CSE’s original statement mentioned telecom working group studying security flaws in global network
NDP MP Matthew Dube inside his Parliament Hill office. A CBC/Radio Canada investigation back in November showed how easy it was to hack the MP’s cellphone by exploiting weaknesses in a global telecommunications network known as SS7.(Marc Robichaud/CBC)
The experts exploited a weakness in a global telecommunications network known as Signalling System No. 7 (SS7). Dubé’s cellphone was connected to the Rogers network, but telephones connected to Bell Canada’s network were also successfully hacked by the experts based in Berlin.
The Communications Security Establishment (CSE), Canada’s electronic communications spying agency, responded to Radio-Canada/CBC’s questions for the government. The CSE told CBC/Radio Canada that, among other things, the security issues with SS7 had been known for many years and that it had been actively working with Canada’s telecommunications industry on ways to reduce the risks associated with SS7.
The CSE later published a similar declaration on its website.
But the intelligence agency originally planned to say more. Documents obtained under Access to Information legislation reveal that the CSE’s initial response was modified at the last minute following discussions between the agency and the Ministry of Innovation, Science and Economic Development.
The headquarters of the Communications Security Establishment (CSE) in Ottawa. (Sean Kilpatrick/Canadian Press)
In its first — and unpublished — statement, the CSE revealed the existence of a working group looking into SS7’s flaws that the agency had co-led with the telecommunications industry within the last year.
The statement also went into greater detail about measures mobile phone vendors could take to protect their networks and the privacy of their subscribers.
“Some SS7 mitigation measures may be easier for industry to implement, while others could require significant investment and effort,” the federal agency wrote in its initial draft.
Those elements were missing from the agency’s official response.
After these documents were brought to CSE’s attention, the agency confirmed that a working group related to SS7 meets on a regular basis to “discuss various updates, challenges and concerns our telecoms partners may have.”
The agency would not comment further.
“As a result of the working group agreement, CSE is prohibited from discussing further details of meetings and we are not authorized to disclose the participation of individual, private telecom partners,” the agency wrote in an email.
The Access to Information documents also show that in November, when Radio-Canada/CBC requested a response to the hacking of Dubé’s cellphone, the government wasn’t sure which ministry was responsible for the file — Public Safety, Innovation or Shared Services. After two days of hesitating, the CSE was tasked with drafting a response.
The documents ultimately were obtained from Public Safety. A similar Access to Information request made to CSE remains unanswered after four months; by law, such requests are to be answered within 30 days in most cases.
Award winning investigative reporter with Radio Canada