skip to main content (press enter)

CBC Global Header Navigation




Foreign hackers attack Canadian government

Computer systems at 3 key departments penetrated

Last Updated: Thursday, February 17, 2011 | 1:05 PM ET

An unprecedented cyberattack on the Canadian government also targeted Defence Research and Development Canada, making it the third key department compromised by hackers, CBC News has learned.

The attack, apparently from China, also gave foreign hackers access to highly classified federal information and also forced the Finance Department and Treasury Board — the federal government's two main economic nerve centres — off the internet.

Defence Research and Development Canada works to assist in the scientific and technological needs of the Canadian Forces. It is a civilian agency of the Department of National Defence.

The cyberattack, first detected in early January, left Canadian counter-espionage agents scrambling to determine how much sensitive government information may have been stolen and by whom.

Highly placed sources tell CBC News the cyberattacks were traced back to computer servers in China.

They caution, however, that there is no way of knowing whether the hackers are Chinese, or some other nationality routing their cybercrimes through China to cover their tracks.

So far, officials in Prime Minister Stephen Harper's government have been all but mum on the extraordinary breach of security.

The government initially issued a terse statement, passing it all off as merely an "attempt to access" federal networks. It has refused to release any further information.

Finance, Treasury Board

The hackers apparently managed to take control of computers in the offices of senior government executives as part of a scheme to steal the key passwords that unlock entire government data systems.

It is unclear whether the attackers were able to compromise other departmental computer networks, including those that contain Canadians' sensitive personal information such as tax and health records.

Michel Juneau-Katsuya, a security analyst and former CSIS intelligence officer, told CBC News on Thursday "all indications point at China" as the origin of the attempted cyber espionage.

He added that any such attack would have some connection to the government in China, which is also known for producing so-called "patriotic hackers" devoted to targeting institutions or governments perceived as threatening to the government at home.

Juneau-Katsuya said he believed Canada is seen by China as "a land of opportunity to get natural resources that they need so, so much."

The Chinese Foreign Ministry denied on Thursday that the Chinese government was responsible for the attack.

Once the attack was detected in early January, Canadian government cybersecurity officials immediately shut down all internet access at the Finance Department and the Treasury Board, in an attempt to stop stolen information from being sent back to the hackers over the net. In an earlier attack, Defence Research and Development had to shutdown access to one of its servers for two months.

The move left thousands of public servants without internet access, although officials in both affected departments report service has slowly been returning to normal since the attack.

While the government is trying to keep the embarrassing security breach under tight wraps, even from its own employees, a number of sources involved in the investigation agreed to speak to CBC News on condition of anonymity.

Canadian techno-gurus

This extraordinary tale of the Canadian government being targeted in cyber warfare actually began in 2009 with an international investigation by a group of Canadian techno-gurus whose findings shook the security world.

The group, called the Information Warfare Monitor, reported that an electronic spy network based mainly in China had hacked into almost 1,300 government computers in 103 countries.

They called the massive and now-infamous cyberspying operation GhostNet.

While many countries immediately moved to strengthen their defences against potential cyberattacks, it wasn't until the fall of 2010 that the Canadian government went on high-alert against potential electronic intruders.

Leading that task was the Communications Security Establishment Canada (CSEC), a little-known branch of National Defence, and the country's only electronic eavesdropping agency.

Sources say the agency went hunting for any signs the federal government networks might have been compromised.

Turns out they had.

At least two departments, Finance and Treasury Board, and the DND agency, had been compromised the same way the China-based hackers behind GhostNet had penetrated more than 100 other governments around the world.

How it was done

In the world of cybercops, it is called "executive spear-phishing."

Here's how it worked:

Sources say hackers using servers in China gained control of a number of Canadian government computers belonging to top federal officials.

The hackers, then posing as the federal executives, sent emails to departmental technical staffers, conning them into providing key passwords unlocking access to government networks.

'There is nothing particularly innovative about (phishing). It's just that it is dreadfully effective.'—Computer expert

At the same time, the hackers sent other staff seemingly innocuous memos as attachments.

The moment an attachment was opened by a recipient, a viral program was unleashed on the network.

The program hunts for specific kinds of classified government information, and sends it back to the hackers over the internet.

One source involved in the investigation said spear-phishing is deadly in its simplicity: "There is nothing particularly innovative about it. It's just that it is dreadfully effective."

Effective indeed, especially against a government cybersecurity system that has long been described as a sieve.

Auditor-General Sheila Fraser, for one, first raised the alarm in 2002 when she warned "there are weaknesses in the system.

"There are access controls that need to be fixed; there are a whole series of minimum security issues that are not being dealt with. There are vulnerabilities. Government needs to fix them."

Three years later, Fraser checked again and found not much had changed.

"It is important that these things be dealt with and be fixed — the government is vulnerable to attacks."

Evidently, it still is.




    More Politics Headlines

    Military launching 5 new support centres
    Defence Minister Peter MacKay has announced millions of dollars in funding to expand a network of centres to help ill and injured current and former Canadian Forces personnel and their families.
    Cyberattack defences in place, PM says Video
    Prime Minister Stephen Harper says the government has a strategy to protect computer networks, following the revelation that at least three key departments had their systems compromised by hackers.
    Hackers after weapon information: expert
    Foreign cyber hackers who attacked federal government departments could have been looking for information on weapon technology and natural resource policy, an expert in China's cyber spying program says.
    Speaker asked to investigate Oda Video
    For the fourth day in a row, opposition MPs hammered at Bev Oda, accusing the government of a pattern of abuse.
    U.S. travel fee proposal criticized by Harper
    Prime Minister Stephen Harper says he doesn't think much of a new border tax that's being proposed by the United States, calling it a cash grab designed to help a budget crisis.

    Top Headlines


    Inflation rate edges down to 2.3% in January
    The annual inflation rate edged down one-tenth of a percentage point to 2.3 per cent in January compared with the same month in 2009, Statistics Canada reported Friday.
    Military launching 5 new support centres
    Defence Minister Peter MacKay is set to announce millions of dollars in funding to expand a network of centres to help ill and injured current and former Canadian Forces personnel and their families.
    Latimer still defends killing daughter Video
    EXCLUSIVE: Saskatchewan farmer Robert Latimer stands by his decision to end the life of his severely disabled daughter almost 20 years ago, in his first interview since being released on full parole in December.
    Bahrainis call for monarchy's downfall Video
    Thousands of Bahrainis are calling for the downfall of their ruling monarch, one day after at least five people were killed in a brutal attack by the kingdom's military.
    Egyptians stage Tahrir Square victory march
    Egyptian pro-democracy leaders held a victory march on Friday to celebrate the overthrow of Hosni Mubarak's nearly 30-year rule one week ago.