State-sponsored cyberattacks on Canada successful about once a week

The Canadian government's computer networks have been hit by state-sponsored cyberattacks about 50 times a week — and at least one of them usually succeeded. 

That acknowledgment from the Communications Security Establishment (CSE), the secretive agency charged with preventing such attacks, is a rare glimpse into the scale and frequency of attempts by foreign powers to penetrate federal government systems.

"Between 2013 and 2015, the Government of Canada detected, on average a year, more than 2,500 state-sponsored cyber activities against its networks," says a new report. 

"Although more than six per cent of these attempts breached the Government of Canada's systems in 2013, this number had fallen to less than two per cent in 2015."

The report does not name the foreign states behind the attacks, though the government has previously identified China as responsible for a major cyberattack at the National Research Council in 2014 that forced a long shutdown of its systems and cost millions of dollars for recovery. Russia, Iran and North Korea are also well-known players in cyberwarfare, though have not been publicly identified as such by Canadian officials. 

The report did not say how CSE knows the attacks were state-sponsored. 

The National Research Council has spent $32.5 million recovering from an attack in 2014 that was sponsored by China. (Trevor Pritchard/CBC)

Small-time hackers

The new report from the Public Safety Department says Canada successfully blocks some 600 million attempts each day to identify or exploit vulnerabilities in its government computer networks. But the vast majority are small-time hackers or other players not aligned with foreign states.

Word of the frequency of state-sponsored hacking follows a deal struck between Canada and China on June 22, in which both sides agreed to refrain from conducting or supporting "cyber-enabled theft of intellectual property," such as private-sector trade secrets and confidential business information. That agreement, however, was silent about cyberattacks on government networks.