Loss of secret data puts navy's handling of storage devices under investigation — again

Two of Canada's frontline frigates lost electronic storage devices containing classified and top secret data — including electronic warfare material — according to security inventories conducted over the last two years, CBC News has learned.

The devices — USBs, DVDs and a backup hard drive — went missing despite an apparent tightening of security in the wake of a spy scandal almost a decade ago, and a separate internal 2013 board of inquiry which recommended measures to clean up the navy's handling of classified data.

In August 2020, according to documents obtained by CBC News, an inventory of the secure data account aboard HMCS Fredericton "discovered numerous classified and unclassified [electronic warfare] items" were missing.

A subsequent search focused on two missing DVDs containing highly "sensitive" information, including information about threat emitters — electronic devices to identify and help counter incoming missiles — used by the ship's various systems.

A follow-up internal investigation concluded the loss of the secret data had the potential to seriously affect the national interest.

"The possibility of uncontrolled disclosure cannot be ruled out, however it does not appear inappropriate disclosure took place," said a security assessment prepared for the military's director general of security.

Military police were called in to investigate but the DVDs are still missing. The frigate is now deployed in support of Operation Reassurance, a NATO mission to deter Russian aggression in Eastern Europe.

This isn't the first time that highly sensitive electronics and information have been mishandled by the navy.

Hard drive goes AWOL

In mid-October, a classified message-handling hard drive was reported missing after a routine security audit of HMCS Montreal.

CBC News has learned senior officers aboard the frigate alerted officials at the Department of National Defence (DND) to the loss of the drive — typically used to store high-frequency or ultra-high frequency message traffic during NATO operations.

News of the HMCS Montreal security audit came from two confidential sources; CBC News has agreed not to identify them because they were not authorized to speak publicly.

The hard drive was discovered missing during inventory of the security safe where it and other classified material, such as technical manuals, are stored, said the two sources.

DND subsequently confirmed the breach to CBC News.

Sailors searched for the storage device for more than six weeks. 

Also missing from HMCS Montreal were two USB sticks — one of which contained technical manuals related to a weapons system. In a media statement, DND insisted that the manuals were old and had been superseded by other publications, while the missing USB sticks were quickly recovered.

The lapse was blamed on poor accounting methods since the previous audit two years ago.

Lost and found

A spokesperson for DND said Tuesday that the hard drive remained missing until just recently, when it was discovered in HMCS Montreal's secure emergency radio room.

No one in the navy has explained why it took a military police probe and an administrative investigation to find the device in an obvious location — where it would be needed to store message traffic — or how it was missed in previous searches.

The country's top military commander said he was concerned by the incidents and said the military must become "much more security conscious."

"The practices we have in place may not be sufficient for the emerging security environment," Gen. Wayne Eyre, chief of the defence staff, said in a recent interview with CBC News.

Eyre suggested the military's security regulations will have to evolve to meet the growing challenge posed by adversaries such as China and Russia, which run sophisticated cyber operations and are capable of stealing vast amounts of secure electronic data.

"This is extremely important," said Eyre, who would not comment on the specifics of the two investigations. "We're seeing not just the Canadian Armed Forces but Canada writ large under increasing attack. The domain of cyber is increasingly important in military operations, in national security. We have to put much more emphasis on cyber security."

The navy has struggled for more than a decade to secure classified information on electronic storage devices.

In early 2012, the RCMP arrested now-former navy sub-lieutenant Jeffrey Delisle for violating the Security of Information Act. He pleaded guilty a year later and was sentenced to 20 years in prison for passing secret material to Russia in exchange for upwards of $110,000 over a period of more than four years.

Delisle used a USB thumb drive to carry out his espionage activity at the all-source intelligence centre in Halifax.

Just a few months after the Delisle case concluded in 2013, the military launched a separate board of inquiry investigation after it discovered that three USB sticks containing secret information had gone missing from several units in the Atlantic fleet, including the now-decommissioned destroyers HMCS Iroquois and HMCS Athabaskan.

A copy of that inquiry report was obtained by CBC News under access to information legislation.

The sticks — one of which disappeared as HMCS Iroquois travelled between Baltimore and Boston in 2012 — were never found. The board of inquiry said it "was unable to determine whether or not classified material was viewed by unauthorized persons."

Among its 20 recommendations, the board of inquiry said that the navy should reduce the number of classified USB drives from an unlimited amount to just five, that unit and ship commanding officers be the only ones to allow the devices to be signed out, and that a better inventory system be developed.

"You have repeated incidents of sloppy handling of classified information that might very well undermine your naval capabilities, as well as undermining your reputation with allies," said Wesley Wark, a University of Ottawa professor who specializes in intelligence matters and testified as an expert witness in the Delisle case. 

He said he's particularly worried about the recent loss of classified DVD storage devices on HMCS Fredericton because the data involved the configuration of threat emitters, which are crucial to both the Canadian navy and allies. 

"The only fortunate thing is that there is no indication that this was the result of deliberate espionage," said Wark. "That is not to say that the missing material has not gotten into the wrong hands, but at least there doesn't seem to be a deliberate espionage nexus."

Wark pointed out that "the case is open."

"Let's hope it doesn't involve espionage on the scale of the Delisle case," he added.