Security protocol adopted after Hydro One hired alleged ISIS recruiter 'unreasonable': labour decision

After hiring an alleged ISIS recruiter, Ontario's largest power provider tried to take in a a great deal sir thomas more intensive certificate screening process to protect its grid — but a labour arbitrator has found Hydro One's national security background checks were "intrusive" and "unreasonable."  

The decision comes as Canada's intelligence agencies have increasingly warned that critical infrastructure in Canada is vulnerable to attack from foreign states, and that private companies need to take national security and insider threats seriously.  

But as the decision — issued in late January and made public only recently — shows, there's still a gulf when it comes to balancing those concerns with labour and privacy rights. 

"There can be no doubt that Hydro One’s business is highly safety sensitive and is part of Canada’s critical infrastructure," wrote arbitrator John Stout in his decision. "But the issue remains, do the general potential threats identified by Hydro One provide reasonable cause or justification for the intrusive screening of all existing employees? I think not."

The case dates back to 2015 when, according to evidence filed by Hydro One, it was approached separately by the Canadian Security Intelligence Service (CSIS) and the RCMP about an active investigation into a former co-op student "who was acting as a mid-level ISIS recruiter while employed at Hydro One."

CSIS said it won't confirm or deny any specific investigative details.

The individual was subsequently killed in the Middle East, said the arbitration document.

Hydro One then hired Juno Risk Solutions, a consulting firm which specializes in insider risk management and workforce reliability screenings, to investigate. It turned up "red flags" in Hydro One's hiring process, according to the company's evidence.

The company brought in a new reliability policy around 2022, setting out three tiers of screening depending on an employee's or third-party contractor's access. But even at the lower level, which includes tradespeople such as carpenters, they were required to provide a criminal record check and driver's abstract, and could be subject to other screening tools such as deep internet searches "as needed."

Those with access to sensitive electronics, including meter readers and stock-keepers, were also asked to provide a credit check. Stout's decision said 69 per cent of Power Workers' Union (PWU) employees would have had to undergo the highest level of security screening. 

To maintain their reliability status, employees had to renew their screenings every seven years, and contractors every three years.  

Hydro One argued individuals with even basic access "may serve as initial entry points into the environment, potentially enabling malicious activity."

"Hydro One acknowledges that the policy was designed to exceed express minimum regulatory requirements. However, it is Hydro One’s view that in the context of a critical infrastructure environment more than minimum standards are necessary to provide protection," reads the decision.

According to Hydro One, the program has successfully blocked 41 candidates of "varying levels of risk," and at least five of those were high-risk candidates, including ones linked to Chinese and Russian state actors.

The PWU, which represents the majority of unionized employees at Hydro One, grieved the policy in 2023, arguing it was too broad and a violation of the collective agreement covering existing employees.

According to the decision, the union argued that while the more rigorous checks may be applicable to some of Hydro One's workforce, it contended the company was using the case to apply additional checks on all employees.

"The PWU argues that the security clearance requirements under the policy infringe upon employee privacy rights without properly balancing the degree of risk and the degree of intrusion," it said.

Key to the union's argument was that Hydro One's security screening superseded those  established by the North American Electric Reliability Corporation, the industry's international regulatory authority. 

Of particular concern for the union were the driver's abstracts and credit checks, the latter involving inherently sensitive information.  

Hydro One argued driver's abstracts for employees who are not required to drive a company vehicle were needed because they can help identify "a pattern or propensity to engage in adverse or illegal behaviour," said the decision. 

The union felt it was an invasion of privacy without proper cause.

Defending credit checks, Hydro One said anomalous transactions or cash flows help identify individuals who may be susceptible to blackmail by malicious actors. Credit checks are also recommended by the federal government in its 2019 directive titled Enhancing Canada's Critical Infrastructure Resilience to Insider Risk.

In asking for the grievance to be dismissed, Hydro One argued it has "a statutory duty to protect the public interest," and said the policy screens people "who pose a risk to Hydro One staff, safety and the integrity of the electrical grid, as well as Hydro One's intellectual property." 

"The policy acts as a critical safety control against fraud, theft in the workplace, violence or workplace harassment, sabotage and espionage," and weakening it "poses a serious security and safety risk to other employees, the public and national security," according to Hydro's One's arguments.

Stout disagreed, finding the policy "infringes upon all employees' privacy rights and does not provide a balanced approach."

"Moreover, I am not satisfied that Hydro One has exhausted less intrusive alternative measures for addressing the risk," he wrote.

Stout wrote that while a prospective employee who objects to a criminal record check can walk away from the hiring process, a gainfully employed worker "faces a Hobson's choice between giving up their privacy or being disciplined or worse, losing their livelihood." 

At one point during its arguments, Hydro One pointed to an example it felt helped justify the policy. According to the decision, the utility said a Chinese national who had been rejected for a position identified two long-term employees "who might be unreliable." 

"Hydro One points out that changes can occur in one's life that may make the person more vulnerable to being recruited by a foreign state or make them less reliable," wrote Stout. 

"That may be true of any individual, but does that possibility justify a requirement that all existing employees must arbitrarily provide private information to Hydro One?"

Canada's cyber intelligence agency, the Communications Security Establishment (CSE), has been steadily issuing bulletins warning of potential state-sponsored attacks on critical infrastructure such as energy and water systems, transportation arteries, food supply chains and financial networks.  

Its sister agency CSIS has also ramped up its warnings around economic espionage in recent years.

Stout said without regulation, the warnings and advice do not constitute a legal obligation. His decision calls for the policy to be amended for existing members. 

Legal counsel for the union said it's currently working with Hydro One to implement the ruling. 

"Maintaining public trust and ensuring the continued reliability of Ontario’s electricity system are fundamental to our work," said Madeleine Porter in a statement.

"Multiple safeguards are in place to manage risk and protect critical infrastructure, and customers can be confident that the electricity system remains secure, reliable, and resilient for communities across Ontario."

The decision does allow Hydro One to implement its screening policy on new hires.

The industry has been rocked by threats to their systems and allegations of espionage in recent years. 

Did he spy for China? Trial begins for former Hydro-Québec employee

A former Hydro-Québec employee is waiting for a decision after he was accused of spying on the utility on behalf of China. Yuesheng Wang has pleaded not guilty to economic espionage under Canada’s Security of Information Act.  

In 2023, a leak of U.S. Intelligence documents suggested Russian-backed hackers successfully gained access to Canada's natural gas distribution network.

Nova Scotia Power's computer systems were breached by ransomware hackers last year, and about 280,000 customers — more than half of the utility's customers in the province — were informed by letter that their personal information may have been compromised in the attack.  

Michael Powell, who oversees the security file at Electricity Canada, the industry's advocacy association, said companies are working to make sure "the most essential parts of our day-to-day life are protected."

"The issue around hostile state actors embedding in critical infrastructure for any number of reasons isn't new and is a thing that our members have to think about," he said. "I think it's important that we develop rules and processes that address that risk, because the broader concern about making sure that we have a reliable and safe grid is an important one."

---

---