National Defence Committee on Nov. 20th, 2014

[John Williamson, Conservative, New Brunswick Southwest, NB]

That's interesting. I think you make a good point but do we not risk.... I'm going to touch on where I think Mr. Daniel is going with the sectoral approach or even what I'm beginning to wonder, which is if a macro versus a micro approach is better. Let me give you a small example, the one you raised, with AP, I think you said, in highlighting the false news feed.

I would think, at the end of the day, we want to hope it's AP's responsibility to protect against those kinds of attacks. That organization has the most to lose by an attack: misinformation. People then question their data; they look elsewhere. Similarly, my concern would be if we hold another entity responsible for bank data, no one's really accountable for it. I haven't come to any conclusion, but should banks not be responsible for their security? If we keep elevating it, ultimately, no one might be responsible for control. The backdrop to all this is that to me, working in this environment you have to be nimble, you have to evolve, you have to recognize threats, you have to be able to assess, and it strikes me that, ultimately, government is the place where you're least going to find that kind of thinking or approach. Don't get me wrong, governments do some things very well.

[The Chair, Conservative, Peter Kent]

Mr. Williamson—

[John Williamson, Conservative, New Brunswick Southwest, NB]

I probably only have 30 seconds, but this macro versus micro approach....

[Rafal Rohozinski]

I don't think the government should take responsibility, but I think the role of government is to set rules and those rules can either regulate or they can incentivize. In certain cases, creating incentives for information-sharing through very light regulation is probably a lot better than creating an institution to oversee it. I would say that both macro and micro are important.

[The Chair, Conservative, Peter Kent]

Thank you. That's time.

Mr. Chisholm, please.

[Robert Chisholm, NDP, Dartmouth—Cole Harbour, NS]

Thank you very much, Mr. Chairman.

I'll again share my time with Mr. Rafferty.

We've talked a bit about ISIL and their role in the cyber domain. There was apparently a conference recently hosted in Kuwait. Some of the Five Eyes were there. Canada wasn't. What is being done, or what should be done, to combat what ISIL is doing in the cyber domain?

[Rafal Rohozinski]

I'll give a two-part answer, partially answering a question that was asked previously.

This method of public health surveillance as a way of identifying individuals at risk I think actually does have applicability in cyberspace and could be applied at a community level without creating a liability for Canadian rights. That's certainly something we should be doing, because ISIL is only the tip of the iceberg in terms of this kind of self-radicalization threat that we face.

In terms of shutting down ISIL's ability to use the Internet, I think that would be a big mistake. It is a channel for being able to understand their actions and motivations, which yields far more intelligence value for us in terms of the organization than simply shutting them down. I say this partially because we are engaged as a company in support of doing exactly that kind of work—in other words, being able to understand the motivation and actions of actors such as ISIL in places like Syria and Iraq.

[Robert Chisholm, NDP, Dartmouth—Cole Harbour, NS]

So you're saying the role, then, is to do the assessment and detection work here, or online.

[Rafal Rohozinski]

Exactly right. This is a separate topic but maybe an important one.

The global Internet, because it reflects the majority of humanity right now, is probably the single most valuable intelligence tool we have. By that I don't mean intelligence in terms of state intelligence but in terms of open intelligence. Literally, it allows us to gain perspective on what previously would have been local water-cooler conversations, but at a distance—not by using the capabilities of a CSEC to listen in on the very specific conversations of two individuals but literally by being able to listen in to it in a crowd.

I think that aspect of it is something that is greatly underappreciated. My colleagues in the intelligence community in the United States will openly say that 80% to 90% of useful intelligence is open source intelligence. It's not the stuff that we pay the institutions for, it's the stuff that literally exists and needs to be simply processed from the street.

[Robert Chisholm, NDP, Dartmouth—Cole Harbour, NS]

Interesting; very interesting.

[The Chair, Conservative, Peter Kent]

Mr. Rafferty, you have 90 seconds.

[John Rafferty, NDP, Thunder Bay—Rainy River, ON]

Thank you, Chair.

Thank you for being here, Mr. Rohozinski. I just want to follow up on some of Ms. Murray's comments with regard to lawful access and privacy.

You have some experience with other national governments. Should international norms and laws be developed to govern the cyber domain? Very briefly, can you tell us what's been done and what your own personal thoughts on privacy are?

[Rafal Rohozinski]

I think we have a much greater risk at the moment in terms of what is happening within the commercial sector and the aggregation of data at scale than we do within the government institutions. This is an immensely challenging area because we have not only built an industry around it but we also benefit disproportionally from it. I mean, there is a utility function that each and every one of us gives up when we decide to give our credentials to Google, which allows us to more efficiently and effectively organize our everyday lives.

That again, I think, is something where the danger of silently rewriting the social contract...and not just between the institutions of governance and the individual. The responsibility of the third sector, the private sector, in it really needs to be explored in all of its depth, and it has not been to date. I think the Snowden revelations at least lifted the lid on the fact that this is an issue of a social contract, but the fact that it has been weighted so heavily on issues of responsibility of state institutions I think has partially obscured the fact that it requires a much broader examination.

[The Chair, Conservative, Peter Kent]

Thank you.

Our final five-minute slot goes to Mr. Bezan, please.

[James Bezan, Conservative, Selkirk—Interlake, MB]

Thank you, Mr. Chair.

Mr. Rohozinski, it's great to see you again. Last time we talked it was on the Iranian situation, on their cyber capabilities and some of the attacks they've already orchestrated on North American soil. I want to get that perspective: who are the threats?

As well, you might be familiar with a story that came out last week that earlier this year, in April, a U.S. destroyer, the USS Donald Cook, was disabled while on patrol in the Black Sea by an unarmed Russian bomber. The Voltaire Network reported that a Russian Su-24 buzzed the ship and “disabled all radars, control circuits, systems, information transmission, etc. on board the US destroyer. In other words, the all-powerful Aegis system...installed on NATO’s most modern ships was shut down”.

Is there legitimacy to the story that was reported? What other capabilities are we facing from a military standpoint?

[Rafal Rohozinski]

Again, I'd go back to what I said earlier. In my work with the International Institute for Strategic Studies this year, for the first year, the strategic balance, which is really the referential tome when we look at the capabilities of nation states and others in traditional military domains, has started to look at cyberspace as one of those domains. Perhaps most interesting in the research that's been done is the range of countries that now develop active cyber capabilities, offensive cyber capabilities.

Why? As I said earlier, it's because it allows them to leapfrog a whole generation of industrial warfare. It lowers the threshold for being able to compete at a military political level that previously required an investment in manned materiel technique that was really reserved only for the most advanced countries. The question really is not who is the threat; it's who's not the threat, because the threshold is so low. I think if we don't want to be the Zulus faced with a Gatling gun, we do have to wake up and recognize that an investment in cyber as a capability of national security and national defence is a critical requirement and something that we do have to spend the time and resources to develop.

On the question of the Aegis of the destroyer, I can't really comment on that. I'm aware of it but it may well be as much a fanciful part of the Russians' information operation strategy around Ukraine as anything else.

[James Bezan, Conservative, Selkirk—Interlake, MB]

Even if it is hypothetical, would that be considered an act of war?

[Rafal Rohozinski]

That's a question and there has been quite a bit of work done in the last three years in terms of looking at how the existing laws of armed conflict can be updated to include the cyber dimension. I think there's a greater understanding now, especially post Ukraine and Crimea, that incorporating cyber into one of the trigger points for alliance-based responses is something that's required.

However, as we have seen and as I'm sure this committee will also be examining, hybrid war, in other words war that exists outside of the laws of armed conflict, exists outside of the threshold of what can be considered state to state, is certainly something where cyber has a huge and important role to play. Given the confluence of those two things, I think the challenge of creating norms around the use of cyber in the sub state-to-state warfare scenario is going to be extremely challenging.

[James Bezan, Conservative, Selkirk—Interlake, MB]

The U.S. has set up Cyber Command. We have activities in NORAD—and we are talking about the defence of North America—but we also have a great relationship with NATO, and you already mentioned Estonia. They have the NATO Cooperative Cyber Defence Centre of Excellence base there. Can you talk about how important it is that Canada should be playing more of a role in cybersecurity in these multinational organizations?

[Rafal Rohozinski]

CCDCOE is not an operational structure of NATO. It is a research centre, so it actually has no capability apart from the research function that it forces. If the question is should Canada be creating a cyber command or at least looking at where cyber fits within the current force structure, I think the answer is unambiguously, yes. The challenge of course will be that we have three strong services and our own traditions of institutions and rearranging these to create a cyber-force will be a challenge institutionally, budgetarily, as well as in terms of simply the visionary leadership required to make it happen.

[The Chair, Conservative, Peter Kent]

On that challenging note, Mr. Rohozinski, we will end this hour and your testimony. I will say though on behalf of the committee we would welcome any afterthoughts or summaries or advice that you might still wish to correspond with us, but we thank you certainly for your presence here today.

[Joyce Murray, Liberal, Vancouver Quadra, BC]

There were more questions but we just ran out the clock.

Thank you.

[The Chair, Conservative, Peter Kent]

We'll now suspend as our next witnesses approach the table. We would like to make this transition nice and quick if possible.

[The Chair, Conservative, Peter Kent]

All right, colleagues, we will resume and continue with our study of the defence of North America.

From the Department of Fisheries and Oceans we have two witnesses with us here today: Nadia Bouffard, deputy commissioner of operations, Canadian Coast Guard; and with her Gregory Lick, director of operations support, Canadian Coast Guard.

Ms. Bouffard, your opening remarks please.

[Nadia Bouffard, Deputy Commisioner, Operations, Canadian Coast Guard, Department of Fisheries and Oceans]

Thank you, Mr. Chair.

Good afternoon, everyone.

My name is Nadia Bouffard. I’m the acting deputy commissioner of operations in the Canadian Coast Guard. I'm joined by Greg Lick, who is the director general of operations.

We wish to thank you for the opportunity to speak about the Canadian Coast Guard and its role in maritime security. The Canadian Coast Guard has a long and proud history of supporting our partners and allies and serving Canadians. For more than 50 years, the Canadian Coast Guard has been recognized across the country as a symbol of maritime service and safety. Our personnel operate in challenging circumstances, in the harshest of climates, and throughout many of the most remote corners of Canada. The distinct red and white hulled coast guard vessels are symbols of safety, sovereignty, and security.

Our mandate focuses on the safety of mariners at sea, and we deliver programs that are critical to the safe, economical, and efficient movement of ships in Canadian waters. To that end, our direct service includes: aids to navigation and waterways management, environmental response, icebreaking, marine communications and vessel traffic services, and of course, search and rescue. These services are delivered along the single longest coastline in the world and within major waterways, such as the Great Lakes, the St. Lawrence Seaway, the Mackenzie River, and Lake Winnipeg, to name just a few.

Although we have no explicit legislative mandate for security or law enforcement, I will explain today how we have a direct role in supporting our partners that do.

Our fleet is the backbone of the Canadian Coast Guard. The government recently invested $6.8 billion in renewing vessels and helicopters, and I am pleased to report that we are making significant progress on this front.

Of great interest to this committee, perhaps, we recently accepted the last of the midshore patrol vessels into service. These nine new midshore patrol vessels provide new tools to deliver our maritime security program on the Great Lakes and St. Lawrence Seaway and fisheries conservation protection on the Atlantic and Pacific coasts. We are renewing the fleet to maintain our significant vessel and helicopter capacity for the future.

Combined with our various vessels' tracking systems, the Canadian Coast Guard is well positioned to support Canada's security priorities. No single department or agency is responsible for maritime security in Canada. lt's important to recognize that the lead for maritime security always remains the department with the explicit security, intelligence, or enforcement mandate. These include, for example, the RCMP, Transport Canada, the Canada Border Services Agency, and Fisheries and Oceans Canada in terms of our conservation and protection officers, as well as the Department of National Defence.

The Coast Guard has a dual role in maritime security. We provide critical maritime information to security partners, and we help deliver on-water security activities. Coast Guard information is essential to the building of maritime domain awareness, which is the foundation of maritime security in Canada.

Canada uses a layered approach to establish maritime domain awareness. lt's the result of a coordinated effort among federal departments, allied nations, and other levels of government to collect, consolidate, and analyze information and intelligence to support maritime monitoring. Federal organizations use this information for a range of purposes, including marine safety, security, national defence, and environmental protection. For instance, the 96-hour, pre-arrival information report provides information for our security partners on vessel type, cargo, crew, last port of call, destination port, and flag.

Coast Guard vessel identification and tracking systems validate location information reported by vessels and monitor vessel movements within Canada's exclusive economic zone, its maritime approaches, and around the world. This information is collected from a number of sources, including radar, the automatic identification system, and the long-range identification and tracking system, as well as other vessel traffic management systems.

We also collect weather and geographic information as well as real-time reports on commercial vessels and pleasure craft observed by our own vessels.

The long-range identification and tracking system provides positional data on vessels of 300 tonnes or more, including Canadian-flagged vessels, international vessels destined for Canadian ports, and vessels transiting within 1,000 nautical miles of Canada's shores. Inside 50 nautical miles, Canada's Coast Guard automatic identification system tracks vessels of 300 tonnes or more.

These capabilities are critical within Canada's vast Arctic territory where few resources are readily available to monitor the maritime domain. The important role the Canadian Coast Guard plays in providing maritime information is further demonstrated through its presence within Canada's three marine security operations centres, or MSOCs as we call them. These centres are vital in the collection, analysis, and dissemination of maritime information and intelligence. Located on Canada's west coast and in the Great Lakes region, these centres co-locate five federal departments: Fisheries and Oceans Canada and the Canadian Coast Guard, the Department of National Defence, Transport Canada, Canada Border Services Agency, and the RCMP.

The Coast Guard brings great value to the marine security operations centres as it provides close to 80% of the maritime vessel traffic information that our partners require. In the north, the Canadian Coast Guard marine security operation centres monitor all traffic entering the Arctic, including the entire northern Canada vessel traffic services zone. From the centres' watch floors, the Coast Guard sends out reports of all known vessel activity in the Arctic and approaches twice a day.

Our marine security operations centres' personnel liaise regularly with various federal, territorial, and international organizations to maintain comprehensive awareness of activity in the Arctic. This includes but is not limited to liaising with the foreign affairs department; Environment Canada; the Public Health Agency of Canada; the governments of Nunavut, Northwest Territories, and Yukon; the government of Greenland; and the United States Coast Guard.

The Canadian Coast Guard plays a second important role in supporting Canadian security by providing marine platforms and support needed for law enforcement, as well as the ability to intervene on water. For this role, the Coast Guard provides ships, equipment, personnel and expertise to federal law enforcement and security organizations in order to provide more effective protection in Canada's navigable waters.

Our ships are routinely active in Canadian waters: along our coasts, in the Great Lakes, all along the St. Lawrence River and in the High Arctic. They usually support law enforcement activities in the course of their daily work and whenever they are needed.

A good example of our routine marine activities is the marine security enforcement team program, jointly operated by the Royal Canadian Mounted Police and the Coast Guard. This joint program ensures that specialized security investigation resources are present in the Great Lakes and St. Lawrence Seaway. The Coast Guard is responsible for the operation of the vessels, the RCMP for all law enforcement activities.

Because of their high visibility, their frequent patrols and their capacity for rapid intervention against potential threats, these teams provide a strong presence nationwide as a deterrent to illegal activities.

In 2012, the Coast Guard began the transition to the marine security enforcement team program, moving from the four original temporary vessels to new mid-shore patrol vessels. In contrast to the original modified vessels, these new vessels have greater range, higher speed and better ability to sail in difficult weather conditions at all times.

In addition, they can communicate securely with other Government of Canada vessels and with the national classified command and control networks. These new vessels were constructed specifically for marine security activities and they have enhanced the Coast Guard's overall capacity to provide effective support to marine law enforcement activities.

Canadian Coast Guard vessels also play an essential role in support of marine security priorities in the Arctic. Each year, from the end of June to the beginning of November, the Canadian Coast Guard deploys six icebreakers: one light icebreaker and a combination of five medium and heavy icebreakers in the Arctic.

Often the only visible Government of Canada presence in many parts of the region, these vessels strengthen Canada's sovereignty by providing essential services to our northern partners and communities.

That includes escorting commercial shipping—