Election 2019 still ripe for opinion-shaping, CSE says

OTTAWA — Efforts to stanch online misinformation campaigns will not eliminate the very real situation that may see Canadians fall victim to attempts to influence their political opinions, the Canadian Security Establishment said in its cyber threat assessment Thursday. “Although major web platforms are making efforts to curb the negative effects of manipulative information sharing, the opinions of Canadians will remain an attractive target for cyber threat actors seeking to influence Canada’s democratic processes,” the CSE said Thursday. That view came from a national cyber threat assessment released by the new Canadian Centre for Cyber Security (CCCS), a central hub for cyber-related matters, on Thursday. The assessment lays out seven “judgements” that paint a grim picture for the cyber landscape going into an election year. One of those assessments is a suggestion that it’s “very likely” that Canadians will encounter malicious online activity from state-sponsored cyber threat actors in 2019, when the next federal election will take place. “We assess that in 2019, state-sponsored cyber threat actors will very likely attempt to advance their national strategic objectives by targeting Canadians’ opinions through malicious online influence activity,” the CSE said. During a technical briefing on Thursday, officials from the CSE said social media campaigns of disinformation are a “widespread issue.” Reasons provided by officials as to why misinformation campaigns would be state-sponsored, or orchestrated by a country’s leaders, include advancing their strategic priorities and discrediting democracies. The methods used by these malicious actors include stealing, modifying news stories to make their content more “compelling and distracting,” creating fraudulent or distorted “news” outright, and promoting “extreme opinions,” the assessment read. Social media companies, such as Facebook Inc. and Twitter Inc., have put out press release after press release outlining their efforts to identify and delete accounts linked to such campaigns, revealed to have led to public opinion shaping of political events, including the 2016 U.S. election and Britain’s referendum to leave the European Union. As such, the assessment includes recently-revealed information that showed Russian “trolls” from the Internet Research Agency, which “promoted divisive and inflammatory content before the 2016 United States presidential election,” tweeted about Canadian events. About 8,000 tweets were issued by the agency about Canadian issues, including the Quebec mosque shooting in January 2017 and the increase in asylum-seeker border crossings in the summer of that year. “The Russian trolls attempted to create confusion by inserting false information into online discussions and exacerbating existing differences of opinion,” the assessment said. “This case demonstrates that Canadian social media users can be exposed to foreign malicious influence activity.” The CSE said Thursday it’s working on an updated threat assessment for the democratic process that it hopes will provide more details by early 2019, but expects threat actors to be a moving target as they shift gears using different methods. The head of the CCCS, Scott Jones, told reporters Thursday that his organization hopes they, the media, can step in to correct any misleading or false information wherever they can, including on social media. The CSE’s report Thursday laid out other alarming threats, including the pace at which internet-of-things (IoT) devices are being adopted and noted that the organization is seeing a threat actors "shifting their preferred platform" from computers to IoT devices. They don’t require a sophisticated state-sponsored actor in order to be exploited, it said. In fact, as more Canadians connect devices like toasters and refrigerators to their home network, they are “increasingly susceptible” to “less-sophisticated cyber threat actors, such as cybercriminals.” During a technical briefing on Thursday, CSE officials used examples of poorly secured web cameras and baby monitors that were used in an attack. Often, these devices will have no or default passwords that go unchanged. Earlier this year, cyber security experts suggested the Canadian government should have import standards for IoT devices to mitigate these kinds of threats. This alert comes in light of the country’s largest telecoms moving to exploit their new LTE-M networks to facilitate the seamless transition to a universe with ubiquitous IoT, which includes technology used for agriculture. Jones said the government has been trying to raise awareness about these connected devices, not to deter their purchase and use, but to emphasize vigilance to protect against cyber attacks. “Internet-connected devices and applications bring great benefits to individuals and to the global economy, but as more physical and information assets become accessible online or have a digital component, cyber threat actors will have more opportunities to conduct malicious cyber threat activity, to access information, disrupt operations, or even have a physical impact,” the report said. Thursday’s threat assessment, however, noted that it’s also “very unlikely that state-sponsored cyber threat actors would intentionally seek to disrupt Canadian critical infrastructure and cause major damage in the absence of international hostilities.” Critical infrastructure includes the energy, aerospace, and defence sectors. CSE officials said Thursday they aren’t aware of any successful attempts to undermine that infrastructure, but they have seen them in international contexts. Officials also said that as they collaborate more and give the public tools to combat threats, such as the anti-malware tool called Assemblyline, the threats, and the likelihood of an attack’s success, diminishes. During the press conference, officials didn’t answer questions about whether events, such as Canada’s arrest of Huawei Technologies Co. Ltd.’s chief financial officer Meng Wanzhou on Wednesday, would open Canada to cyber attacks. Critics have previously also said that proposed legislation that would give the CSE more power could make the country fair game for such attacks. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Related Stories

Regulating TSPs, not suppliers, in cybersecurity bill will be ineffective: Telus exec

News | 11/22/2022 3:55 pm EST

Feds give $675k for UWaterloo cybersecurity project

Briefs | 08/16/2022 5:03 pm EDT

Canadian organizations paying more than $450,000 in ransomware attacks: study

Briefs | 12/08/2021 4:54 pm EST

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us