Government Operations Committee on May 25th, 2020

[The Chair, Conservative, Tom Lukiwski]

I will call the meeting to order.

Welcome, colleagues. This is meeting number 14 of the Standing Committee on Government Operations and Estimates.

The meeting will last from 5 p.m. to 7 p.m., and the minister, I understand, will be with us for only the first hour. Her officials will be able to remain in the meeting until 7 p.m.

The committee's next meeting will take place this Friday from 11 a.m. to 1 p.m., eastern standard time. We have not yet received information about next week's meetings from the whips. As soon as we have that information we will be sending that out to all committee members directly.

I will go over a couple of the quick procedural and housekeeping matters.

We will go to a full complement of questions using the six-minute, five-minute, two and a half minute rule that we've established. That should give us adequate time to get all of the questions in, but we will be suspending, or at least excusing, Minister Murray at 6 p.m. sharp and then going on to a second full round of questions with the witnesses at that time.

I would ask that if you are making a statement or asking a question, you begin and please continue in one official language. I would ask that you do not alternate between French and English because we have had, over time, some technical difficulties when we've switched between the two. If we can do that, I think it would make for an easy facilitation and a much quicker meeting, because we won't have to worry about getting interrupted by our technicians.

With that, colleagues, I think you all know the drill.

Madam Minister, it's good to see you once again. The floor is yours for what I believe will be a five-minute opening statement.

Minister Murray, please go ahead.

[Joyce Murray, Liberal, Minister of Digital Government]

Thanks so much, Mr. Chair. It's good to see everyone virtually.

I'm pleased to appear before this committee from my home in the traditional territory of the Coast Salish peoples. I'm joined today by Paul Glover, president of Shared Services Canada; Raj Thuppal, SSC, senior assistant deputy minister for networks, security and digital services; Marc Brouillard, acting chief information officer of Canada; and Scott Jones, head of the Canadian Centre for Cyber Security.

Mr. Chair and colleagues, as Minister of Digital Government, I'm leading the Government of Canada's digital transformation. My mandate is to provide public servants with the tools they need and to deliver the digital services Canadians expect. This transformation is critical for the government to keep pace digitally, and as the pandemic has shown, it's more important than ever that we have secure, reliable and easy-to-use digital services to make sure that no Canadian is left behind.

It has been about 10 weeks since our government took the unprecedented step of asking federal employees to work from home, and to support this, the digital teams right across government stepped up their efforts to ensure the public service could continue working safely and effectively, because our government's first priority is to continue serving Canadians.

I have been so impressed by the work of Shared Services Canada, the office of the chief information officer and the Canadian Digital Service have been doing to ramp up our digital capacities almost overnight. SSC has been working to maintain IT support for efficient and secure delivery of critical services as citizen needs escalate, and this in addition to supporting an unprecedented increase in public servants teleworking from their homes. I can't express enough the magnitude of this work and I thank all of the public servants who've been doing it.

SSC expanded networks, boosted services and provided equipment and tools so employees were able to continue to deliver critical services while working from home. They also enabled WiFi-calling so that employees could call and receive calls where there was poor cell service, and they increased departments' Internet capacity, in some cases up to 300%. They nearly doubled government's secure remote access capacity so that we can currently have up to 270,000 simultaneous remote connections. SSC also tripled the ability of the CRA to manage the flood of Canadians applying for the Canada emergency response benefit and the emergency student benefit.

The Canadian Digital Service has also been helping with digital responses right across government. They created a digital tool kit, helping departments recruit tech staff and access a library of open source code solutions—and how to use them—and helping citizens navigate the multiple benefits that are available and sign up for secure notifications about COVID-19 from Health Canada and other ministries.

The office of the CIO has been working across government to provide guidance on COVID-19 IT challenges, making sure that private sector offers of help are assessed and connected quickly with departments as well. To keep information safe, this office has helped all federal employees make telework more secure and provided best practices for using digital tools safely.

Disruption attracts cybersecurity challengers and we're very aware that increased and new uses of digital tools carry the risk of malicious cyber-activities. Cybersecurity is and will continue to be a high priority for our government as we safeguard Canadians from cyber-threats. Let me assure this committee that we are constantly monitoring, detecting and actively neutralizing cyber-threats, and that we coordinate events effectively through the Government of Canada cybersecurity event management plan.

Shared Services Canada has increased the overall security of the government through services such as perimeter defence, vulnerability management, supply chain integrity and an integrated cyber and IT security program to protect the infrastructure supporting departments and agencies.

To combat COVID-19 misinformation and fraud, the Canadian Centre for Cyber Security coordinated with industry partners to help remove thousands of fraudulent websites and email addresses that could have been used for malicious activity.

In conclusion, every crisis can be an opportunity to change for the better, and this pandemic is no different. In short order we have seen a move towards collaboration across all orders of government and industry. We've adopted digital solutions to unprecedented challenges at unprecedented speed, and we're doing it safely. I thank all our public servants for their Herculean efforts in this digital response.

Thank you. We'll be happy to now take your questions.

[The Chair, Conservative, Tom Lukiwski]

Thank you very much.

We'll now go to Mr. Aboultaif, for six minutes, please.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Good afternoon, Minister. I hope you are keeping well with your family.

There was a story that came out showing hundreds of thousands of credentials being hacked from Zoom. There was a story also about Skype, some actual videos being stolen for external analysis where the users were unaware.

We've been using Zoom, as well as other methods such as Skype. How are we protecting sensitive information from being hacked or communicated over video chat? How are we making sure that sensitive information is not going into the wrong hands?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

First, we understand that during a time of pandemic there are always those who look to take advantage of the crisis, and we're taking every precaution to ensure that Canadians and our systems are protected.

You refer to Zoom. In particular, I understand that the House of Commons is using zoom for virtual Parliament. It's widely known to be an insecure application, of course, but it is not used in the public service nor with Parliament for anything that is required to be confidential. It is only for matters that can be discussed and dealt with in the open that Zoom and that type of public tool are appropriate.

We have been providing guidance to public servants on what the appropriate tools are for which type of activity in supporting Canadians.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Minister, a lot of public servants are working from home, from politicians to everyone else. Different departments are operating from homes and there is some sensitive information being exchanged back and forth.

Are you aware of any sensitive information being leaked, or have you received any complaints of any kind or any reports of such an incident?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

Mr. Aboultaif, I'll ask my officials to add to my answer because they will have more information about details, but I am not aware of any breaches.

We have rapidly increased the capacity of the secure networks to be able to support the public servants working from home. In fact, before this pandemic emergency, an average number of secure remote connections at a single point in a day was about 40,000. We are now up to 200,000 such connections, which means that there was a very fast and very effective transition to public servants working from home through secure networks. There have also been secure cloud-to-ground networks created for other types of specific work.

It's an important question and I think the public servants have been doing a great job to protect the integrity—

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Minister, was any cybersecurity assessment done before we used Zoom, and since when has any Zoom application been used by the government in any capacity?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

The answer is yes. Zoom is being used by government employees but only in circumstances where their communications are public, or can be public. For anything that is restricted or confidential, Zoom is not used. The chief information officer provides clear guidance on that, and again, I invite my officials to add.

I know in this format it's a little more difficult, but if there is anything they have to add, I welcome that.

Paul.

[Paul Glover, President, Shared Services Canada]

Thank you, Minister.

We have definitely done security assessments of all the different pieces of software to make sure their uses were appropriate. That is what translates into the guidance that the minister referenced, which the chief information officer then communicated to all departments.

We have provided departments with secure remote access so that their employees, when working from home, when they need that secure access, have that available to them. Because there were limits in the early days to the amount of bandwidth and secure remote connections, we also made unsecured channels available so that we could optimize the channels for what was secure and what was non-secure. We continue to do that every day.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

I have a quick question.

Definitely there were some breaches—I will verify—if I understood correctly the minister's aide. Was there any exchange of intelligence with other partners such as the Five Eyes, for example, on incidents happening to us or happening elsewhere within our allies?

[The Chair, Conservative, Tom Lukiwski]

Please give a very brief answer.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

We're continually monitoring, and yes, the Centre for Cyber Security, which my ministry is a partner in, works closely with the Five Eyes to identify threats.

[The Chair, Conservative, Tom Lukiwski]

Thank you very much.

We'll now go to Mr. MacKinnon for six minutes, please.

[Steven MacKinnon, Liberal, Gatineau, QC]

Thank you, Mr. Chair.

I'm delighted to see my colleague the minister and the people who are with her today.

I'm extremely proud of what these people have been able to accomplish in terms of resources, having visited Shared Services Canada. The progress we're seeing at Shared Services Canada is quite remarkable. So, Madam Minister, I want to acknowledge the success of the men and women at Shared Services Canada who have provided public servants with access to the secure networks and technological tools they needed to maintain services to citizens during this crisis. I know that Shared Services Canada has often been the target of criticism, but this time it is showing us the way forward. We are very proud of what these people have been able to accomplish.

I'm sure my colleagues don't always appreciate that we highlight the success stories here, Madam Minister, but I think it's important that the women and men of our public service are recognized for the incredible work they have done.

There's a lot of talk lately that everyone is going to be able to work from home. We'll be able to empty all of our downtowns and no one will ever have to go back to the office again.

Minister, you've been working very hard on technology-enabled workplaces. That's work that goes on with Public Services and Procurement Canada as well, with respect to enabling flexibility, enabling unassigned workplaces and enabling the kinds of workplaces that we're really going to need going forward, and doing so in part using technology. Maybe we could have the benefit of your thinking on that.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

Thanks, Mr. MacKinnon.

There has been certainly commentary in the public about the emergency we've been responding to with so much increase in digital tools and secure digital tools, and how that will translate into changes post-COVID. We are certainly thinking about what might be a strategy for going forward post-COVID.

I think we've all been surprised, and pleasantly surprised, as you mentioned, by how quickly we as a government were able to continue to serve Canadians, and not just that, ramp up service. As we know, almost a million Canadians applied for the CERB on day one.

I see this as a continuum. From 2018's budget of over $2 billion over five years there has been a very concentrated effort to have a more integrated approach to our information storage use and our digital government. That was an SSC budget. There has been a half a billion dollars put into the whole arena of cybersecurity and the creation of a collaborative approach to cybersecurity, which is really serving us very well as a government right now. On some of those building blocks of addressing the old data centres and migrating them, I think about 40% have now been migrated to modern data centres and the cloud.

Some of these fundamental pieces that may have not been given the attention they deserved over the years have really been a key focus of this government, which is what the ministry of digital government is all about. It's to continue focusing on better serving Canadians. Really, what we know is that it just is not good enough if the only channels the public has to get service from their government is through downloading PDFs and faxing documents, or potentially standing in line and waiting to see someone.

[Steven MacKinnon, Liberal, Gatineau, QC]

We've moved it into the modern era.

I know Mr. Chair's going to cut me off very soon, but I just want to perhaps point out or even ask.... We've spent a lot of time doing things as basic as putting WiFi into the new GC workplace standard, so that public servants across departments can collaborate and come together in new, modern workplaces and are able to use technology to unleash creativity. That's going to be an important part of the mix going forward as well. I'm just wondering if you have any closing thoughts on that, if we have any time left.

[The Chair, Conservative, Tom Lukiwski]

Unfortunately, we do not have any time left.

[Steven MacKinnon, Liberal, Gatineau, QC]

All right.

[The Chair, Conservative, Tom Lukiwski]

Since there was an open-ended question, Minister, if you care to respond to Mr. MacKinnon, I would ask you to do so in writing as soon as possible and send that response to our clerk.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

That's excellent.

[The Chair, Conservative, Tom Lukiwski]

Ms. Vignola, you have the floor for six minutes.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Thank you Mr. Chair.

Good evening, Ms. Murray.

Indeed, the pivot that employees performed in recent months has been dramatic. Nonetheless, we will have many questions in this regard.

On May 8, the Acting Chief Information Officer told the committee that there was ongoing monitoring of the federal government network by the Communications Security Establishment.

What are the greatest risks, the major threats, to the federal government network? How is the federal government mitigating these risks and threats?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

Thank you for that question, Madame Vignola.

I think one key is that we have an integrated approach to threats. There may have been a previous day when each of the ministries had to deal with its cybersecurity threats. We have a very collaborative approach right now, and that's through the Canadian Centre for Cyber Security.

One example of how this works well is in the creation of the new benefits, which happened so quickly, for example the emergency response benefit. There are cybersecurity officials who are monitoring that application to make sure there are no vulnerabilities and there are no attacks that succeed in disrupting our service.

It's a very collaborative approach. Each of the ministries has a clear and separate responsibility with respect to preventing and responding to cybersecurity threats and attacks. I think it has been working very well.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

In your speech, you referred to fraudulent websites that were copying Government of Canada sites. How many of these websites have been detected? Were they all shut down?