Canadian Intelligence Service CSIS Warns Against ‘Smart City’ Technology

The Canadian intelligence service warns that adversaries like the Chinese government could use “Smart City” technology innovations to harvest sensitive data, target diaspora communities, and interfere in elections.

Before “smart city” platforms are widely adopted, the Canadian Security Intelligence Service urges policymakers and the technology industry to consider steps that can be taken to address and mitigate the emerging security threat.

These systems include electronically linked devices that gather, analyze, store and transmit data via centralized platforms. Municipalities, in turn, can use artificial intelligence to control operations and services more efficiently, such as changing traffic lights at the optimal time, managing energy use, or tracking the location of publicly rented bicycles.

“One of the primary security concerns associated with smart cities is the requirement for the selection and retention of massive, continuously processed data pools that could be exploited to reveal patterns of individual and societal behavior,” according to the report.

“These worries are exacerbated by a lack of control and visibility over where this data is stored and who has access to it.”

The CSIS report, completed in 2021, was only recently made available to CTV News in response to an access-to-information request filed in October.

While integrating technological innovations and data can improve process efficiency, CSIS warns that it can also introduce security risks.

“Smart city devices collect massive amounts of personal data, such as biometric data and other information highlighting personal life choices and patterns. Hostile state actors are investigating various methods of gaining access to future smart city platforms, including access provided by state-owned or state-linked technology firms.”

CSIS warns that Canadian municipalities may willingly enter into technological partnerships with foreign companies that allow hostile or undemocratic states access to collect data.

Smarty City Tech Projects

Smart city projects in Western countries have faced opposition due to privacy concerns, but China has “embraced the concept wholeheartedly,” according to the report, giving the country’s technology companies a competitive advantage. Beijing’s artificial intelligence advantage stems from its access to large amounts of data, lax privacy regulations, and cheap labor to categorize data and develop AI algorithms.

According to CSIS, China is utilizing new technologies to support “digital authoritarianism,” which uses advanced technology to monitor, repress, and manipulate domestic and foreign populations.

Meanwhile, the report predicts that next-generation networks and interconnected technology will become deeply embedded in municipal critical infrastructures over the next decade, increasing the possibility of “back door” access. A major concern is that a single breach could expose all devices to interference or attack.

“In other words, data collected via a bike-sharing app could theoretically increase access to other connected devices, such as a city’s energy grid, water supply, or traffic-light management database,” according to the report.

“This exposure will have serious financial, social and health and safety implications in Canada. Consider a scenario in which a coordinated cyberattack disables safety locks that prevent catastrophic explosions at a petrochemical facility while controlling traffic lights to thwart emergency response.”

According to the report, legal access to data could come from contracts between cities and companies, whereas illicit access could occur internally through a built-in function of foreign equipment or software or externally due to a cyberattack or data breach.

The data can then target specific elements of Canadian society, such as Chinese diaspora communities, infrastructure such as natural gas plants, water treatment facilities, and central government databases, democratic political processes such as elections, or civil society groups, it adds.

Data-harvesting techniques

The use of data-harvesting techniques by countries such as China, Iran, and Russia to track diaspora populations, specifically individuals considered adversaries, is a legitimate concern, according to David Murakami Wood, a University of Ottawa professor who specializes in surveillance, security, and technology.

“There is no such thing as innocent data,” he said in an interview.

Murakami Wood cautioned against believing that keeping data entirely in Canadian hands makes it safer. According to him, it is common for organizations to seek access to large pools of data for reasons unrelated to why the data was gathered in the first place.

“You can be sure if there’s a very large-scale national database constructed, for example, that the police will want access to it sooner or later. And they’ll make a compelling case for why they should.”

While connecting some municipal services to the internet makes sense, others, such as hospitals, may be too sensitive to the risk of being linked to cyberspace, according to Murakami Wood.

“If you want a very smart city, we should first consider what you don’t want to connect.”

Taking the necessary steps to address the security threats posed by smart cities will necessitate informed debate and consultation at all levels of government, according to the CSIS report.

“Various authorities have jurisdiction over different aspects of this challenge. Municipalities, particularly, are leading the way regarding implementation and contractual arrangements with technology vendors.”