|
4 |
+Both the Canadian and American cyberstrategies recognize the shift in threats over the past five years. In 2004, cyberattacks were considered a¶ low-risk threat by the government of Canada. Today, cyberattacks are “about¶ as high as terrorism in terms of national security threats” (Canada, SSCNSD,¶ 2012a). Canada’s Cyber Security Strategy notes that the Canadian federal government¶ is increasing the resilience of government systems, pursuing publicprivate¶ partnerships to secure critical infrastructure, sharing information¶ about cybersecurity with the public, and enhancing police powers (Public¶ Safety Canada, 2010: 1). The American Cyberspace Policy Review calls on¶ the US to “improve its … resilience to cyber incidence” through infrastructure¶ hardening, and defence and recovery tactics (US, White House, 2013).¶ Cyberthreats will be confronted through international partnerships, deterrence¶ strategies, and “appropriate responses for … state and non-state actors”¶ (US, Executive Office of the President of the United States, 2009a: 5). In 2011,¶ the United States released its International Strategy for Cyberspace, which¶ formalized the Policy Review into an actionable agenda for international collaboration¶ (US, Executive Office of the President of the United States, 2011).¶ On a state-to-state level, Canada and the United States have an extensive¶ history of working together through the Five Eyes alliance (Gendron,¶ 2013). The 1946 UKUSA Agreement formalized an intelligence-sharing¶ arrangement between the United States, the United Kingdom, Canada,¶ Australia, and New Zealand that began in World War II and remains in force¶ today (National Security Agency, Central Security Service, 2010). The Five¶ Eyes—a shorthand that refers to the alliance members (Cox, 2012)—predominantly¶ targeted states of the Soviet bloc during the Cold War (Rudner,¶ 2001). After the Cold War, the alliance shifted its focus to tackle competing¶ threats from multiple states and actors.¶ To ensure adequate coverage, the Five Eyes divided the world up¶ into five regional clusters, one for each alliance member (Richelson, 1990).¶ Unofficial accounts suggest that Canada covers the Arctic, Latin America,¶ and the North Pacific and North Atlantic Oceans. The United States surveys¶ “the Caribbean, China, Russia, the Middle East and Africa”. The United¶ Kingdom is responsible for Europe and Western Russia, while Australia and¶ New Zealand cover South and East Asia, and the South Pacific and Southeast¶ Asia, respectively (Cox, 2012: 6; Rudner, 2001: 103).¶ The United States possesses cyberintelligence capabilities that are significantly¶ more advanced than most states (Nye, 2011), yet alone it is unable¶ to gather the volume of information it needs. Cooperation with the Five Eyes¶ is necessary to reduce this intelligence deficit. Without the Five Eyes, America¶ could only “collect information … against a part of the target” (Lander, 2004:¶ 492). Cooperation provides more information so the US government can¶ prepare more effectively for the threats it faces directly, and the threats its¶ allies face that could spill over to the United States (Cilluffo and Cardash,¶ 2013). Cooperation between Canada and the United States in the cyberrealm¶ is largely embedded in, and a by-product of, the Five Eyes regime. As with¶ much of the Canada-US partnership on security-related matters, Canada-US¶ cooperation for cybersecurity goes even further than the Five Eyes. Close¶ cooperation occurs between the NSA and the Communications Security¶ Establishment (CSE)2 to target “approximately 20 high-priority countries” in¶ the collection of signals intelligence (SIGINT) (US, National Security Agency,¶ Central Security Service, 2013).¶ A capabilities gap exists between the United States—the primary,¶ technologically advanced, well-resourced partner—and the secondary Five¶ Eyes partners (Lefebvre, 2003). Since Canada has a more limited ability to¶ develop sophisticated technology, Canada acquires and uses NSA capabilities¶ (US, National Security Agency, Central Security Service, 2013) to help¶ manage its portion of the partnership’s mission. Inevitably, the United States¶ influences some of the intelligence gathering done by Canada.¶ US-Canada resource-sharing in the cybersphere—including hardware,¶ software, and personnel—means that the NSA and CSE are relatively well¶ integrated (US, National Security Agency, Central Security Service, 2013;¶ Rudner, 2001). While integration increases efficiency, it also increases the¶ prospect of a cyberattack against one partner spreading to another. Titan¶ Rain, for example, was a series of coordinated cyberattacks from 2003 to 2005¶ that originated from China (Markoff, Sanger, and Shanker, 2010). Although¶ Titan Rain initially stole information from the systems of the US Department¶ of Defense, it later spread to other “sensitive government and private-sector¶ systems” (Porteous, 2011: 1). By 2005, Titan Rain had infiltrated the systems¶ of the Five Eyes governments, amongst other American allies (Porteous, 2011;¶ Thornburgh et al., 2005). Likewise, an attack against a Five Eyes ally could¶ spread into the United States via the allies’ integrated cyberintelligence assets.¶ An adversary in cyberspace may only need to penetrate one Five Eyes system¶ to find and retrieve American secrets through the linked networks (Cox,¶ 2012). Interoperability, while efficient, is perhaps more of a double-edged¶ sword in cybersecurity than in conventional military defence.¶ Canadians should not underestimate the benefits they gain from¶ America’s willingness to share advanced capabilities. The NSA’s US$10.8 billion¶ budget (Gellman and Miller, 2013) easily dwarfs CSE’s 2013 budget of¶ CA$460 million and 2014 budget of CA$829 million (Freeze, 2013; Treasury¶ Board of Canada Secretariat, 2014). To upgrade CSE’s capabilities to roughly¶ equivalent NSA levels would require a very large increase in its budget, a¶ costly and most unlikely investment. Instead, Canada has “access to a $15¶ billion global information-sharing partnership” that imparts vital intelligence¶ on key “threats and … technological challenges” through the Five Eyes¶ (Canada, SSCNSD, 2012b). Participating in the alliance provides Canada¶ with access to a multi-billion dollar intelligence apparatus without needing¶ to make equivalent investments in its own SIGINT capabilities. Cooperation¶ is decidedly cheaper than independently developing competitive intelligence¶ capabilities (Sims, 2006).¶ Access to American capabilities and the dynamic of an alliance relationship,¶ such as the Five Eyes, includes US requests on Canada’s intelligence¶ collection. Several Canadian embassies, for example, have been set up as listening¶ posts at the request of the NSA (LeBlanc and Freeze, 2013; Weston,¶ Greenwald, and Gallagher, 2013b). More recently, Canada allowed the NSA¶ to carry out surveillance during the 2010 G20 Summit in Toronto. The specifics¶ of Canada’s involvement are unknown, but a leaked memo points to¶ close operational cooperation between the NSA and “the Canadian partner”¶ during the G20 (US, National Security Agency, 2010: 3; Weston, Greenwald,¶ and Gallagher, 2013a).3¶ To carry out its Five Eyes mission—defending government systems¶ in cyberspace and providing intelligence to support governmental decisionmaking¶ (Cox, 2012)—Canada relies in part on American capabilities and,¶ specifically, US intelligence. This means that the United States, in turn, can¶ influence Canadian intelligence priorities (Richelson, 1990). In this relationship,¶ Canada is, of course, in a more dependent position. The government¶ of Canada must thus keep its eye continually on both the effectiveness of its¶ cooperative cybersecurity network with the United States and the sovereign¶ Canadian parameters for security and privacy. Despite some of the embarrassing¶ leaks emanating from the Snowden incident, the relationship’s disadvantages¶ are outweighed by Canada’s continued access to high-level American intelligence and the advanced technologies Canada and the United States¶ use together to confront the ever-evolving threat of cyberattacks (Richelson,¶ 1990). At the same time, on a balance of vulnerabilities, cooperating with¶ the Five Eyes and Canada in particular provides an important means for the¶ United States to expand its global surveillance reach (Bauman et al., 2014)¶ and to enhance North American cybersecurity.¶ Canada draws a clear net benefit from close cooperation with the¶ United States in cybersecurity because the nature of the evolving threat and¶ the nature and cost of countering this capacity is increasingly more difficult¶ for a state to address on its own. At the same time, the Canadian government¶ faces a balance between security and the Canadian definition of freedom as¶ it cooperates with the United States and Five Eyes. Surveillance capacity, like¶ capacity for cybersecurity, is on the increase. Managing the information that¶ results from this capacity remains a key value that both the American and¶ Canadian public demand. |