National Defence Committee on May 6th, 2014

[The Chair, Conservative, Rick Norlock]

Thank you very much, ladies and gentlemen, for being here on time. We're continuing our study into the defence of North America.

We have with us today, Mr. Paul Stockton, managing director of Sonecon, LLC.

Mr. Stockton, as per usual, we'll start with your 10 minutes of introduction.

[Paul Stockton, Managing Director, Sonecon, LLC, As an Individual]

Let me begin, first of all, Mr. Chairman, and distinguished members of the committee, by thanking you for the opportunity to share perspectives with you today.

I was the assistant secretary of defense for Homeland Defense and Americas' Security Affairs from 2009 through January of 2013. In that capacity, I was responsible for U.S. security relations and security policy with Canada and with the western hemisphere as a whole.

I'm here as a private citizen today. Nothing that I say should be taken to reflect the views of the United States government. But I want to emphasize that as a private citizen, I remain enormously grateful for the collaboration that Canada and the United States have to meet our shared security challenges, and above all, I want to take a moment and honour the 158 men and women in the Canadian Armed Forces who made the ultimate sacrifice in Afghanistan. Americans will never forget what Canada accomplished in Kandahar and beyond, and we remain enormously grateful.

I always like to start with my bottom line up front. What I'm going to argue with you today is that although Canadian-U.S. defence collaboration is extraordinary, and extraordinarily valuable, I believe that there are opportunities to deepen and broaden this collaboration into new security realms.

Two forces drive us to consider this expanded collaboration: first of all, emerging threats that challenge the security of the United States and Canada together on a North American basis, and second, the budgetary pressures confronting both nations. I believe there are opportunities to have collaborative investment strategies, opportunities to partner together, so that we understand who is going to take the lead in international engagement in particular countries, in regions around the world, so that this kind of collaborative planning can provide for a much more efficient use and effective use of Canadian and U.S. defence resources than would otherwise be the case if we failed to have the strategic dialogue. I'm going to offer a couple of examples of how this dialogue can go forward, but I'm going to keep my remarks very brief because I'm looking forward to your questions, your insights, and to allow you to drive our sense of priorities today.

Let me start with a prime opportunity for deeper collaboration, and that is the resilience of critical infrastructure. As all of you know, the United States and Canada share extensive interconnections in natural gas infrastructure, electricity infrastructure, and other forms of critical infrastructure. Hydro-Québec is really important to the United States. Equivalent sources of energy on the west coast flow down to California and make it possible in California for electricity generation to be possible based on natural gas that comes from Canada. This infrastructure, in many ways, is structured to run north to south, not east to west, and the interconnectedness of critical infrastructure, especially energy infrastructure, between the United States and Canada creates an important opportunity for collaboration.

This is especially true given the rise of new threats to critical infrastructure. Mr. Chairman, members of the committee, as I speak right now, efforts are under way to penetrate the networks on which our energy infrastructure depends. The computer networks are under attack today, both to map those networks, to steal valuable data, and potentially to launch attacks on the industrial control systems, the other mechanisms that provide for the functioning of this critical infrastructure.

The Canadian Department of National Defence is not responsible for critical infrastructure in the civilian sector; neither is the U.S. Department of Defense.

Public Safety Canada and other non-DND departments play a critical role in overseeing the cyber-security of critical infrastructure. It's the same in the United States. The Department of Homeland Security, not the Department of Defense, has primary responsibility for the cyber-security of the electric power grid and other critical infrastructure.

I'd like to suggest today that the resilience of critical infrastructure is increasingly important to the United States Department of Defense, and provides opportunities for defence collaboration between Canada and the United States. Let me give you some prime examples.

First of all, although we continue to collaborate on building protections against cyber-attack, better defending the networks against cyber-attack, I believe that eventually it is inevitable that a successful cyber-attack will occur on the electric, natural gas, or other energy infrastructure on which both our nations depend. The offence is developing weapons much more quickly than we can defend against them.

I believe that former Secretary Panetta had it exactly right when he said that we in the United States are at risk of a cyber Pearl Harbor that will create an electric power outage of a length and a duration that could dwarf the outage caused by superstorm Sandy or any previous event.

Although thus far I've been talking about cyber-threats, other potential hazards, both natural and man-made, pose the threat of these severe power outages in the United States. Certainly on our side of the border, this would land in the lap of the Department of Defense.

As part of my responsibilities as assistant secretary of defense, I led the Department of Defense's operations to help restore power and help reduce the threats to public health and safety in superstorm Sandy.

The Department of Defense flew hundreds of utility trucks and power restoration crews from the west coast to New York and New Jersey in order to accelerate power restoration. The Department of Defense provided millions of gallons of fuel and many, many hundreds of emergency generators in order to keep hospitals, nursing homes, and other facilities critical to saving and sustaining lives up and running when the power grid went down for two weeks.

But again, an outage of two weeks from a U.S. perspective is not nearly as severe as some of the outages that we could be facing in the future. The demand for the Department of Defense to help save and sustain lives, to provide defence support to civil authorities would be much, much greater.

At the same time that the Department of Defense would be called on to assist civil authorities, above all the Department of Homeland Security and FEMA in our system, providing that assistance will be much more difficult because the environment in which we'll be trying to provide disaster assistance will be so severely disrupted.

It would be great if big trucks full of assistance could flow on highways into the stricken area, but as you know, every gas pump runs on electricity. When electricity goes down, as we found in superstorm Sandy, emergency vehicles, police cars, everything else that you need in order to provide for life-saving and rescue operations, couldn't get the fuel they needed unless the Department of Defense brought it forward.

Guess what? We found that in critical cell communications towers, which fortunately had backup generators, there was only enough fuel stored at those critical communication nodes for them to run for two or three days. When that fuel ran out, the delivery of backup fuel had been disrupted.

My point is that if there is a long duration of wide-area loss of electric power or the natural gas that fuels electric generation, not only is there going to be an immense demand for our armed forces to save and sustain lives, but our ability to deliver that assistance is going to be disrupted, because the infrastructure on which we depend to provide the assistance is itself going to be severely degraded.

That's the puzzle we're facing in the United States, where the leaders of our emergency management community and the leadership of the Department of Defense have agreed that we're not going to plan just to do better the next time a superstorm Sandy strikes. We're going to assume that a much worse catastrophe, from either natural or man-made hazards, is right around the corner and could strike at any day. Therefore, from a Department of Defense perspective, being ready to support civil authorities and conduct disaster response operations is a prime defence mission.

There's a second way in which thinking is evolving in the United States, and that is support for power restoration. In the kind of catastrophe that I've been discussing, nothing is more important for saving lives than getting the power grid and natural gas systems back up and running. Emergency power can only do so much to save and sustain lives. Restoring the functionality of the grid and the natural gas system is absolutely essential.

I mentioned that in superstorm Sandy the Department of Defense conducted unprecedented operations to help the private utilities that own and operate our grid and yours move their assets and support the mutual assistance agreements that work so effectively in Canada and in the United States. Now the effort is under way in our country to think about what it would take to provide for mutual support in a nationwide event worse than Sandy. Here's where the opportunity for binational collaboration comes in.

Today in Halifax, the regulators of energy infrastructure in both the United States and Canada are meeting to discuss how, on a binational basis, we can support each other if a disaster occurs in Canada or if a disaster occurs in the United States: how utilities can move more effectively across the border. There are opportunities for defence collaboration to support this movement as well.

But there's an even more interesting opportunity for defence collaboration. In the United States, we have a mission assurance strategy in the Department of Defense. Let me give you the argument.

The Department of Defense depends on the electric power industry for 99% of the electricity that DOD uses. If the electric power grid goes down for an extended period in the United States, very quickly the ability of U.S. military facilities to execute their responsibilities to the nation could be in jeopardy. The Department of Defense doesn't own much generating capacity and doesn't regulate electric utilities, nor should it. Instead, there needs to be a partnership between DOD and industry to strengthen the resilience of the power grid.

Inside the Department of Defense, DOD leaders have been taking a hard look at the vulnerability of the U.S. armed forces to an asymmetric attack, that is, not an attack on our forces when they're deployed abroad but an attack on the critical infrastructure in the United States on which we depend.

Those are examples of opportunities for deeper collaboration, which I welcome the chance to talk about further, in the western hemisphere, in the Arctic, and beyond.

Thank you very much.

[The Chair, Conservative, Rick Norlock]

Thank you very much, sir.

We'll start with a seven-minute round with Mr. Leung.

[Chungsen Leung, Conservative, Willowdale, ON]

Thank you, Mr. Chair.

Mr. Stockton, in the area of defence, you mentioned electricity and energy. What about threats from other people to our water system and supply? I was in UNTAC, the United Nations Transitional Authority in Cambodia, and there were attacks contaminating the water source at the nuclear, biological, and chemical level. I would think if energy is a critical part of survival, so is water. A corollary to that would be, how do we do adequate disaster mitigation as in the case of preventing the second occurrence of a Katrina, or in Banda Aceh, Sri Lanka, or the situation in Fukushima? A lot of our infrastructure was put in more than 50 years ago before we had these insights into the changing threats, both natural or man-made, or by a potential person or country that could be a threat to us.

I would like you to share your comments with us.

[Paul Stockton]

Thank you especially for emphasizing the importance of water infrastructure.

People get thirsty fast if water infrastructure is attacked. Scholars in the United States last year, in order to assess the threat to water and waste water infrastructure in the cyber realm, built an imaginary website, loaded it up on the Web, and provided a website and an entry into an imaginary municipal water system just to see whether it would attract cyber-attacks on the industrial control systems that govern the municipal water system here in Ottawa, back in Washington, and across our two nations. That website attracted hundreds of attacks immediately.

Water infrastructure, and waste water infrastructure, are absolutely vital to strengthen in terms of resilience because of our dependence on water. This goes not only to direct attacks on the infrastructure, but the indirect effects, because certainly in Washington, D.C., perhaps also here in Ottawa, that water system is utterly dependent on electricity in order to function and in order to pump the water. With no electricity, no water for drinking, no water for firefighting, everything else is in jeopardy.

In regard to your second point in terms of aging infrastructure and how we can build resilience against non-traditional threats, this is why it's so important at the federal level and at the provincial level to have a dialogue on how investments should go forward against these non-traditional hazards. Ratepayers and customers are ultimately going to get stuck with the bill. What kinds of investments are prudent? What kinds of investments are important from a national security perspective for Canada and the United States? Who ought to pay and where should those investments be targeted going forward? That is a critical opportunity for progress in Canada and in the United States.

[Chungsen Leung, Conservative, Willowdale, ON]

You mentioned budgetary pressure and budgetary constraints. As you know, as politicians we're always determining where to spend the money. If we do this on the national defence side, it is for disaster mitigation, it is for emergency purposes. But if we look at it from, say, the overall national public security side, then it really is very long-term strategic thinking.

Perhaps you can share with us how that allocation is best performed to look at making sure that long-term infrastructure has its survivability and sustainability and then the emergency.... In the United States you have Homeland Security. Should that not all come under the national defence strategy?

[Paul Stockton]

In this realm I believe defence will always be in support. That's one of the lessons learned from the revitalization of the Permanent Joint Board on Defence over the past few years. The PJBD took on, as a core area for work, the question of how the Department of National Defence could be in support of Public Safety Canada, the Department of Homeland Security, and other agencies in order to strengthen the resilience of infrastructure on which national defence and national security depends.

There are very few dollars in the Canadian defence budget, or the U.S. defence budget, to strengthen resilience of infrastructure, even though it's absolutely vital to national defence. So the question is this: how can government and industry partner together to make sure the investments go forward in the way they need to? And how, in the Canadian system, can provincial governments that have so much of the regulatory authority over infrastructure be brought into this dialogue?

In our country we need much deeper federalist approaches that bring federal, state, and local dialogue together with the private sector above and beyond anything we've ever had before. This is an opportunity to do it not only within the United States but in close partnership with industry and the Government of Canada.

[The Chair, Conservative, Rick Norlock]

Mr. Leung, you have about 30 seconds.

[Chungsen Leung, Conservative, Willowdale, ON]

Let me just add a comment, if time permits. I'd also like to hear later on how in the United States the Department of Defense coordinates all the activities of the federal government and the state reserves in the military.

[Paul Stockton]

We welcome the chance.

[The Chair, Conservative, Rick Norlock]

That response will have to come later.

Mr. Harris, you have seven minutes.

[Jack Harris, NDP, St. John's East, NL]

Thank you, Mr. Stockton, for your presentation.

I understand the thrust of what you're saying, but are you suggesting that the military budget or the military itself have some responsibility for making the pipelines or the Hydro-Québec facilities more resilient? Really, that is something that in your country Homeland Security takes extremely seriously, has a budget for, works on, etc., and Public Safety in Canada has responsibility for cyber-security. They presumably work hand in glove with the keepers and operators of critical infrastructure to assist them in achieving some cyber defence security.

What I don't understand is how...other than the planning role, which is pretty clear on both sides. Both the military and the civil society sides would be very important, and yes, it would be great to know exactly how many generators might be available so those pumps that are pumping gas can actually pump at the critical points to make sure the police cars are able to run, etc.

But I'm not sure...and I'm looking here too at an agreement between Canada and the U.S. on civil assistance, which you're probably familiar with. It's the Canada-U.S. civil assistance plan, the 2013 version of it. Is there some inadequacy in that plan that needs to be fixed or expanded on?

I hear you saying that, yes, we can find opportunities to cooperate, but I gather we've found them, and at least we put them down on paper, and we have agreements about them, and who's going to do what, and all of that.

Could you tell us what the inadequacies of that plan might be, or are you looking at some expanded role for interjurisdictional cooperation?

[Paul Stockton]

The civil assistance plan provides a strong foundation on which to build, and it's in the planning realm that I think the greatest progress can go forward. What we discovered with superstorm Sandy is that we did not have the agreements in place to allow for Canadian utility crews to easily come across the border to assist the United States. There were too many impediments, too many delays.

[Jack Harris, NDP, St. John's East, NL]

They offered and they were available. Were they not able to deliver?

[Paul Stockton]

They weren't able to get through the customs system as quickly as we would want, to be able to have that go forward in the future.

More generally, we are not prepared in the United States yet for worse events than Sandy where the Department of Defense would be called on to provide support to civil authorities in order to respond to the disaster, save lives, and provide support to utilities for power restoration. We have agreements in place that provide a terrific basis for moving forward, but the concrete work to get to the level of detail where we have plans that we can actually fall in on and implement when lives are at stake, when every hour matters, is very much a work in progress.

There's a second dimension, too, that I'll mention, and that is in the Department of Defense. Until very recently, DOD was not where it needed to be to understand its own vulnerability, the vulnerability of U.S. armed forces to the long-term loss of electric power. That requires internal investment inside the Department of Defense.

[Jack Harris, NDP, St. John's East, NL]

Could you give us an idea of what has been different in terms of the American overall disaster assistance response in Katrina versus Sandy, for example? I'm sure we all remember the awful pictures of people in New Orleans struggling to survive, but did not survive in many cases. Sandy was a little different. It was in New York, and floods, and all of these.... It was a different type of event, obviously. But in terms of the U.S., Homeland Security, government response, FEMA, etc., what was the difference? Was there any improvement in the U.S. approach to handling disaster relief in those circumstances?

[Paul Stockton]

There was a great improvement in Sandy over Katrina, in part because of the lessons learned. Let me give you a prime example. We were able to use state national guard forces much more effectively, in a much more coordinated fashion, with federal military forces, than was possible in Hurricane Katrina.

[Jack Harris, NDP, St. John's East, NL]

Why?

[Paul Stockton]

This was because we reached an agreement between the Department of Defense and the governors of each state in the United States for how these military forces would operate more effectively together and give governors a say over the disaster response priorities that these military forces would be carrying out. That was a breakthrough in governance in the United States and allowed for much more efficient targeting of defence resources to support civil authorities than was possible in hurricane Katrina.

[Jack Harris, NDP, St. John's East, NL]

You talked about hydro or electrical energy resources as a critical infrastructure. Would there be the same difficulty of, say, expertise resources, like the utility workers? Supposedly during the ice storm in Quebec we needed American assistance because they didn't have enough riggers—I forget the exact name now—people who do that transmission tower work. Would there be the same difficulty for them to get into Canada? Is that something that needs to be worked out as a protocol?

[Paul Stockton]

It's something that's being worked on today. We need a binational approach to these severe threats, natural hazards and man-made, in order to provide for infrastructure restoration. There's important progress under way right now with industry, and between industry and government. That progress needs to be sustained, it needs to be deepened, and it needs to be built out in greater detail.

[Jack Harris, NDP, St. John's East, NL]

Can you tell us—

[The Chair, Conservative, Rick Norlock]

Thank you very much. Sorry, Mr. Harris.

Mr. Williamson, for seven minutes.

[John Williamson, Conservative, New Brunswick Southwest, NB]

Mr. Stockton, it's nice of you to be up in our country today sharing some of your views.

I think this is a really interesting line of questioning. I have a couple questions.

You talked about the threat to the electrical system, and you've touched on both infrastructure and the cyber-threat, but I'm a little unclear. Is it a cyber-threat that you see as being the bigger concern or is it a natural physical attack on the infrastructure? Put aside a natural disaster; I'm just curious to kind of get the threat level, and where it's coming from.

[Paul Stockton]

We recently had an exercise, a government-industry exercise, in the United States with strong Canadian participation from the electric industry. The scenario on which that exercise was based had a simultaneous cyber and physical attack on the electric grid. I don't believe our adversaries are going to do us a favour in the future and only attack with cyber. The risk of having a combined cyber and kinetic attack—attacks on high-voltage transformers, other components of critical infrastructure that are vulnerable to physical attack—that kind of combined attack would put extraordinary stress on the infrastructure systems being attacked and could make restoration much more complicated.