Oilsands a hacker target: RCMP

Enlarge Image

Jeff McIntosh / The Canadian Press Archives Alberta�s high-profile tarsands could attract the attention of hacktivists. (CP)

OTTAWA -- Canadian security agencies have warned energy companies such as Imperial Oil their computers may be attacked by the hacker group Anonymous because of the industry's work developing Alberta's oilsands, government documents show.

The RCMP, public safety department and Communications Security Establishment Canada all investigated threats against the industry between the start of 2011 and mid-March, according to documents obtained this month by Bloomberg News under freedom of information laws. The RCMP conducted a threat assessment after Anonymous issued a press release in July 2011 accusing oilsands companies of being greedy and harming the environment.

"The Canadian law enforcement and security intelligence community have noted a growing radicalized environmentalist faction who is opposed to Canada's energy sector," the RCMP's assessment said. "Corporate security officers should verify that security testing has been performed on public facing web servers and mail servers."

The hackers are attracted to high-profile projects such as TransCanada Corp.'s proposed Keystone XL pipeline, which would ship Alberta crude to the U.S., said Thomas Dean, associate professor of electrical and computer engineering at Queen's University.

"It's the high-profile targets that tend to get hit," Dean said from Kingston, Ont., where he researches software security. The chance of an attack rests on whether the industry makes new international headlines, he said.

U.S. President Barack Obama rejected TransCanada's initial application to build the $7.6-billion Keystone pipeline in January after Nebraska officials said it threatened the state's water. The company re-applied with an altered route for the link between Alberta producers and U.S. Gulf Coast refineries.

"Threats to Canada's critical infrastructure are real and will persist," Tahera Mufti, spokeswoman with the government's Canadian Security Intelligence Service, wrote in an emailed comment on the reports.

Anonymous has infiltrated the computer systems of Toronto's police, Bank of America and the Australian and Syrian governments, according to the 44 pages of documents released by Canada's foreign affairs department. The group uses online discussions instead of formal leadership to organize actions and focuses on embarrassing prominent companies, Dean said.

Canada's oil reserves are the world's third largest after Saudi Arabia and Venezuela, most of which in bitumen deposits in Alberta. Environmental groups say extraction of the tar-like bitumen from sand exacerbates global warming and threatens wildlife. Crude output from Canada is forecast to more than double to 6.2 million barrels a day by 2030, according to the Canadian Association of Petroleum Producers, known as CAPP.

"Within this most recent threat, Anonymous could target or be targeting the IT infrastructures" of companies including BP Plc, Canadian Oil Sands, Suncor Energy and Nexen, the RCMP said in the 2011 report.

The government documents didn't show evidence of plans for a specific attack and the RCMP said in the report there's no indication Anonymous intends to cause "material damage."

"We were made aware of the issue by various third-parties, including the government, and we also became aware of the issue via our own monitoring systems," said Patti Lewis, spokeswoman for Calgary-based Nexen. "We have processes in place to mitigate business impacts that IT security threats may create."

Siren Fisekci, a spokeswoman for Canadian Oil Sands, the largest owner of Canada's biggest oilsands project, declined to comment, as did Scott Dean of BP. Sneh Seetal of Suncor didn't return emails and a phone call seeking comment. TransCanada didn't immediately respond to phone calls and emails.

CAPP president David Collyer met April 12 with the head of Canada's spy service, known as CSIS, federal lobbying records show. That was "part of ongoing/regular meetings with CSIS to ensure secure networks and infrastructure," Travis Davies, spokesman for the industry group, wrote in a May 11 email.

The Integrated Terrorism Assessment Centre, which brings together staff from various government agencies, produced a July 2011 memo about the risks posed by Anonymous to Alberta's oilsands, which was distributed to "stakeholders," according to a separate set of documents released by the spy agency under freedom of information law.

"Anonymous has demonstrated that it can effectively mount cyberattacks with the potential to disrupt corporate or government operations," the report said.

Jessica Slack, a spokeswoman with Public Safety Canada, declined to comment on any specific threat when asked about Anonymous. The department's minister, Vic Toews, was threatened by the group in a February video over proposed legislation that would increase the police's powers to monitor people's activities on the Internet.

Anonymous doesn't have formal leadership or spokespersons, and often works by calling hackers to join causes that are chosen through online polls, according to a government report. Their attacks focus on overloading websites until they shut down.

-- Bloomberg News

Republished from the Winnipeg Free Press print edition August 28, 2012 B4