The Canadian Security Intelligence Service (CSIS) investigates threats to the security of Canada, this includes threats to the security of Canadian research efforts. Join CSIS as they explain the importance of research security, the current threats that Canadian research and innovation are faced with, and how you can do your part to contribute to research security in Canada.
CSIS Threat Briefing
-
Transcript - CSIS Research Security Briefing
Introduction
- Hello, my name is Tricia Geddes and I’m the Deputy Director of Policy and Strategic Partnerships at the Canadian Security Intelligence Service or CSIS. I’m very pleased to have this opportunity today to provide you with information on threats to research security.
- We are engaging more and more in public conversations about the nature, complexity and evolution of the threats facing our country because we are dedicated to protecting our national interests and we can’t do it alone.
- CSIS investigates threats to the security of Canada. For the sake of this presentation, I’ll be focusing primarily on the threats of espionage and foreign interference, but our mandate covers all threats to national security.
- One way to look at the importance of what CSIS does in confronting the scope of these threats is to understand that terrorism threatens our lives, while espionage and foreign interference threaten our way of life. Defending Canadians and Canadian interests from these threats is what inspires CSIS employees to do the work they do.
Balancing Openness with Safeguards
- Globalization has greatly expanded research cooperation, providing immeasurable public good in advancing research and development across borders. The research community has nurtured a climate that favors openness, autonomy, and collaboration.
- This has provided significant benefits for Canada and supported the growth and development of our country, our economy, and our society. We are a world leader in many sectors, and attract students and researchers from around the world to our universities and research facilities.
- At the same time, the permissiveness of this model may leave it open to exploitation by those who do not share those values, including regimes that have proven adept at taking advantage of this openness for their own purposes. To combat this exploitation we need to have safeguards in place.
- Our objective is not to hamper international scientific and research collaboration, but rather, to ensure that Canada’s research community, R&D, and significant investments are protected against threat actors who might choose to exploit Canadian knowledge for their own national strategic or economic advantage.
- Protecting our assets today will allow our research and innovation sectors to grow and flourish into the future. Academic research can be open and collaborative, while still ensuring that privacy, security, ethics, and intellectual property safeguards are in place.
- These protections benefit both Canada and the research community, by ensuring that the funders and researchers directly involved in research and knowledge development retain the ability to benefit from the work they are advancing.
- I hope that the information in this presentation will allow you to engage in informed cooperation and collaboration with eyes wide open, enabling you to continue to make a vital contribution to global scientific advancement, sensitized to the risks, and equipped with the knowledge to effectively mitigate against the threat.
What is Research Security?
- What is research security? Research security is distinct from, but related to, research integrity. Research integrity is conducting research in a way which allows others to have trust and confidence in the methods used and the findings that result. Research security, is about protecting research and staff from potential theft, misuse or exploitation by those who would seek to acquire information and intellectual property for their own benefit and potentially to the detriment of those involved in the work and, ultimately, Canada.
- As the world becomes more competitive, states are naturally seeking every advantage. As a result of this competitive drive, some hostile state actors leverage all elements of state power, including their intelligence services, to advance their national interests at the expense of others. Individually in some cases - and certainly in the aggregate - these activities constitute a threat to our national security interests.
- CSIS was created during the Cold War. At that time, espionage activity was typically directed towards illicitly obtaining Canadian political, military, and diplomatic secrets, mostly secured in top secret government bunkers and military facilities.
- These targets remain attractive to our adversaries, but in today’s data and high technology-driven world, some of the most advanced research and discovery is conducted in relatively open and accessible university labs and small start-ups making you and your research a target. Today’s spies are as likely to wear lab coats as trench coats.
- In the knowledge-based economy, the most valuable national economic and security assets are intellectual property and data. These vital assets can be both tangible and intangible – including not just documents and research results, but novel processes and tacit knowledge. The exfiltration of these knowledge assets outside Canada through clandestine or deceptive means constitutes a pressing national security concern, particularly if the knowledge is sensitive or has possible military applications.
- Foreign adversaries take a multi-pronged approach to acquiring the information they seek. Research funding, language and cultural training, visiting students and professors, conferences and knowledge exchange opportunities, and state-sponsored industrial and technical espionage can all be used to support their military and commercial research, development, and acquisition.
- However, I want to acknowledge that talent recruitment, exchange programs, funding arrangements, foreign travel, and joint research all represent legitimate opportunities for collaboration and to advance knowledge. Security concerns arise only when these activities are conducted covertly or clandestinely to conceal the involvement of a foreign state or the true objectives of those involved. In certain cases, foreign adversaries might use any combination of these approaches to strategically target you and your work.
- While talent programs are not inherently malicious and are an acceptable part of the modern research enterprise, they can be subject to employment conditions that cross into the realm of foreign interference. The requirement to transfer or replicate research, or requirements to attribute research to foreign institutions, are examples of ways in which foreign actors use talent programs to seek unfair advantage.
Current Threat Environment
- Threat activities, which can include attempts to steal or otherwise exploit Canadian intellectual property, know-how and talent are happening in Canada right now. These activities are undertaken by individuals of any background or nationality and are not unique to Canada. Our allies are also experiencing these threats.
- Recently, the heads of our counterpart agencies in Australia, the United States and the United Kingdom have indicated publicly that the current levels of espionage and foreign interference are unprecedented and unacceptable.
- Canada is not alone in facing these challenges, but we are equally not alone in responding to them. We can work closely with our allies – just as you can work with your research partners and counterparts – to identify and implement effective strategies and tools to protect our national and mutual interests.
- Canada’s research ecosystem has long been a target of hostile actors, but recent developments have amplified both the threat, and also certain vulnerabilities.
- Working remotely via unsecured virtual networks, for example, can increase vulnerabilities to cyber espionage and theft of research. This is particularly true when that work involves collaboration with international partners, based in countries whose legal and regulatory regimes do not recognize principles of academic freedom and proprietary rights.
Why Should You Care?
- These actions have an impact at the individual, organizational and national level. As an individual, theft of your research could result in diminished publishing or commercialization prospects, loss of funding, negative reputational impact and other losses of opportunity. These actions could take your life’s work and your ability to reap the benefits of your ideas and efforts.
- Further, these actions take away your control over your work and your ideas, and the way those ideas are disseminated and applied. For example, your work could be used and adapted for mass surveillance, to repress human rights, or for military advantage.
- Even if you, as researchers and supporters of research, do not intend to commercialize or personally benefit from your research, you should have the ability to decide why, when, and with whom you share your research knowledge and results and also some control over how it is applied.
- Further, these actions threaten to undermine the integrity of the research enterprise as a whole in Canada by eroding its most basic principles of openness, transparency, and collaboration and core values such as objectivity, honesty, accountability, fairness and stewardship.
- Clandestine or deceptive practices could lead to foreign interference in decisions about advancement, publication, promotion and funding, which erodes trust – trust of a level-playing field and shared objectives within the research community - as well as public trust in research and stewardship of public funds.
- If our open, free, and collaborative research environments are compromised, limited, or obstructed, all of us - and our future generations - lose. We want to work with you to address these challenges.
What is At Stake for Canada?
- Your research matters. It drives forward innovation and scientific discovery and advances the public good.
- Canadian academic institutions are world leaders in various economic, technological and research sectors that are of interest to foreign states. In a growing knowledge-based economy like Canada’s, research and development are even more valuable.
- Given this reality, we cannot afford to be complacent about Canada’s place in the global research, development and innovation landscape. Our future depends on our ability to secure and protect Canadian research. The Government of Canada invests heavily in research and innovation because of the obvious benefits to our country, and recognition that securing Canada’s place in the world depends on it.
- Most of this research is being done in universities, colleges and associated research facilities. As such, the Canadian government has made, and continues to make, significant investments in these institutions to support Canadian research with the objective of ensuring Canada’s economic security.
- Universities and degree-granting colleges receive a significant portion of their funding from government sources (47%). The vast majority of federal government funding (88.4%) is directed toward sponsored research through the Tri-Agency Council.
- Given the size and importance of this investment, the Government of Canada is focused on protecting the integrity of the system of international research collaboration, which is vital to the success of our research and innovation sector.
- This is particularly relevant to researchers in STEM subjects, dual-use technologies, emerging technologies and commercially sensitive research areas. The guidance we are providing is designed to help you get the most out of international collaboration, while protecting intellectual property, sensitive research and its underlying data, and personal information.
- Regardless of motive, when hostile actors unfairly take advantage of our research environment, they do so at a cost to our research institutions and our greater innovation ecosystem. Directly or indirectly, their actions cost money, jobs, expertise, sensitive information, advanced technology, and domestic incentive to innovate.
How Can You Protect Yourself?
- You can safeguard yourselves from foreign threats without damaging the very open elements that have helped Canada’s research enterprise become one of the best in the world. And it doesn’t require ending international research collaborations, which are foundational to scientific research advances.
- Increasing our collective awareness of, and resilience against, the threat is critical and can assist you in developing a security strategy appropriate for you and your organization. This is why CSIS has been increasing its engagement with stakeholders outside of government, including in academia and the private sector.
- Threat actors use a variety of covert and clandestine means to gain access to and steal the information they seek. The threat can emanate from outside our organizations (for example through a cyber attack). Equally it can originate within (through insiders that may be deliberately placed, recruited or co-opted on a willing or unwilling basis to access and share knowledge).
- It can also be enabled and facilitated by a lack of awareness, due diligence, mitigation and resilience in our research practices.
- We need to do all we can to protect our institutions and our most valued assets so that we do not unwittingly assist our adversaries in achieving their objectives at our expense.
- Among the methods utilized by foreign adversaries are non-traditional information collectors. This could include research partners, visiting students, faculty, or other staff. These are people who have no formal intelligence training or tradecraft, but who are insiders with access to your most important information. These individuals can be witting or unwitting collectors who have been coerced, co-opted or otherwise incentivized into delivering the information that adversaries seek.
- The use of partnerships or funding agreements to obtain direct access to valuable intellectual property and research also represents a common tactic. Again, these are valid mechanisms to support international collaboration and knowledge development, but can also be used for deceptive or clandestine purposes to access knowledge for objectives or reasons that may be deliberately obscured or work to the disadvantage of the researchers involved. There are a number of steps you can take before entering into international partnerships or funding agreements to ensure that your partnership is not being exploited for other purposes. We encourage you to:
- to consult legal and government sources of information;
- conduct due diligence to ensure that the proposed partnership is legitimate, objectives are clear and shared, that the sources of funding are transparent, and that the agreement includes clear and enforceable conflict resolution mechanisms; and,
- ensure that the terms of the agreement respect Canadian laws, regulations and international research norms.
- Although the methods and means used by threat actors vary, some ‘red flags’ to look out for include:
- Offers of funding where the source of the funding or value is unclear or offers of cash.
- Any collaboration or partnership where you are asked not to report some or all of the activities to your institution.
- Use of elicitation techniques to gain information.
- Unusual requests for on-site visits.
- Discrepancies between an individual or organization's online presence and their communications.
- Lack of familiarity with the area of research or equally a level of interest in or knowledge about your research project that seems unusual or difficult to explain.
- Any demands or inducements to change content, access limitations, research protocols, or staff.
- Any activities or communications that seem unusual - you know your area of research. Trust your best judgement. If an offer seems too good to be true it probably is.
- To support you in employing the necessary safeguards and mitigation measures, CSIS has developed a Safeguarding Your Research Checklist, which is just one example of the guidance and best practices available on the Safeguarding Your Research portal.
- You can also access tailored online courses through the portal or book a Safeguarding Science workshop for your organization with Public Safety Canada.
- Thank-you for your attention and please don’t hesitate to reach out to CSIS through any one of our offices if you have questions or concerns. Our contact information is available on our website.
- With a shared approach to security and reciprocal partnerships between our organizations we can protect you and all Canadians, increasing our collective resilience and ensuring the future prosperity and security of Canada.
CSIS – Safeguarding your research checklist
These are some questions to consider. Together, the answers to these questions can help you to assess your level of risk and will inform possible mitigation strategies.
- Ask yourself: How might an adverse foreign interest exploit your research or product?
- Ask yourself: How might an adverse foreign interest exploit “usual” requests for cooperation, access or sharing?
- Are you aware of specific and/or suspicious foreign interest in your research or product?
- Have you had any requests for visits to your facilities from foreign delegations? If such a visit transpired, were there any unusual requests or any breaches of security practices during the visit? Did anyone attempt to extract or engage with your network during the visit (e.g., inserting a USB stick or taking photographs)?
- Have foreign researchers expressed an unusual interest in obtaining the details of your research/product?
- Do you actively monitor and audit the computer usage of your employees?
- Have you considered customizing computer access or removable media use for certain groups of employees or physical work areas?
- Do you have processes and policies in place to monitor your networks and detect large data exfiltration?
- Have you had any offers from foreign entities to purchase or invest in your research/product? If so, from whom and what were the terms of the offer? Where those terms unusually generous, confident, or with less due diligence than you might have expected?
- What is the source of your current funding?
- Do you control access to specific technologies or know-how on a need-to-know basis?
- Do you have up-to-date and enforceable conflict-of-interest policies?
- Do you have a process in place to determine whether your employees are engaged in work or research activities beyond your organisation, while working for you? (e.g. universities, other companies, etc.)
- Do you know who owns the patents related to your work?
- Does your research/product have multiple uses? Can you imagine a scenario in which your research/product could be used for malicious purposes regardless of intended use? Is your research strategic/novel/ground-breaking or could it otherwise fill in an important piece of the puzzle for a competitor?
- Have you or anyone you know (friends/family/colleagues) ever been employed/ offered employment or invited to visit a foreign research facility that conducts similar research or creates similar products?
- Do you have an employee travel policy or a videoconference policy to ensure your awareness of what is being shared with foreign entities?
- If anyone from your organisation travelled to a country that exhibits adversarial behaviour towards Canada, did they bring any electronic devices? Were they checked before and after for any signs of compromise? Do you use dedicated devices for international travel?
- What is the vetting process for hiring foreign researchers at your facility? (This may include students, professors, contractors, etc.)
- Are you aware of any compromises or theft of your intellectual property? If yes: do you know how it was obtained, and by whom? What steps did you take to prevent future compromise?
- To your knowledge have any of your suppliers or partners been compromised or been victims of a security breach? If so: do you know why they may have been targeted, and by whom?
- Do you know all your suppliers and others (e.g. brokers, shippers, logistics firms) in the import/export of your research or product?
- Have you attended any conferences related to your research and if so, have you had any interactions with other attendees that raised your suspicions? Did any new contacts reach out before or after?
Additional guidance on how to assess and mitigate the risks to your research, development, and intellectual property is available from the Government of Canada. Please see the Safeguarding Your Research Portal or reach out to the Canadian Security Intelligence Service. Our regional contact information is found on our website.