Canada sanctions suppliers of Russian cyber infrastructure for the first time
Canada has for the first time sanctioned entities that supply cyber infrastructure used in Russia's hybrid operations against Ukraine, Foreign Affairs Minister Anita Anand announced on Nov. 12.
The listings are part of a wider package under the Special Economic Measures (Russia) Regulations. Naming cyber infrastructure providers extends Canada's sanctions regime from the military and energy sectors into the hosting and network services that support Russian state cyber and influence activity, and it creates compliance obligations for Canadian companies that might do business with them.
What was announced
According to Global Affairs Canada, the package lists 13 individuals and 11 entities, including several tied to the development and deployment of Russia's drone program, plus 100 vessels in Russia's so-called shadow fleet. Several liquefied natural gas entities were also listed. The department's release did not give the number or names of the cyber infrastructure suppliers.
Law firm Baker McKenzie noted that the regulatory amendments took effect on Nov. 6, several days before the public announcement. Law360 Canada also reported on the package's focus on drones and cyber infrastructure.
Anand said Canada will keep intensifying pressure through sanctions in co-ordination with allies. Since 2014, Canada has sanctioned more than 3,300 individuals and entities and more than 400 vessels in connection with Russia, the government said.
Why it matters for Canadian organizations
Once a person or entity is listed, people in Canada and Canadians abroad are generally barred from dealing in their property or providing them with financial or related services. For technology firms, that can include hosting, domain, payment and resale arrangements with listed suppliers or their fronts.
Sanctions also intersect with ransomware response. Legal commentators have long pointed out that once a threat actor is on a Canadian sanctions list, paying that actor can expose the victim to liability, which makes screening an incident response step rather than an afterthought.
What we don't know yet
Global Affairs did not describe what services the newly listed cyber suppliers provided or how they were linked to specific operations. The full names appear in the schedule to the amended regulations.
What to do
- Compliance teams should update screening lists against the amended Russia regulations schedule.
- Incident response plans should include a sanctions check before any payment to a threat actor, with legal counsel involved.
