Evidence of meeting #122 for Procedure and House Affairs in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was colleagues.
A video is available from Parliament.
Chief, Communications Security Establishment
I can assure you that it's not because I don't wish to share the information. It is because I wasn't personally present at the time when we were having some of these exchanges with the House of Commons IT security team—
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
Okay—that's good enough. I did ask this question previously, and I was told you could get back to us. You're back and you still aren't able to answer. Would you undertake to provide a response to this committee in writing, specifically regarding caveats, within two weeks?
Chief, Communications Security Establishment
We'd be happy to be able to answer the question in writing. We are waiting for the official taskings out of the last time I was present at PROC to be able to answer all of the other questions that were also asked of us.
Conservative
Chief, Communications Security Establishment
I suspect that we should be able to do that, Mr. Chair.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
Thank you.
I asked you a series of questions in my first round about what you communicated with the House of Commons. I noticed something afterwards when I was reviewing this. I asked if you informed House administration about the source of the attack. You said you had informed them about “what we believed at that time to be the originating source of the threat”.
I asked you in follow-up, “You shared, with House of Commons administration, the source of the attack—this being APT31”. Then your response changed. You suggested that we go in camera. You variously dodged the follow-ups. At no point did you confirm that APT31 was identified to House of Commons administration as the threat.
I want to press that point, because I noticed that you didn't answer about APT31 specifically. Did you at any point inform House of Commons administration that APT31 specifically was the source of the attack?
Chief, Communications Security Establishment
Mr. Chair, when we started the conversation with the House of Commons, it was in 2021. It's very possible that at that time we were not calling this actor APT31. What we were sharing with the House of Commons was what we were, at that time, understanding to be the originating actions and the threat actor, which we now have come to know as APT31. What I cannot confirm and guarantee is that at that time we were calling it APT31.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
At what point in time did you mention APT31 specifically to House of Commons administration? It was not in 2021, it sounds like. Was it at some point in the future, or never?
Chief, Communications Security Establishment
What I'm understanding is that we did eventually come to confirm to the House of Commons that this actor was APT31. What I'm saying is that originally, when we started to understand the actor, we may not have called it APT31.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
When did you identify the actor to the House?
Chief, Communications Security Establishment
My understanding, based on the exchanges we've had with the House of Commons and the presentations we made collectively with CSIS, is that it might have been around February 2021 that we then may have alluded to that being the possible actor, by that name.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
You named or you think you might have named APT31 in February 2021.
Chief, Communications Security Establishment
In the presentations that were done by us and CSIS and the House of Commons—
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
I'm almost out of time. I'd just like a yes or no.
Chief, Communications Security Establishment
—there was a series of documents shared with the IT team, and one of those documents outlines that the actor could be APT31.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
It could have been. Okay.
This is the problem we have with the government's narrative. They said House of Commons IT was told and they were supposed to tell MPs, but you said there may have been caveats. You can't confirm whether there were, but there may have been caveats. You also can't confirm whether the House of Commons was even told that APT31 was the source of the threat. How in the world could House of Commons IT have informed members of Parliament if there were caveats and if they weren't informed who the source or the actor was?
We've had you here twice. We've asked you specific questions about that information being passed along. You haven't been able to answer. You've told us that there might have been caveats; the information might have been shared, or it might not have been shared; it might have been in a document, but you're not sure which document; and you're not precisely sure of the timeline.
Do you see how this—
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
—completely blows up the government's claim—
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
—that the House of Commons IT was properly informed?
Liberal
The Chair Liberal Ben Carr
Mr. Genuis, if there is a question, I will afford Ms. Xavier a moment to answer it.
Conservative
Garnett Genuis Conservative Sherwood Park—Fort Saskatchewan, AB
I think the point is clear, but I would welcome a response, if there is one.
Liberal
Chief, Communications Security Establishment
Mr. Chair, what I've made clear and what I'm trying to emphasize is that when you're dealing with cyber-incidents, at the beginning you may not know all the details. Eventually, as you continue to have the back-and-forth conversation with the service provider, more clarity comes to be, especially when there are exchanges of the logs.
At the time, we may not have originally known it was APT31, but in the exchange of information we had with the House of Commons, there was sufficient information provided for them to know what the issue was that was at risk and what actions they needed to take to mitigate—
Conservative