Hydro-Quebec has thanked half a dozen consultants who had downloaded software to simulate the movement of their mouse while teleworking, learned The Press. The Crown corporation is continuing its investigation into this file and could take action against some of its own employees.
Posted at 5:00 a.m.
Last week, The Press revealed that Hydro had detected a series of cybersecurity incidents related to the installation of unauthorized computer programs. Targeted software allows employees who work from home to feign their presence at the computer while they go about other activities, thus escaping the potential monitoring of their boss.
Hydro-Québec said it took this matter “very seriously”, and it wasted no time in taking action.
“Consultant contracts have indeed been terminated,” spokesperson Maxence Huard-Lefebvre confirmed on Tuesday. We sometimes terminate contracts when the contractual clauses are not respected. Downloading unauthorized software violates our requirements. »
The internal investigation is “still in progress” and is narrowing down to a “very limited” number of employees who would also have downloaded such software, adds Mr. Huard-Lefebvre. Other consultants could still be thanked, he says. “It should be noted that a continuous watch will be maintained in the organization, and that interventions will follow if necessary. »
Huge risks
Some 11,000 of the 22,000 Hydro-Québec employees are now teleworking, more than two years after the start of the pandemic. The state-owned company says it does not spy on their activities remotely, but rather constantly monitors its computer network for any external threats.
It is this lookout that has made it possible to flush out illegal downloads in recent months. Installing unauthorized software violates two Hydro cybersecurity rules and could have been an entry point for computer viruses or cyberattacks.
Several cybersecurity experts consulted by The Press confirm that this type of download poses a serious threat. It is common, for example, for ransomware to be encrypted in seemingly legitimate software.
No “malicious code” or “cybersecurity issue” has been detected at Hydro-Québec, according to a spokesperson.
Theft of time
Beyond the risks of computer attack, the use of mouse movement software by workers can be tantamount to stealing time from their employer – an act liable to dismissal.
In an email sent to employees, obtained by The PressHydro stresses that the use of these programs is not “in accordance with the duty to act professionally at all times and to apply oneself to give the expected performance of work”.
No case of use of mouse movement simulation software has been declared elsewhere within the Quebec government. Also, “the Ministry of Cybersecurity and Digital does not have information that public bodies monitor the presence of their employees working from home using tools to detect mouse movements”, indicates the spokesperson. Laurent Berube.
“It should be noted that in several departments, installing software on employee workstations requires administrator rights,” he adds.
Mr. Bérubé underlines that “citizens’ personal data is saved in secure environments and access to it by civil servants, in the performance of their duties, meets the same security standards in teleworking as when they are in the office”. All access to the government network is via “secure links,” he said.
Russian threats
Computer monitoring had already been raised several notches in recent months at Hydro and elsewhere in the Quebec public apparatus, to guard against the “serious” threat of a cyberattack from Russia.
Electrical distribution networks, such as Hydro’s, have been identified as “potential targets for a cyberattack” by the Quebec government.
According to the Minister of Cybersecurity and Digital, Éric Caire, Russian hackers could target Quebec and then attack the United States in retaliation for their support for Ukraine in the context of the conflict between the two countries.
“Just imagine if we attacked Hydro-Québec and if we managed to stop the production of electricity [alors qu’]Americans are supplied with electricity. If you want to attack the Americans, we are a good transmission belt,” said Mr. Caire in April during the study of the budgetary appropriations of his ministry in the National Assembly.
Hydro-Quebec confirmed in April that it had tightened its surveillance to specifically target threats of Russian origin.