Government Operations Committee on Nov. 25th, 2020

[Matthew Green, NDP, Hamilton Centre, ON]

Why is that the case?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

May I ask Marc to talk about the planning of—

[Matthew Green, NDP, Hamilton Centre, ON]

Before you do that, you touched on something that was flagged 10 years ago, which is kind of what I got to at the beginning of my question, which is that we knew there were some vulnerabilities. We're in an act of God, as it were, from a COVID perspective and having to shift all these people offline. A lot of people are furloughed, couldn't get the connection and can't necessarily work.

If it was flagged 10 years ago, I'm wondering why more significant investments had not been made that may have offset some of the challenges we face in COVID?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

I will not speak for the previous government, but that is the period in which there was really—

[Matthew Green, NDP, Hamilton Centre, ON]

You've been the government for four years prior to this, respectfully, so could you speak to that?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

That's right. Thank you for pointing that out.

The flags were from 10 years ago. We began investing in 2016, and we have made historic investments in upgrading IT, including $2.2 billion in 2018. It takes time with an enterprise with the complexity and size of the Government of Canada, and the number of people we serve.

[Matthew Green, NDP, Hamilton Centre, ON]

Yes, thank you.

You'll appreciate that the reason we're so terse is that we have six minutes and then it stops, and so the longer you talk, the less time we have to ask further follow-up questions. That answer suffices.

Would it be possible to know what the pandemic has revealed about the technological capacity of our government services? What are the specific limitations that our technological capacity has been exposed to during COVID?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

I'd like Marc Brouillard, CIO, to tackle that, because he can also talk about what things were imagined before and answer your question about planning for disasters.

[Marc Brouillard, Acting Chief Information Officer of Canada, Treasury Board Secretariat]

The way the government plans for these types of disasters is through our business continuity planning exercises. These are done at the departmental level through the identification of critical services. They aren't necessarily related to or require foreknowledge of what the event will be. The fact that we have a snowstorm, a flood or a pandemic that keeps people from being in the office, all will have the same results—

[Matthew Green, NDP, Hamilton Centre, ON]

I have a quick supplementary on that. Is there an audit of the departments? Are you actively going out and seeking who is doing this and who is not? Is it like a fire drill? Perhaps some departments are lax, and if so, when is that revealed?

[Marc Brouillard]

We evaluate which departments have identified critical services and whether they have business continuity plans and have tested those plans.

[Matthew Green, NDP, Hamilton Centre, ON]

What's the pass or fail on that?

[Marc Brouillard]

I don't have the exact numbers. We can get you that information.

[Matthew Green, NDP, Hamilton Centre, ON]

Do you think we can do that between now and my next round of questioning??

[Marc Brouillard]

I don't know.

The point is to make sure we are ready for the unforeseen. We don't know what the next event will look like, but we do know what critical services have to be up and how they have to be up.

To answer the second part of the question, the way we do that is by making sure we plan for resiliency in the systems and the infrastructure, and the work that Paul and Shared Services are doing to make sure the core infrastructure is also modernized. One of the things we've seen is that legacy, underinvested technology breaks, typically at the wrong time, so we have to make sure that our systems are well maintained and well cared for so they deliver on the services for Canadians.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much.

[The Chair, Conservative, Robert Gordon Kitchen]

Thank you, Mr. Green.

We've finished our first round. We'll now go to the second round.

We will go with five minutes, starting with Mr. Lloyd.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

I'm going to continue on the same stream as Mr. Green. I read recently in the Wall Street Journal that China is working on the Manhattan Project of the digital age, namely the race to develop quantum computing.

Does the minister understand the risks of quantum computing and can she tell the committee what actions the government is going to take to address this significant security threat?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

Thanks for that question.

We're very actively looking at how to have artificial intelligence and other more modern uses of data to make decisions and to analyze situations and to be responsible. We have a directive on responsible use of AI for the Government of Canada. The Canada School of Public Service just hosted a meeting with public servants who are involved with AI to discuss all of the issues around responsibility, safety, privacy and appropriate use of technology in artificial intelligence.

I'd happy to have Mr. Brouillard add to that if you have—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Minister, thank you. I appreciate that. You talked about artificial intelligence, but my question was on quantum computing and the risk of quantum computing being used to break all encryptions on any encrypted software, whether it involves Canadians' private data or government's data. I want to know what your understanding is regarding where Canada's at with quantum computing and what actions the government is going to take to protect Canadians' security.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

Quantum computing is also an emerging industry here in Canada, actually right in Vancouver. As we do for any other new technologies, we need to make sure that they're used responsibly. I think Marc can talk about the cybersecurity issues that you're raising around quantum computing.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

I think you can agree that we should be using it responsibly, but we're talking about sometimes hostile state actors using it against Canadian security systems. What is the government doing to increase protections for Canadians against the risk of foreign state actors using quantum computing against Canada?

[Joyce Murray, Liberal, Vancouver Quadra, BC]

We are continually upgrading our systems. Our perimeter has been very effective in keeping out attacks. We'll continue investing in that.

We have a whole-of-government approach to cybersecurity, which has worked very well. The Centre for Cybersecurity has our CIO, SSC, as well as CSE as the key drivers. We have cybersecurity event management plans in which it's very clear, in an almost military way, what to do should there be a breach. I will ask Marc if there is a specific aspect related to quantum computing that he can discuss.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Minister. I think I'll follow up with the officials in the next round of questioning.

On the question of security, we're about to undergo a huge logistical challenge with the distribution of vaccines across Canada. We're living in a digital age and we know we're going to need to use digital systems to facilitate this distribution. What actions is the government taking proactively to ensure that our distribution networks are not attacked by organized crime or any other hostile actors who might try to use ransomware to seize up the system and delay the distribution of vaccines to Canadians? What work is being done today to ensure that doesn't happen? That's a gold mine for organized crime.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

We do have a supply chain integrity process in place to protect us. My ministry has a core responsibility to protect Canadians' information, and I take it very seriously. I must say that, as it is with any large organization, the Government of Canada's systems are constantly under attack using illegally acquired information, logins or other means to try to access our information. We are continuously finding ways to boost our security and we're supported by CSE, which has—