Spy agency warns foreign states trying to steal COVID-19 research in Canada

Open this photo in gallery:

Canada’s spy agency is warning Canadian academics and corporations that they are at increased risk of espionage or intellectual property theft as agents of foreign governments target a surge in research related to COVID-19.

A May 13 bulletin from the Canadian Security Intelligence Service obtained by The Globe and Mail flags what CSIS identifies as a rising threat of stolen technology or data as spending in this country on coronavirus research surges, scientists work from home, and researchers entertain partnership offers from foreign interests.

The guidance offered to universities and researchers reports a “rapid evolution in the nature and volume of threat activities and ... [a] focus on new targets in Canada” in areas from health research to artificial intelligence and nanotechnology amid international efforts to develop vaccines and other treatments.

The Canadian government has announced more than $1.2-billion in support for COVID-19 research to date.

“The biopharmaceutical and health care sectors are at a significantly high risk at this time as many countries are accelerating their COVID-19 research and development to support the pandemic response,” CISIS said in the document. “CSIS is particularly concerned about this threat in relation to state-sponsored activities of hostile states secretly seeking strategic or competitive advantage.”

Other sectors, including quantum computing, “big-data analytics,” and manufacturing, that are involved in the COVID-19 response are also an attractive target for foreign espionage, CSIS said in the six-page bulletin, which is marked “Restricted distribution: Government of Canada and partners only.”

CSIS did not identify the countries targeting COVID-19 research in Canada, but U.S. authorities including the Federal Bureau of Investigation produced a similar notice, also on May 13, naming China and accusing Beijing of seeking to “illicitly obtain valuable intellectual property and public health data related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research."

Former CSIS director Ward Elcock said China is Canada’s “largest counter-intelligence target and has been for some years.” Beijing recruits people from outside the espionage community to spy, he said.

Mr. Elcock said Russia and Iran also engage in cyber attacks to steal intellectual property and confidential data.

CSIS also warned researchers that investment offers from abroad or requests to license their work could be a pretext for theft.

Canada’s corporations, especially financially distressed start-ups, also need to cast a critical eye on state-owned enterprises or “front” companies that want strings – and consequences attached,” the agency said.

““Your intellectual property may be exposed to theft if you enter into licensing or other contractual arrangements with foreign partners, in an expectation that they will abide by Canadian laws and norms.”

CSIS said foreign spies are trying to steal intellectual property (IP) and corporate data through cyberattacks, but also by employing business people, scientists, researchers and students. “These people know what is valuable and they are able to operate in business and research environments without raising suspicions,” CSIS said.

Jim Hinton, a patent lawyer based in Kitchener, Ont., said he believes CSIS has already learned that foreign actors have compromised COVID-19 research.

“You don’t put out something like this unless there has been something to put you on notice. This is a reactionary document.”

He said that, in his opinion, Canadian universities don’t have the same level of concern about the leakage of intellectual property.

“I think there is a naivete they have that they are working for the public good so that if something gets out, it doesn’t really matter.”

The Communications Security Establishment, which handles cybersecurity, said in a joint statement with CSIS last week that “state-sponsored actors have shifted their focus during the pandemic and that Canadian intellectual property represents a valuable target.”

In CSIS’s annual report tabled in Parliament on Wednesday, director David Vigneault said hostile states striving to gain competitive advantage represent the “greatest danger to Canada’s national security" and can have a “tremendous impact on our economic growth and ability to innovate.”

Without naming China, he said a number of state-owned enterprises and private firms with close ties to their government and or intelligence services pursue corporate acquisition bids in Canada.

“Corporate acquisitions by these entities pose potential risks related to vulnerabilities in critical infrastructure, control over strategic sectors, espionage and foreign influenced activities, and illegal transfer of technology and expertise,” Mr. Vigneault said.

The University of British Columbia said on Thursday it has increased protections for research.

“In response to the heightened level of risk during COVID-19, UBC has implemented increased cybersecurity controls across the institution for faculty, staff and researchers, particularly those who process medium- to high-risk information," Don Thompson, chief information security officer at the university, said in a statement.

"We anticipate that threat activities will continue to evolve, and more cautionary measures will be required. We remain vigilant, with our research partners and post-secondary colleagues, to protect our institutions.”

The University of Toronto said in a statement that it “acts on the advice of the Canadian government on national security issues ... to monitor risks and to put in place additional measures.”

Canadian entrepreneur Jim Balsillie, the co-founder of Research in Motion, the company behind the Blackberry, lauded CSIS for drawing attention to Canada’s vulnerabilities, but said Ottawa must lay down clear rules to deal with these risks.

“Yes, we need to better protect against foreign actors poaching our valuable publicly funded IP, but a far greater cost to our economy and security is the IP we freely give away in so-called partnerships,” he said. “We know from numerous studies that Canadian universities are uniquely unqualified and ill-equipped to manage IP. If we want to generate and retain IP and data assets for the benefit of Canada’s economy and security, we will need a hands-on approach involving IP and data experts.”

Sign up for the Coronavirus Update newsletter to read the day’s essential coronavirus news, features and explainers written by Globe reporters and editors.