NRCan’s China Data-Breach Case Needs a Breach-Control Ledger

When federal research files are allegedly copied for China-linked use, Canadians deserve access-control receipts — not another redacted trust-us file.

A former Natural Resources Canada scientist is facing criminal charges in a case that should set off alarms far beyond one courtroom. The allegations have not been proven. That matters. But the public accountability question is already obvious: how could a federal science department’s files allegedly be copied at this scale, and what did Ottawa change after discovering it?

Juno News reported July 13 that Dennis Lu, 65, faces two counts of unauthorized use of a computer and one count of breach of trust relating to his federal duties. Juno said Lu worked for decades at Natural Resources Canada’s Centre for Mineral and Energy Technology and alleged he shared more than 2,000 documents from a departmental server with China.

A CBC News feed item carried by Unpublished says a former federal scientist in an alleged foreign-interference case is accused of copying more than 2,000 documents from a shared departmental server near the end of his career, with the intention of sharing them with China. The Bureau, citing open-source records and a May court ruling, describes Lu as a longtime NRCan carbon-capture specialist and says the case involves two unauthorized-computer-use counts and one breach-of-trust count.

The court record confirms this is not just internet noise. In R. v. Lu, an Ontario Superior Court ruling dated May 25, 2026, Justice I. Carter dealt with a defence application for third-party records. The ruling lists counsel for NRCan, the Privy Council Office and the Canadian Security Intelligence Service, and says records were disclosed subject to redactions under sections 38 and 39 of the Canada Evidence Act. That is precisely why Parliament should demand an institutional ledger now, without compromising the prosecution.

Conservatives should be careful here. A charge is not a conviction. No minister should prejudice a trial by freelancing facts. But “the case is before the courts” cannot become a blanket excuse to hide every management failure, access-control gap or security lesson inside the bureaucracy.

NRCan handles research tied to energy, carbon capture, critical minerals and industrial competitiveness. If federal research can be copied from shared servers by a long-serving insider, taxpayers deserve to know the category of information exposed, the access privileges involved, when warning signs appeared, when accounts were disabled, whether security clearances were reviewed, and what controls now prevent a repeat.

Publish the breach-control ledger: a timeline, anonymized access logs, file-classification counts, export-control assessment, disciplinary chronology, security-clearance review, interdepartmental warning record, and reforms ordered across federal science departments.

Canada does not need theatrical tough talk on foreign interference. It needs operational receipts. If the Carney government wants Canadians to trust that sensitive public research is protected from hostile-state transfer, it should prove the controls exist — in writing, before the next breach.