Auditor Finds Key Federal Agencies are Unprepared to Combat Rising Cybercrime Threat

According to the federal spending watchdog, three key agencies in Canada lack the necessary capacity and tools to effectively protect the public from cyberattacks and address the increasing threat of online crime.

In a report released on June 4, Auditor General Karen Hogan highlighted breakdowns in response, coordination, enforcement, tracking, and analysis within and among the organizations – the RCMP, the Communications Security Establishment (CSE), and the Canadian Radio-television and Telecommunications Commission (CRTC).

Ms. Hogan’s review revealed that individuals were often left to determine where to report cybercrime incidents and may have been directed to report the same incident to multiple agencies. For example, the CRTC advised a complainant who reported an offer to sell child sexual exploitation material to contact the police directly instead of referring the matter to law enforcement.

The report also pointed out staffing challenges within the RCMP’s cybercrime investigative teams, with nearly a third of positions remaining vacant as of January.

The report highlighted that in 2022, victims of fraud reported losses totaling $531 million to the RCMP’s Canadian Anti-Fraud Centre, with three-quarters of these reports involving cybercrime. However, only a fraction of cybercrimes are actually reported, indicating a growing concern for financial and personal information losses.

The lack of a centralized reporting system for cybercrime incidents was also identified as a challenge, as there is no single point of contact for Canadians to report such incidents to the appropriate agencies.

The CSE found that almost half of the reports it received between 2021 and 2023 were outside its mandate, yet did not inform individuals to report their situations to the proper authorities. The report also noted instances of effective coordination between the RCMP and the CSE in addressing high-priority cases but found shortcomings in case management and victim notification procedures within the RCMP.

The report further criticized the CRTC for its limited efforts in safeguarding Canadians against online threats and highlighted gaps in the National Cyber Security Strategy developed by Public Safety Canada, including the exclusion of the CRTC as a key player despite its mandate to enforce anti-spam legislation.