Foreign Interference and the Risk of Industrial Espionage: A Critical Issue for Quebec Businesses

By Benoit Grenier

Quebec businesses, whether small, medium, or large, are increasingly exposed to espionage threats from foreign actors. These threats are not fictional but a tangible reality affecting various sectors of the economy. As an intelligence and counter-espionage consultant, it is crucial to raise awareness among Human Resources (HR) departments about the risks associated with foreign interference and the measures that need to be taken to protect sensitive information from the hiring process through to the end of an employee’s tenure.

The Threat Landscape: A Constantly Evolving Reality

Foreign intelligence services are continually seeking valuable information on technological innovations, industrial processes, and business strategies of Quebec businesses. According to a report by the Canadian Security Intelligence Service (CSIS), these threats primarily originate from countries aiming to enhance their economic competitiveness by illegally accessing advanced technologies developed in Canada.

Companies in the information technology, biotechnology, aerospace, and renewable energy sectors are particularly targeted. However, no company is immune, as any organization possessing sensitive or strategic information can become a target.

Methods Employed by Foreign Actors

The espionage methods used by foreign actors are varied and constantly evolving. Here are some concrete examples to illustrate the diversity of approaches employed:

1. Insider Recruitment: Foreign actors may attempt to recruit company employees to obtain information. This recruitment can occur directly or indirectly, using influence agents who approach key employees at conferences, trade shows, or even through social networks. A notable example is the case of a Canadian technology company where an engineer was approached by a “headhunter” under the guise of a foreign job opportunity, which was actually a recruitment attempt to obtain trade secrets.
2. Intellectual Property Theft via Cyberattacks: Cyberattacks are becoming increasingly sophisticated. Adversaries can use malware to penetrate computer systems, as happened with a Quebec biotechnology company where hackers managed to extract data on a new vaccine under development. Ransomware attacks, where systems are locked until a ransom is paid, are also common and can serve as a cover for data theft.
3. Fraudulent Partnerships and Joint Ventures: Some foreign actors establish partnerships with Quebec companies solely to gain access to specific technologies or processes. For example, an aerospace company accepted a partnership with a foreign company to develop a new generation of drones, only to later discover that their partner was secretly transferring critical information to a third party.
4. Social Engineering: Social engineering techniques are often used to psychologically manipulate employees into divulging sensitive information. For example, an administrative employee received a phone call from someone posing as a member of the company’s IT department, requesting server access information under the pretext of an urgent update.
5. Physical and Electronic Surveillance: Listening devices or surveillance equipment can be installed in company offices, meeting rooms, or even employees’ computers. A revealing example is that of a Quebec company where hidden microphones were discovered in the boardroom, recording critical strategic discussions.
6. Attacks by Disgruntled Insiders: A disgruntled former employee can be a source of information leaks. For instance, a fired telecommunications employee attempted to sell sensitive information to a foreign competitor, jeopardizing the company’s future projects.
7. Spear Phishing: Apparently harmless emails may be sent to specific employees, enticing them to click on malicious links. For example, a senior executive received an email seemingly from the CEO, asking him to download a document containing spyware.
8. Direct Physical Attacks: Sometimes, foreign actors do not limit themselves to discreet methods and may try to physically infiltrate company premises to steal equipment, documents, or install surveillance devices. Such a case was reported by a high-tech company where intruders were caught trying to steal servers.

The Importance of Vigilance in Recruitment and the Crucial Role of Human Resources in Prevention

HR departments are on the front lines to protect companies against espionage. They have the power to influence security from the first contact with candidates and throughout their tenure with the company. Here’s what HR must do to identify potential threats and secure processes:

1. Thorough Background Checks: HR must ensure that every candidate undergoes a rigorous background check, especially for sensitive positions. This includes verifying qualifications, previous work experiences, potential political or religious affiliations that may pose a risk, and the candidate’s reputation in previous jobs.
2. Security-Oriented Interviews: During interviews, it is essential to ask specific questions about confidentiality management and information security. HR must assess candidates’ awareness of espionage risks and their ability to adhere to security protocols.
3. Ongoing Security Training: After hiring, employees must be regularly trained on espionage risks and how to identify them. This training should include practical exercises, such as recognizing phishing attempts or social engineering scenarios.
4. Confidentiality Contracts and Non-Disclosure Agreements: Employment contracts must include strict confidentiality and non-disclosure clauses that remain valid even after the employee leaves.
5. Regular Monitoring and Audits: HR should collaborate with security teams to conduct regular audits of security practices and monitor unusual employee behaviors, such as unauthorized access or suspicious activities outside normal working hours.

Measures to Secure Sensitive Information

Beyond HR practices, companies must implement technical and organizational measures to protect their information. These measures include:

1. Network Segmentation: To limit risks in the event of a cyberattack, it is recommended to segment computer networks so that access to sensitive information is restricted and monitored.
2. Data Encryption: Sensitive information must be encrypted, both in transit and at rest, to prevent unauthorized access.
3. Ongoing Awareness: Awareness programs should be regularly updated to inform employees about new threats and best practices in security.

Conclusion: A Challenge to Be Addressed Today

Industrial espionage and foreign interference threats are very real and pose a danger to Quebec businesses. Raising awareness and training HR departments are crucial steps to strengthening security from the recruitment process onward. As an expert in intelligence and counter-espionage, it is our duty to guide companies in adopting appropriate security measures to protect their most valuable assets.

By taking these threats seriously and adopting a proactive approach, Quebec businesses can not only protect themselves against espionage but also strengthen their resilience in an increasingly competitive international environment.

Useful Links:

• Canadian Security Intelligence Service (CSIS) Publications
• Communications Security Establishment (CSE) – Cyber Threats
• Government of Canada – Industrial Security

These resources provide additional information on espionage threats and the measures companies can take to protect themselves.

Finally, Some Critical Questions for Human Resources

To ensure the company’s security, HR should always have answers to these critical questions:

1. Does the employee have political or religious affiliations that could pose a security risk?
2. Has the employee worked for foreign companies or governments?
3. Does the employee have a history of handling sensitive information?
4. Does the employee understand the importance of data security in our company?
5. Has the employee been involved in security incidents in previous jobs?
6. Do the candidate’s references confirm their reliability and integrity?
7. Does the employee have personal relationships with at-risk individuals or entities?
8. Has the employee had access to sensitive information in previous roles?
9. Do the candidate’s social networks reveal suspicious behaviors or affiliations?
10. Has the employee recently traveled to high-risk security countries?
11. Was the employee recommended by a trusted person or entity?
12. Has the employee been involved in disputes or controversies regarding confidential information?
13. Is the employee willing to sign a strict confidentiality agreement?
14. Is the employee familiar with best practices in information security?
15. Does the employee have access to critical networks or computer systems?
16. Has the employee ever reported security incidents in previous jobs?
17. Has the employee been involved in espionage or counter-espionage activities?
18. Is the employee familiar with the threats related to cyberattacks?
19. Does the employee understand the risks associated with social engineering?
20. Has the employee had access to physical or electronic surveillance devices in previous jobs?
21. Does the employee have a criminal background related to security or fraud?
22. Has the employee been subjected to external pressures to disclose sensitive information?
23. Is the employee familiar with security protocols for international travel?