In February Russia launched a vicious attack on Ukraine, though it’s not the one that’s received all the attention. This assault involved a telecommunications satellite, and it interrupted Internet service not only in Ukraine, but across Europe.
Canada was spared the fallout from that attack, but we haven’t been immune to assault. While Russia has been careful not to breach NATO borders in its ground war in Ukraine, such 20th-century alliances mean little in the age of cyber warfare.
Indeed, just a few weeks before the Ukraine attack, Global Affairs Canada was subject to a days-long Russian cyber assault. Russia is everywhere in the cyber world today and it’s not alone.
Bad actors, be they nation-states seeking to undermine global stability or compromise the national security of other countries, or private individuals or organizations seeking to steal a quick buck through the use of ransomware, hover in the shadows of the virtual world, waiting to strike on the unsuspecting.
And in this world, everyone — countries, business, individual citizens — is unsuspecting. Cyber security experts have repeatedly warned that the world is not prepared for the ongoing and upcoming assaults. The world has therefore been scrambling to prepare, and Canada introduced its major effort this week in the form of Bill C-26.
The bill, an Act Respecting Cyber Security, will, if passed, grant the feds sweeping new powers. And while significant powers are perhaps necessary to combat the threat, we need to ensure there are sufficient oversight measures to ensure they’re not subject to abuse.
The law applies primarily to federally regulated businesses that provide critical infrastructure services in four sectors: finance, telecommunications, energy and transportation. Among other things, such businesses will be required to implement cyber security programs to prepare for and respond to cyber attacks.
Furthermore, the feds will be authorized to “direct” companies’ efforts to protect themselves from threats, and will have the ability to fine businesses for failure to follow the directives.
More controversially, the bill prohibits companies from divulging the contents of the directives, or even the fact that directives have been issued. A certain degree of confidentiality is, of course, necessary given that details of the directive could alert bad actors to critical vulnerabilities in the Canadian cyber infrastructure.
Yet by cloaking everything in secrecy, the feds’ behaviour is effectively insulated from any form of scrutiny or review, which opens the door to abuse. It’s therefore imperative that the directives be subject to some form of independent audit, much as the federal privacy commissioner audits initiatives that threaten individual privacy.
Bill C-26 will also require businesses to report cyber attacks to the federal Cyber Centre. Currently, reporting is voluntary unless the attack could cause significant harm to an individual, in which case the incident must be reported to the privacy commissioner.
Some companies do report voluntarily but many others are reluctant to do so for fear of alerting malicious actors to their vulnerabilities, and also because the resulting publicity could cause financial and reputational damage.
Yet by not reporting, similar businesses remain vulnerable, and if the attack was the result of a systemic vulnerability, then the cyber security of the entire country could be at stake. Reporting is therefore in all Canadians’ interests and is an essential aspect of cyber security.
Now that said, given that reporting could have profound adverse effects on individual businesses, it’s important to mitigate such damage as best as possible. In most circumstances, releasing the name of the affected business is unnecessary — rather, providing details like the type of business, revenue and number of employees should help similar businesses to fortify themselves.
The feds should also offer assistance to businesses, especially small- and medium-sized ones, in their efforts to protect themselves. It’s all well and good to “direct” companies to prepare themselves and to order them to report breaches, but since cyber security is everyone’s business, a collaborative effort between the public and private sectors will prove much more effective.
That goes for federal-provincial relationships as well. Since Bill C-26 applies only to federally regulated businesses, the feds and provinces need to work together to ensure their efforts are consistent, coherent and capable of protecting the national interest.
Finally, just as cyber threats are ever evolving, so too must be our efforts to combat them. Flexibility is key, as we must be prepared to refine and adjust our strategies and to accept that the war against cyber crime might never end.
Credit Goes To News Website – This Original Content Owner News Website . This Is Not My Content So If You Want To Read Original Content You Can Follow Below Links