Canadian political parties have already been targeted by at least one foreign state-backed hacking campaign, the Star and BuzzFeed News have learned.
The Communications Security Establishment, one of Canada's security agencies, said Monday that “political parties, candidates and staff” were the target of one-tenth of state-sponsored hacking campaigns against the democratic process globally in 2018.
The spy agency was cautious in its wording of a long-awaited report into the threats to this October’s general election.
But the report makes clear that Canadian political parties and operatives have already been the target of sophisticated state-sponsored hacking in advance of this year’s general election — a fact that was not challenged by a senior intelligence source Sunday night.
This is a particular problem in Canada, where federal parties are not subject to any rules around what information they can collect, store, and analyze about Canadian citizens, and have no minimum standards for data security.
“[Foreign hackers] may steal information and then release it to the public for the purpose of embarrassing or discrediting the political party or candidate. In order to enhance this effect, a threat actor may modify information before releasing it to the public,” the report, which was shared with media organizations Sunday night, reads.
“Foreign adversaries may steal voter or party databases because they fetch a price on illicit areas of the internet, where large quantities of personal identity information are constantly bought and sold. They can steal sensitive campaign documents and communications and sell or release them. And they can disrupt or destroy a party’s information, networks and devises using malware, such as ransomware.”
The Star and BuzzFeed News reported last month that Canadian law enforcement and security officials are concerned that foreign actors are already attempting to influence the federal election.
In the United States, the United Kingdom, France, Germany, and Australia — all key allies to Canada — political parties have been targeted by cyberattacks during electoral events.
“We judge it very likely that foreign cyber interference against Canada would resemble activity undertaken against other advanced democracies in recent years,” the report reads.
“Foreign adversaries have attempted to sway the ideas and decisions of voters by focusing on polarizing social and political issues, promoting the popularity of one party over another, or trying to shape the public statements and policy choices of a candidate using cyber tools or social media platforms.”
The federal government has done little to insulate Canada from the threat.
Political parties are now required to publish privacy policies, but there is no independent oversight or auditing capabilities. There are no minimum standards on security practices. Democratic Institutions Minister Karina Gould has, for the time being, ruled out rules for how political parties handle Canadians’ personal information.
According to CSE’s report, 88% of attacks on the “democratic processes” globally since 2010 have been “strategic” in nature — meaning not the compromises were not simply incidental to the ever-growing problem of cybercrime.
There is almost no precedent for this kind of report from a Canadian spy agency. While the CSE released a general report about threats to Canada’s elections in 2017, in the height of public interest in the 2016 US presidential election and the Kremlin’s meddling, there has been little specific intelligence released about threats to the Canadian electoral process.
“We assess that an increasing number of foreign adversaries have the cyber tools, the organizational capacity and a sufficiently advanced understanding of Canada’s political landscape to direct cyber interference during the 2019 federal election, should they have the strategic intent,” the report reads.
“[We] consider foreign cyber interference of the scale of Russian activity against the 2016 United States presidential election improbable at this time in Canada in 2019. However, we judge it is very likely that Canadian voters will encounter some form of foreign cyber interference ahead of, and during, the 2019 federal election.”
BuzzFeed News and the Toronto Star are investigating the ways in which political parties, third-party pressure groups, foreign powers, and individuals are influencing Canada’s political debate in the run-up to this fall’s federal election. This report was published as part of that collaboration.