was anything other than an incredibly unfortunate” update to Rogers systems, he said.

CSE strongly encouraged organizations in highly critical sectors to report “compromises or potential compromises,” noting that the “lack of incident reporting remains a challenge” in the recent bulletin.

Carvin revealed that in issuing the bulletin, the CSE isn’t warning of a cyberwar, but is attempting to encourage Canadian companies to upgrade their cyber defences, and to encourage companies to approach the agency if they’re hacked.

Last month, the Liberal government instituted legislation that would put new responsibilities on operators in the federally regulated telecom, finance, transport, and energy sectors to ensure cybersecurity of their systems which include reporting incidents to the CSE.

The national security experts revealed that the report of CSE is significant in stating there is a cyber side of the war in Ukraine, which hasn’t been visible. Parsons said it “perhaps lays to rest the public discussion of ‘where is the cyber’ in the war.”

Carvin disclosed that the CSE is “trying to say there’s a lot more cyber activity here than maybe what a lot of people believe.”