Russian Claims of Pipeline Hacking Are Deadly Serious – Geoffrey Cann

Russia’s recent claims about hacking a Canadian gas pipeline must be taken with deadly seriousness, and not just by pipeline companies, but Canadians at large.

A document leak allegedly caused by a 21 year old cyber transport professional working inside the US security services contained a story that a shadowy Russian cyber team had successfully hacked into the operations of a Canadian gas pipeline system and with disruptive intent.

To understand why I am skeptical of these claims, you might want to read an earlier article where I set out how hard it actually is to hack into these operational systems and wreak a little mayhem. For their claims to be true, the hacking impacts had to be successfully hidden from the Canadian public. There have been no reports of gas supply disruption this past winter.

Then again, skepticism is not a substitute for preparedness. And it’s a certainty that hackers are constantly attacking energy infrastructure because energy is so vital to national interests. Energy companies are more likely to settle quickly with hackers as happened with Colonial Pipeline.

It’s through a review of the broader geopolitical landscape that underscores why Canadians should not dismiss these claims, and why we should be stepping up our efforts to protect our northern flank.

How Canada Protects Itself

Let’s assume for the moment that these Russian hackers were not the usual grubby criminal hoods out for quick ransom but were state actors, employed by Russia’s government (they claim they aren’t, but are these really people you can trust?). Why would an arm of Russia’s government go after Canadian energy infrastructure if the hacking activity was not entirely commercially motivated?

Perhaps it was out of spite for Canada’s support of Ukraine in the war effort. Perhaps it was a tit-for-tat reaction to Canada’s quick alignment with sanctions imposed on Russians.

Or perhaps it was for more serious strategic security reasons.

For example, imagine that the Russians were simply testing Canada’s defensive posture against cyber activity that targets militarily important infrastructure. As the aggressor, if you can disable the national heating system (the gas pipeline) with cyber, and there’s no swift reaction from the owner, the military or the government, there may well be no reason to need to bomb it during an invasion. Disabling energy infrastructure so as to disrupt the civilian population makes peace negotiations much easier (a cold, wet and hungry population huddling in the dark with a free press may be readily persuaded to sue for peace).

Clearly, gaining insight into how well energy infrastructure (especially critical oil and gas systems) are protected, and measuring the reactions by the pipeline owner and governments is quite valuable if you’re a military planner in the Kremlin and your job is to map out how you might invade militarily weaker Arctic nations.

How governments react to such cyber activity is dependent on how the victim nation, in this case Canada but equally applicable to Mexico, and the US view national, regional, and continental security.

In this instance, Canada has a military capacity but it’s generally hidden from public view in remote bases (aside from a large HQ presence in Ottawa). Politically, the government, through its words and deeds, demonstrates the following security stance:

• A view that the US, with its huge military capacity, will come to Canada’s defence should Russia attempt to seize far off Arctic real estate. This breeds a certain complacency among Canada’s political elites about spending appropriately on defence. Continental protection is substantially outsourced to the US.
• A reliance on NATO agreements for security. Although Canada does not meet its 2% of GDP spend on military support, the country is still the 6th largest NATO contributor. Canada’s political decision makers can convince themselves that they are spending enough.
• A largely isolationist national stance since the country is surrounded by water, except to the South, where the longest undefended border (between Canada and the US) limits concerns about a southern invasion. The threat of a naval attack feels minimized, and an Arctic land assault would quickly bog down in the harsh northern tundra and forests.
• A national economy that is highly coupled to the US. Almost all oil and gas exports head south with relatively little going overseas. The next biggest trade sector, automotive, is half the size of energy, and is largely part of a continental market agreement. These two sectors are bigger than the rest of Canada’s exports combined. It stands to reason that the US will not want to see this disrupted.

In June of 2022, Canada and the US announced a program to modernize NORAD, the North American Aerospace Defence Command. This program provides early detection and warning of threat actors on the continental border (Canada, Alaska, and continental US). The program is enormous, will take years to execute, and will somehow involve the provision of energy in the North (such energy is required to power radar and telecommunications). Energy companies are the logical partners in the renewal effort since they are likely also providing energy for resources companies operating in the north as well as for the local population.

Look at Canada through Russian Lens

Russia and Canada are two of a handful of countries (Canada, the US, Iceland, Denmark, Norway, Sweden, Finland, and Russia) that have tidal borders in the Arctic. A big difference is that most of Russia’s naval assets are based out of the Arctic, by necessity, as that’s where the country has its most protected ports and tidal access. Its few southern ports are more exposed and accessible to NATO. Russia is more rightfully the regional leader in Arctic capability.

If you’re in the Kremlin looking over the Arctic horizon to the far Canadian side, here’s what you think you see:

• A country that has no clear strategy or statement of intent for its valuable Arctic region. Planners in the Kremlin could use a test-and-see game plan to sort out how the country might respond under threat.
• A country that, while part of NATO, lacks sufficient domestic defensive measures and capabilities in its own Arctic region. The region is resource rich, with known deposits of some of the more valuable and sought-after resources (oil, gas, diamonds, copper). The Arctic is a prolific source of fish. You have a fine fleet of icebreakers that could attract the Chinese fishing fleet.
• For a country with an open press and relative information transparency, Canada has no comprehensive inventory of northern settlements, water, energy and resource infrastructure. Penetrating a national gas pipeline company might have offered an opportunity to gain valuable data about pipeline assets that are not available through other means.
• A fraying protector relationship with the US, whose political system that may no longer view Russia as a threat because of Russian equipment, logistical, and leadership performance in the Ukraine war. Running a cyber attack plan could be just the low cost, low asset method to gauge the reaction of the US military and political system to inbound Russian aggression.
• A defensive threat detection system (Distant Early Warning or DEW Line) that originated in the Cold War, and that was originally designed to detect inbound slow-moving missiles and long range bombers. Such systems may no longer be well positioned to detect and deter hypersonic weapons, stealth aircraft, and cyber warfare.
• A domestic political environment that does not provide bipartisan support for the military, nor funding for national cyber defenses that extend beyond military assets and into militarily important assets, such as the national energy, telecommunications, and transportation systems.
• A general inability to enforce its sovereignty over its northern borders. Canada lacks the submarine assets to patrol its northern assets, and lacks the ships to enforce its territorial claims. Even cruise ships sail with impunity through territorial waters belonging to Canada.

If I were a Kremlin spook, I could be persuaded to mount a cyber campaign against Canadian energy, transportation, and communications infrastructure to see where there might be weaknesses. The military might pull the trigger, but it’s the civil engineers who tell the gunners where to aim based on insights from intelligence.

Canada Must Step Up

The European nations with Arctic exposure have been investing with renewed emphasis in their northern Arctic flank now that the Russian threat has been exposed. The Nordic countries recognize that the security umbrella of NATO is but one element of a broader strategic defensive stance, and that stance must be bolstered with real assets and investments in the North.

There’s long been a joke in Canada that when the elephant sneezes, we catch a cold. I worry that the southern elephant may one day conclude that the geography to the north isn’t worth protecting with blood and treasure. Certainly POTUS45 telegraphed that message with considerable flair, and he still has a following. The US may well disconnect from Canada, but Canada cannot so easily disconnect from the US.

It is therefore imperative that Canada, as have our Arctic neighbours, step up to defend our Arctic region.

We urgently need:

• A national Arctic strategy that brings together energy and resources, defence, and indigenous populations in light of the massive multi-year NORAD modernization.
• A national cyber protection capability that spans beyond the military into the militarily important.
• True bipartisan support for the protection of Canada’s borders, most importantly those on the Northern Flank as that seems to be where the enemy lives.

The conflict in Europe between Russia and Ukraine is but one of a number of global moves that threaten the rules-based order. China has been making the same, if more subtle, noises about invading Taiwan. North Korea is perfecting its intercontinental strike capability. Iran will soon be nuclear armed. We need to be prepared.

Artwork was drawn by the author.

Geoffrey Cann writes about, speaks to and teaches the energy industry about digital innovation. For more about Geoffrey Cann, click here.

Digital Oil and Gas is published every Monday morning and is read by energy industry professionals and digital entrepreneurs. Subscribe here