Auditor finds gaps in federal government’s cybersecurity shield as threats multiply

In a report released Tuesday Canada’s Auditor General Karen Hogan found inconsistent deployment of the government’s cybersecurity defences.

The federal auditor found “significant gaps” in the government’s cybersecurity services, monitoring efforts and responses to active attacks on information systems.

In report tabled in Parliament on Tuesday, Auditor General Karen Hogan said the federal government must continually bolster its defences as cyberattacks become more sophisticated, pervasive and harmful.

In separate reports released Tuesday, Hogan found fault with federal efforts to respond to Canadians’ questions about tax issues, provide adequate housing for military members and address health and infrastructure problems in First Nations communities.

The Treasury Board of Canada Secretariat, the Communications Security Establishment and Shared Services Canada are responsible for protecting federal information technology systems and operations.

Hogan said the organizations work together and with departments and agencies to prevent data theft and limit disruptions to systems that deliver programs and services to Canadians.

She reported that not all federal organizations were subject to the same security policies, resulting in the inconsistent use of available protection services.

The report said CSE officials told Hogan the inconsistent deployment of its cybersecurity defence sensors across all federal organizations created security gaps, affecting the agency’s ability to defend government networks, systems and devices.

Shared Services and the CSE also lacked a comprehensive current inventory of government devices and assets such as laptop computers, smartphones and servers, Hogan reported.

Shared Services Canada began working on a complete list of government devices in 2017, but the project was not finished.

“Without up-to-date IT information across all departments and agencies, the federal government risks not being aware of -- let alone being able to quickly respond to -- changing cybersecurity challenges,” the report says.

Hogan concluded a lack of information sharing delayed the government’s response to a significant cyberattack in January 2024, allowing the attacker “prolonged access” to personal information.

She said an initiative to set up a cybersecurity collaboration platform and incident case management tool had not received funding at the time of her audit.

The agencies agreed to various recommendations to remedy the cybersecurity shortcomings.

Treasury Board President Shafqat Ali and Joel Lightbound, minister responsible for Shared Services Canada, said Canadians expect their government to keep their personal information and the systems they rely on secure.

“We continue to invest in advanced technologies, enhanced monitoring and real-time threat detection to strengthen the federal government’s ability to anticipate, defend against and respond to cyberincidents,” they said in a joint statement.

In another audit, Hogan found the Canada Revenue Agency’s contact centres provided only five per cent of callers with quality tax help in June.

Just 18 per cent of incoming calls this year met the revenue agency’s service standard by being answered within 15 minutes, the report said. Most callers waited an average of 31 minutes.

“The Canada Revenue Agency has a duty to help individuals and businesses meet their tax obligations and access benefits,” Hogan said in a media statement.

“I am concerned that in spite of a new call system and other improvements, Canadians are still waiting too long to get answers to their tax questions.”

Hogan also found many of the living spaces used by Canadian Armed Forces members across several bases were in “poor physical condition” and ripe for overcrowding.

Hogan looked at living conditions on three Canadian Forces bases: Esquimalt in British Columbia, Gagetown in New Brunswick and Trenton in Ontario.

The report said aging living quarters were often in serious states of disrepair, with deteriorating walls, a lack of drinking water and malfunctioning sewage systems.

The audit said the Canadian Forces Housing Agency did not have enough residential housing units to meet military needs -- a challenge as the Forces looks to add more than 6,000 new members by April 2029.

In a separate report on recruitment, Hogan said the military was not bringing in enough recruits for its operational needs, and that National Defence did not always know why potential recruits ultimately abandoned their applications.

Hogan found Indigenous Services Canada was falling far behind on efforts to address long-standing health and infrastructure problems in First Nations communities.

She said despite an 84 per cent increase in its spending since 2019, the department continued to struggle to expand access to clean drinking water and emergency services.

Indigenous Services had failed to implement about half of the recommendations her office made between 2015 and 2022, Hogan’s report said.

Twenty years after the auditor general first raised concerns about First Nations’ access to clean drinking water, 35 long-term drinking water advisories remain in place and nine of them have been active for a decade or more, Hogan added.

The auditor said many of the recommendations issued to the department over the years align with the Truth and Reconciliation Commission’s calls to action and the final report into missing and murdered Indigenous women and girls.

-- With files from Alessia Passafiume and Kyle Duggan