National Defence Committee on May 19th, 2016

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

It's fair to say that operationally it really is quite seamless. Even though your jurisdiction stops, the other jurisdiction kicks in right at that spot where yours stops.

The second question goes back to testimony that this committee received early on in the review of the aerial readiness of North America. Can you comment on and ideally substantiate the testimony that this committee received that domestic terrorism, defined as terrorism that would occur within Canada, is our principal security threat?

[Greta Bossenmaier]

Mr. Chair, I'm not au courant of the previous testimony that occurred here.

I will note that in terms of overall threats to Canada, I reflect on the remarks that were made not too long ago by the outgoing national security adviser who talked about two primary threats that he was most concerned about. He had a responsibility of looking at the overall threat environment for Canada. The two that he referred to that were utmost in his mind were counterterrorism and cyber-threats.

In terms of overall threat reporting, the national security adviser and CSIS both have an authority to look at the overall threat environment.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

That's helpful.

Mr. Chair, those are my questions. I'd be happy to defer the remaining time to the next LIberal speaker.

[The Chair, Liberal, Stephen Fuhr]

The parliamentary secretary asked if he could have a question. I'd like some latitude to give him an opportunity to speak.

[Some hon. members]

Agreed.

[The Chair, Liberal, Stephen Fuhr]

Mr. McKay, you have the floor.

[John McKay, Liberal, Scarborough—Guildwood, ON]

One of our NATO partners, Estonia, had a cyber-attack from what's presumed to be Russia. It was pretty serious. What are the implications for NATO, and therefore indirectly for us, and what were the lessons learned from that cyber-attack?

[Greta Bossenmaier]

Thank you for the question.

Many of the questions today go back to the heart of what I think we're seeing, a watershed change in the nature of the cyber environment, the types of attacks that are occurring. To the point the member made, there are a wide variety of attacks.

You're referencing attacks at a state level. We're seeing attacks on critical infrastructure in various countries, attacks against the Government of Canada systems from a variety of threat actors. From each one of these either successful or unsuccessful attacks, we all learn something. The international community learns something. One of the things we learn over and over again goes back to my earlier point that we can't be complacent, that we always have to continue to look at our methods, our tools, our techniques, the types of threat actors.

It's impossible to be complacent. You always have to try to stay ahead of this.

The other item I raised before is it has to be a team imperative. No one organization or one country can do everything alone. It very much is trying to work together and bring together the various resources to deal with these complicated cyber-attacks.

Looking forward, we'll have to continue to be very vigilant. The advice that we provide to the Government of Canada, I've given you our “Top 10 IT Security Actions”, those have evolved. We continue to learn from various actions that are taken. We also learn from when people have implemented some of our recommendations. Once those are taken care of, what are the next variety of steps we recommend that people take?

It's constantly evolving, necessary to be a team imperative, and impossible to say we're done; I don't think we're ever going to be done in this domain.

[The Chair, Liberal, Stephen Fuhr]

Thank you very much for the answer.

We'll move on to our second round of questions for five minutes, starting with Mr. Rioux.

[Jean Rioux, Liberal, Saint-Jean, QC]

Thank you, Mr. Chair.

Ms. Bossenmaier, thank you for being here. You are becoming a familiar face at this committee.

If I am not mistaken, your $583 million envelope comes from the Department of National Defence. You are in charge of providing intelligence to all the other departments. This intelligence is useful not just to defence or foreign affairs, for example. What is the connection or what are the ramifications with the other departments?

[Greta Bossenmaier]

Thank you for the question.

I am more comfortable speaking English. I will answer your question in English.

As a point of clarification, our budget doesn't actually come from the Department of National Defence. It's appropriated to the Communications Security Establishment. As I mentioned, it was about five years ago that the Communications Security Establishment became a stand-alone agency, still under the National Defence portfolio and clearly reporting to the Minister of National Defence, but we're now a separate organization. Again, that happened about five years ago.

In terms of the funds we have and the efforts we make, the member is absolutely correct. I can talk both on the foreign signals intelligence side and on the information protection side. We work very closely with our colleagues in the Department of National Defence. We have a long-standing relationship that goes back throughout our 70-year history of working with the Canadian Armed Forces and supporting them in their operations. That continues today with our efforts with them, for example, in Operation Impact in Iraq.

At the same time, we do provide foreign signals intelligence to decision-makers across the Government of Canada, not only in terms of the Minister of National Defence and colleagues at the Department of National Defence, but through other decision-makers across the Government of Canada in line with the intelligence priorities that the government sets.

The member is also absolutely correct in terms of our cyber-defence activities. We work very closely, of course, with the Department of National Defence to help ensure that their systems are secure. At the same time, we work with the whole-of-government partners, again whether it be Shared Services Canada, or Public Safety emergency management, or the Treasury Board of Canada Secretariat, and individual departments, all of which are part of this overall effort to secure the Government of Canada systems.

Yes, our efforts across all three of our mandates are there to support Government of Canada priorities. We work not only with our colleagues in the Department of National Defence, and of course in the Canadian Armed Forces—we're very proud to work alongside them—but across the other government departments as well.

[Jean Rioux, Liberal, Saint-Jean, QC]

Earlier, the parliamentary secretary was talking about cyber threats. This is an area he is quite familiar with. It is new to me. For my own knowledge and for those watching us this morning, can you provide some very simple examples of cyber threats?

[Greta Bossenmaier]

Thank you for the question.

In terms of specific examples of cyber-threats, I'll try to answer that in two parts. I'll talk briefly about the cyber-threat actors, because it's an important piece, and also about some of the cyber-threats we are seeing.

To speak briefly on the actors, there are sophisticated nation-states that target and try to infiltrate systems. There are non-state actors. We've seen the prevalence in recent months of reports that ISIL is developing cyber capabilities. There are state actors and non-state actors. There is cybercrime, as was raised by one of the other members of the committee a moment ago, and there is the rise of cybercriminals who look to steal information or to steal resources.

There are also examples of the so-called hacktivists. These are organizations or people who are trying to be disruptive, and who are trying to disrupt a government service or disrupt a system. There were examples in the last year. In terms of giving a concrete example of those people who are trying to be disruptive, there were a number of so-called denial-of-service attacks. Those are from people or organizations trying to flood the government systems with requests through a variety of systems that slow down or impede legitimate Canadians trying to do business with the government from being able to do so.

You can see that nuisance and threat activity, and you can see defacement of government websites. The earlier example that was raised was in terms of significant attacks that could be trying to steal intellectual property or trying to infiltrate systems to gain personal information. There was a significant cyber-attack recently with one of our partner countries, and what the cyber-attackers were trying to go after was personnel information, Government of Canada employees and other people who are working for the government.

To underline the point, it's a variety of different threat actors and a variety of different techniques that are being employed for a variety of different ends, all of which either are disrupting systems and trying to infiltrate information, or trying to steal information or shut down systems.

I hope that gives you a bit of an idea of the range of threats and actors we are seeing.

[Jean Rioux, Liberal, Saint-Jean, QC]

That is quite clear.

I will be sharing my time with the hon. member.

[The Chair, Liberal, Stephen Fuhr]

That's your time. Thanks very much.

I'm going to give the floor to Mr. Paul-Hus, and he will split the time with Mr. Bezan. That will be the rest of the questions for the day, so we can sum up and get to committee business.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

Ms. Bossenmaier, in your handout it says that more than 100 million cyber attacks are directed at the Government of Canada's systems daily. That is huge. I suppose that of that number, there are attacks that are made continually by automated systems. There must also be some attacks being made directly by people.

Do you have an idea of the source of the attacks being made against National Defence?

[Greta Bossenmaier]

Thank you for the question.

In terms of the nature of attacks, I'll go back to my earlier comments. They are coming from a variety of sources with everything from sophisticated cyber-actors to the hackers or hacktivists, perhaps in someone's basement or perhaps not. There is a wide variety.

In terms of those that are focused on the Department of National Defence, I would have to refer you to the Department of National Defence because it's their responsibility to have that overall view of their systems. We're there in a support role for them.

With regard to your reference to the 100 million probes we are seeing a day, the variety of different types of activity, some are just probes. They're trying to look at the Government of Canada writ large for the weak spot. There is an old phrase, “the weakest link in the chain”. They are looking for weak spots and trying to understand if there are systems that haven't been updated, or if there are weak spots they can try to infiltrate. They are trying to probe. One of CSE's responsibilities is to help thwart those probes on Government of Canada systems.

In terms of using automation, those are all things that are important for us.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you.

I have a second question before giving the floor to Mr. Bezan.

In your mandate described in subsection 273.64(1) of the National Defence Act, it mentions an assistance role in paragraph (c): “to provide technical and operational assistance to federal law enforcement and security agencies in the performance of their lawful duties.”

Is Bill C-51 currently of capital importance in order for you to be able to perform those duties?

[Greta Bossenmaier]

Thank you for the question.

In terms of our assistance mandate, federal law enforcement security organizations may request CSE's technical assistance, an important part of our overall mandate and, aptly, that's in part C of our assistance mandate. In order for us to consider the request, the organization has to have the lawful authority to be able to ask us. If an organization has the lawful authority, and as my colleague pointed out, if we've confirmed that they have that, we can consider providing that assistance to them.

In terms of Bill C-51 in particular, that bill has not impacted CSE directly, in the sense it's not changing CSE's authorities, etc. It has altered CSIS' authorities. If they, again, had the lawful authority to ask us, we could consider assisting them in their lawful mandate. But it's not directly affecting our mandate. Our mandate stays the same under that reference to the National Defence Act that you made.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

We're glad to have CSE here today. I have two quick questions.

First, we always talk about the Five Eyes relationship that you share, but as a branch of National Defence I assume that we're also sharing intelligence with our NATO members. Mr. McKay talked about the Russia cyber-threat, and how they attacked Estonia back in 2008. I wonder if there were lessons learned there that were shared with Canada through CSE.

Second, you talked about protecting critical infrastructure. I know that you mean energy systems and financial systems and things along those lines, but are you also engaged with protecting the cybersecurity for corporations that have defence contracts? I draw your attention to the issue where there was a cyber-attack on a subcontractor for the cruise missile. The schematics were stolen, then sold on the open market. That's how it's believed China got the information to develop their own cruise missiles.

I wonder if you work with defence contractors in Canada who are providing equipment to our military to ensure that they're protecting their systems.

[Greta Bossenmaier]

Thank you for the question.

As I noted, we do work with Public Safety and Emergency Preparedness Canada. They have a particular role with regard to—let me see if I can get my acronyms right—CCIRC, the Canadian Cyber Incident Response Centre, that is a link to critical infrastructure providers and a link to the private sector in terms of providing everything from threat mitigation advice to information on if we see something coming, how they can help themselves. We provide information to Public Safety and work with Public Safety dealing with those critical infrastructure providers.

In terms of defence contractors in particular, I would want to confirm in terms of their relationship with CCIRC, but I also would have to confirm in terms of their relationship and how they work with the Department of National Defence.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Okay. Just the question on the NATO relationship.

[The Chair, Liberal, Stephen Fuhr]

Very quickly, if you could, please.

[Greta Bossenmaier]

Sure.

Madam Bruce, do you want to talk about NATO?