Procedure and House Affairs Committee on April 29th, 2020

[Dr. Christian Leuprecht]

If I may, I would encourage the member to read the report by the Cyberspace Solarium Commission that was released by the bipartisan U.S. congressional commission in February, which is very thorough on all the challenges that the cyber domain poses for democracy.

While we're having very technical conversations about whether a caucus is secure and whether conversations are secure, think about the adversarial intent and it is relatively straightforward. One is to sow discord in our democratic societies by polarizing conversations. The other is to show that democracy is chaotic and dysfunctional in order to hold up authoritarian systems. In a virtual Parliament, we also have the opportunity to demonstrate that democracy does function and is resilient in times of crisis, in times of emergency, because people in Russia and China can stream the Parliament as much as we can in Canada.

I think we need to be much more broadly aware of the broader objectives of our adversary over the tactical sort of dimensions of “can the adversary extract particular aspects of data”, because the adversary every day is trying to discredit democracy and sow discord.

[Corey Tochor, Conservative, Saskatoon—University, SK]

Of those bad actors I can only imagine them hearing, be it government or opposition.... Probably government is where they could hear the juiciest details—what was being considered or a debate within caucus maybe. If the federal government had virtual caucus meetings—and I'm assuming they do—would that be one place for a bad actor in the world to learn juicier things and use them for economic reasons, or to destabilize? Would that be one of the juicier ways for them to hack into our Parliament?

[Dr. Christian Leuprecht]

One of the concerns about data being routed through servers in adversarial countries is that it opens up that data to greater vulnerability, for instance, the technology, the data assurance component. Really, it is about being able to discredit parliaments, the political executive and the way we function.

I actually think that demonstrating—with some reservations about what is discussed—the ability to continue to meet as a Parliament sends the strong message that I think we have not sent sufficiently enough, which is that democracies are actually more resilient than authoritarian systems. What is the answer to these adversarial actors to convince both the adversarial actors and Canadians that democracy is where they should be placing their faith, rather than with authoritarian systems? Parliament is the answer to that question.

[Corey Tochor, Conservative, Saskatoon—University, SK]

Along those lines, as technology changes and improves—and this is why I asked Ms. Bernier whether she would feel more comfortable with that statement today than two years ago—so will the other bad actors in the world. Things are never static. They're going to find new and unfortunate ways.... If you think about the last 10 years, bad actors have influenced other world elections with emails, and how safe did we all think emails were, depending on the server and all that comes with that? It'll be the next step. There are additional steps we can take to make it secure, but similar to anyone who builds a fence to keep people out, people will just find taller ladders to climb the fence.

[The Chair, Liberal, Ruby Sahota]

Thank you, Mr. Tocher. I wanted to allow you time to finish your thought, and I have been trying to allow you to finish, but can you wrap it up?

[Corey Tochor, Conservative, Saskatoon—University, SK]

Generally, if you were looking at technology to be the solution out there, along those lines, how long would it take to develop something? You talked about having separate servers and separate dedicated lines for parliamentarians. Are we talking two weeks, two months or two years to get it somewhere where you would be comfortable?

[The Chair, Liberal, Ruby Sahota]

That's all the time we have. Maybe we can get that answer another time, but I think Mr. Leuprecht was able to hear your question, at least.

Next we have Madam Petitpas Taylor.

[Ginette Petitpas Taylor, Liberal, Moncton—Riverview—Dieppe, NB]

Thank you, Madam Chair.

I would like to take the opportunity as well to thank our witnesses for being with us this evening. It's always great to receive your feedback and your insight regarding this very important topic that we're studying.

As we all know, Canadians, including parliamentarians, are really trying hard to follow public health measures by staying home and working remotely. As we've heard this evening, many of us are using different platforms and different tools, and it's been quite successful for the most part, but we are also hearing concerns about cybersecurity. I know that on a daily basis we hear the words “threats” and “vulnerabilities”, and we've heard that many times this evening.

My question would probably be for Madame Bernier and perhaps Monsieur Turcotte.

What questions do you think we need to ask ourselves to ensure that we're respecting privacy concerns and security concerns in the virtual meeting part of it?

Madame Bernier, you also spoke about working remotely, and that really piqued my curiosity. I'm wondering if you would be able to elaborate a bit on that as well, as to what we should be doing and asking ourselves.

[Chantal Bernier]

Exactly, and as you have heard me say, I encourage you, first of all, to have a conversation with your staff. What is each of them doing to ensure that they protect information security in the context of their home? There are very specific ways to protect it. I gave you some. They are based on the major risks that we have seen through years of seeing issues. We've seen laptops lost. We have seen files left on a bus. I'm speaking of what I've seen in my five and a half years at the Office of the Privacy Commissioner of Canada, and now five and half years as external counsel.

I can tell you that there is a lot of very good, practical literature out there that really states, “These are the risks on the basis of what we've seen most often, and these are the ways to mitigate the risk.” I would encourage you to look at that very helpful literature.

[Ginette Petitpas Taylor, Liberal, Moncton—Riverview—Dieppe, NB]

Thank you, Ms. Bernier.

I don't know if Monsieur Turcotte wants to—

[Martyn Turcotte]

I'm going to echo what Madame Bernier just mentioned, but also from a technological point of view, it is important, I think, that most of the systems, if they are hosted, be self-hosted or in-house, within the organization. That's going to increase.... It doesn't mean that it's necessarily going to be perfect, but at least it's going to increase the security aspect of it, as you have full control of the infrastructure. That's one part.

The other part is in terms of mitigation. It was mentioned previously that guidelines and procedures need to be adapted. Cybersecurity is not necessarily just technology. It can be caused by humans, so having proper guidelines and procedures in place is also going to help. People need to understand their environment, so that's going to come with time and practice. The different settings and different functions that are available within the different tools you are going to use are also different types of measures or safeguards in place.

[Ginette Petitpas Taylor, Liberal, Moncton—Riverview—Dieppe, NB]

Thank you.

This is perhaps my last question. How would you suggest we stay current on the cyber-threat landscape, on what we're facing right now?

Perhaps Madame Bernier, Monsieur Turcotte and also Monsieur Leuprecht could respond.

[Chantal Bernier]

The challenge is that every day, almost every minute, one.... Ian Kerr, a professor at the University of Ottawa, who passed away last summer, sadly, and who was truly a great thinker on these subjects, used to say that when the technology is current, it is already out of date. I smiled when I heard your question, because you're referring to my everyday challenge. I constantly have to learn, because it's changing so fast.

What I would tell you is that there is a shortcut, and the shortcut is to make sure that you have a cybersecurity expert at the ready and that you have the right questions, so that what you have, then, is a good framework of what your risks are. If you know that, then you may not have the answers but you have the right questions.

You put it to them, and they will, as Monsieur Turcotte was saying earlier on, align the safeguards to the risks that you have identified.

[The Chair, Liberal, Ruby Sahota]

Okay. That's all the time we have. Thank you so much.

Next up for questioning is Mr. Duncan.

You have five minutes.

[Eric Duncan, Conservative, Stormont—Dundas—South Glengarry, ON]

Thank you very much, Madam Chair. I have a couple of questions, maybe as a bit of background.

Ms. Qaqqaq, I can relate to you about Internet connectivity, but probably not on the same scale that you have or in terms of the challenges you have in Nunavut. At our committee meeting last week, I was on a passionate rant to my colleagues and felt like I had their support about halfway through, when all of a sudden I was cut off and had to reconvene, right in the middle of a House of Commons committee.

One of the questions I have about connectivity when we talk about procedures and all that—and maybe Ms. Ashton can speak about this as well—is that it's important for us to understand time frames, not necessarily just for ourselves as members who may have challenges but for provincial colleagues or municipal elected officials and some of those essential services.

A fix for this, for having quality Internet access in your riding accessible to you, is not something that's going to take a couple of weeks. We lack a lot of infrastructure. Can you give some details from your community on how far we really need to go to get that parity, whether it's for you individually or members of your community in your hometown?

[Mumilaaq Qaqqaq, NDP, Nunavut, NU]

Yes. Thank you for that.

To go back to what Ms. Ashton was saying, this is all so connected and intertwined with everything else. The hydro-fibre link I mentioned is also an opportunity to have a road that goes from Manitoba into the territory to a select number of communities. They're looking at similar projects over in the west, in the Kitikmeot region. In order for us to start talking about other options, we also need to be talking about things such as housing, infrastructure and accessibility to transportation.

All of these things are impacted by the lack of services. We need them in order to really increase the services, really make an investment, really make a push and really see change for the opportunity for connectivity.

[Eric Duncan, Conservative, Stormont—Dundas—South Glengarry, ON]

Timeline-wise, you would say realistically that if we had these plans and dollars announced tomorrow, it would be months, if not maybe years, to get those communities physically connected with the fibre and what's needed.

[Mumilaaq Qaqqaq, NDP, Nunavut, NU]

I would argue that. I think we move as fast as the federal government allows us to. We saw, for example, that when the distant early warning system was put in place, the DEW line sites across the north, it took less than two years, I think.

When we hear how things are going to take years and years, that's not true. It's only because we don't have the funding and we don't have the services. As a people, we're not treated as a priority.

I think you definitely have a fair point, though. We hear that it takes a lot of time. Realistically, it doesn't need to, but this is where we're at.

[Eric Duncan, Conservative, Stormont—Dundas—South Glengarry, ON]

Ms. Ashton.

[Niki Ashton, NDP, Churchill—Keewatinook Aski, MB]

Thank you for your question.

Just in reiterating some of what my colleague Ms. Qaqqaq said, I think what's needed here is political will. We've seen some unprecedented investment from the federal government in recent weeks to deal with the crisis that we have in front of us right now. As I pointed out in my presentation, this crisis sheds a very bright and unflattering light on the digital divide that we have. This is deeply linked to access to health care services, access to government services and access to fundamental education.

We can do this. We have the ability to do this. I appreciate your point that we're not the only representatives who are in the same bind. Three of my provincial colleagues also live north of the travel restriction here and should not be travelling to the south, if it can be avoided, to attend the legislative assembly.

Again, though, this is a question of access to an essential service, not just for us as MPs but also, very importantly, for the citizens we represent.

[Eric Duncan, Conservative, Stormont—Dundas—South Glengarry, ON]

[Technical difficulty—Editor] health care, education, and the list goes on, as you both mentioned. Thank you for your comments.

Dr. Leuprecht, we've met before, through the Eastern Ontario Wardens' Caucus. You had done a great report on policing sustainability.

For my first question I wanted to ask you maybe what you gave Mr. Gerretsen in the class you had with him. However, I'll pass on that and ask you to build on your comments about the parliamentary aspect. I respect what you say when you note that Parliament is open, transparent and on TV, in terms of the security risks there. My concern goes more to what Madam Normandin of the Bloc talked about, the caucus aspects and some of those in camera and behind the scenes stuff that are an essential part of seeing that public face of Parliament. I worry about some of those security aspects. I liked your line about building the plane while flying it, and agree that technology may not be the challenge as much as the human dynamic.

We have Zoom, for example, and we've been rolling these processes out. Do you not think that might be a human issue and not a best practice, at times? Yes, we want to get here quickly, but when you talk about the protocols, the connectivity and the devices, and those questions that you want to ask in a contract you would have with a company, do you not agree that perhaps as humans right now, who are rushing to do this, these might not be best steps, or maybe there's a higher risk of having the challenges of hacking or accessing our software outside of these programs?

[Dr. Christian Leuprecht]

There's—

[The Chair, Liberal, Ruby Sahota]

That's all the time we have. I'm so sorry.

[Eric Duncan, Conservative, Stormont—Dundas—South Glengarry, ON]

Sorry.

[The Chair, Liberal, Ruby Sahota]

At least you got your question on the record. That was a little bit over time—