Friday, August 19, 2016
Canadian government departments have been hacked before
Intrusions into computer systems by sophisticated attackers ("hacks") have already happened multiple times for multiple Canadian government departments. Some of these attacks have been attributed to other nation-states. This means the risk of attack to online voting is far from theoretical.
- CBC - Foreign hackers attack Canadian government - Finance, Treasury Board Secretariat and Defence Research and Development Canada - Feb 16, 2011
- Reuters - Canada says cyber-attack serious, won't harm budget - Finance Department and Treasury Board [Secretariat] attacked - Feb 17, 2011
- Wikipedia - 2011 Canadian government hackings
- CBC - Chinese cyberattack hits Canada's National Research Council - Jul 29, 2014
- Government of Canada - Statement by the Chief Information Officer for the Government of Canada - Jul 29, 2014
- Globe and Mail - Extensive fallout from Chinese hack of National Research Council - Sep 2, 2016
Quote from the CIO of Canada, July 29, 2014:
Government of Canada computer networks, like those of other governments and the private sector, are under increasing threat of cyber-attack.
Labels: canada, cybersecurity
Tuesday, April 05, 2011
Cyber attacks hit Canadians. Again.
The threat of cyberattack is not abstract. When there is information of value, there are now very sophisticated attackers who will attempt to penetrate your systems.
Two recent incidents are:
* the Epsilon breach in the US, where Canadian email addresses were compromised
Air Miles among firms hit by huge data breach
* the attack on four Bay Street law firms
Major law firms fall victim to cyber attacks
Now imagine that instead of email addresses and mergers and acquisitions information, the prize was the entire Canadian election, the direction of the entire Canadian economy.
Do you imagine for a second that the same sophisticated computer attackers that have already successfully broken into computer systems will somehow not decide to attack an online voting system? Keep in mind that corporations and law firms have huge financial and reputation incentives to protect their systems, and they still fail. Do you think the government will do any better? Do you think that the millions of Canadians using their personal computers to vote will have better Internet security than Bay Street law firms?
Voting over the Internet is an invitation to successful cyberattack. And following such an attack, the entire integrity of your voting system is compromised. To compromise a paper-based election you need people to physically intervene simultaneously at locations all across Canada, somehow escaping detection of all the citizens and elections officials present. It would require massive coordination and risk of detection and capture. To compromise an Internet-based election, all you need is one person with an Internet connection anywhere in the world, pushing a button.
Two recent incidents are:
* the Epsilon breach in the US, where Canadian email addresses were compromised
Air Miles among firms hit by huge data breach
* the attack on four Bay Street law firms
Major law firms fall victim to cyber attacks
Now imagine that instead of email addresses and mergers and acquisitions information, the prize was the entire Canadian election, the direction of the entire Canadian economy.
Do you imagine for a second that the same sophisticated computer attackers that have already successfully broken into computer systems will somehow not decide to attack an online voting system? Keep in mind that corporations and law firms have huge financial and reputation incentives to protect their systems, and they still fail. Do you think the government will do any better? Do you think that the millions of Canadians using their personal computers to vote will have better Internet security than Bay Street law firms?
Voting over the Internet is an invitation to successful cyberattack. And following such an attack, the entire integrity of your voting system is compromised. To compromise a paper-based election you need people to physically intervene simultaneously at locations all across Canada, somehow escaping detection of all the citizens and elections officials present. It would require massive coordination and risk of detection and capture. To compromise an Internet-based election, all you need is one person with an Internet connection anywhere in the world, pushing a button.
Labels: canada, cybersecurity, online voting, security
