Is Canada's Security Screening Failing?

WEBVTT
00:00:08.720 --> 00:00:11.359
Hello and welcome back to the Global Intelligence Weekly Wrap Up.
00:00:11.439 --> 00:00:12.320
I'm your host, Neil B.
00:00:12.480 --> 00:00:17.760
Son, a retired intelligence officer with the Canadian Security Intelligence Service, and the director of the Global Intelligence Knowledge Network.
00:00:17.920 --> 00:00:34.240
Each week I take open source reporting from various news reports around the world on espionage, sabotage, national security, foreign interference and terrorism, and provide you with the insights, analysis, and intelligence to help you understand the shadowy world of spies, how it affects your career, your country, and your safety.
00:00:34.479 --> 00:00:40.479
It's been a busy week, from concerns over Canada's security screening process to suspected Russian drone attacks against Germany.
00:00:40.640 --> 00:00:42.799
There's a lot to discuss, so let's get started.
00:00:42.960 --> 00:00:53.039
We begin this week in Canada, where the federal government is considering changes to its national security screening system following the arrest of a Canadian intern accused of espionage while working at NATO headquarters in Belgium.
00:00:53.200 --> 00:01:03.280
On October 21st, David Morrison, Prime Minister Mark Carney's senior diplomatic and international affairs advisor, appeared before the House of Commons Standing Committee on Public Safety and National Security.
00:01:03.520 --> 00:01:15.760
Morrison suggested that a government-wide registry of security clearance information could help federal departments identify relevant personal security information, reduce duplication, and improve the effectiveness of security screening.
00:01:16.000 --> 00:01:17.680
But this raises an important question.
00:01:17.920 --> 00:01:30.480
If an individual has already been identified as having engaged in dishonest behavior during a federal government employment process, shouldn't that information be available to the people responsible for determining whether that individual can be trusted with classified information?
00:01:30.640 --> 00:01:35.519
And if that information isn't being shared, what other warning signs might be slipping through the cracks?
00:01:35.680 --> 00:01:42.719
Regular listeners may remember that we discussed this very issue during our October 9th episode of Global Intelligence Weekly Wrap-Up.
00:01:42.879 --> 00:01:51.040
The case involved Bi Wei Zhang, also known as Claire Zhang, a Canadian national arrested by Belgian authorities on the 24th of July.
00:01:51.280 --> 00:01:57.040
Zhang had been working as an intern at the Supreme Headquarters Allied Powers Europe or Shape in Mons, Belgium.
00:01:57.120 --> 00:02:02.400
She was arrested on allegations involving espionage for a third country and participation in criminal organization.
00:02:02.640 --> 00:02:10.319
Reuters reported that the allegations were linked to China, although Chinese Embassy rejected suggestions that Zhang had been spying for Beijing.
00:02:10.800 --> 00:02:15.919
What makes this case particularly concerning is the information that was already available before her arrest.
00:02:16.080 --> 00:02:24.639
In 2023, Canada's Public Service Commission determined that Zhang had committed fraud during an appointment process involving the Canada Border Services Agency.
00:02:24.800 --> 00:02:32.000
The conduct reportedly involved submitting applications using different names and email addresses without clarifying that they came from the same individual.
00:02:32.240 --> 00:02:37.520
Zhang challenged the finding, but the federal court dismissed her application for judicial review in 2024.
00:02:37.919 --> 00:02:46.639
Despite this finding, Public Safety Minister Gary Anasanguri confirmed earlier this month that Global Affairs Canada had granted the individual a security clearance.
00:02:46.800 --> 00:02:49.520
And this brings us to the latest parliamentary testimony.
00:02:49.840 --> 00:02:55.520
Morse explained that the responsibility for security clearances is divided across several government organizations.
00:02:55.680 --> 00:02:59.120
The Treasury Board Secretariat establishes the overall policy framework.
00:02:59.280 --> 00:03:10.240
RCMP and CESIS provide criminal checks and national security assessments within their respective mandates, but the ultimate responsibility for granting a clearance rests with the federal department or agency making the decision.
00:03:10.400 --> 00:03:11.840
This is an important distinction.
00:03:12.080 --> 00:03:16.080
CESIS does not simply grant security clearances to every federal employee.
00:03:16.240 --> 00:03:25.199
It provides security assessments and advice that departments consider alongside other information when determining whether an individual should receive access to sensitive or classified material.
00:03:25.360 --> 00:03:30.879
In our October 9th episode, we identified four questions that investigators needed to answer.
00:03:31.120 --> 00:03:31.439
1.
00:03:31.599 --> 00:03:33.599
When was Zhang's clearance granted?
00:03:33.840 --> 00:03:36.159
What information was available at the time?
00:03:36.400 --> 00:03:38.800
Who knew about the earlier finding of fraud?
00:03:38.960 --> 00:03:41.599
And four, how was that information assessed?
00:03:41.759 --> 00:03:43.759
Those questions remain relevant today.
00:03:44.000 --> 00:03:56.800
A finding of dishonesty in an employment process does not automatically establish that someone is engaged in espionage, but honesty, reliability, and trustworthiness are fundamental considerations when assessing an individual's suitability for access to classified information.
00:03:57.039 --> 00:04:02.000
The proposed government-wide registry could improve how departments identify existing clearance information.
00:04:02.159 --> 00:04:06.000
However, a registry alone would not necessarily resolve the underlying problem.
00:04:06.159 --> 00:04:16.959
A record is only useful if it has relevant information that is accurate, accessible to authorized decision makers, and properly evaluated, and this is where Morrison's other recommendations become particularly important.
00:04:17.199 --> 00:04:29.519
He suggested greater consistency in the use of open source background checks, common training standards, improved access to relevant human resource information, and continuing personnel security assessments through an individual's employment.
00:04:29.680 --> 00:04:33.680
These are not simply administrative improvements, they are counterintelligence safeguards.
00:04:33.839 --> 00:04:46.480
During our December 12, 2025 episode, we discussed Canadian military intelligence member, Master Warrant Officer Matthew Robar, who faced allegations involving the unauthorized communication of safeguarded defense information to a foreign entity.
00:04:46.639 --> 00:04:51.920
We returned to the broader issue of espionage and insider threats during our December 27th yearly wrap-up.
00:04:52.319 --> 00:04:54.480
Those discussions highlighted an important principle.
00:04:54.639 --> 00:04:59.839
The greatest vulnerability is not always someone attempting to penetrate a secure facility from the outside.
00:05:00.000 --> 00:05:03.279
Sometimes it is someone who has already been granted limited access.
00:05:03.439 --> 00:05:17.040
We revisited that concern on our October 9th episode when we examined the Zhang investigation alongside allegations involving a former German intelligence chief, August Hanning, and the admitted fraud committed by former senior CIA official David J.
00:05:17.279 --> 00:05:17.600
Resch.
00:05:18.079 --> 00:05:26.079
Although these cases involve different circumstances and legal proceedings, they demonstrate why security screening cannot be treated as a one-time administrative exercise.
00:05:26.240 --> 00:05:29.519
In security screening, as with anything, people's circumstances change.
00:05:29.680 --> 00:05:37.759
Financial difficulties, undisclosed relationships, significant changes in behavior, and attempts to obtain information outside assigned duties can all warrant further examination.
00:05:37.920 --> 00:05:45.920
Although none of these factors alone can or will establish espionage, they must still be assessed objectively, proportionately, and in context.
00:05:46.079 --> 00:05:56.959
An effective security screening program must be capable of recognizing changes that could indicate an emerging insider threat, and it must ensure that relevant concerns reach the peoples responsible for making security decisions.
00:05:57.120 --> 00:06:06.560
Wesley Warke, a senior fellow at the Center for International Governance Innovation, told Parliamentary Committee that Canada's current security screening system is unsustainable.
00:06:06.639 --> 00:06:12.000
He argued that CESIS is carrying a substantial screening workload in addition to its core intelligence responsibilities.
00:06:12.319 --> 00:06:20.319
Warke suggested Canada consider following the United Kingdom's example by establishing a separate, centralized organization responsible for security clearances.
00:06:20.480 --> 00:06:22.240
This raises another important consideration.
00:06:22.480 --> 00:06:32.879
Would removing some of the administrative security screening burden from CES allow the service to dedicate more resources to investigating espionage, foreign interference, terrorism, and other threats to national security?
00:06:33.120 --> 00:06:41.759
Potentially, but centralization also introduces questions about accountability, privacy, information sharing, and the security of clearance records themselves.
00:06:42.079 --> 00:06:47.759
The centralized systems contain sensitive personal information that would be a track target for hostile intelligence services.
00:06:47.920 --> 00:06:56.240
Any reform would therefore need strong safeguards governing who has access to that information, how it is protected, and how decisions can be reviewed.
00:06:56.399 --> 00:06:59.199
There's another dimension to this story that deserves attention.
00:06:59.360 --> 00:07:02.240
Canada's security screening system doesn't operate in isolation.
00:07:02.399 --> 00:07:11.519
When Canada's personnel are assigned to sensitive positions with organizations such as NATO, the effectiveness of our screening procedures can have consequences for our international partners.
00:07:11.759 --> 00:07:18.879
Allied intelligence relationships depend on trust, and that trust extends beyond the intelligence being shared to the people authorized to access it.
00:07:19.040 --> 00:07:26.240
As we discussed in October, NATO security personnel reportedly identified concerns that ultimately contributed to the investigation involving Zhang.
00:07:26.560 --> 00:07:32.240
That demonstrates the importance of having multiple layers of security rather than relying exclusively on initial clearance.
00:07:32.399 --> 00:07:37.519
From my perspective, the issue isn't simply that Canada needs a new registry or another set of screening procedures.
00:07:37.600 --> 00:07:44.959
It's whether the government can demonstrate that relevant information is being collected, shared, assessed, and acted upon throughout an individual's employment.
00:07:45.199 --> 00:07:50.240
A security clearance should never be interpreted as a permanent guarantee of trustworthiness.
00:07:50.399 --> 00:07:54.000
It is an assessment based on information available at a particular point in time.
00:07:54.160 --> 00:08:08.079
The challenge is ensuring that the assessment remains relevant as circumstances change, and until we know precisely what information was available when Zhang received her clearance and how that decision was made, we cannot conclusively determine where the screening process may have failed.
00:08:08.160 --> 00:08:14.639
What we can say is that the largest parliamentary testimony identifies specific areas where Canada's system could be strengthened.
00:08:14.879 --> 00:08:19.040
The next question is whether those recommendations will result in measurable improvements.
00:08:19.199 --> 00:08:23.279
Because when it comes to national security, identifying a vulnerability is only the first step.
00:08:23.519 --> 00:08:28.160
Addressing it before it can or is exploited is truly what matters.
00:08:44.159 --> 00:08:54.960
According to Reuters, Germany's armed forces, the Bundesrear, have classified the threat of Russian sabotage as significant, the second highest level on their internal threat assessment scale.
00:08:55.200 --> 00:08:58.399
This is the first time the threat has been assessed at this level.
00:08:58.559 --> 00:09:04.799
The reassessment follows the discovery in September of a crash drone near Wundstorf military base in Lower Saxony.
00:09:04.960 --> 00:09:08.720
Investigators also discovered a container holding high explosives near the drone.
00:09:08.879 --> 00:09:17.120
What makes this particularly concerning is that German investigators believe the drone may have been intended to target German military aircraft, and this isn't an isolated incident.
00:09:17.279 --> 00:09:26.879
In August, German authorities accused Russia of carrying out an attempted explosive drone attack at Litchbig Hale Airport, where aircraft supporting Ukraine were reportedly targeted.
00:09:27.039 --> 00:09:30.960
Russia has denied involvement in sabotage operations against European countries.
00:09:31.200 --> 00:09:35.360
But German military intelligence is now assessing something particularly important.
00:09:35.600 --> 00:09:39.200
Russia may not simply possess the capability to conduct these operations.
00:09:39.440 --> 00:09:46.480
German authorities believe Moscow's willingness to employ potentially lethal sabotage against Germany and German military targets has increased.
00:09:46.639 --> 00:09:50.000
That represents a significant change in the threat assessment.
00:09:50.240 --> 00:09:54.799
For listeners who have been following the Global Intelligence Weekly wrap-up, this story should sound familiar.
00:09:55.039 --> 00:10:00.000
We've been examining the evolution of sabotage and proxy operations across Europe for several months.
00:10:00.240 --> 00:10:09.440
At our September 11th episode, we discussed attacks against Germany's electrical infrastructure and the vulnerabilities that relatively simple acts of physical sabotage can expose.
00:10:09.600 --> 00:10:18.399
In the same episode, we examined reports concerning suspected Russian activity near Slavbard, where NATO allies were investigating potential threats to undersea communication cables.
00:10:18.559 --> 00:10:23.519
Then again on September 25th, we examined a suspicious fire at a Starlink ground station in Poland.
00:10:23.679 --> 00:10:31.519
Polish officials believed the incident involved deliberate sabotage, but we were careful to explain that Russian responsibility had not been publicly established.
00:10:31.679 --> 00:10:39.600
We also discussed an assessment from Denmark's Defense Intelligence Service warning that Russia was expected to intensify its hybrid operations against NATO in the West.
00:10:40.000 --> 00:10:45.200
Now, less than a month later, Germany is raising its own military sabotage threat assessment.
00:10:45.440 --> 00:10:47.120
This is a significant progression.
00:10:47.279 --> 00:10:59.679
We have moved from examining individual incidents involving electrical grids, communication infrastructure, and transportation networks to a formal military assessment, warning that German armed forces themselves may face direct attacks.
00:10:59.840 --> 00:11:01.440
And there's another detail worth examining.
00:11:01.600 --> 00:11:12.799
Additional reporting from Germany's WDR in Studzettung indicates that technical analysis suggests the drone discovered near Wusstorff may actually have been lying there for approximately two years.
00:11:12.960 --> 00:11:17.440
The discovery is recent, but the suspect activity may be considerably older.
00:11:17.679 --> 00:11:26.000
That distinction matters because the intelligence significance lies partly in what the investigators are now learning about the potential duration and nature of the threat.
00:11:26.320 --> 00:11:33.279
German investigators have also identified other incidents of suspected reconnaissance involving sensitive military infrastructure.
00:11:33.519 --> 00:11:41.679
These reportedly include suspicious drone flights near an Aero 3 missile defense site and obsolete associated with Patriot Air Defense maintenance.
00:11:41.919 --> 00:11:47.759
Authorities also discovered a concealed camera monitoring a strategically important railway station in Minden.
00:11:48.159 --> 00:11:49.919
Now we need to be cautious here.
00:11:50.159 --> 00:11:57.440
These incidents do not by themselves establish that every suspicious drone flight or surveillance device was directed by Russian intelligence.
00:11:57.600 --> 00:12:00.320
But collectively, they raise an important intelligence question.
00:12:00.480 --> 00:12:03.120
Are we observing unrelated security incidents?
00:12:03.279 --> 00:12:11.120
Or are some of these activities part of a broader effort to identify vulnerabilities, monitor military movements, and prepare for future disruption?
00:12:11.360 --> 00:12:16.240
This is precisely the type of question intelligence services and NATO military need to ask themselves.
00:12:16.399 --> 00:12:18.879
And it brings me to something particularly relevant this week.
00:12:19.039 --> 00:12:27.200
I just completed teaching another session of my Sabotage and Proxy Operations and Military Intelligence course through the University of Ottawa's Professional Development Institute.
00:12:27.360 --> 00:12:42.960
As part of its National Security and Intelligence Certificate Program, during the course, we examined how sabotage operations have evolved, how intelligence services can employ intermediaries or proxies, and why attribution remains one of the most difficult challenges in identifying state-directed hostile activity.
00:12:43.279 --> 00:12:48.480
We also discussed how seemingly minor incidents can become more significant when examined collectively.
00:12:48.559 --> 00:12:52.879
I'll leave a link in the notes in the transcript for those of you who are interested in taking the course.
00:12:53.039 --> 00:12:54.080
So what do we have?
00:12:54.399 --> 00:13:03.440
A suspicious drone sighting, a camera position near transportation infrastructure, damage to an electrical station, and an attempted attack against aircraft.
00:13:03.600 --> 00:13:19.440
Viewed individually, these may appear to be separate security or criminal investigations, but intelligence analysis requires us to examine the relationship between the events, the capabilities involved, the possible objectives, and the evidence connected to those activities and these particular actors.
00:13:19.679 --> 00:13:23.840
It's also important to understand the distinction between sabotage and proxy operations.
00:13:24.000 --> 00:13:28.320
Sabotage describes the activity intended to damage, destroy, or disrupt a target.
00:13:28.480 --> 00:13:40.320
A proxy operation describes an arrangement in which an actor uses another individual organization to conduct activity on its behalf, potentially creating distance between the operation and whoever directed it.
00:13:40.399 --> 00:13:55.200
Not every act of sabotage is a proxy operation, but when a foreign intelligence service recruits or directs intermediaries to conduct sabotage, those two methods can intersect, and the strategic objective may extend well beyond the immediate physical damage.
00:13:55.360 --> 00:14:05.600
Disrupting equipment deliveries, delaying military training, increasing security costs, and creating public anxiety can all affect a country's willingness or ability to support Ukraine.
00:14:05.759 --> 00:14:08.960
That is a broader concern reflected in Germany's latest assessment.
00:14:09.120 --> 00:14:16.399
Germany's decision to raise its sabotage threat level is significant not simply because of the discovery of an explosive equipped drone.
00:14:16.720 --> 00:14:24.159
It's significant because German authorities are reassessing the possibility that their own military personnel and facilities could be directly targeted.
00:14:24.320 --> 00:14:31.759
The Bundschwehr is responding by strengthening protective measures, including patrols and technical surveillance at vulnerable installations.
00:14:31.919 --> 00:14:34.639
But the larger lesson extends beyond Germany.
00:14:34.879 --> 00:14:43.919
As we've repeatedly discussed on the Global Intelligence Weekly wrap-up, modern sabotage campaigns can target military facilities, civilian infrastructure, and the systems connecting them.
00:14:44.080 --> 00:14:56.240
The challenge for Intelligence and Security Agency is to identify which incidents are connected, establish responsibility through credible analysis and evidence, and intervene before reconnaissance or preparation develops into an attack.
00:14:56.480 --> 00:15:00.320
For Canada and other NATO members, this isn't just a European security problem.
00:15:00.639 --> 00:15:06.720
An attack intended to disrupt one ally's ability to support Ukraine can have consequences for the entire alliance.
00:15:06.960 --> 00:15:11.200
The intelligence takeaway is this individual incidents tell us what happened.
00:15:11.360 --> 00:15:17.039
Identifying patterns help us understand what may happen next and how to possibly prevent it.
00:15:17.200 --> 00:15:27.440
And that is why the continuing evolution of sabotage and proxy operations deserves attention not just from the military, law enforcement, or intelligence organizations, but from all of us.
00:15:46.399 --> 00:15:57.519
According to Agence France Press, the men, aged twenty four and twenty five, were rearrested on October twentieth under Section 3 of Britain's National Security Act, which addresses conduct assisting a foreign intelligence service.
00:15:57.679 --> 00:16:01.759
One of the men is a British citizen, the other holds British and Iranian citizenship.
00:16:01.919 --> 00:16:03.360
Both men were from London.
00:16:03.600 --> 00:16:09.440
The investigations follows an incident on September 27th, near RAF Fairfurt in Gloucestershire.
00:16:09.600 --> 00:16:13.200
Police responded to suspicious vehicles and found three vans containing petrol.
00:16:13.360 --> 00:16:17.679
Armed officers and bomb disposal specialists attended, but no explosives were discovered.
00:16:17.840 --> 00:16:20.320
Seven men were initially arrested and released on bail.
00:16:20.480 --> 00:16:24.559
Two have now been rearrested in connection with suspected foreign intelligence assistants.
00:16:24.799 --> 00:16:27.039
RAF Fairfort is strategically important.
00:16:27.200 --> 00:16:34.159
It supports United States Air Force deployments, including long-range bombers, and has been used for American operations against Iranian targets.
00:16:34.320 --> 00:16:39.919
That makes it a plausible location of interest to an adversary seeking information about military activity.
00:16:40.080 --> 00:16:43.120
But the precise purpose of the suspected activity remains unknown.
00:16:43.440 --> 00:16:51.919
Bruce investigators have described Iranian state involvement as highly likely while continuing to examine the nature of that involvement and the intended objective.
00:16:52.159 --> 00:16:53.600
Iran denies involvement.
00:16:53.759 --> 00:16:56.320
At the time of this reporting, no charges have been announced.
00:16:56.480 --> 00:17:01.360
We won't make an unjustifiable leap from suspicious vehicles to a proven plot of attack on the base.
00:17:01.600 --> 00:17:07.279
Investigators must establish what the individuals were doing, who directed them, and whether any criminal offenses occurred.
00:17:07.440 --> 00:17:15.200
But this story does have connections to a case that we followed previously in episodes of the Global Intelligence Weekly wrap-up, specifically the case of Daniel Khalif.
00:17:15.359 --> 00:17:18.000
In November of 2024, we examined Khalif's trial.
00:17:18.160 --> 00:17:27.039
He was a former British Air Royal Corps of Signal Soldier accused of collecting sensitive military information and collecting and communicating with Iranian intelligence contacts.
00:17:27.200 --> 00:17:32.880
The evidence included information about military communications and serving personnel, including Special Forces members.
00:17:33.119 --> 00:17:38.240
Khalif claimed he was trying to deceive Iranian intelligence as part of his own unauthorized operation.
00:17:38.480 --> 00:17:42.079
The jury rejected his defense on the espionage related charges.
00:17:42.240 --> 00:17:48.720
He was also notorious for escaping the Woodsworth prison in 2023 by hiding beneath a food delivery vehicle before being recaptured.
00:17:48.880 --> 00:17:57.119
When we returned to the story in February 2025, he was sentenced to 14 years and three months for spying for Iran and escaping custody.
00:17:57.279 --> 00:18:00.319
He was acquitted of a separate bomb hoaxed charge.
00:18:00.559 --> 00:18:03.279
That distinction is important when recalling the case.
00:18:03.519 --> 00:18:06.480
Now to be fair, the Khalif case is one of an insider threat.
00:18:06.640 --> 00:18:10.079
He had legitimate access to military information because of his job.
00:18:10.240 --> 00:18:17.359
The Fairford suspects have not been publicly identified as military personnel, and there is no established link between them and Khalif.
00:18:17.440 --> 00:18:21.759
But the cases illustrate two different potential approaches to the same broad intelligence problem.
00:18:21.920 --> 00:18:25.119
One concerns access from inside a military organization.
00:18:25.279 --> 00:18:29.519
The other concerns suspected activity outside a strategically important military installation.
00:18:29.680 --> 00:18:32.160
There is a wider historical context here as well.
00:18:32.400 --> 00:18:44.559
In October of 2024, we discussed MI5 Director General Ken McCullum's warning that British intelligence and police had responded to 20 potential lethal, Iranian-backed plots since January of 2022.
00:18:44.720 --> 00:18:47.599
Many involve threats against dissidents and critics of Taram.
00:18:47.759 --> 00:18:52.559
The Khalif case added the concern of Iranian intelligence contacts within armed forces.
00:18:52.799 --> 00:18:58.000
The Fairford investigation raises questions about potential interest in military operations themselves.
00:18:58.160 --> 00:19:00.799
These events do not establish one connected campaign.
00:19:00.960 --> 00:19:06.559
They do, however, show why British counterintelligence officials remain concerned about the breadth of potential Iranian state activity.
00:19:06.720 --> 00:19:10.319
Section 3 of Britain's National Security Act is also significant.
00:19:10.640 --> 00:19:20.640
It allows authorities to investigate suspected assistance to a foreign intelligence service, even where the public evidence does not establish theft of classified documents or a completed act of sabotage.
00:19:20.799 --> 00:19:23.119
The law does not prove the allegations in the case.
00:19:23.359 --> 00:19:25.279
It helps explain the nature of the investigation.
00:19:25.440 --> 00:19:30.000
From an intelligence perspective, the distinction between suspicion, assessment, and proof matters.
00:19:30.240 --> 00:19:37.680
Police may have strong grounds to suspect foreign direction while still needing to establish exactly what occurred and whether the evidence supports charges.
00:19:37.920 --> 00:19:41.680
And that brings us to the thread connecting most of these segments for this week.
00:19:41.839 --> 00:19:48.000
In Canada, we're examining whether the right information reaches the people responsible for granting and maintaining security clearances.
00:19:48.160 --> 00:19:53.920
In Germany, the concern is reconnaissance and potential sabotage against military infrastructure.
00:19:54.079 --> 00:19:59.599
In Britain, investigators are examining suspected assistance to Iranian intelligence near an airbase.
00:19:59.680 --> 00:20:08.000
And in our next segment, we'll discuss a NATO cyber base where Russian linked operators obtain authorized network access to a defense contractor.
00:20:08.240 --> 00:20:10.799
Different countries, different actors, and different methods.
00:20:11.039 --> 00:20:19.839
But each story turns in some way on access, access to sensitive positions, facilities, networks, personnel, or operational information.
00:20:20.079 --> 00:20:29.200
The intelligence challenge is to identify vulnerabilities and hostile activity early, assess them with evidence, and intervene before access can be exploited further.
00:20:29.519 --> 00:20:34.880
That is the difference between understanding an emerging threat and simply investigating the damage after the fact.
00:20:43.839 --> 00:20:48.240
As I alluded to in the previous segment, our final segment this week keeps us in Europe.
00:20:48.640 --> 00:20:52.559
But this time we're moving from physical sabotage to cyber espionage.
00:20:53.119 --> 00:21:00.480
And what makes this story particularly interesting is that we've been following the activities of Russian military intelligence against NATO for some years.
00:21:02.240 --> 00:21:10.319
According to Cyberscoop, cybersecurity researchers have uncovered a Russian-linked espionage campaign targeting three organizations and two NATO member countries.
00:21:10.720 --> 00:21:16.400
Those targets include a naval shipholder, a manufacturer of military aircraft engines, and a law enforcement agency.
00:21:17.119 --> 00:21:20.079
The countries and organizations haven't been publicly identified.
00:21:20.880 --> 00:21:34.640
The investigation was conducted by Semantics Threat Hunter team, which attributes the activity to a group known as ABT or Advanced Persistent Threat 28, also called Fancy Bear, Force Blizzard, and Swallowtail.
00:21:35.039 --> 00:21:41.759
Western governments have linked this group to Unit 26165 of Russia's military intelligence service or the GRU.
00:21:42.160 --> 00:21:44.000
And the targets are particularly significant.
00:21:44.880 --> 00:21:54.000
We're talking about organizations that can possess sensitive information about military production, engineering capabilities, procurement, supply chains, and national security operations.
00:21:54.640 --> 00:21:58.960
This isn't simply a case of hackers trying to steal credit card information or demand ransom.
00:22:00.079 --> 00:22:06.240
Activity semantics identified is consistent with intelligence collection operation, but what did the attackers actually accomplish?
00:22:06.400 --> 00:22:11.519
The investigation provides a detailed picture of how the attackers gained access to one of their targets.
00:22:11.759 --> 00:22:20.240
On July 24, 2026, an employee at the Naval Shipbuilding Company opened a malicious Microsoft document received through email.
00:22:20.480 --> 00:22:24.160
The document installed a backdoor called HookEdge.
00:22:24.400 --> 00:22:33.839
A backdoor is a piece of malicious software that allows an unauthorized individual to access a compromised computer and potentially issue commands without the legitimate user's knowledge.
00:22:34.079 --> 00:22:41.440
In this case, the attackers used a hidden instance of Microsoft's Edge browser to communicate with their malicious infrastructure.
00:22:41.599 --> 00:22:47.839
The objective was to make the activity look conspicuous by using software and network traffic that might otherwise appear legitimate.
00:22:48.079 --> 00:22:51.440
But the most interesting part of the investigation is what happened next.
00:22:51.759 --> 00:22:55.920
Semantic observed the attackers repeatedly returning to the compromised computer.
00:22:56.079 --> 00:22:59.680
This wasn't simply malware running an automated series of instructions.
00:22:59.839 --> 00:23:04.720
There is evidence of human operators making decisions, collecting credentials, and exploring the network.
00:23:04.880 --> 00:23:10.319
They established a persistent communications tunnel that could provide access deeper into the organization's system.
00:23:10.480 --> 00:23:18.000
They also developed a previously undocumented tool capable of decrypting and executing malicious software directly and a computer memory.
00:23:18.160 --> 00:23:22.240
That technique can make identifying and analyzing malicious activity more difficult.
00:23:22.480 --> 00:23:27.119
Semantic observed evidence associated with the intrusion through September 24th.
00:23:27.279 --> 00:23:32.880
However, researchers could not determine whether the attackers maintained uninterrupted access throughout that period.
00:23:33.039 --> 00:23:34.880
And there's another important limitation.
00:23:35.119 --> 00:23:43.599
Although the investigators documented credential theft and unauthorized access, they could not establish whether sensitive defense information was successfully stolen.
00:23:43.839 --> 00:23:45.680
That's a distinction we need to remember.
00:23:45.839 --> 00:23:55.119
This was a documented compromise of a defense contractor's network, but we cannot claim that Russian intelligence successfully obtained naval designs or military technology.
00:23:55.279 --> 00:23:58.400
Now here's where the previous reporting becomes particularly useful.
00:23:58.640 --> 00:24:00.160
Let's go back more than two years.
00:24:00.319 --> 00:24:13.440
In our September 13, 2024 episode, the Global Weekly Intelligence wrap-up examined accusations from German domestic intelligence agencies concerning Russian GRU cyber operations against NATO and European Union countries.
00:24:13.680 --> 00:24:21.920
That investigation involved GRU Unit 29155, an organization associated with cyber operations and other clandestine activities.
00:24:22.160 --> 00:24:32.960
Now, Unit 29155 is not the same organization as Unit 26165, which is associated with APT-28 activity we're discussing today.
00:24:33.119 --> 00:24:34.640
We need to be clear about that.
00:24:34.880 --> 00:24:37.359
But the broader intelligence significance still remains.
00:24:37.519 --> 00:24:46.079
In September 2024, we were examining warnings that Russian military intelligence was conducting cyber operations against Western countries and critical infrastructure.
00:24:46.400 --> 00:24:54.079
Two years later, we're examining another GRU link campaign, this time involving documented access to a NATO defense contractor.
00:24:54.480 --> 00:24:58.559
Different units and different operations, but the same overarching concern.
00:24:58.799 --> 00:25:04.160
Russian military intelligence is actively directed against Western security services.
00:25:04.480 --> 00:25:06.240
But the same overarching concern.
00:25:06.880 --> 00:25:11.440
Russian military intelligence activity directed against Western security interests.
00:25:11.759 --> 00:25:19.039
Then, in our March 7, 2025 episode, we returned to the threat of Russian cyber operations against critical infrastructure.
00:25:19.279 --> 00:25:29.839
We discussed how previous incidents, including the destructive Natpeya attack in 2017, demonstrated that cyber operations could have consequences extended far beyond their initial targets.
00:25:30.079 --> 00:25:34.799
Notpetya caused a widespread disruption to business and infrastructure internationally.
00:25:34.960 --> 00:25:37.440
The earlier example illustrates an important distinction.
00:25:37.680 --> 00:25:44.880
Cyber operations can be conducted to collect intelligence, disrupt services, destroy information, or achieve several objectives.
00:25:45.039 --> 00:25:50.079
The latest APT-28 activity appears to have been directed toward the espionage.
00:25:50.319 --> 00:25:56.480
There is no public evidence establishing that the shipbuilder intrusion was intended to cause physical destruction.
00:25:56.640 --> 00:26:02.000
But the historical record demonstrates why understanding an adversary's access and capabilities is important.
00:26:02.160 --> 00:26:06.960
And then we have a development from May 2025 that connects even more directly to today's story.
00:26:07.200 --> 00:26:21.519
The United States National Security Agency, the FBI, CISA, and International Intelligence and Cyber Security Partners used a joint warning about Russian GRU cyber operations targeting Western logistics and technology organizations.
00:26:21.839 --> 00:26:25.680
The advisory specifically identified Unit 26165.
00:26:26.000 --> 00:26:30.160
That's the same GRU unit associated with APT-28.
00:26:30.319 --> 00:26:39.119
According to that assessment, Russian cyber operations have been targeting organizations involved in coordinating, transporting, and delivering assistance to Ukraine.
00:26:39.359 --> 00:26:47.279
The campaign included attempts to compromise logistic providers, technology companies, and organizations connected to transportation infrastructure.
00:26:47.519 --> 00:26:53.680
The advisory also described the targeting of internet connected cameras in Ukraine and neighboring NATO countries.
00:26:53.839 --> 00:26:56.400
Why would Russian military intelligence be interested in cameras?
00:26:56.559 --> 00:27:03.440
Because information about the movement of equipment, vehicles, and supplies can have considerable military intelligence value.
00:27:03.599 --> 00:27:08.960
An intelligence service doesn't necessarily need to steal a classified military document to obtain useful information.
00:27:09.200 --> 00:27:17.680
Sometimes observing what equipment is moving, how frequently shipments occur, and which transportation routes are being used can provide valuable operational intelligence.
00:27:17.839 --> 00:27:22.000
Now compare that 2025 warning with the latest semantic findings.
00:27:22.319 --> 00:27:29.920
Last year, Western intelligence agencies were warning about Russian efforts to collect information concerning the movement and delivery of military assistance.
00:27:30.160 --> 00:27:36.559
This week, we're examining Russian-linked intrusion involving organizations that build and maintain military capabilities.
00:27:36.799 --> 00:27:41.680
That suggests a continuing intelligence interest in the wider system supporting NATO and Ukraine.
00:27:41.920 --> 00:27:47.680
And that's a much more meaningful connection than simply observing that Russia continues to conduct cyber attacks.
00:27:48.079 --> 00:27:58.960
Dick O'Brien, a principal intelligence analyst with Semantic Threat Hunter team, told Cyberscoop that the human-directed activity demonstrated the shipbuilder was a genuine target rather than an accidental infection.
00:27:59.200 --> 00:28:03.519
The attackers weren't simply distributing malware and hoping something useful would happen.
00:28:03.759 --> 00:28:13.039
Investigators observed operators actively exploiting access to a particular organization, and that raises the question of what intelligence requirements may have been driving the operation.
00:28:13.279 --> 00:28:15.359
Consider the potential value of the targets.
00:28:15.519 --> 00:28:23.119
A naval shipbuilder may possess information about vessel construction, production schedules, military contracts, and engineering capabilities.
00:28:23.279 --> 00:28:30.240
An aircraft engine manufacturer may hold information about propulsion technology, maintenance requirements, and production capability.
00:28:30.400 --> 00:28:35.279
A law enforcement organization may hold investigative information and sensitive operational records.
00:28:35.440 --> 00:28:43.839
We don't know which of those categories of information the attackers were seeking, but each could provide intelligence value to a foreign military intelligence organization.
00:28:44.079 --> 00:28:45.920
And there's another connection worth making.
00:28:46.079 --> 00:29:00.319
In our September 18th, 2026 episode, we examined reporting primanthropic about suspected Russian state-linked cyber espionage after incorporating artificial intelligence into reconnaissance, fishing, malware development, and other intelligence activities.
00:29:00.480 --> 00:29:09.599
The earlier case involved activity assessed as consistent with reporting about APT-29, commonly associated with Russian Foreign Intelligence Service, the SBR.
00:29:09.759 --> 00:29:13.519
Today's investigation concerns APT-28 and the GRU.
00:29:13.680 --> 00:29:20.000
Again, two different intelligence organizations, but the comparison demonstrates how cyber espionage continues to evolve.
00:29:20.160 --> 00:29:24.160
In September, we discussed how artificial intelligence could accelerate intelligence collection.
00:29:24.400 --> 00:29:34.400
Now we're examining how established cyber espionage operators are developing techniques to conceal communications, steal credentials, and maintain access to sensitive networks.
00:29:34.559 --> 00:29:43.599
And when we place those developments alongside the 2024 GRU warnings and the 2025 Joint Advisory, we begin to see longer-term patterns.
00:29:43.759 --> 00:29:48.160
The objective of gaining access to sensitive Western information remains consistent.
00:29:48.480 --> 00:29:53.039
What changes are the targets, tools, and techniques employed to accomplish that objective?
00:29:53.200 --> 00:29:58.319
There are several lessons that I believe are particularly relevant for Canada and our NATO allies.
00:29:58.559 --> 00:30:05.359
First, foreign intelligence services don't need to penetrate a government's intelligence agency to obtain valuable national security information.
00:30:05.599 --> 00:30:14.480
Defense contractors, manufacturers, technology companies, and transportation providers can hold information that is extremely valuable for a foreign state adversary.
00:30:14.640 --> 00:30:18.480
Second, the initial compromise may involve a relatively familiar method.
00:30:18.640 --> 00:30:21.359
In this case, a malicious email attachment opened the door.
00:30:21.759 --> 00:30:27.119
More sophisticated activity came afterward, when the attackers began exploiting the access they had obtained.
00:30:27.200 --> 00:30:34.720
And third, the ability to identify unauthorized activities after an intrusion is just as important as preventing the initial compromise.
00:30:34.880 --> 00:30:41.200
The attacks in this case were able to seal credentials, explore the networks, and establish additional means of access.
00:30:41.440 --> 00:30:49.279
That creates opportunities for further intelligence collections, even if investigators cannot establish that sensitive information was ultimately stolen.
00:30:49.440 --> 00:30:53.519
There is also an important intelligence distinction between access and intent.
00:30:53.759 --> 00:30:58.480
An intelligence service may seek access to a network because it has an immediate requirement for information.
00:30:58.640 --> 00:31:03.039
It may also seek access because that network could become useful later.
00:31:03.279 --> 00:31:12.559
That doesn't mean every compromise is preparation for sabotage, and it certainly doesn't establish that this particular intrusion was intended to support a destructive attack.
00:31:12.720 --> 00:31:16.000
But persistent access can create options for an adversary.
00:31:16.240 --> 00:31:26.799
Those options are precisely why counterintelligence and cybersecurity organizations need to understand not only whether the system was compromised, but what an attacker could potentially do with the access obtained.
00:31:26.960 --> 00:31:34.240
When we examine this week's story in isolation, we see a Russian-linked cyber espionage campaign targeting NATO defense-related organizations.
00:31:34.559 --> 00:31:42.079
But when we compare it with our previous reporting from 2024, 2025, and 2026, a more significant picture emerges.
00:31:42.240 --> 00:31:45.279
We've examined Russian GRU operations against NATO countries.
00:31:45.440 --> 00:31:50.079
We've discussed destructive cyber attacks and their consequences for critical infrastructure.
00:31:50.240 --> 00:31:56.400
We've followed official warnings about Russian efforts to collect intelligence on Western military logistics supporting Ukraine.
00:31:56.480 --> 00:32:05.920
And now we're examining a documented intrusion into a NATO naval shipbuilder alongside targeting of an aircraft engineer, manufacturer, and a law enforcement agency.
00:32:06.079 --> 00:32:18.000
These are not necessarily components of one coordinated operation, but they do demonstrate a persistent Russian intelligence interest in the organizations, technology, and infrastructure that support Western military capabilities.
00:32:18.079 --> 00:32:22.480
And that brings us back to something we've discussed repeatedly on this podcast.
00:32:22.720 --> 00:32:26.079
Espionage isn't always about stealing classified documents.
00:32:26.240 --> 00:32:38.480
Sometimes it's about understanding how an adversary operates, how its equipment is manufactured, how its military is applied, where their vulnerabilities exist, and how its capabilities might be affected during a future confrontation.
00:32:38.640 --> 00:32:43.839
For Canada and our NATO allies, protecting national security means protecting more than government secrets.
00:32:44.000 --> 00:32:55.440
It means protecting the people, companies, infrastructure, and information that allow our military and security institutions to function, because an adversary doesn't necessarily need to know what they're planning to do.
00:32:55.599 --> 00:32:58.720
Sometimes knowing what you're capable of doing is intelligence enough.
00:32:58.960 --> 00:33:01.119
Well, that's going to wrap it up for this week.
00:33:01.279 --> 00:33:07.119
I want to thank Andrew Coyne for his guest appearance and talk at the Pillar Society speaker series on Tuesday evening.
00:33:07.359 --> 00:33:13.599
It was a very impressive presentation concerning Canada's current state as it relates to a multitude of national security concerns.
00:33:13.839 --> 00:33:21.599
And if you're fortunate enough to be at the presentation, you may purchase one of Andrew's latest books, The Crisis of Canadian Democracy.
00:33:21.759 --> 00:33:24.960
If not, you can order on Amazon, and I highly suggest that you do.
00:33:25.119 --> 00:33:33.519
The Pillar Society is an organization of former Canadian intelligence professionals, and if you enjoy the content that I discuss on this podcast, you can check it out on their website.
00:33:33.599 --> 00:33:35.279
I'll leave a link in the show notes.
00:33:35.440 --> 00:33:42.079
And if you want to support the Global Intelligence Knowledge Network and the Global Intelligence Weekly wrap-up, you can do that with a one-time or ongoing contribution.
00:33:42.160 --> 00:33:45.119
Please go to the BuzzBrope page and the transcript in the show notes.
00:33:45.279 --> 00:33:49.440
Your contributions help keep this type of content available to everyone.
00:33:49.680 --> 00:33:54.880
So, until next week, stay curious, stay informed, and stay safe.