That's not a problem.
Individuals in the private sector knew about the Heartbleed bug months before anyone publicly reported the vulnerability. Recognizing that the CSE does not monitor Canadian individuals, when was it that the CSE first learned about the Heartbleed bug?