Page text captured in a browser on 13 October 2026 (canada.ca refused scripted download).
Title: Report 7, Combatting Cybercrime. Office of the Auditor General of Canada.
URL: https://www.canada.ca/en/auditor-general/our-work/audit-reports/parl-oag-202406-07-e.html
Tabling date: 4 June 2024

At a Glance

Overall, the Royal Canadian Mounted Police (RCMP), Communications Security Establishment Canada, and the Canadian Radio-television and Telecommunications Commission (CRTC) did not have the capacity and tools to effectively enforce laws intended to protect Canadians from cyberattacks and address the growing volume and sophistication of cybercrime. We found breakdowns in response, coordination, enforcement, tracking, and analysis between and across the organizations responsible for protecting Canadians from cybercrime.

In 2022, victims of fraud reported financial losses totalling $531 million to the Canadian Anti Fraud Centre. Three quarters of these reports were cybercrime related. The centre estimates that only 5% to 10% of cybercrimes are reported. Without prompt action, financial and personal information losses will only grow as the volume of cybercrime and attacks continues to increase.

Effectively addressing cybercrime depends on reports going to the organizations best equipped to receive them. Those organizations need to act on the reports they receive to help protect Canadians against the risk of financial loss and other harms. While the RCMP, Communications Security Establishment Canada, and Public Safety Canada have discussed implementing a single point for Canadians to report cybercrime, this has yet to be implemented. Under the current system, people are left to figure out where to make a report or may be asked to report the same incident to another organization. For example, between 2021 and 2023, Communications Security Establishment Canada deemed that almost half of the 10,850 reports it received were out of its mandate because they related to individual Canadians and not to organizations. However, it did not respond to many of these individuals to inform them to report their situation to another authority.

In general, we found that Canada's cybersecurity workforce needed to be strengthened across organizations. For example, the RCMP has struggled to staff its cybercrime investigative teams. As of January 2024, we estimated that almost one third of positions across all teams were vacant. In our view, having a plan to reduce human resource gaps across all responsible organizations is an important component of an updated National Cyber Security Strategy.

The RCMP has also experienced delays in deploying its National Cybercrime Solution, an information technology system meant to make it easier for victims to report cybercrimes, provide a shared cybercrime database for Canadian law enforcement agencies, and allow cross-referencing of domestic and international malware samples.

Key facts and findings
The RCMP, through its National Cybercrime Coordination Centre, established partnerships with Canadian and international law enforcement to understand the needs of these agencies and coordinate efforts. However, it did not always forward to domestic police agencies requests for information it received from international partners.
The RCMP and Communications Security Establishment Canada were often well coordinated in their responses to potential high priority cases, such as attacks on Government of Canada systems or critical infrastructure.
In a report involving an offer to sell child sexual exploitation material, the CRTC did not refer the matter to law enforcement but rather told the complainant to contact law enforcement directly.
In 1 instance, to avoid being served with a search warrant by a law enforcement agency, the CRTC deleted evidence and returned electronic devices on an accelerated time frame to a person being investigated for violating the anti-spam legislation.
The National Cyber Security Strategy developed by Public Safety Canada had critical gaps, such as the absence of the CRTC as a key player despite its mandate to enforce Canada's anti spam legislation, which is directly linked to cybercrime.

Highlights of our recommendations
The RCMP's National Cybercrime Coordination Centre should establish procedures to identify the most urgent victim notifications and ensure that they are sent first.
Public Safety Canada, the RCMP, Communications Security Establishment Canada, and the Canadian Radio-television and Telecommunications Commission should work together to ensure that cybercrimes reported by Canadians and Canadian businesses are routed to the organization with the mandate to address them.