Canada lags behind allies in cybersecurity

File reveals Ottawa follows 2010 strategy, spending little compared to other countries

OTTAWA— Canada’s closest allies are pumping billions into new cybersecurity plans as Ottawa ponders a new approach to defending the country’s vital cyber systems and networks.

A 2016 briefing note prepared for Prime Minister Justin Trudeau noted the U.S., U.K., Australia and New Zealand have all updated their cybersecurity strategies, with the U.S. planning to spend $24 billion to bolster the country’s defences.

Canada is still operating under a cybersecurity plan devised in 2010. And compared with the updated plans of the other “Five Eyes” countries, Ottawa spends comparatively little to protect the public and private systems that underpin everything from online banking to the government’s top-secret network.

The briefing note was prepared by Canada’s most senior public servant, Michael Wernick, and obtained under access to information law.

In it, Wernick stated that these “allied strategies reflect a fundamental enlargement of cybersecurity issues into policy areas” including research and development, trade and market development, and international relations.

They also emphasize cybersecurity needs to be addressed across all government departments, Wernick wrote.

The Liberals have pledged to revamp Canada’s approach to cyberdefence, and recently completed months of public consultations on the issue.

The results of that survey have not been made public, but are expected to be released by Public Safety Minister Ralph Goodale sometime this spring.

Scott Bardsley, a spokesperson for Goodale, said that it was premature to talk about what the Liberals’ ap- proach to cybersecurity will be.

“When Canada’s current cybersecurity strategy was launched over seven years ago, there was no Instagram and Netflix had just launched in Canada,” Bardsley noted.

“A lot has changed since then, which is why the prime minister mandated a review of measures to protect Canadians and our critical infrastructure from cyber threats.”

Bardsley pointed to $77.4 million committed in the Liberal’s first budget to improve the “security of government networks and information technology systems.”

But that money is spread out over five years, and only $27 million is expected to be spent before 2019.

Australia, Wernick’s briefing note states, has committed $227 million for cybersecurity over the next five years.

Australian Prime Minister Malcolm Turnbull also appointed a new minister of cybersecurity, as well as an adviser and “cyber ambassador.”

In a statement this week, Turnbull called cybersecurity the “new frontier of warfare.”

“This is the new frontier of warfare, the new frontier of espionage, it’s the new frontier of many threats to Australian families, to governments, to businesses,” Turnbull said in a statement.

Turnbull connected the threat directly to allegations that Russia interfered with the 2016 U.S. presidential election. American intelligence officials allege Moscow hacked the emails of several prominent Democratic party officials and released them through WikiLeaks.

In an unclassified report, U.S. spies alleged Russian President Vladimir Putin was personally involved in the hacking campaign, a claim Moscow denies.

The U.S. has proposed $24 billion in spending to enhance government cybersecurity, as well as to help private businesses and individuals to protect themselves, the briefing note states. President Donald Trump, who dismissed the recent allegations of Russian hacking as a “witch hunt” and who has professed an admiration for Putin, has said that he will appoint a team within the coming months to “aggressively combat and stop cyberattacks.”

Canada spent $780 million between 2001 and 2012 on various cybersecurity initiatives, according to an October 2012 report from the auditor general’s office.

That same month, the previous Conservative government committed an additional $155 million over five years for the Canadian Cyber Incident Reponse Centre, which assists other levels of government and the private sector in securing their networks.

But it’s difficult to say just how much money the federal government spends on cyberdefence. Several departments have a mandate to protect Canadian government networks, including the Communications Security Establishment and Shared Services Canada.