U.S. takeover of network carrying sensitive federal data raises security concerns

Share

A U.S. takeover of a national fibre optic network in Canada that carries sensitive federal government telecommunications traffic is raising security concerns that the United States will find it easier to gain access to confidential Canadian data.

In a transaction that closed this month, Manitoba Telecom Services Inc.'s Allstream unit has been bought by U.S.-based Zayo Group. Allstream, with its coast-to-coast Internet backbone network, is under contract to carry data for 43 Canadian departments and agencies, including the Department of National Defence, the RCMP and Canada Revenue Agency.

In 2013, the Harper government blocked a deal to sell Allstream to Egypt's Accelero Capital Holdings on the grounds of national security. Ottawa said it kept Allstream out of foreign hands because it "provides critical telecommunications services to businesses and governments, including the government of Canada."

Manitoba Telecom and Zayo announced the deal in November, and the Trudeau government declined to conduct an official national security review.

"The 45-day period during which the government could raise national security concerns has passed," said Stéfanie Power, a spokeswoman for the Department of Innovation, Science and Economic Development, which screens foreign takeovers through its investment review division.

Critics say the net result of the deal is that a foreign entity now owns and controls a network carrying extremely confidential Internet traffic for Ottawa. No other major domestic network supplier to the federal government is foreign owned and controlled.

The Allstream takeover was announced weeks after Prime Minister Justin Trudeau took office. The period for review by Ottawa ended in early January.

Michael Geist, an expert in Internet law at the University of Ottawa, says U.S. ownership of a Canadian Internet backbone makes it easier for Washington to obtain access to the data it carries, either through the courts or covertly.

"Any time you have a U.S.-based entity that owns a Canadian network, it increases the risk that U.S. authorities will have easier access to the information that runs on that network," Prof. Geist said.

Legislation such as the U.S. Patriot Act gives the United States power to compel a U.S. company to produce information, including communication possessed by a foreign subsidiary.

"It's not limited to the U.S Patriot Act. U.S. authorities have a number of legal mechanisms that allow them to try to gain access and [this] is unquestionably made easier when the entity that they are dealing with is U.S. based," Prof. Geist said.

Manitoba Telecom's chief corporate and strategy officer, Paul Beauregard, said his company worked long and hard to provide sufficient information to satisfy the government that "Zayo would be an appropriate purchaser from a security perspective."

Innovation Minister Navdeep Bains defended Ottawa's conduct in this case, saying every foreign investment is "subject to a due diligence process."

He declined to explain why the Liberals decided against a formal national security review, saying these are ordered only when the government feels "investment could be injurious to national security."

Washington has made it clear it considers data held by U.S. companies abroad part of its purview.

Microsoft is appealing an order by a U.S. court in 2014 to turn over e-mails on company servers in Ireland. Last fall, U.S. government lawyer Justin Anderson told Reuters News that U.S. law enforcement believes it can obtain electronic information held by U.S. companies with a valid warrant, regardless of where the data are stored. "It's not a question of ownership," Mr. Anderson said, likening it to seizing account records from a bank. "It's about custody and control."

Conservative foreign affairs critic Tony Clement slammed the Liberals for skipping a national security review and said he wants to know what protections Canada has obliged Zayo to enact to prevent interception of crucial data.

"The Trudeau cabinet declined to do even the very least to examine whether Canada's national interests are being affected by this transaction. This is a very bad precedent," he said. "Canadians deserve to know what safeguards the government of Canada is putting into place to ensure the protection of sensitive and proprietary information."

An executive with Zayo Group said the company also provides telecommunication and data services elsewhere outside the United States, including for customers in northern Europe. "They all take their data security very seriously … so we are used to operating in that environment," said Dave Jones, executive vice-president of security and IT. "Security is very important to Zayo."

Asked to gauge the risk that the U.S. government could demand access to data on Zayo's new Canadian network, Mr. Jones said "it's not something we can comment on specifically."

Ray Boisvert, a former assistant director of intelligence at the Canadian Security Intelligence Service, said Ottawa appears to be betting a major ally will not take advantage.

"Generally speaking, friends don't spy on friends," Mr. Boisvert said.

Andrew Clement, a professor in University of Toronto's faculty of information, said spying revelations from whistleblower Edward Snowden should breed skepticism among Canadian decision-makers about what kind of surveillance spying the United States might undertake. "A significant part of the Canadian Internet backbone has just transferred to U.S. ownership. This is critical infrastructure from a Canadian sovereignty point of view," Prof. Clement said.