Thank you, Mr. Chair.
When you have classified intelligence reporting, there's a lot of context and information, and then there's often a tear line, so there is another set of information that you can provide to an incident responder or to another organization to enable it to take immediate action in resolving an incident. In the lead-up to the incident, we would be sharing tear-line information: “Here is a sophisticated threat actor,” which, in cybersecurity terms, typically means a nation-state and is super important. It definitely reinforces the seriousness and the importance of the event.
However, all we're allowed to share, because of the intelligence, are the technical indicators. We didn't have the email addresses, so we would share the things that would be needed to find the email addresses. That's what we shared with the House of Commons, and we worked with the House of Commons collaboratively to figure out exactly what was going on, because typically you have a thread you need to pull.