Days Before The Federal Election, Computers On A Remote BC Island Were Hijacked In A Mysterious Cyber Attack

What happened to Texada Island on October 16? No one seems to know for sure — including authorities and government officials.

Kim was visiting family on the remote island, 200 km north of Vancouver up the Sunshine Coast, when he was jolted awake by someone shouting in German.

“We woke up to the sound of a German voice in the living room loudly exclaiming something in German,” Kim told PressProgress. “My father-in-law had tried to open a website and had instead been greeted by a video.”

Texada Island (Google Maps)

Each time his father-in-law typed a search request into his web browser, he was redirected to a German-language YouTube video about teenage climate activist Greta Thunberg titled “Warum Greta gar nicht gegen den Klimawandel kämpfen darf” (or, “Why Greta should not fight climate change”).

“We were all sitting around the kitchen table discussing the video,” Kim recalled. “Suddenly the video started randomly playing again on the computer.”

“We shut it down, but every 15 minutes or so it would start up again.”

Unable to use the Internet, Kim and his partner boarded a ferry so they could work remotely from Powell River.

“On the way over, we were sitting in a group talking about the experience and a few people overheard us. They started telling us they had the same experience.”

Van Anda, BC is located on Texada Island (David Stanley, Flickr)

John Dove, director of the Gillies Bay Internet Society (GBIS), a local non-profit organization that provides Internet access to many island residents, says his phone was ringing off the hook that morning.

“Everybody I talked to had the same video presented to them,” he told PressProgress.

Residents on the remote island launched their own non-profit Internet provider in the mid-2000s after the former BC Liberal government omitted Texada Island from a list of rural communities eligible for funding for broadband infrastructure.

“It was unlike anything I’ve ever come across in ten years of working with the Internet here on Texada,” Dove said about the flood of complaints.

Later that morning, GBIS took the unusual step of sending an e-mail to all of its customers on the island, notifying them of the situation.

“There is a widespread problem with the network this morning,” the e-mail to GBIS customers stated. “It appears that traffic is being intercepted outside our network somewhere and being redirected to a Greta Thunberg video site.”

“Larry is investigating,” the e-mail added. “The problem may be external to GBIS.”

E-mail from Gillies Bay Internet Society to customers (October 16, 2019)

Multiple businesses and groups on Texada Island confirmed to PressProgress their Internet access was crippled by the German-language video, including the local general store, the local branch of the Royal Canadian Legion, as well as several other restaurants, hotels and guest houses scattered across the island.

The local RCMP detachment, whose Internet is routed through a secure network, told PressProgress they did not experience any issue.

Some Texada Island residents shared their confusion in a local Facebook group.

One user wrote: “Is anyone else unable to access the Internet? I get the video at first and every time I try Google I get a ‘not secure warning — your connection is not private’.”

“Have same problem when trying to access normal sites, potential security alert comes up everywhere,” wrote another. “When I press advanced and try to continue, Greta comes up.”

Another user described receiving a warning that their wifi had been “compromised by Man in the Middle,” — a kind of cyber attack in which a hacker alters and relays communications between two parties who believe they are communicating with each other.

Texada Island Facebook group

After the disruption ended around 2 pm, GBIS said they tracked the problem down to one of their devices located in Powell River that connects to fibre optic cables owned by Telus.

“That had been hacked,” Dove told PressProgress.

“I learned it may have been somewhere in Bulgaria that the connection was made.”

“They got access into that piece of equipment remotely and changed some of the internal software,” he explained. “That meant from then on, it was possible for the link to that video to override anything that our clients did.”

“The technical manager was surprised at how easily (hackers) were able to do that.”

Dove said the network may have been vulnerable partly due to the particular brand of equipment that the Internet society uses.

Map showing network access points and connection to routers located in Powell River (Gillies Bay Internet Society)

Although Texada Island’s Internet access was crippled by the Greta Thunberg video only days before the federal election and coincided with Thunberg’s visit to Alberta last month, cyber security experts say the patterns don’t align with the way hackers typically operate — although they agree the incident is “very bizarre.”

“If you’re going to do a hack of some sort, you want people to understand why you did it,” Allen Mendelsohn, a McGill University expert on Internet law, told PressProgress.

“If you’re going to hack an Internet company where there’s no German speaking customers and redirect them to a German video, that just doesn’t make any sense.”

“Hackers prefer to go after larger fish than the Gillies Bay Internet Society,” Mendelsohn noted.

In fact, while the German video portrays the teenage climate activist as a hypocrite, two German-language speakers told PressProgress the video is actually satirizing Thunberg’s critics — context undoubtedly lost on anyone who can’t speak German.

The video itself was first published by “Funk,” a youth-focused media outlet jointly owned by German broadcasting companies ARD and ZDF.

Eric Kuhnke, a telecommunications specialist with an Internet service provider in Washington state who is familiar with smaller ISPs operating in BC and the Pacific Northwest, thinks it’s unlikely Texada was specifically singled out by hackers.

Although he cautions he has “no first-hand knowledge of their equipment,” Kuhnke says the “most likely explanation” is that GBIS’ routers were exploited by hackers who set-up automated tools that scan networks looking for weak spots.

“There’s fully automated tools people have let loose on the Internet to discover and exploit vulnerable routers,” the core network engineer explained.

He notes that GBIS appears to use routers manufactured by MikroTik that have a known security vulnerability that could be exploited by hackers.

“In my experience, these things are more automated than people think,” he said, adding he doubts a “nefarious hacker in a dark room” targeted Texada Island.

A recent report from the Brookings Institute warns rural and remote communities face unique cyber security risks as rural Internet providers are too under-resourced and understaffed to implement a “robust cybersecurity program.”

Based on his observations of smaller ISPs in the Pacific Northwest, Kuhnke says rural and remote communities tend to have a smaller client-base, meaning limited budgets and fewer staff to “keep up to date on network security issues and emerging Internet-based threats.”

Shed containing miscellaneous equipment (Gillies Bay Internet Society)

In January 2019, months before the federal election, the Trudeau government issued a press release promoting a wide range of initiatives aimed at safeguarding the democratic process from disinformation and cyber threats.

That included the creation of a “Security and Intelligence Threats to Elections Task Force” — a special partnership between the Canadian Security Intelligence Service, the Communications Security Establishment, the RCMP and Global Affairs Canada.

Contacted by PressProgress days before the federal election, one SITE partner said the task force had been unaware of any suspicious incidents on Texada Island, but indicated the task force would investigate further.

Despite the Trudeau government’s overtures that it takes cyber security seriously, some governmental agencies struggle to provide basic information about threats to rural and remote communities.

The Canadian Centre for Cyber Security, a special unit that “leads the government’s response to cyber security events” and works to “educate Canadians about cyber security issues,” later told PressProgress it was not authorized to provide any information to the public about cyber security issues facing rural communities because it does not “facilitate research requests or interviews.”

The Canadian Security Establishment, a SITE partner tasked with “providing cyber security advice and guidance,” also indicated it had no information to share on rural cyber security issues.

Earlier this month, nearly 40,000 people in Nunavut lost all government services after hackers infected government computers with malware.

According to the Government of Nunavut, the ransomware attack disabled services relating to “health, family services, education, justice and finance,” leaving residents in remote northern communities unable to book medical appointment and using makeshift food-vouchers in place of income assistance.

While the bizarre incident on Texada Island several days before the federal election appears to have had no meaningful impact on anyone’s ability to cast votes, Texada’s federal riding was ultimately decided by only a few thousand votes.

Rachel Blaney, the Member of Parliament for North Island – Powell River, says the incident highlights some of the unique issues rural and remote communities face when it comes to Internet access.

“Reasonable and affordable access to the Internet at modern speeds is a significant issue for many rural and remote communities in our riding and across the country,” Blaney told PressProgress.

“As we work to expand networks we need to ensure that data and privacy protection are as secure as possible regardless of where in Canada we are logging on.”

Texada Island’s population totals just over 1,000 people.