Communications Security Establishment

• Potential adversaries are using and developing cyber capabilities in order to exploit vulnerabilities in our cyber systems.
• The Communications Security Establishment Canada (CSE) employs sophisticated cyber tools and technical expertise to help identify, prepare for, and defend against cyber threats, as well as to impose costs on malign actors that seek to harm Canada's information systems, networks, businesses, and institutions.
• CSE's Canadian Centre for Cyber Security (the Cyber Centre) is a unified source of expert advice and guidance and leads the Government's operational response to cyber incidents. The Cyber Centre also collaborates with the rest of government, the private sector, and academia to strengthen Canada's cyber resilience.
• CSE and the Canadian Armed Forces (CAF) continue to work with domestic and international partners to support and build a stable cyberspace built on the respect for international law and the norms of responsible state behaviour in cyberspace.
• Accordingly, CSE conducts joint cyber operations with the CAF to support mission objectives. Cyber operations capabilities are a key element of military and state power, needed to deter and defeat foreign-based threats to Canada in times of peace and conflict.
• The CAF contributes to international peace and security through cyber threat intelligence sharing with Allies and partners, and through the conduct of full spectrum cyber operations as authorized by the Government of Canada.
• Specifically, the CAF relies on the force multiplier effects of technology enabled communications, intelligence, and weapon systems, all of which must be secured and defended from cyber threats.
• Canada's updated Defence Policy: Our North, Strong and Free, announced commitments to improve the Canadian Armed Forces' ability to conduct cyber operations.
• This includes establishing a Canadian Armed Forces Cyber Command, and a joint Canadian operations capability between CSE and the CAF.
• Strengthening the Canadian Armed Forces' cyber resilience through the Cyber Mission Assurance Program, in partnership with CSE, the CAF will also establish a cyber security certification to protect defence supply chains from cyber threats.

• Cyber security is a foundation for Canada's future, for our digital economy, our personal safety, and our national prosperity and competitiveness.
• Every day, the Communications Security Establishment Canada (CSE) uses its sophisticated cyber and technical expertise to help monitor, detect, and investigate threats against Canada's information systems and networks, and to take active measures to address them.
• CSE's Canadian Centre for Cyber Security (Cyber Centre) is Canada's technical and operational authority on cyber security. As part of CSE, it provides leading-edge advice and services to help prevent cyber incidents and keep critical services up and running, including by using sensors to detect malicious cyber activity at the host, cloud, and network levels.
• The Cyber Centre's mandate covers federal institutions and systems of importance, which include critical infrastructure. Under the CSE Act, the Cyber Centre can also assist any other entity designated by the Minister of National Defence as being of importance to the Government of Canada. Examples last year include providing cyber defence services to the territories and cyber security assistance to Ukraine and Latvia
• Recent and ongoing geopolitical events and incidents of cybercrime have elevated the potential risk of cyber threats. CSE continues to publish advice and guidance to help all sectors protect themselves from cyber threats. It works with industry partners, including government and non-government partners, to share threat information and cyber security best practices.
• Bill C-26 (An Act Respecting Cyber Security), currently before the Senate, is a critical next step that provides the government with new tools and authorities to better bolster defences, improve security across critical federally regulated industry sectors, and protect Canadians and Canada's critical infrastructure from cyber threats.
• Cyber security matters to all of us, and the federal government works together with other jurisdictions, organizations, and critical infrastructure network defenders to raise Canada's cyber security bar.
• If Canadian companies have been impacted by cyber threats, I urge them to contact the Cyber Centre toll free at 1-833-CYBER-88, by email at contact@cyber.gc.ca or report an incident through the Cyber website.

• The Government of Canada takes seriously its responsibility to safeguard Canada's democratic institutions.
• Pursuant to the CSE Act, the Communications Security Establishment Canada (CSE) and its Canadian Centre for Cyber Security (Cyber Centre) share intelligence and information with government clients, including appropriate authorities in Parliament.
• The House of Commons and Senate are independent, and its officials are responsible for determining when and how to directly engage with MPs and Senators.
• CSE continues to monitor GC networks and systems of importance for cyber threats. They are working in close coordination with government partners, including relevant security agencies.
• CSE helps to protect Canada's democratic process by:
  • providing foreign signals intelligence to Government of Canada decision makers about the intentions, capabilities, and activities of foreign-based threat actors;
  • defending Canada's federal elections infrastructure from malicious cyber activity;
  • proactively helping democratic institutions improve their cyber security;
  • sharing unclassified threat assessments with the public; and,
  • sharing information to help Canadians identify disinformation.
• To support Parliamentarians, the Cyber Centre, part of CSE, provides a 24/7 hotline service offering direct support in the event of a cyber incident. The Cyber Centre has provided cyber threat briefings to political parties as well as a dedicated point of contact at the Cyber Centre for assistance with cyber security matters.
• In the run-up to both the 2019 and 2021 federal elections, the Minister of National Defence authorized CSE to conduct defensive cyber operations (DCO) to protect Canada's election infrastructure from malicious cyber activity if needed. In the event, no activities took place that would have required a DCO response.
• CSE's Canadian Centre for Cyber Security works closely with Elections Canada, elections authorities and political parties on cyber security preparedness. This includes offering briefings, training resources, consultations, tailored advice and cyber security services.
• The Cyber Centre has an ongoing relationship with Elections Canada, which includes:
  • monitoring services to detect cyber threats;
  • working with them to secure their computer networks; and,
  • incident response assistance, if necessary.
• Provincial and territorial elections authorities can take advantage of services the Cyber Centre provides to critical infrastructure partners, such as:
  • cyber alerts (including mitigation steps);
  • malware analysis; and,
  • cyber incident advice and support.

• Ransomware continues to pose a threat to Canada's national security and economic prosperity and is one of the most impactful cyber threats in Canada, benefiting significantly from the specialized cybercrime economy and the growing availability of stolen information.
• Due to its impact on an organization's ability to function, ransomware is almost certainly the most disruptive form of cybercrime facing Canadians.
• Cybercriminals deploying ransomware have evolved in a growing and sophisticated cybercrime ecosystem and will continue to adapt to maximize profits.
• Threat actors will typically compromise a victim, encrypt their data, and demand ransom to provide a decryption key. They may also threaten to sell the stolen information on the dark web and demand further payment to prevent that posting.
• Data stolen during a ransomware attack almost certainly enables further cyber threat activity from a range of actors. Threat actors can also leverage sensitive business information to support commercial espionage.
• Ransomware can incur significant costs, disrupt the operation of important systems, damage or destroy an organization's data, and reveal sensitive information.
• A ransomware attack can prevent access to essential services and in some cases, threaten Canadians' physical safety and wellbeing.
• The Government of Canada is working to reduce the threat of ransomware by targeting and disrupting cybercriminals, coordinating strategies with international allies and issuing advice, guidance, and services for those affected by ransomware.
• In 2021, CSE shared a ransomware playbook for incident prevention and recovery, and an updated cyber threat bulletin.
• CSE also published the 2023-2024 National Cyber Threat Assessment (NCTA) which highlights the cyber threats faced by individuals and organizations in Canada, including ransomware.
• In May 2023, the Cyber Centre launched a new pilot pre-ransomware notification initiative in the fight against ransomware.
• Since the pilot launch, the Cyber Centre has issued pre-ransomware notifications to over 250 Canadian organizations in a variety of sectors including healthcare, energy, finance, manufacturing, and education.
• Although it remains a business decision, organizations should be aware that paying a ransom funds criminal enterprise. It also enables further malicious cyber activity and ultimately there is no guarantee that cybercriminals will return stolen information.

If pressed on any specific ransomware group and/or activities:

• CSE does not comment on specific cyber security incidents; however, it continues to provide advice and guidance to Canadians and Canadian organizations, if and when requested.
• CSE's Canadian Centre for Cyber Security continues to monitor new forms of ransomware and vulnerabilities, and shares tips and threat information with partners across Canada to help mitigate risks.
• I encourage all victims to report cybercrime activities to local law enforcement and the RCMP. I also encourage victims to report a cyber incident to CSE's Canadian Centre for Cyber Security (Cyber Centre) toll free at 1-833-CYBER-88, by email at contact@cyber.gc.ca or report an incident through the Cyber website.