CSE says it shared information on Chinese hacking of parliamentarians in 2022

A sign for the Government of Canada's Communications Security Establishment (CSE) is seen outside their headquarters in the east end of Ottawa on Thursday, July 23, 2015. (Sean Kilpatrick / The Canadian Press)

While several MPs and senators say they were only recently made aware of China-backed hackers targeting them, the Communications Security Establishment (CSE), one of Canada's intelligence agencies, says it shared information about the incident with parliamentary officials in June of 2022.

After the issue around when parliamentarians were informed was raised in the House of Commons on Monday, CSE spokesperson Ryan Foreman told CTV News on Tuesday that CSE shared "specific, actionable technical information on this threat," with both House and Senate IT officials.

"As would be our normal process with other Government of Canada partners when threats are detected," Foreman said. "Once the FBI report was received by Canada’s security agencies, the information that included the names of the targeted parliamentarians was shared immediately."

"Questions related to how MPs are engaged on situations like this would be best addressed by HoC officials," he added, in an updated statement after another spokesperson indicated that in this case, the House "briefed and informed MPs with a general message."

It's not clear what that general message entailed.

Conservative MP Garnett Genuis said on Monday that he and other members of the Inter-Parliamentary Alliance on China (IPAC) – of which Genuis co-chairs – only learned their email accounts were targeted last week, following the unsealing of a U.S. Department of Justice indictment in March.

"I find that is disgraceful," Liberal MP Judy Sgro told CTV News Tuesday. Sgro was one of the parliamentarians affected by the hacking incident but was never informed of it by House of Commons staff.

Sgro was told House of Commons officials did a check of the firewall system and then sent an email to all 338 MPs asking them to pay attention to their computer systems to avoid being hacked.

"I want to know how much of a threat I'm under," Sgro said. "I would have expected that my IP address would have been changed. I would have felt much better. But that didn't happen."

The CSE said its engagement with the House of Commons and the Senate began before the agency received the FBI report, as the agency had been tracking and helping to protect their network and users against threats to their systems.

House says no cybersecurity impacts

The CSE and its Canadian Centre for Cyber Security share information on potential and emerging cybersecurity threats with Parliament on an ongoing basis, said Mathieu Gravel, a spokesperson for the Office of the Speaker of the House of Commons.

"The House employs layers of robust cybersecurity protections and monitoring programs to ensure the integrity of the parliamentary environment and works closely with national security partners to detect and mitigate threats," Gravel said in a statement to CTV News.

In this case, he adds, the agency determined that the risk-mitigation measures had successfully prevented any attack, and that there were no cybersecurity impacts to any members or their communications. As of Monday night, another MP impacted, fellow IPAC co-chair John McKay did not appear to be aware of this.

"I just don't know the nature of the threat, I've had it explained to me," he said. "It's kind of a bizarre situation to be in."

According to the unsealed U.S. Department of Justice documents, around January 2021, the hackers sent in excess of 1,000 emails to more than 400 unique accounts of individuals associated with IPAC.

LeBlanc asks for exact chronology

Genuis says members of IPAC were told that U.S. intelligence officials with the FBI were not permitted to inform targeted legislators from other countries. However, foreign dissemination requests were issued to every government with impacted political figures in 2022.

Public Safety Minister Dominic LeBlanc told reporters on his way into cabinet on Tuesday morning that he has asked his department for an exact chronology of when the information about the hacking was received, which agency received it and if they followed the proper protocols.

"The information I have, I'm not prepared to say that no notifications were given. We're determining the exact facts of what happened a couple of years ago," Leblanc said.