A Pair of Bolt Cutters Was All It Took to Break Into Canada's Cyberspy Agency

You'd think the new headquarters of one of the US's closest cyber intelligence allies would make for one of the most secure construction sites in the world.

Instead, Ottawa emergency crews responding to a fire at the unfinished new home of Communications Security Establishment Canada (CSEC) in late 2013 were able to break into the top-secret facility through a back gate that had been secured with nothing more than a padlock.

This and other details were revealed in an unusual access to information request obtained by The Toronto Star—a candid set of documents that, in another apparent foible, had received no redactions before being sent.

According to the newspaper, a small fire broke out on the roof of a building still under construction at CSEC's new headquarters around midnight on Nov. 9, 2013. The agency expected local fire crews to enter the compound through the main gate, but crews drove up an alternate entrance instead and were confronted by only a padlocked gate, which they cut.

Agency spokesperson Ryan Foreman told Motherboard in an email that an extensive system of security cameras, 24/7 guard patrols and perimeter fencing were still protecting the unfinished facility at the time, in addition to the padlocked gate—what documents described as an "extreme vulnerability," according to the report. Foreman said that the incident took place before CSEC had taken possession of the building and that "security concerns related to the gate used by the fire department to access the site were immediately addressed."

The fire, meanwhile, only caused minor damage, and was attributed to cans of tar and a heater left on by contractors. The gate used by emergency crews, according to Foreman, was used only for construction, and no longer exists.

"For security reasons, we cannot provide any additional information about current site access or emergency plans," Foreman wrote.

But the documents also revealed that security cameras suffered multiple outages, according to the report, and that as many as 11 cameras were offline for part of one day. "Should this information be released to a hostile entity it could provide details of faulty security cameras and areas of vulnerability for entrance to the campus," the briefing notes are quoted as saying. In his email, Foreman wrote that the camera system had redundancies built-in.

A visitor pass has also been missing since 2013, according to the report.

This isn't the first time that CSEC's new headquarters have come under scrutiny. A CBC report from October 2013 described the building as a $1.2-billion "spy palace," complete with high-tech glass, soaring atriums and a grand fireplace.

The agency later clarified that there would be no fireplaces in the facility, and that its headquarters actually cost $880 million to design and build. Construction was completed last fall.

Update (Jan. 20): This story has been updated with comments from a CSEC spokesman.