Canada’s electronic spy agency has warned the country’s political parties, candidates and news media that it is “highly probable” the increasing cyber threat activity against democratic processes around the world will be seen here.
In a report issued Friday the Communications Security Establishment (CSE), which looks after protecting federal networks, said specifically it expects “that multiple hacktivist groups” will very likely deploy cyber capabilities in an attempt to influence the democratic process — including disrupting political parties, candidates and the media — during the 2019 Canadian federal election. “We anticipate that much of this activity will be low-sophistication, though we expect that some influence activities will be well-planned and target more than one aspect of the democratic process.”
For example, it notes that in 2015 the hactivist group Anonymous leaked reports about the redevelopment of Canada’s key diplomatic centres in Britain.
The warning applies not just to federal political parties and candidates, but to local candidates as well.
Affected groups are urged to consider CSE’s Top 10 IT security actions, advice on cyber hygiene and advice on mobile security.
Because federal elections are still largely paper-based and Elections Canada has a number of legal, procedural, and information technology measures in place which mitigate cyber threats, CSE doesn’t think it likely a federal vote will be tampered with. Instead it says the greater risk is to political parties — by DDoS attacks, defacing a Website, blackmail, tampering with a party voter database or releasing embarrassing material — and the media — by trying to inject false news.
The agency hasn’t yet seen nation-states using cyber capabilities to influence the democratic process in Canada during an election. Whether that remains the case for the next federal election depends on how other countries perceive our foreign and domestic policies, and on the policies of federal candidates, the report says.
“While there is a risk that cyber capabilities could be used to covertly change the vote count and lead to a different election winner,” says the report, “we assess that this would be very challenging for an adversary to accomplish if elections were conducted in a manner that includes cybersecurity best practices and paper processes that occur in parallel. In general, it is likelier that adversaries would use cyber capabilities to disrupt the voting process in order to sow doubt among voters about the fairness of the election.”
Daniel Tobok, CEO of Cypfer, a Toronto-based cyber breach investigation firm, said “it’s refreshing to see them ringing the alarm and waking up people … People should not have a false sense of security.”
Satyamoorthy Kabilan, director of national security and strategic foresight at the Conference Board of Canada, called the report “astute,” noting “overt” cyber incidents during the recent U.S., French and German elections. Part of that is “fake news” spread through social media and regular news outlets to influence political discussions.
The challenge for reporters, he added, is verify where information is coming from.