Foreign cyber hackers who attacked federal government departments could have been looking for information on weapon technology and natural resource policy, an expert in China's cyber spying program says.

The attacks, revealed by CBC News, targeted the Finance Department, the Treasury Board and Defence Research and Development Canada.

It's unclear what information the hackers, believed to based in China, were after.

Charles Burton, who teaches Chinese politics at Brock University and has written extensively on Chinese cyber spying programs, said that in the case of DRDC, the hackers were looking for information on new weapons.

"Canada has access to secrets that are shared with other Western industrial countries, such as the United States, with regard to sophisticated weaponry. And the Chinese government would have strong interest in getting hold of technologies," Burton said.

In the case of the Finance Department and the Treasury Board, Burton said, the hackers may have been looking for evidence of new international plans to pressure China to revalue its currency.

"With regard to the Treasury Board, the hackers would be able to get information about the passwords of key government officials that would then give them access to a wide range of classified data," Burton said.

But the hackers are interested in more than defence and economic information, he said.

China also has great interest in Canada's resource sector — oil and gas in particular, where it's a big investor. Companies in those fields have been targets for hackers in the past, although the source has never been pinned down.

Information on evolving federal government resource policy would give China useful information as it continues to expand its investments in Canada.

"Natural resources and the oil sector are very important to them, and there have been allegations of Chinese sources also hacking into computers of companies involved in those particular areas as well," Burton said.

China has denied any responsibility for the attacks.

The attack gave hackers access to highly classified information and was first detected in early January. The attacks forced the government departments that were targeted to disconnect temporarily from the internet.