OTTAWA — A Chinese telecommunication company secretly diverted Canadian internet traffic to China, particularly from Rogers subscribers in the Ottawa area, says an Israeli cybersecurity specialist.
The 2016 incident involved the surreptitious rerouting of the internet data of Rogers customers in and around Canada’s capital by China Telecom, a state-owned internet service provider that has two legally operating “points of presence” on Canadian soil, said Yuval Shavitt, an electrical-engineering expert at Tel Aviv University.
Shavitt told The Canadian Press that the China Telecom example should serve as a caution to the Canadian government not to do business with another Chinese telecommunications giant: Huawei Technologies, which is vying to build Canada’s next-generation 5G wireless communications networks.
WATCH: Conservatives continue push to ban Huawei
“It’s too dangerous to let them in,” Shavitt said. “You can just imagine how Chinese companies are co-operating with the Chinese government.”
The Trudeau government is still deciding whether Huawei will be permitted to supply equipment and services to Canadian companies seeking to build the networks expected to serve everything from smartphones to autonomous cars.
READ MORE: China brushes off mounting international concern over Canadian sentenced to death
That has become a politically charged decision with massive geopolitical implications since Canada arrested Huawei’s chief financial officer last month at the request of the U.S. It sparked a diplomatic crisis with the People’s Republic that has seen the jailing of two Canadian men working in China, and a death sentence imposed on a third man previously convicted of drug charges.
WATCH: Trump says he will meet with China’s Xi to try to seal trade deal
Shavitt’s warning comes as the U.S. Justice Department this week revealed the scope of its fraud and theft case against Huawei’s Meng Wanzhou. On Monday, the department unsealed 13 criminal counts of conspiracy, fraud and obstruction against Meng, while her company’s U.S. branch was accused of stealing trade secrets and equipment from cellphone provider T-Mobile USA.
Huawei has denied that it co-operates with Chinese intelligence or ever would, saying that could be fatal to the company.
The 2016 Ottawa area incident that included Rogers was part of an attack in which Canadian internet data bound for South Korea was rerouted to China over a six-month period. The diversion of the South Korean data was first documented in a report last fall co-authored by Shavitt and Chris C. Demchak of the U.S. Naval War College.
The report described how China Telecom uses two points of presence in Canada and eight in the United States to take “information-rich” internet traffic crossing its network — part of the ordinary working of the internet, in which packets of data pass through numerous servers on the way to their destinations — and reroute it through China with no noticeable effect on customers.
READ MORE: Canada has 30 days to authorize extradition proceedings in case of Huawei CFO Meng Wanzhou
China Telecom did not respond to a request for comment.
Rogers declined comment and referred the matter to the Public Safety Department.
Public Safety and Global Affairs Canada did not respond to requests for comment.
WATCH: Trudeau says Canada to hold firm on ‘rule of law’ as U.S. charges Huawei officials
The Shavitt-Demchak report called internet points of presence the “perfect scenario for long-term espionage” because local alarm bells won’t be raised “about the long-term traffic detours.”
The Canada-South Korea diversion was discovered by a company Shavitt co-founded called BGProtect that monitors internet routing infrastructure and sells services to protect countries and corporations from internet hacks. He said he used some of his company’s data to write the academic paper with Demchak.
READ MORE: U.S. hits Huawei and CFO Meng with 23 criminal charges. Here’s what you need to know
Shavitt described how hundreds of his company’s agents around the world monitor movements in the digital world. He said that could involve focusing on “a certain installation, an IP or server. We pick up locations around the world, and monitor the traffic and look for anomalies.
“In this case the anomaly was from Canada.”
WATCH: China demands Canada to ‘immediately release’ Huawei CFO
In a followup email, Shavitt provided further details: “Our software agent was indeed at Ottawa, but the attack had affected the entire Rogers network (at least) and its customers in the entire region.”
Shavitt said his company’s monitoring of Canada “was not dense enough” at the time of the attack to assess its full scope.
In the case of national network like Rogers’ in a large country such as Canada, the attack might affect only a “portion of the network, (but) usually still quite large ones — it depends how routing is configured. For example in our case, it may affect only Ontario and Quebec, but not the western regions of Canada,” Shavitt explained.
“I should say that the effect of the hijack is not only on Rogers’s direct customers (home and businesses) but also smaller networks in the affected regions that depend on Rogers for transit.”
WATCH: China tells U.S. to back off Huawei CFO extradition
A hijack attack can be used in many ways, including for espionage by “extracting important information from communication,” said Shavitt.
The attack can also be part of what is known as man-in-the-middle attacks, he said.
A man-in-the-middle attack can neutralize an organization’s internet security measures because it involves the insertion of a “bad actor” between a sender and the desired recipient, says the Shavitt-Demchak report.
When the internet traffic is rerouted into an adversary’s hands, “the attacker can learn enough to impersonate trusted sources” and “can allow the malicious attacker to harvest passwords,” the report says.
WATCH: What is 5G? Everything you need to know about the technology
“With those keys to the victim’s network in hand, attackers can distort, disconnect or destroy any part of the company’s network accessible from the internet, increasingly to include critical financial and physical systems and their backups.”
The Chinese government steadfastly denies engaging in cyberattacks.
In 2014, the federal government blamed a sophisticated state-sponsored Chinese entity for a breach that caused a shutdown of the National Research Council’s systems in Ottawa. China called that accusation reckless.
WATCH: Justin Trudeau says Canada consulting ‘security experts’ on 5G technology
In 2016, the Canadian Security Intelligence Service, or CSIS, warned that China and Russia were targeting Canadian government officials and information systems as well as classified information and advanced technology.
Without naming any countries, David Vigneault, CSIS’s new director, said in a December speech that “hostile foreign intelligence services” were targeting the “corporate secrets” and “intellectual property” of Canadian companies.
Vigneault said those state actors posed a greater threat to national security than terrorists do.
“It’s not that the Chinese are bad, or doing bad things in the U.S.,” Shavitt noted. “I’m sure that the U.S. and Canada are trying to do the same also to China. It’s a spying game that everybody’s trying to play.”
- Roll Up To Win? Tim Hortons says $55K boat win email was ‘human error’
- Bird flu risk to humans an ‘enormous concern,’ WHO says. Here’s what to know
- Halifax homeless encampment hits double capacity, officials mull next step
- Ontario premier calls cost of gas ‘absolutely disgusting,’ raises price-gouging concerns
Comments