Аудит выявил критические уязвимости в системе безопасности Канады на границе

Canada Border Services Agency (CBSA) is woefully behind when it comes to protecting its only facilities at airports, ports of entry and offices from security threat and risk, an audit found. A recent effort to catch up on that work has exposed major shortcomings: Unauthorized people walked into secure areas through “piggybacking.” Surveillance cameras were missing or too blurry to be useful to guard the facilities. And official stamps used to process travellers and goods at ports of entry couldn’t be accounted for. The report examined the security controls at premises of the border agency, which operates in more than 1,000 facilities across the country, including airports, land border crossings, mail processing centres, warehouses, telephone reporting sites and office buildings. ARTICLE CONTINUES BELOW Of the 410 sites classified as “critical facilities,” 312 or 75 per cent had no records of threat and risk assessments or had one that was more than five years old — and only 69 or 40 per cent of 162 “medium and high-risk” premises had a valid evaluation, the internal audit found. “This indicates that the agency does not have a comprehensive or up to date baseline understanding of the risks and vulnerabilities present in most of its facilities,” said the report, released on Monday. Advocates say they are alarmed by the pushback of immigration authorities against migrants trying to exercise their right to protest. Advocates say they are alarmed by the pushback of immigration authorities against migrants trying to exercise their right to protest. Security and intelligence expert Wesley Wark said it’s incumbent on every federal department and agency, especially those with a role in national security, to protect their data and infrastructure. “That level of seriousness in terms of responding to a potential threat is not there for CBSA and improvements have to be made,” said Wark, a senior fellow at the Centre for International Governance Innovation. “This is an important responsibility that needs to be done in a better, more rigorous way.” The CBSA audit, covering the period between April 2022 and September 2025, focused on its physical security rules and oversight, internal controls and processes such as risk management, as well as monitoring and reporting of physical security activities. Auditors reviewed more than 300 documents, interviewed over 75 people involved and affected by these measures and visited 18 sites with walk-throughs in facilities in Ontario, the Pacific and Quebec regions. ARTICLE CONTINUES BELOW ARTICLE CONTINUES BELOW They pored over 180 physical security recommendations issued during the audit period but found only 25 per cent had been implemented, while the rest were either not carried out or could not be confirmed, indicating the identified vulnerabilities may have persisted, the report warned. The border agency’s management attributed the lacking valid threat and risk assessments to other priorities and limited human and financial resources. Reasons for lagging implementations included insufficient funding, infeasibility and no clear order of priority. In an email, CBSA said it’s on track to complete all ongoing threat and risk assessments by March 2027, at which time it will establish annual compliance monitoring of threat risk assessment recommendations. “We treat this matter seriously and take immediate action whenever gaps in physical security are identified,” said the agency, which has conducted an internal analysis to ensure its physical security data is accurate and up to date. “The CBSA has worked to address these issues over recent years by investing in physical security elements such as alarm systems, distress alarms, lighting, fences, barriers, signage, doors and windows.” Access to secure areas without authorization During a number of walk-throughs in various locations, audit team members were able to access all secure and non-secure floors unannounced, at various times of day, without access cards or visible CBSA identification. They were let in by occupants of the floors or entered through “piggybacking” — following an authorized person. They were only questioned on one of the six secure floors and two of the nine non-secure floors. ARTICLE CONTINUES BELOW ARTICLE CONTINUES BELOW On two occasions, employees were found to be away from their workstations, with computer screens unlocked and unattended. Sensitive documents were left at printers, including financial documents and documentation containing personal traveller data such as names, passage dates, passport numbers and dates of birth. “In some instances, the audit team was also able to consult paper documents with Protected B and C information, in cabinets that were left open, without being questioned,” said the report, referring to classified information pertaining to private personal data and business records. Although all 18 inspected sites had some form of electronic surveillance or  CCTV  infrastructure, problems were identified at half of them, including no coverage in key operational areas and low-quality resolution: There was no CCTV installed at one primary inspection lane that processes millions of crossing vehicles yearly; Three other locations had no  CCTV  coverage in areas such as the bond rooms, where seized goods are held; The remaining five locations had  CCTV  cameras with such poor resolution that in some cases images were not visible. “The most significant deficiencies were noted in one facility that had no electronic access management system; the entire Port of Entry (POE) leveraged locks with a pin code and/or keys with the same code for the entire facility,” the audit noted. “This facility had no intrusion alarm, although the audit notes that it is manned 24/7 with officers. Another three POE had access management systems which were deemed to be at a very high risk of failure.” Gaps in port stamp management The team also audited the management of port stamps that are used to identify the date, location, purpose and duration of a traveller’s authorized stay, or the personal and commercial goods entering and exiting Canada. They authenticate documents and identify the issuing officers with their unique numbers. ARTICLE CONTINUES BELOW ARTICLE CONTINUES BELOW They found that the government’s database was consistently out of date and didn’t match the actual stamps on hand at border crossings, while others in the system were missing, damaged, moved, reassigned or unaccounted for. There were also stamps in storage that were not in the inventory data. “Compromise, such as a lost or stolen stamps, can directly impact the integrity of Canada’s border,” the report cautioned. Throughout his nine years in Canada, the Egyptian man has gone through — and passed — three extensive security checks by multiple federal agencies. Throughout his nine years in Canada, the Egyptian man has gone through — and passed — three extensive security checks by multiple federal agencies. Security expert Wark believes the gaps identified in the audit have more to do with what he calls the “security culture” at CBSA, rather than lacking resources because infrastructure such as access controls and CCTV cameras are not “a big money pit.” He said a lot of people don’t understand the threat and risk until they are convinced to take it seriously, but more often than not major changes only happen after there’s a security crisis. “The security culture at CBSA is a little more lax than they should be comfortable with,” said Wark. “It’s an important reminder that physical security matters and that there are practices and policies in place that need to be followed as rigorously as possible.”  The border agency said many historical CCTV issues have been rectified and it’s working to address known deficiencies as quickly as possible. ARTICLE CONTINUES BELOW ARTICLE CONTINUES BELOW Following the audit, it said it conducted further review of its port stamps inventory and located some missing stamps at a different port of entry, and the records have since been updated to reflect the stamps’ actual location. The agency said a new step-by-step guide will be ready by the end of September for how to do a yearly check across the country to make sure all security-sensitive items are accounted for, and a five-year program of work will replace access control systems at a number of sites every year. “The CBSA maintains a safe and secure operational environment where its personnel, facilities, information and assets are guarded from security threats and vulnerabilities,” it said.  The Customs and Immigration Union, which represents more than 9,000 CBSA employees, said it’s still reviewing the audit and declined to comment.