Cellphone companies may need to step up privacy protections, minister says

Cellphone companies may need to do a better job protecting their customers, in light of a CBC/Radio-Canada investigation showing security vulnerabilities in Canada's two largest cellphone networks, Public Safety Minister Ralph Goodale said.

And if telecommunications companies need "encouragement" to better protect privacy, the government will provide it, he said.

"According to the information in the public domain today, the companies need to improve their level of performance in protecting the privacy of their customers," said Goodale, during an interview with CBC News Network's Power & Politics guest host Hannah Thibedeau.

"It would appear that in a number of cases they have not been as proficient as they should."

Hacking demonstration raises questions

A CBC/Radio-Canada demonstration showed that hackers only needed an MP's cellphone number in order to record his phone conversations and track his movements, using a technique known as an SS7 attack. The Berlin-based cybersecurity experts who helped with the demonstration tested phones on both the Rogers and Bell networks.

"I think the two Canadian networks we tested have about 10 per cent of the security that they need to do, to protect from SS7 attacks," said Karsten Noh, managing director of Security Research Labs.

Both Bell and Rogers responded with statements to CBC News saying they worked with domestic and international partners to address security risks. Rogers added that it had introduced "the most advanced technologies" to address SS7 attacks, but couldn't offer details because of security concerns.

Offering 'encouragement'

The MP who volunteered to be part of the test, the NDP's Matthew Dube, said seeing how those experts tracked his movements for days and recorded his calls was "pretty creepy." On Thursday, he stood in the House of Commons and called on the government to do more.

"What we need is leadership and legislation from this federal government. So will the minister finally take Canadians' privacy seriously and modernize our laws?"

Goodale responded by saying the Canadian Security Establishment — Canada's digital spy agency — had been working very closely with industry to "correct the problem" and ensure Canadians' privacy.

"And if the telecoms need a little bit more encouragement we'd be pleased to give it to them," said Goodale.

Later, in his interview with Thibedeau, he was asked just how he planned to do that.

"It will take an examination of the tools available to us," he said, adding that the timing was good because the government was just wrapping up a re-examination of its cybersecurity strategy. He promised new initiatives during the winter and into the new year that would show the government's commitment to cybersecurity.