Information & Ethics Committee on Feb. 26th, 2019

[Michel Picard, Liberal, Montarville, QC]

Thank you, Mr. Chair.

One of the aspects that has not yet been discussed is the aftermath of the attack. I will explain.

Let's say that, one day, we are inundated with a huge amount of hateful messages, we react effectively and, the next day, we dismantle those hateful messages by making a correction or by posting a positive advertisement, regardless of the strategy. The damage is already done. We are in an environment of freedom of expression where some things are a bit less tangible. So the damage is social, in a way.

There is an issue when it comes to system attacks by hackers, where algorithms, codes and management systems can be attacked. Even if the attack has taken place and, in a best-case scenario, you have identified it and reacted to it on the same day, the system data is still compromised. Can the compromised nature of data be repaired?

If not, and if attack on data or algorithms compromised our system, the election underway would completely lose its legitimacy. As a result, the electoral process would lose its legitimacy with regard to this next election, in October.

Is the compromised nature of data and systems following an attack maintained, or can it be guaranteed that, after steps are taken to remedy the situation, data or systems can once again be trusted? Otherwise, it would be impossible to accept the election as legal and legitimate.

[André Boucher]

I will provide some answers.

When an individual notices that their account has been hacked by someone and that wrong information has been disseminated, they can go on our website, where we say what should be done in hacking cases. One of the first things to do is take back control and remove the information. Depending on the type of attack, that information can be removed.

The quickness of intervention is important, as information spreads like a wave. I think that is what your comment was about. I don't think that wave can be stopped with the current tools.

[Michel Picard, Liberal, Montarville, QC]

It's fair.

It's an attack on a reputation. If someone hacks my personal account and puts unfounded things in it, that is a matter of reputation, but we are talking about words.

If someone gets into the election data management system for an attack, we are no longer talking about reputation being at stake. That is real system hacking. Data, the program, the algorithm or the line of code is affected. A compromised line of code puts into question the election's legitimacy. Even if we manage to block the signal, our data that is at the foundation of our electoral system's management has just been compromised.

Is the compromised nature of data important enough for the election to be declared null?

[André Boucher]

The first answer I gave was in the context of social media hacking.

Your second question, if I understand correctly, is about the hacking of electoral systems, correct?

[Michel Picard, Liberal, Montarville, QC]

Yes.

[André Boucher]

It is important to reassure us. We have been working with Elections Canada for a number of years to implement the necessary protection measures to avoid these types of incidents. If someone is getting into our systems, that activity must be detected as soon as possible to stop the hacking. In the unlikely but possible case of the system being accessed, we must be able to go back in order to identify the activity, close the door, make backups and re-establish the information's integrity.

I think the work that has been done, as well as the partnership and the collaboration, must be recognized. I am very confident in our systems when it comes to the upcoming election.

[Michel Picard, Liberal, Montarville, QC]

So corrected data can be said to have integrity.

[André Boucher]

Absolutely.

[Michel Picard, Liberal, Montarville, QC]

I now turn to Mr. Rogers.

This is a bit outside my area of expertise. Can a foreign signal be converted into a local signal to go unnoticed and fly under the radar? I assume that foreign signals do not arrive in Canada with an accent.

[Dan Rogers]

Thank you for the question.

I want to be clear, so I will answer in English, if that's okay with you.

If I understand correctly, your question is whether a foreign actor can come into Canada and masquerade as a Canadian. Technology—

[Michel Picard, Liberal, Montarville, QC]

[Inaudible—Editor] signal. SIGINT.

[Dan Rogers]

Yes.

The answer is that yes, technology does allow foreign actors to masquerade as Canadian or otherwise. Our intention is to look at the foreign actor and try to find out whether they are attempting to do that, so that we can pass information on to, for example, the cyber centre. Then they can put in defensive measures or share that information with others who may the victim of the act.

[Michel Picard, Liberal, Montarville, QC]

Your duty is to look at foreign signals. Is it possible for you to not only to stop the signal, but to return an attack to destroy the source?

[Dan Rogers]

Under the current mandate for CSE, our authorities are limited to intelligence collection. There are provisions in Bill C-59, which the Senate is currently considering. If that bill is passed, we may have more authorities in the future.

[Michel Picard, Liberal, Montarville, QC]

That's what we are waiting for.

[Dan Rogers]

Yes.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

[The Chair, Conservative, Bob Zimmer]

We have about nine minutes left, so we'll be down to about three minutes each.

We'll go to Ms. Kusie first of all, for three minutes. Then we'll go to Mr. Erskine-Smith for three minutes. Then we'll be close to done.

Ms. Kusie.

[Stephanie Kusie]

Given the concern you've heard from this side of the table today in regard to the non-partisanship or independence of the five individuals who comprise the panel that will decide the critical incident protocol trigger, I am asking for assurance from both Mr. Boucher and Mr. Sutherland that you will do everything possible in your power as public servants to support the absolute disclosure of equal and shared information to all political parties, please.

[Allen Sutherland]

I just want to be precise. If there was an event that passed the threshold, it is an obligation that the Prime Minister, the leaders of the opposition parties and Elections Canada be informed. I can give you full assurance that that's what will take place. It will be the same briefing to all actors. The decision would have been made that the threshold had been passed. The Prime Minister, the leader of the opposition party and Elections Canada are not the deciders. The decision will have been made, but they will be informed equally. I can give that assurance.

[Stephanie Kusie]

Thank you, Mr. Sutherland.

Mr. Boucher, do you want to comment?

[André Boucher]

Yes, absolutely.

There will likely be many more events that do not pass the threshold. The practice of the cyber centre has always been—and will continue to be—to inform those who are affected or potentially affected when we detect incidents or events of significance. Unlike the threshold conversation, ours is always an unattributed conversation. It's about the manifestation and giving the tools to those who are or might be affected to defend themselves or remediate the problem.

In our conversation, we would not be specific about “Entity X is having this issue.” We would just say that there's an entity in the process having an issue and you can detect whether you are also having the issue with the following tips and indicators. We'll provide assistance to help resolve those issues. That's what would happen in all circumstances below threshold.

[Stephanie Kusie]

Mr. Rogers, you might be tired of me talking about this, but I'm a member of the Trilateral Commission. We were fortunate to go to Silicon Valley in November to have an overview of a cybersecurity update with some of the most brilliant minds in the world. I felt that perhaps instead of being at Facebook and Google, we should have been at the main office of Fortnite.

I want to hear your comments, very briefly, in terms of how you find, engage and employ the absolute best to secure our electoral systems.

[Dan Rogers]

That's a great question, thank you.

We are recruiting, so anyone who's listening is welcome to send through a resumé.

[Charlie Angus, NDP, Timmins—James Bay, ON]

For everybody around this table, ethics rules. I'll come after you.