Analyzing cyber threats, one year from the federal election

A sign directing voters to a federal election polling station in Cremona, Alta., on Oct. 19, 2015. (Jeff McIntosh / THE CANADIAN PRESS)

The 2019 election will be held in new cyber threat environment, are we ready?

Published Oct. 21, 2018 7:30 a.m. ET
Updated Nov. 14, 2018 10:29 a.m. ET

OTTAWA – The next federal election is exactly a year away, should it happen as scheduled. Politics aside, candidates and those who oversee the campaign are bracing for an altogether different kind of fight. Forget the air war, the 2019 election will increasingly be fought, and potentially won, online.

But it won’t just be about the parties duking it out. Citing examples including foreign interference in the U.S. 2016 presidential election and disinformation that flooded the Brexit referendum, as well as the Cambridge Analytica Facebook data scandal, both Canadian and international intelligence services have warned we’re not immune to some form of cyber interference happening here.

This begs one key question, is Canada ready? spoke with the minister responsible for overseeing efforts to protect Canada’s electoral system from foreign threats and hackers, the head of Canada’s new cyber security centre, and the opposition critics, and posed that exact question.

“It will be a different threat environment in 2019,” said Scott Jones, head of the government’s new Canadian Centre for Cyber Security.

Canada has taken, and is still in the process of taking, steps to shore up the electoral system to keep out foreign spending; protect voting infrastructure from being hacked; and working with social media companies on plans to combat fake news and disinformation from interfering with public opinion during the campaign.

Democratic Institutions Minister Karina Gould discusses an assessment of cyber threats to Canada's democratic process in Ottawa, on June 16, 2017. (Adrian Wyld / THE CANADIAN PRESS) Democratic Institutions Minister Karina Gould in Ottawa

The minister can’t say the steps that are being taken will be enough.

“I think we’re ready, I have confidence in the process, but you know, you can’t always prevent everything.” said Gould, who promised more news on this front in the coming weeks.

Her critics feel much less assured.

“I would say we are aware, but we are not ready. I think that we are just starting to wake up to the realities of the potential implications and results this could have,” said Conservative democratic institutions critic Stephanie Kusie. “We are just starting to consider the measures which are necessary to outsmart and outmanoeuvre those that intend to harm our electoral process.”

“Imagine the Quebec referendum happening and then a week after we find out that $1 million showed up into some shell group and targeted certain Quebec voters. Can you imagine what the consequences of that would’ve been?” said NDP democratic reform critic Nathan Cullen.

Candidates face new social media reality

Prime Minister Justin Trudeau has already warned that the next federal election will be “the most divisive and negative and nasty political campaign in Canada's history."

He’s pledged to not engage in personal attacks, while his main opponent Conservative Leader Andrew Scheer has been billed as Stephen Harper’s successor with a smile.  Neither has held any punches, especially on polarizing issues.

Consider how that may fuel those seeking to meddle.

Canadian politicians are already having to battle domestic examples of disinformation. Consider past experience with election robocalls, for example, or the recent proliferation of parody Twitter accounts that masquerade as real MPs saying things that the actual politician never would.

Jones said that because people now know that tactics like fake news online can work to micro target groups, or drive wedges on issues, candidates will be facing a different reality online than even in the last federal election.

Scott Jones on CTV Power Play with Don Martin Scott Jones on CTV Power Play with Don Martin

“Certainly the pervasiveness of the tools from 2015 is even greater now, not that social media didn’t exist back then, but I think the difference is, in 2015 we looked at them more as a way of communicating information and we didn’t look at them with much distrust,” Jones said. “I think there’s a lot more distrust out there now, you’re not sure what to believe anymore.”

Jones said the Canadian Centre for Cyber Security will be issuing a guide to candidates ahead of the election getting underway, including things they can do to protect themselves when they’re using social media to campaign.

Last year, Facebook released a Canadian election integrity plan that includes a includes a “cyber hygiene guide” for MPs. It offered the most basic advice: use two-factor authentication and think before clicking anything.

And yet CTV News has been told Canadians would be surprised how many MPs hadn’t already been taking such basic precautions.

Gould said conversations with the major social media companies will continue to make sure they’re doing everything possible ahead of the next Canadian election to take responsibility for their role in making sure what voters see on their platforms is legitimate.  

Kusie said, for the Conservative party, much of the last few years has been focused on encouraging MPs to use social media, but the next conversation will be on cyber literacy.  As for the New Democrats, Cullen said they are bringing in security experts to brief the party, and will be looking to the federal privacy commissioner for guidance.

Though, Kusie said this onus shouldn’t just fall to the political parties to have with their teams and their supporters. 

“Social media providers have an obligation to be responsible for their content, and so I would have the expectation that they would be working to ensure the legitimacy of their products prior to the next election,” Kusie said. 

“If Facebook can’t keep their data secure, what are the chances the Green Party’s got enough systems in place,” Cullen said.

Networking cables and circuit boards are shown in Toronto on Nov. 8, 2017.  (Nathan Denette / THE CANADIAN PRESS) Networking cables and circuit boards in Toronto

Update coming on cyber threats to Canada 

Last year the Communications Security Establishment — Canada's foreign electronic spy agency — issued a report that found that Canada’s democratic process is not immune to potential interference by outside actors.

Jones said his team will be releasing an update to that report in early 2019 “to make sure we bring it up to date with some of the new activities that may have been seen around the world, but also to prepare for the next federal election.”

He told to expect to see a “more blunt” report with more details on what kinds of tools can be used for online manipulation.

The Centre, and the report, is part of the federal government’s broader National Cyber Security Strategy.

In 2018, the federal government announced hundreds of millions of dollars for new cybersecurity initiatives. As part of this, the government is putting in $7.1 million over five years for the Office of the Commissioner of Canada Elections to shore up Canadian electoral processes.

Jones said work happens between Canada’s cyber agencies and Elections Canada continually to secure the infrastructure elements of each campaign, from voter rolls to polling booths.

If the Centre is noticing concerning online behaviour, they will be able to alert other agencies, or the social network to flag, but Jones doesn’t anticipate speaking up publicly about these instances during the campaign.

Right now the eyes of many working to protect our democracy are looking to see what tactics may be used during the U.S. midterm elections in November to see if there will be new, or more sophisticated cyber tactics that Canada will need to brace for.

Asked if there will be time to course correct here, after the U.S. midterms are analyzed and by the time the 2019 updated cyber report is issued, Gould said she thinks the major elections bill she is currently pushing through Parliament will be flexible enough to prevent new ways of interference.

“You can’t predict what you don’t know is going to happen,” she said. “Like anything you create laws because you don’t want these things to happen. Of course some actors may find ways to get around that, but the intent is to tighten up the legislation as much as possible to make it very clear that this is an unacceptable practice.”

A woman enters Maple High School in Vaughan, Ont., to cast her vote in the Canadian federal election on Oct. 19, 2015. (Peter Power / THE CANADIAN PRESS) Federal election day, on Oct. 19, 2015. (Peter Power / THE CANADIAN PRESS)

Key bill not passed, packs hundreds of changes

The legislation Gould is referring to is Bill C-76, the Elections Modernization Act. Introduced in April, the over 300-page bill  makes broad  changes to Canada's elections laws, including new limits on spending and foreign participation, while also aiming to boost accessibility and participation in democracy.

It implements new political party spending limits; adds new reporting measures for third parties conducting partisan work; and also proposes multiple changes aimed at eliminating foreign interference and spending, including prohibiting organizations selling advertising to knowingly accept elections ads from foreign actors.

The Procedure and House Affairs Committee wrapped up its marathon clause-by-clause review of the bill this week. Hundreds of amendments were proposed, most of which were from the opposition parties. In total, 70 passed, including all 52 amendments the Liberals moved. The bill is now back before the House of Commons where it’s being given priority next week to move through to the Senate as soon as possible.

Among the most consequential amendments passed was a ban on the use of foreign money from being spent at any time— whether in an election period or not — to support a candidate’s campaign, or political party. If this ban is not obeyed, the bad actor will be forced to pay a fine of five times that amount.

And now, platforms like Twitter, Google, and Facebook are being called on to create a registry of all digital advertising published and paid for by third parties and, political parties, as well as nominated and prospective candidates during the pre-writ and writ periods.

During one of his appearances before the committee on the bill, Election Canada’s Chief Electoral Officer Stéphane Perrault said he is working on an online repository of all Elections Canada’s communications, so Canadians can check for themselves in case someone tries to impersonate the elections agency and disseminate wrong voting information.

Gould has called this bill one of the “key cornerstones” towards making sure Canada is ready for the 2019 race. It still could be months before it passes and can be implemented. 

“Their cornerstone has got huge cracks in it…. If it’s a cornerstone you’re putting it in after you’ve put up much of the rest of the building,” Cullen said. Adding that he still thinks Canada is “totally exposed” to being subject to a 2016 U.S. election-type situation.

He was pushing for tougher privacy rules and oversight for political parties and the data they harvest from the electorate, something privacy watchdogs across Canada have also called for.

Cullen said, at least, the government should be able to prepare for the threats that are known.

“You still put on the seatbelt. You put the seatbelt on, and you don’t drink before you get in the car. We just chugged a 26-er and are hopping into a vehicle with no airbags or seatbelts,” Cullen said, shortly after the committee wrapped up its review of amendments.

Ultimately, Gould said that while she thinks that all steps that can be taken, are being taken, “it’s difficult to guarantee” there won’t be attempts to interfere.

Jones said that was a fair characterization from his viewpoint, offering that while foreign actors may try to meddle, “it doesn’t mean we’re susceptible to it.”

Perhaps in 365 days we’ll know.