Israeli Cyber Expert Finds China Hack In Ottawa


Massive Geopolitical Implications For Canada; Huawei Denies Links With Intelligence Services

OTTAWA: A Chinese telecommunication company secretly diverted Canadian internet traffic to China, particularly from Rogers subscribers in the Ottawa area, says an Israeli cybersecurity specialist.

The 2016 incident involved the surreptitious rerouting of the internet data of Rogers customers in and around Canada’s capital by China Telecom, a state-owned internet service provider that has two legally operating “points of presence’’ on Canadian soil, said Yuval Shavitt, an electrical-engineering expert at Tel Aviv University.

Shavitt told The Canadian Press that the China Telecom example should serve as a caution to the Canadian government not to do business with another Chinese telecommunications giant: Huawei Technologies, which is vying to build Canada’s next-generation 5G wireless communications networks.

“It’s too dangerous to let them in,’’ Shavitt said. “You can just imagine how Chinese companies are co-operating with the Chinese government.’’

The Trudeau government is still deciding whether Huawei will be permitted to supply equipment and services to Canadian companies seeking to build the networks expected to serve everything from smartphones to autonomous cars.

That has become a politically charged decision with massive geopolitical implications since Canada arrested Huawei’s chief financial officer last month at the request of the U.S. It sparked a diplomatic crisis with the People’s Republic that has seen the jailing of two Canadian men working in China, and a death sentence imposed on a third man previously convicted of drug charges.

Shavitt’s warning comes as the U.S. Justice Department this week revealed the scope of its fraud and theft case against Huawei’s Meng Wanzhou. On Monday, the department unsealed 13 criminal counts of conspiracy, fraud and obstruction against Meng, while her company’s U.S. branch was accused of stealing trade secrets and equipment from cellphone provider T-Mobile USA.

Huawei has denied that it co-operates with Chinese intelligence or ever would, saying that could be fatal to the company.

The 2016 Ottawa area incident that included Rogers was part of an attack in which Canadian internet data bound for South Korea was rerouted to China over a six-month period. The diversion of the South Korean data was first documented in a report last fall co-authored by Shavitt and Chris C. Demchak of the U.S. Naval War College.

The report described how China Telecom uses two points of presence in Canada and eight in the United States to take “information-rich’’ internet traffic crossing its network _ part of the ordinary working of the internet, in which packets of data pass through numerous servers on the way to their destinations _ and reroute it through China with no noticeable effect on customers.

China Telecom did not respond to a request for comment.

Rogers declined comment and referred the matter to the Public Safety Department. Public Safety did not respond to requests for comment.

A spokesman for Global Affairs Canada said the government “takes very seriously threats to Canada’s national and economic security,’’ exchanges information regularly with private internet companies and has meetings with China on the subject, too.

“Canada raises such issues with China regularly,’’ Guillaume Berube said in an email. “The topic of cyber hacking will be a priority when the Canada-China National Security and Rule of Law Dialogue meets next.’’

The Shavitt-Demchak report called internet points of presence the “perfect scenario for long-term espionage’’ because local alarm bells won’t be raised “about the long-term traffic detours.’’

The Canada-South Korea diversion was discovered by a company Shavitt co-founded called BGProtect that monitors internet routing infrastructure and sells services to protect countries and corporations from internet hacks. He said he used some of his company’s data to write the academic paper with Demchak.

Shavitt described how hundreds of his company’s agents around the world monitor movements in the digital world. He said that could involve focusing on “a certain installation, an IP or server. We pick up locations around the world, and monitor the traffic and look for anomalies.

“In this case the anomaly was from Canada.’’ – Canada Press