U.S. official blasts Montreal-based UN aviation agency's handling of cyberattack

Thomas Carter, the U.S. ambassador to the International Civil Aviation Organization, said in a speech that the way the agency dealt with the security breaches was "unacceptable."

ICAO was more concerned with finding whistleblower than transparency, says U.S. ambassador

Thomas Carter, the U.S. ambassador to the ICAO, said members of the aviation agency's elected council would not have known about ICAO's response to a major cyberattack if not for a CBC article. (Louis-Marie Philidor/CBC)

The U.S. ambassador to the International Civil Aviation Organization has slammed the UN aviation agency for its handling of a 2016 cyberattack and the coverup that followed.

A CBC investigation found that in November 2016, the Montreal-based organization, known by its acronym ICAO, was hit by the most serious cyberattack in its history.

Internal documents suggested key members of the team who should have prevented the attack instead tried to cover up how badly it was mishandled. ICAO's chief of communication called the CBC's reporting "greatly exaggerated."

In a speech to the International Aviation Club in Washington, D.C., Thomas Carter said following the CBC investigation, members of the ICAO's elected council learned the network had been compromised for "quite some time" and that both member states and contractors had to fend off attacks from malware that came from the ICAO system.

"To put it bluntly, ICAO systems were totally exposed by a foreign state actor, and two completely independent forensic investigations proved this to be true.

"The way the hacks — by the way, not just one, but four — were handled was unacceptable," he said. His remarks were published on the U.S. Department of State website following the event.

"We, as council representatives of our countries, would not have known about the inadequate response to the hacks or the immense harm that they inflicted on ICAO's IT systems without the CBC article."

Carter said when the CBC article was first published, some members of the ICAO secretariat "were more concerned about finding the leaker than giving the council an accurate portrayal of what actually happened."

He said the ICAO council, which comprises 36 member states, is now looking into strengthening the whistleblower protection program.


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.