Military lags in updating security awareness

• More than three years after a military officer was found guilty of selling secrets to the Russians, Canadian Forces personnel and Defence Department public servants have yet to complete mandatory security awareness training.

All military personnel and DND public servants were to have taken the online course designed to boost security awareness, part of measures brought in after the arrest of Canadian intelligence officer Jeffrey Delisle, who sold information to the Russians.

That training course was supposed to be completed by all military and civilian employees by June 2015.

But figures compiled in a newly released DND audit showed that only 65 per cent of personnel in Ottawa and Gatineau, Que., have completed the course. The audit did not provide any detail about military and civilian personnel in the rest of the country.

A request to the DND for up-to-date information yielded incomplete results. The department says it is no longer tracking separately any numbers related to personnel in Ottawa, the site of the military’s various headquarters.

But it acknowledged not all civilian or military staff have taken the security training, despite the deadline.

It said it has received responses from at least half DND and Canadian Forces organizations across the country.

Of those unnamed units and offices, the completion rate for the security course is “well over 80 per cent,” but no details, such as where the organizations are located, were provided.

The military and the Defence Department do not know how the other 50 per cent of its organizations have fared.

But they believe the completion rate will reach 80 per cent or better.

“We expect to have the rest of the data by this summer,” said spokesman Capt. Fraser Clark.

It is unclear at this point how the military and DND will deal with those who have still not completed the training.

DND sources say it is likely a new order will have to be issued to remind military staff and public servants the deadline has long passed and they are required for security reasons to complete the training.

Over the years, DND security audits have outlined many problems and little progress in fixing those. For instance, the officer in charge of security did not have any authority or staff to make improvements, one of the audits noted.

But that changed in 2013 as the Delisle case forced the military into action. A security reform team was established. The mandatory online training course was put in place.

“This department-wide, high-level training is a good start in addressing the issues with respect to the lack of training and awareness,” the newly released audit found.

It determined that significant progress had been made, but there were still problems with security. However, the details were censored from the audit.

In addition, security breaches have continued.

An investigation was launched this month into a sailor who served on HMCS Charlottetown; the individual allegedly stored secret information on a personal computer network.

In January, the navy found there had been five security breaches of its secure military computer network at a training school in Halifax.

In September 2015, more than 1,000 secret documents were discovered on the personal computer drive of a web designer working at the Halifax dockyard.

Halifax was also the site of the Delisle spy case.

The Canadian Forces officer had been working at HMCS Trinity, a naval intelligence and communications centre when he passed information to the Russians. He pleaded guilty to breach of trust and communicating information to a foreign entity that could harm Canada’s interests.

In February 2013, Delisle was sentenced to 20 years in jail. A previously released damage assessment completed by intelligence officials said the secrets he gave the Russians had “caused severe and irreparable damage to Canadian interests.”