Security Threats in Licensed Facilities

Safeguarding information is increasingly important as the global threat landscape evolves, and security incidents become more sophisticated. Adversaries threaten Canada's life-sciences sector by trying to take advantage of Canada's open and collaborative research.

Threats from adversaries can include:

•        espionage
•        cyber attacks
•        theft of technology
•        hijacking physical infrastructure
•        proliferation of biological weapons
•        intellectual property or other sensitive information (such as genetic sequences of concern or location of pathogens)

Canada's biopharmaceutical and health sectors are facing particularly severe threat activity. Canadian Security Intelligence Service's 2020 Public Report indicated that researchers and third parties may be used to exploit vulnerabilities in background and security checks to gain access to restricted areas. Licensed facilities should consider additional precautionary measures.

Before Applying for a Licence

Before applying for a licence, your facility must identify and prioritize assets in the biosecurity risk assessment (refer to section 4.1.5 of the Canadian Biosafety Standard, Third Edition). Only authorized individuals should have access to sensitive records and documentation related to controlled activities (refer to 4.9.3 in the Canadian Biosafety Standard, Third Edition). This includes information during the construction phase to support the biosecurity plan once your facility is operational (refer to 4.1.8 in the Canadian Biosafety Standard, Third Edition).

Licensed Facilities

Unauthorized access to sensitive information is a serious risk to public health, safety and security. Licensed facilities must consider mitigation strategies to prevent biosecurity incidents such as sabotage of:

•        gas lines
•        heating, ventilation, and air conditioning systems
•        control systems
•        emergency doors
•        accessible windows
•        electrical power lines
•        decontamination systems

To mitigate the risks of biosecurity incidents, consider protecting, classifying, or redacting drawings used during construction based on the risks associated with controlled activities. Examples of these drawings include:

•         architectural drawings, which may identify:
•    doors
•    security walls
•    load bearing points and columns
•    blind spots in the security layout
•         mechanical drawings, which may help identify laboratory space and specialized equipment for venting and scrubbing ductwork or potential attack points via the external make up air intake.
•         electrical drawings, which may help identify critical elements for operations such as:
•    generators
•    transfer switches
•    internal day tanks
•    fridges or freezers
•    external fuel tanks
•    uninterruptible power supply
•    normal and back up power lines
•    Local Area Network or server rooms

Based on the biosecurity risk assessment and biosecurity plan, you may opt not to publicly share identifying information such as a building name, address or architectural features from drawings of the building. Based on the assets you need to secure, you may consider all labelled floor plans confidential, including room numbers, names and titles. Security experts can help identify vulnerabilities and propose mitigation strategies. This may include Public Safety Canada's free Critical Infrastructure Resilience Tool.

Understanding the threat landscape (that is, identifying adversaries and their targets) can help you to identify sensitive information that needs safeguarding. Local, provincial and federal law enforcement agencies can help you better understand the type of suspicious and criminal activities occurring near your facility (for example, the likelihood of break-ins based on available statistics). Identify how your facility's activities may be perceived by the public or targeted by adversaries such as ideologically or religiously motivated extremists.

We recommend that you contact biosafety.biosecurite@phac-aspc.gc.ca before building new facilities or making changes to existing ones. This can help you meet the requirements of the Canadian Biosafety Standard and conditions of licence.

Please contact biosafety.biosecurite@phac-aspc.gc.ca if you have any questions.