US embassy cable - 05OTTAWA3169

C O N F I D E N T I A L SECTION 01 OF 05 OTTAWA 003169 
 
SIPDIS 
 
STATE FOR WHA/CAN-BREESE AND HOLT 
STATE PASS FCC 
DHS FOR FEMA, CBP, S&T DIRECTORATE (DOCKERY), INTERNATIONAL 
AFFAIRS (OPTICAN), IAIS AND EP&R 
USDOC FOR 4320/OFFICE OF NAFTA/GWORD/TFOX; 3134/OIO/WESTERN 
HEMISPHERE 
 
E.O. 12958: DECL: 10/21/2010 
TAGS: EIND, PTER, ECON, CA, SPP 
SUBJECT: CRITICAL INFRASTRUCTURE PROTECTION IN TELECOMS 
 
REF: A. (A) 04 OTTAWA 1424 (OIL AND GAS PIPELINES) 
     B. (B) 04 OTTAWA 924 (VOICE OVER INTERNET PROTOCOL) 
     C. (C) 03 OTTAWA 2558 (ELECTRIC POWER) 
 
Classified By: Economic Minister Counselor Brian Mohler 
Reasons 1.4(d) and (g) 
 
SUMMARY 
------- 
 
1.  (U) This message summarizes key views of Canadian players 
on the challenges of critical infrastructure protection in 
North America's telecom sector.  It is based on a series of 
interviews held by Mission staff in September-October 2005 in 
Ottawa and Toronto with government and industry 
representatives. 
 
2. (C) North America's existing telecom networks seem 
resistant to widespread failures, but there is room for 
further testing/analysis in this area.  Expected rapid 
adoption of voice over internet protocol (VOIP) in the next 
few years could dramatically increase the vulnerability of 
our voice communications to large disruptions.  The most 
serious threat may be Internet-borne software viruses.  While 
certain regulatory measures could control this vulnerability, 
the GOC has been slow to take such steps and has not 
allocated substantial resources to this area.  An additional 
major problem - as we encountered in other Canadian 
industries (refs A, C) - is that private firms are not 
willing to share key security information with GOC 
departments/agencies.  END SUMMARY/INTRODUCTION. 
 
 
OVERVIEW 
-------- 
 
3. (SBU) The United States and Canada have always closely 
integrated their public telephone systems.  Where the systems 
meet, eight "primary gateways" govern traffic between the two 
countries.  With few exceptions, calling to and from Canada 
is like calling long distance within the United States, and 
the technologies and standards are identical.  Indeed, many 
key telecom products and services originated with Canadian 
players (e.g. firms such as Nortel, Mitel, Newbridge, and 
Research in Motion).  The U.S. FCC cooperates closely with 
the Canadian Radio-Television and Telecommunications 
Commission (CRTC) and Industry Canada (IC). 
 
4.  (C) Some of our conclusions about critical infrastructure 
protection in this sector are similar to those we reached in 
studying the energy sector (refs A and C): 
 
-- Natural disasters - particularly storms - have 
historically been the most familiar problem.  In telecoms, 
prolonged power outages (of any origin) that might result 
from such disasters are a top concern. 
 
-- The industry's big players have sophisticated systems to 
maintain reliable service, and they appear to understand 
their security challenges well. 
 
-- On the security side, these players' relationships with 
government appear to be problematic.  Governments have so far 
brought little to these relationships in terms of expertise, 
data, or resources. 
 
 
LANDLINE PHONE SERVICE 
---------------------- 
 
5. (SBU) North America's conventional hard-wired telephone 
system (the "public switched telephone network" - PSTN) has 
evolved a robust network and claims 99.999 percent 
"availability."  Industry experts attribute this reliability 
to several factors, some of which do not prevail in mobile 
communications, including: 
 
-- The 100-plus-year evolution of the industry. 
 
-- A small number of industry players. 
 
-- Competent regulation in the public interest. 
 
6. (C) Industry security experts admit that there may be 
considerable room for improvement in PSTN reliability.  Their 
suggestions include: 
 
-- Longer backup power.  PSTN facilities typically have 
backup batteries and generators with at most 8 to 24 hours' 
worth of fuel on site.  In the event of a long power outage 
over a wide area, they will have difficulty maintaining fuel 
supplies.  The logical response would be storing more fuel 
and/or ensuring that these facilities have priority access to 
fuel during a blackout.  (Comment:  Such "priority service 
arrangements" during a crisis are no small matter, since they 
require someone to make judgments about "priority" and then 
enforce non-market supply arrangements over large sectors of 
the economy for unknown time durations.  With hospitals, 
police and other emergency services competing for priority 
status for fuel, phone company representatives admitted to us 
that they sometimes have difficulty obtaining priority 
status.  End comment). 
 
-- An additional, growing problem is that landline phone 
bases with cordless handsets - now standard in homes - depend 
on house current and are not usable at all during an outage. 
Households will want at least one old-fashioned cord phone in 
these situations. 
 
 -- More security testing.  Telecom industry experts admit 
that they focus their reliability efforts "in areas that 
customers will notice or care about."  This means that 
resources are concentrated in areas such as customer data 
protection, and may be under-allocated to "insidious" risks 
that are improbable or that have not yet led to 
customer-noticeable effects.  In this vein, one expert 
suggested that the PSTN's separate signaling traffic is 
under-protected relative to voice traffic, making signaling 
traffic the "weakest link."  Another commented that the 
vulnerability of modern software switching systems to 
deliberate hacking is unknown, since the industry has made no 
systematic effort to test their resistance.  (Comment:  A 
cybersecurity consultant claimed that hacking of software 
switches was his primary concern for the reliability of 
PSTNs.  End comment.) 
 
 
MOBILE PHONES 
------------- 
 
7. (SBU) A variety of mobile communications technologies are 
on the market, one of the most innovative (and in some ways 
the most secure and reliable) being the Canadian-developed 
"BlackBerry" messaging device.  Because most mobile systems 
are served by towers spaced a few miles apart, many towers 
would have to fail simultaneously in order to cause a service 
outage over a wide area.  While the mix of mobile 
technologies provides lower and spottier reliability than the 
PSTN, it also provides a degree of redundancy, making a 
complete failure of mobile communications unlikely in a 
diversified market. 
 
8. (C) Industry experts admit to a range of vulnerabilities 
in mobile networks.  All of these vulnerabilities become more 
serious as North Americans become more reliant on mobile 
phones.  The problems include: 
 
-- Backup power.  Cellphones need recharging on a daily 
basis, so they will die off during a long power outage. 
Also, each tower needs to be provided with a battery, 
generator and fuel tank in order to operate during a 
blackout.  Not only is this difficult in some cases (e.g. 
many cell towers are on rooftops), but the problem of 
maintaining access to fuel during a long blackout is much 
more complex than with the landline network. 
 
-- Local overload.  If too many mobile users crowd into a 
small area during an emergency, the network can become 
overloaded and fail just when and where it is most needed. 
(This problem is worsened by "BlackBerry" and similar 
devices, which are always connected to the network even when 
not in use.  Comment:  one phone company executive described 
a scenario where, after a power outage, all Blackberry units 
in an area simultaneously attempt to gain access at once, 
triggering a denial-of-service response from the network 
which can be mistaken for a deliberate attack.  End comment.) 
 Preventing this "overload" problem could require firms to 
over-invest in capacity throughout their networks, raising 
their costs significantly.  Another approach is to create 
"priority service lists" of numbers which receive service 
first from an overloaded network.  (Comment:  Industry Canada 
officials described evolving plans for a priority service 
list for mobile phones that would, in the event of an 
emergency, cut off service to anyone not on the priority 
service list.  This all-or-nothing approach was not what 
mobile-phone company executives had described to us; they had 
suggested a system of prioritizing users.  End comment.) 
 
-- Radio jamming.  Suitcase-sized "jammers" (which generate 
white-noise radio signals) can block all cellphone 
transmissions (including those to "priority service lists") 
over a limited area.  While it would take dozens to hundreds 
of these devices to block service across a major city, larger 
jammers can conceivably be built or bought from military 
sources.  (Comment:  while stating that these jammers are 
illegal in Canada, more than one industry interlocutor made 
oblique references to President Bush's 2004 visit, in which 
they suggested that their systems had been affected by 
jammers used in conjunction with the visit. End comment.) 
 
-- Major switching offices (MSO's).  Each of these supports 
one company's mobile network over a large region (e.g. one 
major firm has two MSO's serving Ontario's market area of ten 
million people).  Overlapping disasters/attacks at several 
MSO's could conceivably interrupt service for a sustained 
period over such a region. 
 
 
VOICE OVER INTERNET PROTOCOL (VOIP) 
----------------------------------- 
 
9. (C) Voice communications through the Internet are 
increasingly available and this technology may be adopted 
widely over the next two to three years - especially for 
internal communications within organizations -- because it 
allows voice service to be offered for a fraction of the cost 
of existing technologies.  Industry security experts stressed 
to us that currently, regulators cannot even track which 
firms are offering VOIP ("any crook can get into the 
business").  They expressed concern that rapid uptake of VOIP 
could dramatically increase the vulnerability of North 
America's communications, unless VOIP's currently high 
exposure to power outages, viruses and other risks is 
mitigated. 
 
10. (C) In both the United States and Canada, there are 
ongoing controversies at the regulatory level about whether 
and how VOIP services should be regulated.  The Canadian 
regulator, the CRTC, has expressed the view that VOIP is 
functionally the same as conventional telephony and that a 
similar regulatory regime should apply (ref B), but Bell 
Canada and Internet service providers dispute this, and the 
CRTC is reportedly showing little movement toward effective 
regulation.  At any rate, such regulations as are applied may 
be aimed less at network protection than at other goals (such 
as competition policy, and ensuring support of 911 and other 
public services).  One regulatory difficulty inherent in the 
VOIP design is the portability of numbers and the inability 
to obtain a physical location for a VOIP call: this is an 
obvious problem for providing 911 emergency services, but 
also raises fraud and security issues. 
 
11. (SBU) Our interlocutors offered the following general 
points of advice (some of which may well be self-interested) 
on how to make VOIP less vulnerable: 
 
-- Limit the number of players, even if only because 
regulators only know how to achieve regulatory goals through 
a finite number of firms.  This necessitates somehow 
restricting the offering of VOIP services to North Americans 
from offshore.  (Comment: of all the suggestions, this seemed 
to be the most self-interested. End comment.) 
 
-- Require VOIP phones to switch automatically to landline 
telephone power whenever their own power fails. 
 
-- Respect principles developed over the decades in the PSTN. 
 One such rule states that any call which begins and 
terminates in Canada (or the USA) should be routed 
in-country.  Another is an engineering maxim for preventing 
failure:  "Keep all the smarts in the network and make the 
terminals dumb." 
 
 
ROLE OF GOVERNMENT 
------------------ 
 
12. (SBU) Telecommunications are under federal government 
jurisdiction in Canada.  The GOC has a recently amalgamated 
department - Public Safety and Emergency Preparedness Canada 
or PSEPC - which is analogous to U.S. DHS.  However, 
responsibility for critical infrastructure protection in 
telecoms is partly delegated to Industry Canada, which is 
also responsible for telecom regulation and radio frequency 
allocation, and thus is home to much of the GOC's civilian 
expertise on communications technology. 
 
13. (C) Even more than in energy networks, we received the 
impression that security experts in the telecom industry 
attach little value to the GOC's role in critical 
infrastructure protection.  The overwhelming fact is that the 
infrastructure is owned and understood only by the big 
utility companies.  Even if government bodies allocate more 
resources to developing CIP expertise, they will remain 
outsiders.  They thus have little bargaining power when 
trying to develop dialogues with the companies.  Coercive 
approaches fail, since firms find ways to avoid disclosing 
anything in a form that government officials can use. 
 
14. (C) Clearly, government funding in these areas is an 
ongoing constraint.  One company official told us, "They 
(PSEPC) want our participation but they have no budgets which 
would allow them to share costs or develop joint programs." 
When emboffs asked Industry Canada what they thought the 
sector's vulnerabilities are, they replied that "a 
vulnerability assessment has been identified as a 
requirement" and would be addressed when funding is obtained. 
 (Comment: While industry executives were relatively 
pragmatic in accepting how little value-added they perceive 
from the government, Industry Canada officials surprised 
emboffs with their level of self-confidence in this area. 
Industry Canada interlocutors repeatedly emphasized their 
close and productive ties to the telecom industry players and 
stated how grateful the industry was for their assistance. 
This disconnect is not an encouraging insight into Industry 
Canada's self-assessment capability. End comment.) 
 
15. (C) A further problem affecting telecoms CIP is that 
firms have even less incentive than in the energy sector to 
share information with government players, given (1) the 
sensitivity of their proprietary technologies, and (2) the 
closeness between the Industry Canada offices responsible for 
CIP and those responsible for telecoms regulation.  As one 
company official noted, the systems which are most vulnerable 
- mobile and VOIP - are also those where technology is 
evolving rapidly and competition is most intense.  Another 
said plainly:  "We don't want to admit our security problems 
to our regulators" - lest the companies become burdened with 
further regulatory requirements.  In other words, until there 
is a visible boundary between government officials 
responsible for CIP and those responsible for regulating the 
telecoms market, these firms have a strong disincentive to 
talk to government about security issues.  Their position is 
that they will inform the GOC about their vulnerabilities at 
the time of a crisis (but not before), and only if protected 
by a signed non-disclosure agreement. 
 
16. (C) Finally, such government information as might be 
valuable to telecom firms is generally not made available to 
them in a useful way.  As in the energy sector, companies 
complain that blanket "security alerts" convey no actionable 
information.  One company official said, "We get nearly 
nothing useful from PSEPC by regular channels.  The 
time-critical stuff never gets around in time and it's always 
piecemeal.  Any useful information we get comes through 
personal relationships."  This official said that the best 
capabilities in the GOC were in the military and related 
agencies, such as the Communications Security Establishment 
(CSE), and that what is required includes: 
 
-- GOC security clearances for key company officials. 
 
-- Direct computer links from security agencies to the major 
telecom companies. 
 
-- Substantial budgets (he suggested C$5-10 million) for 
joint operations and investigations "or else all we do is sit 
around and talk." 
 
Visit Canada's Classified Web Site at 
http://www.state.sgov.gov/p/wha/ottawa 
 
WILKINS