Spy agency chief says new powers would help stop cyberattacks before they happen
OTTAWA The head of Canada’s cyberspy agency says new powers proposed by the Trudeau government would let her institution stop cyberattacks before they are launched — instead of having to sit back and wait for them to happen.
Communications Security Establishment chief Greta Bossenmaier made the comments to a parliamentary committee on Thursday as she revealed the agency has been working overtime to block attacks on federal networks.
“We’re now blocking over one billion malicious attempts to compromise government systems on average every day,” Bossenmaier said during an appearance alongside Defence Minister Harjit Sajjan. “One billion attempts.”
That equates to more than 11,500 every second, which the committee was told includes everything from minor pokes to assess the strength of a system, to malware, to dedicated hacking.
That is where the Trudeau government’s proposed national security legislation, Bill C59, would come in, Bossenmaier said, and help nip some of those attacks in the bud by giving the CSE the power to launch offensive cyber operations.
“Instead of sort of standing back with a shield to try to protect against these billion malicious attempts per day and waiting for them to happen, we could actually go and say: ‘Let’s try to stop that cyberattack even from happening’,” she said.
“So there could be a server outside that we know is now trying to infiltrate a Canadian system and steal Canadians’ information, we could through this legislation ‚Ķ stop that attack before it actually gets to our shores.”
That ability to stop an attack before it happens is only one potential use for the CSEs’ proposed new powers; the agency could also halt a terrorist attack and support military operations.
But the move toward government-authorized cyberattacks has raised numerous questions: What if, for example, Russia or China were behind an attack? How much information does the CSE need before acting against a potential threat?
A December report by leading Canadian cybersecurity researchers, said there is no clear rationale for expanding the CSE’s mandate to conduct offensive operations.