And The Culprits Are...

"A number of federal organizations are just not obligated to obtain cyber defence services from the government. Sometimes they'll say it's because they're 'independent'."

"Many of these organizations, including Crown corporations, have knowingly declined the protection."

"We believe that puts them, their data, their people, their systems, and the government as a whole at considerable risk, because of course we're joined at the hip."

National Security and Intelligence Committee of Parliamentarians (NSICOP) Chair David McGuinty

"Information losses were considerable, including email communications of senior government officials, mass exfiltration of information from several departments, including briefing notes, strategy documents and Secret information; and password and file system data."

NSICOP Report

Pexels

 

A redacted report was tabled in Canada's Parliament with key findings by the National Security and Intelligence Committee of Parliamentarians alerting the government to the fact that some federal organizations refuse to take advantage of crucial cyber defence services from their own security and IT agencies. This, when government organizations world-wide are targeted by unprecedented levels of cyber threats, emanating mostly from China and Russia.

The government's centralized IT service, Shared Services Canada (SSC) and its cyber-security agency, the Communications Security Establishment (CSE) have engineered a "very strong" cyber defence system, ostensibly to be put to immediate protective use by all government departments. Of the government's 169 organizations a mere 43 are required to receive all their key digital services (networks, email and data centres) from SSC and its Enterprise Internet Service (monitored for threats and secured by CSE).

The balance of the organizations consider themselves exempt from the need to make use of super-security offered because they are not mandated to as are the 43 that adhere to the need to protect their groups. All government sensitive and confidential data are to be contained within, for the purpose of averting cyber attacks. The recommendation was made that all federal organizations be obliged by law to use the services within government auspices to block cyber attacks "to the greatest extent possible". 

The report outlined CSE having blocked 1.3 billion hostile attempts to infiltrate government networks each and every day in 2019-2020, an increase from the 282 million blocked in 2015-2016. The "wake-up-call" for the federal government for the need of enhanced cybersecurity vulnerabilities arrived with the occurrence of a year-long cyber attack in 2010 by China, detected when CSE deployed "cyber defence sensors" on the government's secure network; a "turning point".

That mass cyber attck targeted 31 federal departments, leading to "severe compromises within eight of those departments". Finance Canada and the Treasury Board of Canada Secretariat were the hardest hit; both lost entire sets of network passwords: and were then forced to disconnect their networks completely from the internet for an undisclosed period.

The cost to restore and recover from a successful cyber attack was staggering; over $100 million and "years-long" efforts to rebuild the National Research Council's network following a devastating cyber attack by a Chinese state-sponsored actor in 2014. China, it was found, had purloined over 40,000 files from the NRC's highly sensitive network, along with gaining access to other government organizations in the process. Three other previously unknown cyber attacks impacted Canadian organizations.

China and Russia, emphasized the report, remain the most sophisticated state-sponsored cyber threats to Canada, while Iran, North Korea and four other unspecified countries were hard on their heels. The report describes China as a "prolific" threat targeting multiple government sectors for the purpose of maintaining internal stability and developing as a global power. China focused some of its cyber efforts on Canadian research networks in particular, since the beginning of the pandemic.

Russia is highlighted as "the most prolific" threat actor to target the government of Canada, employing non-state actors such as private companies and "troll farms", along with cyber criminals on its behalf in conducting cyber threat activities. But not everyone agrees with this assessment...

"From American sources, it follows that most of the cyber attacks in the world are carried out from the cyber realm of the United States. Second place is Canada. Then two Latin American countries. Afterward comes Great Britain. Russia is not on the list of countries from where — from the cyber space of which — most of the various cyber attacks are carried out."

Russian President Vladimir Putin

Russia: "Main Issue", "Secondary Issues"

"As far as this document goes, there is a reaction that allows us to hope for a start of a serious discussion but on secondary issues."

" There is no positive reaction to the main issue."

Russian Foreign Minister, Sergey Lavrov

"There is a scope for dialogue."

"[President Putin would analyze the response in full before any further move]. It would be foolish to expect an answer as early as next week."

Dmitry Peskov, spokesman, for Vladimir Putin

"It's always very sensitive when it's about children. It creates a lot of tension and stress for the parents, for the whole society."

"It ties up law enforcement services It's easier to make a mistake when the constant tension makes everyone tired."

"It is [meant to] destabilize and demoralize the population."

Alina Prolova, deputy head, Ukraine Center of Defense Strategies think tank, former deputy defence minister of Ukraine

A morning at a school in Kiev.  Oleksander Shcherbyn, Ukrainian police demining unit

 

At strategic loggerheads, both sides -- in the debate over whether or not the long build-up of Russian troops and military equipment on the border with  Ukraine is meant to intimidate in the short term, and prepare for an invasion in the longer term -- digging in their heels. While Moscow claims it is prepared for "serious conversations" to defuse the Ukraine crisis, the U.S. and NATO have proposed areas of co-operation on a wider scale.

To an objective observer, defusing Moscow's concern over American and NATO missile silos defensive sites in Europe which Russia views as having hostile intent toward it,  and has led Moscow to denounce U.S. and NATO intentions as militarily malicious, would rank high. Certainly more so than Vladimir Putin's ultimatum to NATO that it must withdraw its members' forces from eastern Europe, and it must never allow Ukraine entry to the military alliance.

But the disposition of Ukraine as a fully sovereign nation entitled by international law to decide its own fate and alliances looms with greater importance to Mr. Putin who views Ukraine as a geographic, cultural, social and political part of Greater Russia. Washington has proposed vital cooperation in areas that should be of great concern to both political adversaries; reviving arms control treaties, limiting military exercises; granting Moscow access to NATO sites in Europe for observational purposes.

 

The DFRLab uses social media monitoring and geolocation techniques to identify the presence of Russian forces deployed along Russia’s border with Ukraine. Those forces are now present in Belarus as well. (Source: Michael Sheldon/DFRLab/OpenStreetMap)

 

This is what Moscow refers to as "secondary issues". Its determination to possess command of Ukraine transcends the issues that are intended to make the world a safer place. So misdirected its priorities as to bemuse any rational mind. Instead, cyber attacks, threatening rhetoric, scheduling war games with nations bordering Ukraine that are firmly in Russia's political orbit continue to fray the sense of national security that sustains Ukraine.

And in Kyiv a Ukrainian bomb disposal expert is teaching students at a school in the capital all about explosives and what to be aware of. The training was organized by law enforcement following a series of hoax bomb alerts that forced the evacuation of schools in the city along with others, including the cities of Kharkiv, Lviv and Zaporizhzhia. These are threats targeting schoolchildren with fear-mongering that point directly to Russia in its hybrid war.

"The purpose of Russian special services is obvious -- to put additional pressure on Ukraine, sow anxiety and panic among the public", explained Ukraine's Security Service which had recorded over 300 bomb threats so far this year alone in comparison to 1,100 that took place during the entire 2021 year. Russian officials, on the other hand, blame Ukraine for similar bomb hoaxes, forcing Russian schools, shopping centres and kindergartens to evacuate tens of thousands.

It is difficult to credit mature societies, responsible governments resorting to such tactics meant to intimidate, strike fear, and demoralize another society. Striking at the very heart of any civilized society by targeting the most vulnerable in the population; its children. Ukraine's Center of Defense Strategies think-tank concentrates on what it speaks of as the main threat it faces; "a hybrid invasion" comprised of more cyber attacks, disinformation, and bomb threats aimed at schools, subway systems, administrative offices and other civil and official infrastructures.

Leaving Kyiv to hold emergency bomb drills for children. Where bomb experts explain that a small, unassuming-looking device is capable of holding a kilogram of explosives with enough power to kill anyone standing within five metres, wounding others up to 15 metres' distance. Classes shown video clips of explosions along with explosive devices meant to appear as though they're a box of chocolates or a mobile phone case.

Hundreds of Ukrainian schools have had to be evacuated since the start of the year amid a spate of fake bomb threats that Kyiv blames on Russia.

China's Cyberwarfare Attacks

"APT 40 almost certainly consists of elements of the Hainan State Security Department's regional MSS office."

"This group's cyber activities targeted critical research in Canada's defence, ocean technologies and biopharmaceutical sectors in separate malicious cyber campaigns in 2017 and 2018."

Global Affairs Canada

"Responsible states do not indiscriminately compromise global network security nor knowingly harbour cyber criminals -- let alone sponsor or collaborate with them."

U.S. Secretary of State Antony Blinken

Canadian Foreign Minister Marc Garneau, speaks during a meeting with US Secretary of State Antony Blinken, at the Harpa Concert Hall in Reykjavik, Iceland, Wednesday, May 19, 2021, on the sidelines of the Arctic Council Ministerial summit. (Saul Loeb/Pool Photo via AP)

 

Global Affairs Canada (Department of Foreign Affairs) has finally, publicly, named China's Ministry of State Security as the state actor responsible for organizing and orchestrating an extensive hack on Microsoft email software earlier in the year. Canada, its allies and their intelligence agencies have a high degree of confidence in charging the state intelligence agency of involvement in the attack. Canada also linked a regional office within the Ministry of State Security which had targeted Canada's defence, biopharmaceutical and oceanic technology sectors in a 2017 series of attacks extending into 2018.

Puzzlingly, with this knowledge and the ongoing warning by Canada's own intelligence agencies against China's cyber attacks, official Canada still made allowances for China and continued permitting Beijing to interfere with Canada's internal affairs, from harassing Chinese-Canadians to persuading Canadian universities to sign on to Chinese cultural programs financed by Beijing and buying out critical Canadian resource companies.. Leaving Canadian scientists working out of universities and official governmental scientific arms to sign contracts with and cooperate with Chinese research institutes and scientists.

Canada appears finally to have surrendered its fascination with China's vast outreach and the wealth that can be gained in free trade agreements with the trade behemoth and the urgency of Canadian corporations to invest in China including production and sharing of trade secrets for the promise of access to its vast market and the profit to be made therein. The massive hack of Microsoft email where over 400,000 servers were infiltrated, causing widespread shutdowns forced on government and corporate operations led to Canada and its allies casting aside kid gloves.

Microsoft referred to the company involved in the attack as a state-backed hacking group it referred to as Hafnium, involved in attempts to steal information from defence contractors, law firms and infectious disease experts. Canada, the U.K. European Union, Japan, Australia New Zealand and the North Atlantic Treaty Organization, joined by the United States all contributed to statements blaming China's MSS agency for the worldwide-cyber attacks. 

 

The Canadian Centre for Cyber Security is urging organizations to protect businesses that use the Microsoft Exchange server because of a massive hack aimed at stealing data. CBC

 

Global Affairs Canada identified the Microsoft attack as having likely been the work of the Advanced Persistent Threat Group 40 (APT40), representing a group with direct ties to the People's Republic of China, described as a "highly sophisticated" network, able to achieve "sustained, covert access to Canadian and allied networks beyond the compromising of Microsoft exchange servers". A 2018 strategic cyber-attack by China attempted to secure data from myriads of foreign governments at which time a similar communication was aired.

The United States, in joining forces with the other nations impacted by China's hacking has committed to instituting remedial steps to counter the hostile cyber activities. Foreign Minister Dominic Raab of the United Kingdom spoke of "irresponsible cyber activity emanating from China", even as Australian Foreign Minister Marise Payne spoke of "serious concerns about malicious cyber activities by China's Ministry of State Security."

Four Chinese nationals with links to the Ministry of State Security's campaign to hack into computer systems of dozens of companies, universities and government entities in the U.S. and abroad between 2011 and 2018, were charged in the U.S. Monday, the indictment alleging the hackers targeted Ebola vaccine research among other areas. Competition with China, according to President Biden, appears one of the defining challenges of the century for the U.S.

 

Western governments said on Monday they are highly confident that hackers under the control of China’s Ministry of State Security breached the security of Microsoft Exchange, affecting 400,000 e-mail servers worldwide.   Steven Senne/The Associated Press

When the Biden administration decided to leave in place the former Trump administration's tariffs, the Chinese were taken by surprise, as well as being infuriated when the U.S. threw its support for an Australian demand on the world community through the United Nations, to have the World Health Organization conduct a deep review of how the COVID-19 pandemic began, and whether a leak from a laboratory in Wuhan might have been involved in the release of a deadly virus.

Canada's Communications Security Establishment issued over 2,500 foreign intelligence reports in 2020 to "alert and inform" officials from 28 departments and agencies of attempted cyber attacks. It was hard put to provide aid to the Government of Canada or its critical infrastructure partners no fewer than on 2,206 occasions, including 84 incidents "affecting Canada's health sector", last year. "Espionage and foreign interference activity at levels not seen since the Cold War", was identified in a separate study by CSIS, involving for the most part Chinese and Russian-backed actors.

Joe Biden and Chinese president Xi Jinping were all smiles in this file photo from when they met in 2013. President Biden now blames Chinese interests for a massive hack of the Microsoft Exchange server earlier this year. (Lintao Zhang/Reuters)

"Terrorism" Outrage in Tehran

"The question is: what caused it - a cyber-attack or a physical act of sabotage, like a bomb?"

"The speculation of cyber-attack comes because Natanz is Ground Zero for cyber-war - the place where the world's first real cyber-attack took place a decade ago." 

"Most events called cyber-attacks are not really attacks in the physical sense - they are thefts of data. But Stuxnet - the name given to the incident that targeted Iran's nuclear programme over a decade ago - is not just one of the few exceptions but arguably also the first demonstration of what such a cyber-attack looks like."

"In that case, computer codes caused real-word damage by interfering with the centrifuge controllers to spin them out of control (and even relaying false messages back to those monitoring them so they would not worry until it was too late). The result was what sounded like a slow-motion explosion as centrifuges crashed into each other. It was an incredibly sophisticated and targeted operation, run jointly by the US and Israel and developed over a period of years."

Gordon Corera, Security correspondent, BBC   

Within hours of Iran proudly announcing the launch of its latest centrifuges, a power blackout damaged some of the precious machines at its site in Natanz.

Iranian authorities are furious. Yet another attack against their peaceful intentions to become nuclear-sufficient. Life is so unfair. "Terrorists" targeted the underground-secreted, bunker installation at Iran's  Natanz nuclear facility; an obvious act of "nuclear terrorist". This is the contorted reasoning for which Tehran's Ayatollahs and its Islamic Revolutionary Guard Corps is famous. As sponsors of terrorism, the godfathers of terrorist groups with whom Tehran conspires to wreak atrocities abroad, spread a network of like-minded Islamists globally, threaten the stability of the Middle East and its Sunni neighbours, warn Israel repeatedly of Iran's intention to destroy it, the Islamic Republic is a sterling world citizen.

Placing the blame on the state of Israel for infiltrating Iran's inner circles through intelligence agencies recruiting disaffected Iranians working underground to destabilize the Iranian Republic, human intelligence resources working hand-in-glove with Israeli intelligence has been able, time and again to demonstrate its capabilities in interfering with the internationally proscribed nuclear program that Tehran is determined to succeed with. Elimination of the IRCG's top general was ascribed to Israel even though it was a planned American operation. The targeting of a number of top Iranian nuclear scientists is considered to be a result of Israel's advanced technology enabling it to extinguish those lives.

But it might easily have been the work of disaffected Iranians, longing for the opportunity to free the country of the control of its Shi'ite Islamist fundamentalists whose agenda is to create a vice-grip on the Sunni Arab states by forming a dedicated extremist military clique prepared to dominate the Middle East and destroy the Jewish state. Previous Iranian President Mahmoud Ahmadinejad stood before the general assembly of the United Nations voicing Iran's intention to destroy Israel, and there were no formal repercussions forthcoming when one member of the UN baldly stated its intention to eliminate another. 

The Islamic Republic of Iran fits all the metrics of 'terrorism', from its control and direction of Lebanon-based Shiite terrorist militia Hezbollah, to its support of Hamas in the Gaza Strip, and that of the Houthis in Yemen. The alliance it has formed with Iraq, Syria, Qatar and Lebanon pits the two main branches of Islam, Sunni and Shi'ite against one another in a bitterly violent upheaval of sectarian hatred. Iran is directly involved in the mass murder of Yemenite and Syrian civilians through the directed influence of the al-Quds division of the IRGC. 

Banks of centrifuges at the Natanz nuclear plant    Reuters

All of this is well enough established and yet the European Union spearheads a return to the nuclear agreement that gave practical assent to Iran's ongoing nuclear program, now re-joined by the new U.S. administration. With or without the nuclear agreement in force, Iran stealthily and steadily proceeded with its verboten nuclear enrichment. The International Atomic Energy Agency discovered through its limited inspections ample evidence that the IRGC detonated atomic devices surreptitiously, but of course for strictly 'peaceful' purposes.

Israel has warned time and again of its existential concerns over a country dedicated to terrorism which has directly threatened its security by plainly stating repeatedly its intention to wipe Israel from the map of the Middle East, that it will not tolerate nuclear weapons in the hands of a country as violently belligerent as Iran. Technological advances in the accuracy and range of ballistic missiles which can have one purpose only beyond conventional warfare, to carry nuclear warheads would be aimed directly at Israel. Possession of those nuclear weapons will play a fundamental role in ensuring that the Arab Muslim nations of the Middle East must take especial care in dealing with a viciously controlling Iran.

So now that, yet again, Iran accuses Israel of 'nuclear terrorism', reserving the 'right' to take active action against the 'perpetrators', the world has been put on notice that more drama is set to ensue courtesy of the Islamic Republic. The 'problem' with the electrical distribution grid of the Natanz site that 'caused an incident' as a result of a cyber attack -- popularly attributed to Israel's Mossad, its external intelligence-and-action arm -- in actual fact, caused more than an 'incident'. Expectations are that the damage that ensued with this carefully constructed cyber attack will set back Iran's nuclear ambitions for close to a year. 

Germany, whose historical record with Jewry represents a colossal milestone in hideous genocide has a shameful soft spot for doing business with Iran, and deplores this act of sabotage as being 'unhelpful', while not recommending out of the goodness of its love for the state of Israel and its Jewish heritage anything remotely 'helpful' in possibly restraining a terrorist regime from carrying out its promised agenda of launching another Holocaust.

"While condemning this despicable move, Iran emphasizes the need for the international community and the International Atomic Energy Agency to deal with this nuclear terrorism and reserves the right to take action against the perpetrators."

Iranian nuclear chief Ali Akbar Salehi

The international community, the United Nations and its various bodies and committees choose not to react when Iran threatens the destruction of Israel, but Iran has full expectations and the chutzpah to go with it, that there will be global condemnation aimed at Israel for interrupting the methodology by which Iran plans to annihilate the Jewish state. The timing of the cyber attack can be viewed as a message, from Israel to all those who tolerate Iran's terrorism with implacable cynicism, that Israel has no intention of sitting back complacently while Tehran builds the wherewithal for its destruction.

"The fight against Iran's nuclearization ... is a massive task", commented Prime Minister Benjamin Netanyahu on the occasion of a ceremony with the Israeli military and intelligence chiefs to mark the 73rd anniversary upcoming of the founding of the State of Israel. Tehran's strictly peaceful nuclear program last year saw a fire break out at the facility; eliciting another claim by Iran of an attempt to sabotage the country's nuclear ambitions. 

Natanz is an uranium enrichment facility about 250km south of the Iranian capital Tehran   Maxar Technologies