Information & Ethics Committee on Feb. 6th, 2024

[Sophie Martel]

Can you provide a bit more information?

[René Villemure, Bloc, Trois-Rivières, QC]

Are there other less invasive ways to achieve the same results?

[Sophie Martel]

Right now, we're using the tools needed to keep our networks secure. Most of these tools are as non‑invasive as possible.

[René Villemure, Bloc, Trois-Rivières, QC]

Can you elaborate on this?

[Sophie Martel]

Mr. Yarker can provide a further explanation.

[BGen Dave Yarker]

We would move to more invasive tools only if something about the nature of the investigation forced us to do that. Yes, we always turn to the least invasive tools possible.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay. Thank you.

Mr. Pelletier, my colleague asked you earlier whether employees know that they're being investigated with these tools. I imagine that, when people start working for you, they fill in all sorts of forms that authorize certain things. However, is that the same as clicking “I accept” when you visit a website but don't read the terms of use?

[Pierre Pelletier]

The government is no different from any other organization. When you use government networks, you have certain obligations as an employee to ensure that your use of the equipment complies with government policies. Clearly, a forensic analysis in particular can't be carried out without the knowledge of the people involved. Under no circumstances could we carry out a forensic analysis without first informing the people involved.

[René Villemure, Bloc, Trois-Rivières, QC]

Like you, I think that makes sense, but are employees regularly reminded about security?

[Pierre Pelletier]

Absolutely. A reminder pops up automatically every time someone connects to the virtual private network. The department regularly reminds employees of their obligations. In fact, we’re in the middle of cybersecurity month. Our department is therefore taking steps to make employees aware of this reality.

[René Villemure, Bloc, Trois-Rivières, QC]

So, if you ended up using that particular tool, people wouldn’t be able to say they had forgotten or didn’t know it could be used. In other words, they were informed.

[Pierre Pelletier]

If we were to use that particular tool, it would be with a great deal of transparency with the organization and the employee involved.

[René Villemure, Bloc, Trois-Rivières, QC]

Very well. Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Villemure.

Mr. Green, you have two and a half minutes.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

I'm going to go back to my friend, Mr. Yarker. I want to have, in fairness, the opportunity for the public to get a sense of what risk Canada is under in terms of cybersecurity and cyber-threats.

In a succinct way, can you express the importance of the work that you do in terms of protecting our country from foreign attacks and possible disruptions, including very serious military breaches?

[BGen Dave Yarker]

Certainly. Thank you for the question.

We know very well that cyberspace is not a friendly space. Cyberspace is a place where we face numerous threats from various directions—both nation-states and criminal actors. We take those threats very seriously.

Within the Department of National Defence, we have a robust cybersecurity program. On top of that, we have cyber-forces capable of defending our networks when and where necessary.

[Matthew Green, NDP, Hamilton Centre, ON]

In some way, it's like a fourth dimension to the typical, traditional military operations. It's a complete new world with technologies that surpass most people's imaginations.

Is that fair to say?

[BGen Dave Yarker]

Yes. Thank you for the question.

I would say that we certainly treat it as another domain. We have air, land, sea and space. Cyber is one of those.

[Matthew Green, NDP, Hamilton Centre, ON]

Do you feel adequately prepared for what's out there?

[BGen Dave Yarker]

Cyberspace, as I've mentioned, is a bit of a nasty place. It's also a place where we are learning, and there's an awful lot to continue to do.

Although, yes, we have well-trained, well-prepared forces, it's also a space where there is always more work left to do.

[Matthew Green, NDP, Hamilton Centre, ON]

I thank both you and Ms. Martel for your service to the country.

I'm going to go over to you fellows at the end of the table around the privacy impact assessment, recognizing that you haven't had to use it. What I'm trying to get out of this study, in terms of the real legislative value of it, is what the process, the systems and the steps it takes are.

You said that you bought the tech and you're prepared to use it if you need it. You said that you would do a PIA if you needed to use the tech. Why not do it in advance?

[Francis Brisson]

Definitely. From our perspective, as I discussed before, Pierre and I are new in the role, and this is definitely something we want to continue exploring and looking into further.

[Matthew Green, NDP, Hamilton Centre, ON]

Do you have the ability, the decision-making capability, to go from this meeting and just start a PIA, or is that something you have to...?

[Francis Brisson]

No. From our perspective, we definitely can.

[Matthew Green, NDP, Hamilton Centre, ON]

Is that something you will commit to doing after leaving this committee?