Procedure and House Affairs Committee on Sept. 26th, 2024

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Both of you, Mr. Shull and Mr. Wark, have come before the defence committee before, where where we've had conversations. It's good to see you in another committee.

We had important conversations about how social media giants are being weaponized against Canadians as well. We're seeing social media bots taking over. Of course, algorithms that are written specifically to make as much money as possible, and advertisements that are surrounding those algorithms, are driving Canadians potentially down a specific path, and there is an ignorance or a denial of that by social media giants.

What do you think government needs to do in order to manage that in a different way than we have before?

[Dr. Wesley Wark]

Ms. Mathyssen, that's a very difficult question. I guess my first response is that I'm not sure governments have the primary responsibility in this regard. I think it's up to all Canadians to be educated about the nature of these kinds of threats and to exercise good judgment to the extent possible.

Regulating social media companies, particularly foreign giants, is a complex task. There are things that can be asked of social media platforms in terms of their own self-monitoring of malicious information and making more transparent the nature of their business enterprise so that we all understand what we're being subjected to. That would be helpful.

It's not consistent around the world, but generally the approach has been, so far, to try to work in partnership with social media companies. Perhaps we'll find that it's not going to work entirely satisfactorily, but it's going to be a difficult business, because they are giants.

[Michel Juneau-Katsuya]

There's a counter-discourse that needs to be developed from the government—

[The Chair, Liberal, Ben Carr]

I'm sorry, Mr. Juneau-Katsuya. Be very quick.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

I'm sorry. Can he finish his sentence, just because of that disruption?

[The Chair, Liberal, Ben Carr]

Yes, he can.

Go ahead.

[Michel Juneau-Katsuya]

I totally agree that social media is currently weaponized, and with the arrival of artificial intelligence, this is going to be even worse. We definitely need to pay attention.

When it comes to cybersecurity and the element of Parliament, what is currently happening is that there's a lot of radicalization taking place, because some foreign countries are using social media to influence certain groups. The polarization that is taking place turns onto our streets, where we have MPs being assaulted by people, and that is happening in cyberspace as well.

That's the reason why we need to pay attention and to develop a stronger discourse—a counter-discourse to what's currently happening.

[The Chair, Liberal, Ben Carr]

Okay, thank you very much.

Mr. de Pulford, I just wanted to note that I know you've raised your hand a few times. The rules stipulate that, unfortunately, unless you are recognized by a member, I can't cede the floor to you. I just wanted to provide that clarification. Perhaps in the line of questioning to come, you'll be called upon, but I just wanted to offer that.

Mr. Cooper, the floor is yours for five minutes.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Thank you very much, Mr. Chair.

Mr. de Pulford, you noted that two politicians were successfully compromised. For clarification, was this part of the same APT31 progressive reconnaissance attack?

[Luke de Pulford]

Thank you for your question, Mr. Cooper.

We do not know, because we don't have evidence of that. I put that question directly to the FBI, and this is what they said: “We have no data showing whether the APT group took any additional targeting actions after sending the initial tracking link emails, but based on our cumulative knowledge, it would be assumed there would have been follow-on efforts by the cyber-actors to target those accounts.”

We don't have evidence of it, but I'll give you the timeline. They were successfully compromised two months after the progressive attack had begun—the pixel reconnaissance attack in January 2021.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Thank you for that.

You also indicated in your testimony.... The position the Government of Canada has taken was to say, “Well, these 18 parliamentarians weren't informed, but to some degree, it's not really that big of a deal because the attack was successfully thwarted.” You stated that this position is, if I heard you correctly, “questionable at best and misleading at worst”. Can you perhaps expand upon that?

[Luke de Pulford]

Yes, absolutely. I would like to say, very quickly, that people from all parties in Canada were attacked in this attack. The attackers didn't care which parties they were from.

However, I do not believe it is correct to say that the attack was unsuccessful. In fact, we've already heard from one of the other witnesses today that because they do not know what happened with Mr. Genuis's personal account, they cannot assure us that the attack was unsuccessful. It is simply not possible to say that.

Not only that, but, technically speaking, it's very difficult to ensure that anyway, for the following reasons: Many parliamentarians around the world were told these were low-level, unsuccessful attacks, like marketing emails. That in itself is not incorrect. Pixel embedding or pixel tracking is very common. However, in the hands of a state-sponsored hacking group like APT31, it's very different.

Very briefly—I know I don't have much time—what they can do is triangulate where that person is from. They can find a vulnerable router, and then easily hack that on the basis of the information they gathered from pixel reconnaissance emails, or much worse. We have a member whose emails were compromised and given to a political opponent for kompromat, so this is rather serious. It ought not to be described as a low-level, unsuccessful attack.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Thank you for that.

Mr. Juneau-Katsuya, the government put in place a ministerial directive in May 2023. However, the 18 parliamentarians were kept in the dark about this attack all the way through. It was only thanks to IPAC that they became aware of it. I would note that, following the issuance of the ministerial directive in May 2023, 24 government agencies and departments received a briefing in August 2023 about this attack, including the Prime Minister's department at the PCO.

What good is a ministerial directive if there is no follow-through? I would welcome any comments you have about the ministerial directive issued in May 2023 and about what, if anything, could be improved upon with respect to that directive.

[Michel Juneau-Katsuya]

It does very little good. If you do not share information about what's going on or learn from the experience of others, you're not going to get ahead of the bad guys. The bad guys will always win. We need to be capable of a bit more transparency. We also need to have accountability. That's one of the things that are lacking. A lot of people, including those in the private sector, will try to hide as much as possible.

Back in 2010, there was a successful attack on the Treasury Board of Canada that went through a law firm in Toronto. They went through the private sector to enter the Canadian.... To this day, we're not able to assess whether we have cleaned the entire Treasury Board system. The Treasury Board was shut down to outside communication for three weeks in that period of time.

It is very important to work in co-operation and share information and experiences in order to defend ourselves.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

You would agree that it's a failure, and that the 24 government agencies, including the Prime Minister's—

[The Chair, Liberal, Ben Carr]

Mr. Cooper, be very brief, please.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

—were briefed, but these members of Parliament were left in the dark following the issuance of that directive.

[Michel Juneau-Katsuya]

Mr. Chair, I didn't hear what he said.

[The Chair, Liberal, Ben Carr]

Mr. Cooper, we are over time. I will give you the opportunity to repeat the question very quickly, please, and get a brief response from Mr. Juneau-Katsuya.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

I think—

[Michel Juneau-Katsuya]

We are learning. Everybody is learning. There's definitely.... In my 40 years of experience in the intelligence world, what I've seen in the government is a constant attempt to hide as much as possible those “failures”. But that's not the right way to do it. We need to be capable of sharing and learning from one another so we can get stronger and better at our job.

[The Chair, Liberal, Ben Carr]

Thank you very much, sir.

Next we have Mrs. Romanado, for five minutes.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Thank you very much, Mr. Chair, and I'd like to thank the witnesses for being here today.

I want to pick up on something that Mr. Juneau-Katsuya mentioned in a previous example of an incident that happened with the Treasury Board in 2010, and it was through a law firm.

Mr. Shull, you also mentioned how there are the physical tools that we can use, and there's also the training in personal responsibility and being careful about how we do the business that we do and get the training that's required. But in this case of APT31, we heard from the previous witness that it was through their organization that the email distribution list or email addresses were accessed. In the case in 2010, it was through a law firm.

There's educating parliamentarians in terms of us making sure that we're careful about what we're doing and that we're using every tool in the tool kit, as Mr. Shull said—and I would love to show him my phone as well after, to secure. There's the behaviour, and then there are the tools as well. But what would you advise organizations that we're involved with? For instance, many of us give our email addresses out when we're talking with people who want to meet with us, organizations and so on. They're creating distribution lists as well that we have no control over. We are public officials. We share our information so that people can get in touch with us.

How can we make sure that if a third party has these distribution lists, they're also being mindful of the fact that they are susceptible, especially if they're working with a lot of parliamentarians, to keep our information safe? What would you recommend to them as well?

[Michel Juneau-Katsuya]

To control and to be capable of raising awareness with a third party is a very difficult task, because you don't necessarily have control over what they do, how they do it, whom they train and stuff like that.

Again, it returns to general public awareness and being informed, but there's another element as well that should be taken. Sometimes you don't have control. As you pointed out, your email address is publicly known. People might take it and simply use it for their own purpose, and only at the end are you going to see that they used your address. However, when you do business with people, you should be able to ask them for certain standards. The Canadian government should be capable of imposing those standards as well, just like Public Works imposes certain standards when people contract with the government.

Somewhere, somehow, there's this kind of new business culture that I'm talking about. It still needs to be defined in its details, but somewhere, somehow, there's a general awareness and education that needs to start to percolate more to the general public.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Okay.

Mr. Shull, I'll give you a few seconds to answer, but I also want to get back to Mr. de Pulford, because he wanted to provide us some additional recommendations, and I don't think he had a chance to do so.

Mr. Shull, do you have anything to add to that?