Former electronic spy chief urges Ottawa to prepare for ‘cyber war’
As Canada reviews its defence policy, the former chief of Communications Security Establishment says it would be negligent not to develop offensive cyber weapons.

thestar.com
By Alex Boutilier
Sept. 1, 2016

The former chief of Canada’s electronic spies is calling on Ottawa to develop an arsenal of cyber weapons - and give defence and intelligence agencies the green light to attack.

“Cyber war” is still in its infancy, John Adams argued in a July paper, but computer viruses could soon cause as much damage to a country as conventional bombs and bullets.

Canada has traditionally - at least officially - focused cyber efforts on defending against espionage and attacks from both hostile states and hackers.

But Adams, the chief of the Communications Security Establishment between 2005 and 2012, is calling on the federal Liberals to rethink that approach and allow Canada to go on the offensive.

“Some people think that cyber war will sooner or later replace kinetic war. More frequently, cyber war is presented as a new kind of war that is cheaper, cleaner and less risky for an attacker than other forms of armed conflict,” Adams wrote in a paper published by the Canadian Global Affairs Institute.

“In either case, the Canadian Armed Forces have a responsibility not only to protect their own systems but they also need to have the authority to direct offensive action . . . if that is what it takes to blunt an ongoing catastrophic attack on critical infrastructure.”

Adams argued that if a hostile state were attacking Canada’s networks, Canada should be able to respond in kind to stop that attack. But in an interview with the Star Tuesday, Adams was clear that he’s envisioning a much wider range of actions for Canada’s defence agencies.

“Let’s say we’ve got A, B, and C. A owes C money, and we want to make sure that money does not get to C. You can take steps to make sure, even though A may intend that (the money) goes to C, in fact it goes to B.”

“And C says, ‘Well, that son of a gun’ and he goes and shoots A in the head.”

To most, Adams said, that would seem like an offensive action - Canadian spies misdirecting money, which ultimately results in someone getting killed.

“That sort of action is very troublesome to governments, and certainly to politicians,” Adams said.

“(Because) that would be judged to be an offensive action . . . (rather than) simply a defensive action, (where) you’re trying to stymie a whatever it might be, a nefarious action, and in so doing you take that kind of action and guess what? The bad guys are killing one another rather than doing the things you’d rather them not be doing.”

Adams is making his argument as the Canadian government is in the middle of a massive re-think of defence and cyber security policy. Defence Minister Harjit Sajjan launched a review of defence policy in April, and is expected to release the new policy in 2017.

Public Safety Minister Ralph Goodale has also launched a review of Canada’s cyber security posture, in addition to a promised comprehensive look at the country’s national security framework. Goodale’s office deferred comment to the Department of National Defence. Calls to Sajjan’s office were not returned as of Wednesday.

In a written response, the Communications Security Establishment simply said that they have no authority to conduct offensive cyber operations.

“CSE does not have a mandate to conduct offensive cyber activities,” agency spokesperson Ryan Foreman wrote in a statement.

“The government of Canada is currently engaged in a defence policy review, which includes consulting Canadians on defensive and offensive military cyber capabilities.”

Part of the difficulty in discussing “cyber attacks” is how often that term is used to describe everything from minor website disruptions (a favoured tool of “hacktivist” groups like Anonymous) to serious hacks aimed at stealing secrets or sabotaging networks.

The lines between attacking, defending, and espionage can also be blurry. Wesley Wark, a professor at the University of Ottawa specializing in national security and intelligence issues, said while limited attack capabilities might be desirable, he thinks Canada needs to prioritize defence and intelligence gathering.

“Before we leap ahead to far in investigating computer network attack capabilities and policies, we have to have a foundation in place . . . network defence capabilities, and the intelligence gathering capabilities,” Wark said.

“If you don’t have those two, you can’t do the network attack . . . I’m afraid that this debate about let’s invest in cyber attack capabilities is going to drain resources, and time and attention, from those two foundational pieces.”

Wark also cautioned that cyber weapons should be used sparingly, or countries risk escalating an already busy exchange of attacks and counterattacks.

“The last thing you want is to get into a round of escalating, out of control cyber aggressions, tit for tat, across international boundaries between state actors,” Wark said.

Proliferation and escalation are valid concerns, Adams conceded to the Star. But he said that he’s “equally concerned” about Canada not having the capacity to respond at all.

“I simply say that it’s time for the debate. Let’s have the discussion,” Adams said.

“Let’s get on with it, because I think it’s now time.”