Spy case raises troubling questions for Canada’s security community
By Mr. Black | Oct 16, 2012 5:05 am | 0 Comments
The case of Sub Lt Jeffrey Delisle, the Canadian Naval Intelligence Officer who pleaded guilty in a Nova Scotia provincial court last week to selling Canadian and NATO intelligence to Russia for $3,000 a month, raises several issues for the government and it’s security staff.
The first issue will be the effect of this case on Canada’s relations with its intelligence partners. Canada is one of the “Five Eyes” Community, along with the U.S., the UK, Australia and New Zealand. Although, rightly, exactly what Delisle sold to the Russians will never be revealed to the general public, it is likely that it included material which one or all of the partners would have considered sensitive.
However, this is unlikely to cause any major rift. The truth is that no one can get very sanctimonious about this kind of case. To name just the most famous, the U.S. have recently had the Wikileaks scandal and before that the Robert Hanson and Aldridge Ames cases. In the 1980s two UK intelligence officers, Michael Bettany and Geoffrey Prime were separately convicted of selling secrets to the Russians.
Delisle was caught after only a four year spying career, Hanson’s duplicity lasted 22 years and he was paid over a million dollars. The West’s intelligence agencies know that no security system is perfect and, to mix metaphors, sooner or later a bad apple slips through every net.
It is also unlikely that any lasting damage will have been done to Canada’s relations with Russia. Sometimes these events are ritually ended with a diplomat being expelled by the aggrieved country, which is usually followed by a tit-for-tat response by the second party. The most extreme form of this came in 1971 when the British expelled 105 Russian Diplomats in one fell swoop.
These events are usually just minor bumps in the diplomatic road. Every country spies and, occasionally, someone gets caught. C’est la vie.
The second issue which Canada will have been addressing is the practical aspects of how Delisle accessed the information and how he passed it to the Russians. As a vetted Naval Intelligence officer he presumably had a legitimate right to access the intelligence in the first place. That he then managed to pass it on to the Russians so easily will have raised concerns about the physical security of the systems to which he had access.
The sort of systems on which Delisle was working will have been on either a stand alone PC or an intranet. They will not have been connected to the Internet. This creates an “air gap” between the sensitive information and the outside world. This means that it is impossible for the material to be sent to someone by accident. Any leak of the information will therefore require deliberate action.
Delisle reportedly copied the material on to a thumb drive which he then passed to the Russians. This is a clear weakness in the system. It is common practice for both private companies and government departments to disable disc drives and USB ports on PCs in sensitive areas. If an employee has a valid reason to copy some classified material on to a disc or any external drive, this is done by a central IT unit and the action is recorded, together with the contents of the disc and reason why it has been copied. This provides an audit trail for IT security to follow. When the disc or drive is finished with, it is returned to the central point for either wiping or destruction. As well as information security, this also provides a defense against computer viruses invading the internal systems.
It is very surprising that the USB port on Delisle’s computer was not disabled and that he was able to copy it so easily. Once the material was on the thumb drive it would have been easy for him to get it out of the building. Thumb drives are very small, and, even in buildings where random exit searches are carried out these are normally perfunctory.
Delisle was reportedly caught after he returned from a short trip to Brazil to meet his Russian handler. He then apparently flashed large amounts of cash and this came to the attention of the security authorities. We don’t yet know how they caught on to him, whether it was one of his colleagues who noticed something unusual or whether it was the security authorities themselves. (If it was the latter, then kudos to them.) As an aside, this seems remarkably stupid on his part, $3,000 a month is not exactly a lottery-winning amount and if he had just carried on his normal life just paying for bits here and there with cash, I suspect no-one would have noticed.
Which brings us to the subject of vetting. When a case like this occurs, someone always puts it down to a failure of the vetting system. And to some extent it is. Vetting systems are designed to do three things, firstly to establish that the person is who they say they are, by checking ID, looking at recent employment history and addresses over the last 10 years. Secondly, to find any personal weaknesses that might open them to blackmail or duress, such as a gambling problems, debts, sexual peccadilloes, lack of discretion etc. Lastly, it attempts to try and gauge their loyalty to their country.
There is also the polygraph, or lie detector. There are major doubts in the scientific community about their efficacy. In a 1998 U.S. Supreme Court case (United States vs Scheffer) the majority commented, “There is simply no consensus that polygraph evidence is reliable.” Aldrich Ames passed two polygraphs whilst spying for the Russians, and, from his prison cell, described it as “junk science”.
Delisle seems to have decided to become a spy on a whim. All other things being equal, it is difficult to see how any vetting system could cope with that. People are extremely unpredictable and no vetting system will be infallible. Which makes it all the more important that the physical security precautions are right.
