Spoofed Police Email Fools Canadian News into Running Fake Crypto Heist Story

This story has many of the elements found in other Commsrisk stories — bad government policy, misinformation spread by mainstream media, spoofing the origin of electronic communications, the theft of cryptocurrency by teenagers — but the combination is novel. That is because this is the story of the Canadian Broadcasting Corporation (CBC) believing a made-up story about crime and then confusing law enforcement agencies into behaving like the crime actually happened.

Fortune Crypto put it thus:

It seemed like a perfectly believable story: Two teenagers in Canada posed as members of Coinbase’s support team and scammed an American man out of $4.2 million in Bitcoin and Ethereum.

After seeing an email with a news release about the supposed arrest of the teenagers, a reporter from the Canadian Broadcasting Corp. (CBC), one of Canada’s leading news outlets, ran the since-deleted story, according to a member of the Hamilton Police Service familiar with the matter… However, the entire story — from the teenagers’ alleged heist to their arrest — is a sham, according to the Hamilton Police Service.

CBC took down fake news story after a couple of days, replacing it with this one:

The Hamilton Police Service says someone “spoofed” the email address it uses to communicate with the media — leading to a fake story about cryptocurrency theft that police say gained international attention.

The service alerted newsrooms on Wednesday, two days after CBC Hamilton received an email about a reported cryptocurrency theft from what appeared to be the police department’s public affairs email account.

CBC wants readers to focus on the police investigation into who spoofed their email address. Identifying and punishing the miscreants is a valid goal, but it also distracts attention from CBC failing to verify a story they published just because it looked like a press release. This insight into how news organizations work is important because it occurs during a vicious fight over whether the government is right to give increased privileges and subsidies to some big media companies, including CBC.

A new law called C-18, the Online News Act, is currently generating international attention because it has prompted a boycott of Canadian news agencies by Google and Meta. They accurately state that the law creates a ‘link tax’ by forcing organizations like theirs to pay certain Canadian media companies each time they present a hyperlink to one of their articles. The law is projected to generate income of CAD329mn (USD246mn) a year. Three-quarters of this money would go to just a few big Canadian businesses: CBC, Bell Canada, and the newly-merged Shaw and Rogers. You may be conscious that the latter three are multiplay comms providers, leading to the irony that their broadcasting divisions will profit from subsidies paid by internet platforms that also attract customers to pay for the services provided by their ISPs. The boycott is an embarrassment for a government who dismissed critics who warned it would happen, but it is just the latest development in a deeply disturbing government campaign that characterizes any opposition to C-18 as a threat to Canada’s democracy, despite most democracies functioning perfectly well without imposing taxes on links.

The febrile political mood was exemplified in May, when the ruling Liberal Party began arguing with itself over a separate motion to impose new anti-disinformation laws that would also “provide additional public funds” to Canadian media, before agreeing with critics that the wording of the motion was “not fully thought through”. But the best example of the poor state of public debate came last year, when Liberal MP Lisa Hepfner tried to justify her support for C-18 by using an outrageous generalization. According to Hepfner, none of thousands of online news organizations founded in Canada since 2008 are gathering news, and they are all “publishing opinion only”. So it is a tad inconvenient that CBC, one of the organizations that will benefit most from C-18, has just been caught copying chunks of an apparent press release without verifying any of its contents first.

CBC tried to shift blame on to the police. Their excuse was that questions about the bogus press release were emailed to the address used by the spoofers, prompting a reply from the actual cops. CBC asked the police about the age, gender and date of arrest for each teenager in the made-up story. This seemingly bamboozled the police who received the message, and who thought they were being asked about a different, real case.

One of the followup answers CBC received Tuesday stated the teens were arrested in 2020 — despite the fact the initial information Monday stated the investigation took place this summer. Hamilton police had shared a media release in 2021 about a similar investigation in 2020 — a case the Monday email referenced.

But even though the police response made no sense, the fake story remained on the CBC website until the following day, when it was finally taken down after the police contacted CBC to tell them their story was false.

Spoofing of email addresses has grown harder over time, although it is telling that even a police force can be impersonated by fraudsters. However, this story is about much more than technological vulnerabilities in communications systems. Insufficient regard is paid to the discipline of risk management, which is a shame because people make mistakes every day. This also means prejudices that lead to mistakes are not tested by comparison to cold, hard facts. This includes the prejudice that a journalist who works for a state-funded broadcaster like CBC can be trusted to work to a consistently higher standard than journalists working for the online news organizations that Hepfner disparaged.

Any moron can copy-paste a press release, and very soon AI bots will be performing that task for every news organization, replacing the junior scribblers who may believe their jobs have just been saved by the new subsidies given to their employer. Instead of just asserting that big companies deserve more money because they theoretically do a good job, it would be helpful to show some evidence they actually do a good job. But the truth is that faltering news media does not want a close examination of how it works in practice, because only a small proportion of their work involves gathering unique information, and most news has been recycled from somewhere else. What sets most news outlets apart are their opinions, not the facts, and this slip by CBC illustrates how much they are simply trusting others to provide them with reliable facts for free.

For those of you who want a detailed understanding of the history of C-18 and the problems it creates, I recommend you follow Michael Geist, a Canadian Professor of Law with a deep understanding of the internet. The best place to start would be his explanation of how C-18 was a shakedown by big media companies.

Eric Priezkalns
Eric Priezkalns
Eric is the Editor of Commsrisk. Look here for more about the history of Commsrisk and the role played by Eric.

Eric is also the Chief Executive of the Risk & Assurance Group (RAG), a global association of professionals working in risk management and business assurance for communications providers.

Previously Eric was Director of Risk Management for Qatar Telecom and he has worked with Cable & Wireless, T‑Mobile, Sky, Worldcom and other telcos. He was lead author of Revenue Assurance: Expert Opinions for Communications Providers, published by CRC Press. He is a qualified chartered accountant, with degrees in information systems, and in mathematics and philosophy.