Forget the cloak and dagger setting of the Cold War.
In the treacherous new world of corporate espionage where spies use distant computer networks to gather business intelligence, the scene of the crime may well be your mobile phone or laptop computer.
It all makes dollars and sense: Canadian companies connected to the Internet spend more on R&D than most foreign competitors.
So agents for foreign companies, and their sponsoring governments, are electronically mining social media on Canadian smartphones or tablets to steal valuable business secrets, rather than create their own intellectual property.
And all the while global hackers hide behind proxy computers and dispersed routers on the other side of the globe, and with the junk mail folder of your laptop computer or other mobile devices as their ultimate attack destination.
Sure, global hackers can attempt to defraud ordinary people by stealing their credit card data or other personal information.
But the way security expert Michel Juneau-Katsuya, a former operative with the Canadian Security Intelligence Service, tells it, click on a hacker¹s email, download its contents, and you may well start a cascading series of events that could compromise an organization’s computer security system.
And the impact could be not only immeasurably costly to the victim organization, but immensely profitable for the cyber spy or hacker after they acquire key proprietary or confidential information to be sold onto competitors or on a global black market.
Here’s how it’s done
Juneau-Katsuya, now CEO of The Northgate Group, a security consulting firm, told a November Toronto media conference about a recent incident involving a Department of National Defence (DND) employee that sounded a lot like a plot from a Hollywood movie thriller.
Except it actually happened.
The email was innocent enough, and suitably bland.
“The National Defence employee returned to work on a Monday and received an email from a fellow employee whose name he didn’t recognize, but whose email address made it look like he was in his department,” Juneau-Katsuya recalled.
The author of the email said he¹d had a great weekend and his daughter had played in a soccer game against the daughter of the DND staffer.
“By the way, the email read, ‘could you send me this specific document,’” Juneau-Katsuya added.
It turns out the document was classified top secret, not to be sent electronically.
Sensing a honey-pot trap set by a hacker to exfiltrate or steal classified secrets, the DND employee flagged his superiors, who launched an investigation.
The email was of course bogus, but it also came from China.
Worse, the hacker constructed and sent his deceptive email from the comfort of his computer half-way round the world using photos the DND staffer posted on his Facebook account of daughter’s weekend soccer match.
Juneau-Katsuya, on hand to help unveil the fourth annual study on Canadian IT security by Telus and the Rotman School of Management, said the DND incident is instructive.
Security breaches in Canadian companies and government agencies are increasingly inside jobs that originate across national borders as mobile computer proliferates.
“You need to identify the threat of who is after you, who is after what in your company. And here you find the true vulnerability within your organization to better spend your IT security dollars,” Juneau-Katsuya said.

Photo: Security expert Michel Juneau-Katsuya (l), a former operative with the Canadian Security Intelligence Service, joins Rafael Etges (c), Telus director of security solutions, and Walid Hejazi, professor of business economics at the Rotman School of Management, at the Toronto press event unveiling of the results of the 2011 TELUS-Rotman study on IT security in Canada.
Breaches down, risks up
The Telus/Rotman study, in offering a snapshot in how Canadians collect and convey personal and professional information in the workplace, should set off other alarms when it comes to social networking and mobile security.
The survey of 649 Canadian firms found the number of security breaches of corporate and government servers fell to an average 7.6 attacks a year in 2011, compared to 14.6 breaches in 2010.
That marks a reversal in the number of virtual attacks countrywide that after a spike following the 2008 financial crisis.
But the more worrying trend is cyber spies increasingly target average individuals in organizations and their data, and are using mobile technology to reach their victims.
“In the past two or three years, the introduction of tablets and smartphones in organizations has changed the dynamics around security technology and precautions,” Walid Hejazi, professor of business economics at the Rotman School of Management, told the roundtable discussion on Canada’s IT security landscape.
Yes, all good technology, smartphones and tablets, but ultimately undermining the ability of organizations to detect and control security breaches.
“We’re talking about any corporate data that was shared as a result of a mobile device or a laptop computer falling into the wrong hands, as well as global hackers accessing data without authorization from an employee working at home,” Hejazi explained.
Top threat: cyber spies
The Telus/Rotman study, first released in 2008, goes far beyond finger-pointing to help combat cyber spies and hackers as they have Canada in its cross-hairs.
Its forensic analysis instead identifies the top corporate and government security breaches in an age of global hacks, with an eye to steering bots, worms, spam away from a company’s computer servers as part of a strong cyber security system.
The latest Telus/Rotman study identifies the top threat to Canadian corporate and government security coming from cyber spies who use spyware and malware to take control of computer technology in an organization so they can harvest personal and professional data.
It’s insidious. An organization may not spot a security breach by a cyber intruder in time to stop it, nor be able to fully measure the cost to the company after it takes weeks or even months to repair the damage.
An example: a recruitment company builds up its base of resumes from which to fill vacant posts.
A competitor then hacks into the organization’s computer system, or steals an employee's laptop or mobile hardware device, and virtually exports those resumes to a remote computer from which they can never be retrieved.
Now the recruitment company’s competitive advantage is lost.
Another scenario has a hacker stealing key credit card information form a corporate database. The company then has to shut its computer system down to clean it.
The company also has to ring the credit card company to inform them of the security breach, which costs both in terms of dollars and lost reputation.
“That’s where we see the greatest number of breaches, where employees and their technology willingly or unwittingly become the window or the door that gives access to that information,” Hejazi explained.
And social networking promises to make that security challenge even larger.
Tomorrow: How companies that ban social networking in the workplace are inviting a higher number of security breaches.
To hear more from Rafael Etges, co-author of the 2011 TELUS-Rotman Study on Canadian IT Security, go to http://www.youtube.com/watch?v=iqWpT9mnXyE. Here, Etges joins Peter Macaulay, head of security of the Government of Ontario, and host Shane Schick, Editor-in-Chief of IT World Canada, to discuss trends in IT security in Canada. The discussion covers breaches and more personalized threats, mobile security, managing social networking in the workplace, and IT complexity.