Information & Ethics Committee on Nov. 20th, 2023

[Matthew Green, NDP, Hamilton Centre, ON]

Would it concern you that the founding member of Cambridge Analytica, who was later involved in a significant scandal regarding the Trump campaign and Brexit, provided services in a contract with a Canadian political party, yet when we're doing a threat analysis, Facebook is never mentioned? How come?

[Sami Khoury]

In our role at the cyber centre, we want to make sure that we expose the threats and that we educate Canadians and Canadian organizations about the threats. We invite them to ask themselves the questions of how to protect—

[Matthew Green, NDP, Hamilton Centre, ON]

Respectfully, I'm just a working-class guy from Hamilton and it took me 10 minutes on Google to find that information. You're with the CSE. How is it that when you're doing a threat analysis of social media you don't find the threat of what I'll call algorithmic capitalism, the harvesting and sale of information for political purposes that would undermine democratic processes? I find that astonishing, to be quite frank with you, because when you talk about what's an acceptable level of risk, we've seen the impacts of Brexit and Trump.

Cambridge Analytica and Facebook, Mark Zuckerberg's company, had to testify in front of the U.S. Congress and had to pay fines in Europe for their interference in political processes, yet the only time we talk about threats, it's related to state-owned actors and not corporate actors, which are often hostile and, quite frankly, more mercenary when it comes to surveilling diaspora communities. I referenced the ways in which dictatorial regimes target their civilian populations here.

I will put this question to you. When you're doing your threat analysis, do you consider all of the other platforms and all of the other ways in which algorithmic capitalism can buy and sell our information and undermine our democratic institutions?

[Sami Khoury]

We definitely factor all of that into our threat assessment, but when we put out our advice and guidance, we pose a set of questions that we encourage Canadians and Canadian organizations, individually, to—

[Matthew Green, NDP, Hamilton Centre, ON]

I'm talking about the banning of an app on government devices. I'm not talking about your PR stuff with the public. I'm not interested in that.

We're here today on a very specific topic, which, for me, is why we're banning one social media outlet and not all of them. Would you not agree that Facebook, Twitter and Instagram also contain significant ways in which they scrape our data, control our likes, funnel us into different news streams, create echo chambers and, ultimately, create profiles on us?

Is that not correct?

[The Chair, Conservative, John Brassard]

We need a quick answer.

[Sami Khoury]

Mr. Chair, if you share information, that can potentially contribute to the data-mining exercise of whoever is at the other end of that data leak.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Green.

Thank you, Mr. Khoury.

That concludes our first round of questioning.

Mr. Gourde, you have five minutes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

I want to thank the witnesses for being here. We rarely have the opportunity to welcome witnesses with such significant responsibilities as these. Thank you for working to keep Canada secure.

I want to return to the issue of foreign interference during the 2019 and 2021 elections. Did your services have the capacity to detect interference during those elections?

[Sami Khoury]

I will begin and then my colleague can respond.

The role of the Canadian Centre for Cyber Security is to collaborate with Elections Canada to ensure that elections infrastructure is properly protected. That's what we did during the 2021 election.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

I'm trying to determine whether you had identified foreign interference, particularly messages on social media that didn't originate from a political party or a political entity, but rather that originated outside the country.

[Sami Khoury]

Our role is not to examine the content of messages exchanged. Our main role is to protect infrastructure.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

If I understand correctly, you didn't detect foreign interference. Had you done so, would you have been able to block that information? Would you have been able to say that the information constituted foreign interference and to not to consult it? Do you have the capacity to do that?

During the election, candidates noticed that there were messages coming out of nowhere. They could read them. If, during an election, Canadians can view those messages, but you're telling me that you can't, I have a problem. In principle, you're here to conduct surveillance. Tell me why you can't see those messages, but the average Canadian can.

[Sami Khoury]

I want to make a clarification. We don't view content because we don't have the mandate to do so. The role and mandate of the Canadian Centre for Cyber Security is to protect infrastructure and not to check content. Clearly, we're concerned with infrastructure security, but also with foreign interference. Our goal is to teach Canadians how to stay as informed as possible and where to get the most credible information. Generally speaking, that's our focus.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you.

On what date following the 2019 and 2021 elections were you made aware that there had been foreign interference during the election campaign?

[Sami Khoury]

Unfortunately, I don't remember the date. I apologize.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Would Ms. Henderson know the answer?

[Cherie Henderson]

Maybe I can answer this question. Thank you.

First of all, I'm going to start by saying that foreign interference does not occur only during an election. Foreign interference occurs all the time, every day, and I think we have to bear that in mind, because when you start to look at an election, which is a finite time frame, you're not going to always catch the foreign interference that's happening at that point. We start watching what's happening every day with regard to the buildup to an election, and we are constantly monitoring to see if there is any type of foreign interference coming from a hostile state actor.

When you're looking at a specific time frame and you're dealing with perhaps a social media attack, it takes a very long time to be able to figure out where that actually came from. You don't just flip a switch and already get it back to the country it came from or the threat actor it came from. It takes a long time for the intelligence services to put that work together and to follow that train back.

Also, when you're looking at social media, we do not monitor social media. You don't want your national intelligence service to monitor all social media. We have to make sure that we know there's a threat there, and then it comes under our mandate.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you.

I have a final question. It's one thing to know the origin of the attack, but knowing that the attack can influence Canadians and that it's illegal because the message isn't coming from Elections Canada is another thing altogether. Canadians are used to taking part in the electoral process. When that kind of attack occurs, it should be detected and condemned, and there should be a way to indicate that it's an attack and that those kinds of messages from outside the country should be ignored. Is it possible to do that?

[The Chair, Conservative, John Brassard]

I would ask the witnesses to provide a brief answer.

[Cherie Henderson]

We also have to guard freedom of speech. We have to educate across the board to make sure that we are guarding freedom of speech but also educating, at the same time, in regard to foreign interference. It's an extremely complex situation. It's not just determining that, yes, this came from a foreign state; we also have to make sure that it's actually causing an impact to our sovereignty and our national security. Then we start to educate across the broader sphere on that perspective.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Henderson.

Thank you, Mr. Gourde.

Mr. Bains, you have five minutes. Go ahead, please.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you, Mr. Chair.

Thank you to our witnesses for joining us today. I too would like to thank you for the work you do to protect Canadians.

Ms. Henderson, in terms of what you talked a little bit about, I'm a father of a teen and a preteen. We're all concerned about the youth of this country. We've learned over time how foreign states like Russia will work for a long time to try to influence a generation of people. You also mentioned that there are efforts to influence a whole generation of people.

Is that same practice now being followed by some of these other hostile nations that you talked about, whether it be China, Russia, Iran or North Korea? Are they copycatting? Are there developments of other applications that you think are in development to do that type of influence, such as with TikTok? We're now looking at TikTok and all these other social media platforms that are even based out of North America but are used worldwide. Are you monitoring other developments of other applications that we may not know of?

[Cherie Henderson]

We don't necessarily monitor the development of social media platforms. It goes a little bit back to what I said earlier, that I would worry that we would focus on one specific platform or two specific platforms. I think it's really important to start to educate everybody on really good social media hygiene. I don't know if that's a phrase, but I'm going to call it that. I think it's fundamentally important that every individual takes responsibility for what they're actually sharing and is aware of the cost and the impact that could have on them.

Therefore, if people are being aware and careful, then even if there are other media platforms, they're already in a good state of mind. They're protecting themselves. It doesn't matter if there's another platform developed, because they already have, again, good social media hygiene practices.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you.

Mr. Khoury, the CSE also alerts the government to foreign activities that seek to undermine prosperity and security, including cyber-threats, espionage, terrorism and kidnappings. Is intelligence also gathered or collected from social media platforms for these kinds of things?