OTTAWA – The 2019 federal election is "very likely" going to be the target of foreign cyber interference, with voters being the most likely targets of this anticipated meddling, a new report from Canada's electronic spy agency warns.
The report is also putting renewed spotlight on the risks of not having more robust cybersecurity and transparency requirements for social media platforms and political parties in place in advance of this year’s campaign, given these two areas are cited as being potential targets for foreign actors.
"An increasing number of foreign adversaries have the cyber tools, the organizational capacity and a sufficiently advanced understanding of Canada's political landscape to direct cyber interference during the 2019 federal election, should they have the strategic intent," the report states.
The report is an update to the 2017 Cyber Threats to Canada's Democratic Process report published by the Communication Security Establishment (CSE).
The 2017 report noted that Canada's electoral process would not be immune from potential interference by outside actors, and that federal candidates, parties, and voters are all at risk. The update notes that the likelihood of online election meddling has increased as the amount of cyber interference in other countries has increased over the last two years.
Now, CSE says that it is "highly likely" that interference in Canada’s democratic process will be done using similar tools that have been implemented in other countries, such as amplifying polarizing political issues, promoting one party over another or discouraging participating in the election altogether.
The document repeatedly cites Russia as an example of a foreign country that has been proven to be conducting this kind of cyber interference, including during the 2016 U.S. presidential campaign. Though a CSE official speaking to reporters on background said it is not anticipated that interference in the Canadian election will be on the same scale as what Americans experienced.
The intention of cyber interference is to compromise or gain access to information, or to use online means to "covertly manipulate online information" in order to influence voters' opinions and ultimately the outcome of the election.
CSE says that the short-term consequences of this foreign meddling include burying legitimate information and distracting voters from important election issues, while the more long-term impacts include weakening the public’s trust in the democratic process and creating divisions with international allies while promoting foreign economic or geopolitical interests.
CSE has identified four key trends from recent examples of foreign interference that could play out in Canada in the lead-up and during the upcoming election campaign:
- Elections targeted by foreign threats are increasing worldwide, more than tripling in OECD countries since the last time Canada held a federal election in 2015;
- Online foreign interference increasingly targets voters directly through creating and spreading misleading information on social media;
- Politicians, their parties, and their staff are targets for more advanced cyber attacks such as obtaining private information for the purpose of blackmail, accessing campaign databases, or being discredited by AI-generated video that appears real, known as "deep fakes"; and
- The electoral system itself is not immune, though in Canada where paper ballots are still used it is not considered a likely or even possible avenue for meddling.
Democratic Institutions Minister Karina Gould and Defence Minister Harjit Sajjan held a news conference to discuss the report's findings, where both stated that ensuring the election remains secured against this threat is the government's top priority. The ministers pointed to the series of new measures unveiled earlier this year that are aimed at further shoring up Canada's electoral system from foreign interference and disinformation.
"Foreign cyber interference targeting voters has become the most common type of cyber threat activity against the democratic processes worldwide," Sajjan said, calling the report the "next step" in the government’s preparedness efforts. "The more we talk about these threats, the better we are prepared to react."
The initiatives the federal government unveiled in January include a new plan to inform Canadians about serious meddling attempts during the campaign, the creation of a multi-departmental task force aimed at preventing interference attempts, and launching a new campaign for citizen-literacy about misinformation online.
As well, the elections modernization Bill C-76 passed parliament in January, making broad changes to Canada's elections laws, including new limits on spending and foreign participation, while also aiming to boost accessibility and participation in democracy.
It implements new political party spending limits; adds new reporting measures for third parties conducting partisan work; and also proposes multiple changes aimed at eliminating foreign interference and spending, including prohibiting organizations selling advertising from knowingly accepting elections ads from foreign actors.
Canada already subject to meddling
Canada has already seen examples of foreign interference outside of the election period, the report notes. "Since the 2015 federal election, Canadian political leaders and the Canadian public have been targeted by foreign cyber interference activities."
Among the examples of how this has already played out in Canada:
- A foreign adversary has "manipulated social media using cyber tools to spread false or misleading information relating to Canada on Twitter" and has used social media to amplify viewpoints that are critical of Canadian legislation;
- There have been foreign state-sponsored media attacks on federal cabinet ministers.
While not referenced specifically in the report, an example of a minister who has been disparaged online by foreign entities is Foreign Affairs Chrystia Freeland, who faced questions in Canada about pro-Russian outlets "sharing scurrilous stories" -- as Prime Minister Justin Trudeau once put it—about her grandfather allegedly helping the Nazis during the Second World War.
Political databases 'attractive' target
CSE's report states that political parties remain “attractive targets” for attacks, as parties, candidates, and staff made up one tenth of the cyber attacks against democratic processes.
This casts back into the spotlight one area left out of Bill C-76: tougher privacy rules and oversight for political parties and the data that they harvest from the electorate.
While the legislation does require political parties to create and publish their privacy policies when it comes to the collection and protection of Canadians’ personal information, various privacy watchdogs and the New Democratic Party were pushing for more concrete measures.
"Foreign adversaries may steal voter or party databases because they fetch a price on illicit areas of the Internet, where large quantities of personal identity information are constantly bought and sold. They can steal sensitive campaign documents and communications and sell or release them," the report states.
As part of the existing plan, Canada's intelligence agencies have been, and will continue to advise political parties about enhancing their security and offering classified threat briefings to senior party leadership.
Defending the government’s decision to not implement more strict rules for political parties, Gould said she has asked a House of Commons committee to study the matter further, though it remains to be seen whether that study will occur and conclude in time for additional policies to be put in place before voters head to the polls.
"This is something I think can be achieved but I think requires more study," she said.
Gould not confident social media doing enough
In January the Liberals called on social media platforms to do more, restating their expectation that they will crack down on disinformation and enhance their transparency -- though there is no policy or legislation compelling co-operation.
Gould said conversations about the roles companies such as Facebook and Twitter play in the election have had "varying degrees of success," and not as much progress as anticipated.
"I don't have the confidence that they are disclosing everything with us, and I think that from experiences that we've seen around the word, there's a lot left to be desired in terms of how seriously they’re taking these issues," Gould said.
The report notes that social media has become the predominate space where people access information, and as a result is often where these cyber interferers are looking to manipulate information.
"I'm not feeling great about where we are right now," Gould said, adding that she is still in "active conversations" about the potential of pursuing further regulations if these social networks don’t take more robust measures on their own.
NDP MP Nathan Cullen criticized the government’s response to the report and the "total lack of regulations."
"We're now just six months or so from the next election, the government failed; chose not to bring in tough new rules for their last election bill," Cullen said, adding that he thinks there may still be time to implore big social networks to work more collaboratively with government on this.
"There's a brawl breaking out in the public square and they should do something about it," Cullen said.
This would go further than what Bill C-76 has set out requirements for: the creation of a registry of all digital advertising published and paid for by third parties and political parties, as well as nominated and prospective candidates during the pre-writ and writ periods.
In response to this, Google has announced that it will instead be banning all political advertising during the election rather than trying to compile a registry, while Facebook is launching a library that will capture this information.
In a statement to CTVNews.ca, Colin McKay, head of government policy for Google Canada, said that Google is "combating misinformation and working with the Canadian government to fight cyber threats." McKay says there have been several meetings with key elections players including Elections Canada to discuss cybersecurity and misinformation.
"We have every intention of continuing our close work with government to protect Canada's democratic institutions and election activities," he said.
