World

Canada’s secret bid to stop Russian hackers

How Ottawa quietly backed efforts to fight Russian cyber-attacks against Ukraine
A billboard of Vladimir Putin reads "Crimea. Russia. Forever" in Simferopol on August 17, 2015 in Simferopol, Crimea. Russian President Vladimir Putin signed a bill in March 2014 to annexe the Crimean peninsula but Ukraine and most of the international community do not recognise its annexation. (Alexander Aksakov/Getty Images)
A billboard of Vladimir Putin reads  "Crimea. Russia. Forever" in Simferopol on August 17, 2015 in Simferopol, Crimea. Russian President Vladimir Putin signed a bill in March 2014 to annexe the Crimean peninsula but Ukraine and most of the international community do not recognise its annexation. (Alexander Aksakov/Getty Images)
A billboard of Vladimir Putin reads, “Crimea. Russia. Forever” on Aug. 17, 2015 in Simferopol, Crimea. Russian President Vladimir Putin signed a bill in March 2014 to annex the Crimean peninsula, but Ukraine and most of the international community do not recognize its annexation. (Alexander Aksakov/Getty Images)

Canada last year quietly funded a $3.7-million program to provide cybersecurity training and software to Ukraine in response to cyberattacks by hackers linked to pro-Russian organizations, and possibly to the Russian government itself.

The contract was awarded to Arcadia Labs Inc., also known as Arc4dia, a cybersecurity company whose executive team includes at least two former employees of Communications Security Establishment, Canada’s signals intelligence agency, and two veterans of the Canadian Forces.

The government revealed the contract in a quarterly disclosure of grants and contribution awards over $25,000, but never publicly announced it due to what Amy Mills, a spokeswoman for Global Affairs Canada, described in an email as “security concerns.”

“Due to the hostile cyberenvironment in Ukraine, the disclosure of the specific training and tools would jeopardize the effectiveness of the project activities, and results achieved to date, and the government of Ukraine would be at even greater risk of more sophisticated cyberattacks and other hostile actions,” she wrote in a separate email.

Mills said security concerns also prevented her from divulging details of the project, though she and a different spokeswoman later provided broad outlines. The project, said Rachna Mishra, was funded through the Department of Foreign Affairs, Trade and Development’s Global Peace and Security Fund and stemmed from an unsolicited proposal by Arc4dia. As such, there was no requirement for a competitive bidding process, wrote Mishra. (The Department of Foreign Affairs, Trade and Development was renamed Global Affairs Canada by Canada’s new Liberal government after the federal election last October.)

Documents released under the Access to Information Act describe the project’s purpose as helping Ukraine counter “foreign and criminal cyberactions,” suggesting some of the attacks originate in Russia—which in 2014 invaded and then annexed the Ukrainian region of Crimea, and since then has also covertly invaded and backed an insurgency in eastern Ukraine.

“Since the commencement of hostilities, the Russian-backed insurgents have been supported by [redacted] hacker groups, which have targeted the Ukrainian government information infrastructure, in an attempt to undermine the government as well as to disseminate hostile propaganda,” reads a “project initiation authorization.”

“In several multi-level engagements the government of Ukraine has asked Canada to provide expertise in the area of cybersecurity in order to respond to cyberattacks against the country’s information and communications infrastructure.”

In an interview with Maclean’s, Vadym Prystaiko, Ukraine’s deputy foreign minister and a former ambassador to Canada, said Ukraine faces cyberattacks “each and every day.” He was not aware of the project run by Arc4dia, but noted that Canada contributes to NATO’s “Centres of Excellence,” which deal, among other things, with cybersecurity training.

Canada did publicize its $3-million contribution to those NATO centres. Indeed, while the Conservatives were in power in Ottawa, the government loudly trumpeted most anything Canada did to help Ukraine.

In August 2014, for example, James Bezan, then parliamentary defence secretary, accompanied two Canadian Forces flights delivering surplus non-lethal military gear such as tents and sleeping bags to Ukraine. According to the Ottawa Citizen, the government spent $1.6 million delivering the gear, which it valued at $5 million. A portion of that $1.6 million went to pay for a photo team the government sent to document the event.

Will Lymer, co-founder of Arc4dia, worked as a special assistant in the Prime Minister’s Office of Stephen Harper from 2008 to 2010. In an email, he said questions about the project should be directed to the government.

Mills said Global Affairs Canada was “not aware of any outside influence on the awarding of this project,” adding it was funded “based on value for money, and confirmation that the organization has the capacity and the financial means to undertake this project.” A handwritten note on the margins of the project’s “initiation authorization” indicates it was approved in January 2015 by the foreign affairs minister—then John Baird.

The initiation authorization also notes Arc4dia’s “extensive experience” working with Canadian government departments and agencies, although it’s not clear that the company has existed that long.  According to Lymer’s LinkedIn page, the company was founded in January 2014. A lobbyist for Arc4dia registered in December 2012. The company established a Facebook account in 2010 but did not post anything until December 2014. A Twitter account was established in February 2013.

From September 2014 to April 2015, Arc4dia was the beneficiary of the Canadian Trade Commissioner Service’s Canadian Technology Accelerator program that provides mentoring and business connections to companies who must compete to be selected.

Arc4dia’s project assisting Ukraine is scheduled to conclude at the end of March.