National Defence Committee on Jan. 30th, 2018

[Cmdre Richard Feltham]

I'm actually in exactly the same space, unfortunately, in terms of the impact of that. In a broad context, when we have more people discussing and sharing information on the cyber-threat, it's usually better. If there are shared equities that get pulled from one to the other, that might be a complication, but I'm not aware of any to this day, Mr. Chair.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

I find today's discussion very enlightening, but also somewhat worrisome. Regarding defence and cyber-security, your role is to protect Canadian Forces and the defence infrastructure. Insofar as operations are concerned, that involves the CSE.

My question concerns NATO. Some of our troops are currently deployed; the Canadian Forces protect us. If we decided to attack Kaliningrad, for instance, and to shut down its power station, who would lead that attack? The Canadian Forces or CSE?

[Len Bastien]

Thank you for the question.

I will answer in English simply because this industry is really a lot easier to describe.

Let me just be clear. Any military operations are governed by the Canadian Armed Forces. Bringing CSE into an operational environment is under the authority of the Canadian Armed Forces. Their ability to bring their capabilities to bear for us right now is somewhat inhibited by legislation, because we're not defined as an agency they're allowed to use and operate with. We're looking to fix that with some of these legislative changes.

The scenario you described would be a military-led, integrated team approach using our equities and CSE's equities in concert. That would be in the future, once the legislative—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

After this meeting, I am going to go to a meeting of the Standing Committee on Public Safety and National Security where we will discuss Bill C-59. We'll be meeting with the CSE Commissioner, as it happens.

That bill involves transferring CSE national defence-related powers to the Minister of Public Safety and Emergency Preparedness. The bill also contains provisions that will require the authorization of the Minister of Foreign Affairs to conduct an operation.

How do you see that?

[Len Bastien]

The impact of the proposed CSE Act is more relevant in its broad terms to their operations than to ours. We have dependencies on them to move into cyber operations and be able to work with them in a more integrated fashion than we can today in operations.

I want to leave you the perspective that we've done the work, we've done the exercises, and we've done simulated operations with them. We've been heavily integrated and invested with that agency to work together in cyber operations going forward, but that will be defined by the government, and I can't speak to the other areas of that.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Do similar concepts exist in most NATO countries? In other words, does their defence include cyber-security elements in addition to emergency preparedness elements? Do they all work together in an integrated fashion?

[Len Bastien]

As I said, we have terrific relationships with our allies. I can tell you that those I work with regularly don't all share the same construct of governance, of design of our governance, when it comes to where cyber capabilities rest inside of government. I can tell you how Canada is engaging, and I'm hoping to do that, but I can't speak—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

As compared to the models in other countries, is Canada's model effective? Are there better models in the United Kingdom or the United States, for instance?

[Len Bastien]

The concept of whether we're good, better, or best among our allies is an opinion. It is what we have established in Canada. For us, our abilities and our current design and portfolios are deemed to be very effective in cyber-defence. It has worked very well in signals intelligence and in other areas and capabilities we've brought to bear for the Canadian Armed Forces. It's the construct we've chosen to propose to government that we will move out on cyber operations.

Commodore Feltham may have a better perspective globally of other militaries. Simply put, he has been deployed and is an operator, versus a civilian member of the defence team. I don't have that perspective.

Do you have anything, Commodore Feltham?

[The Chair, Liberal, Stephen Fuhr]

I'm going to have to leave it there. You might be able to circle back, but I'm going to have to give the floor to Mr. Garrison.

The floor is yours.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

Thanks very much, Mr. Chair.

I really appreciate the testimony we've had on cyber defence today, and I am reassured that we're doing our best in cyber-defence, but your testimony today identified that the legislation in Bill C-59 is really going to bring CSE in line with the authority to do active cyber that DND already sees itself as having.

In the legislation, section 31 says essentially that active cyber, after being authorized, can be carried out despite any act of Parliament or any act of a foreign state. This is a very broad grant of authority.

I'm wondering whether you consider that DND is already authorized to conduct active cyber-activities without regard to any act of Parliament or the act of any other state.

[Len Bastien]

Let me clarify the perception of our relationship with the Canadian Communications Security Establishment that I would like to leave you with.

We have abilities in technology that we have needed to operate in the past. They are of great value to us, but somewhat limited. Before we would invest to grow that arsenal, if you will, of cyber ordnance, we recognize that a lot of that capability exists inside CSE. Getting access to it and giving them the legislative mandate to come to our side and use those capabilities as part of the military construct is the gap. That's the incremental difference that we're looking for, and it's a very small part of that bill.

As for what the rest of the bill addresses and the changes, they are very relevant to the Canadian Communications Security Establishment and, I would offer, are not in my jurisdiction to comment on.

Rich, is there any part of that question you would like to...?

[Cmdre Richard Feltham]

Yes. Mr. Chair, I would just add one point.

Like many other government partners, we will work with the Communications Security Establishment to increase the capabilities of the Canadian Armed Forces, but I want to be perfectly clear. Any military operation that the Canadian Armed Forces engages in, whether in traditional military structures of naval, air forces, army, or in cyber, are government-mandated military operations conducted in accord with the law of armed conflict and the rules of engagement specifically authorized by the chief of the defence staff through the Government of Canada.

The answer to your question is that we would not operate cyber any differently from any other kinetic military structures outside of the government mandate. What CSE would do within their mandate is beyond my scope to comment on, sir.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

It seems to me that some of the common practices that are referred to as “active” cyber operations are modern-day equivalents of things such as wearing the enemy's uniform, the kinds of things that we've tried to prohibit specifically in international conventions. I know that misuse of uniforms was prohibited in The Hague convention of 1907.

Within our NATO partnerships, have there been any activities you're aware of—and I know that it's not necessarily in your mandate—to try to draw some very specific lines around what would be acceptable in the use of active cyber operations?

[Len Bastien]

Let me open, and then I will ask Commodore Feltham to comment on potential policy gaps internationally in cyber engagement or the rules of engagement, if you will, for cyber.

I can tell you that in my experience we've realized the reality that every nation has a different set of legislative and policy constructs for their respective militaries to engage in cyber activities. Some nations fully endorse offensive cyber, while others are completely prohibitive. There's a real variation as you wander around the globe and look at different constructs. I think Canada is looking at its options. Our policy of “Strong, Secure, Engaged” has proposed a scope for cyber—an arc of fire, if you will—that is reasonable, and we've been given explicit direction to implement that.

Commodore Feltham, if there are any activities within NATO or other fora with regard to establishing policy around rules of engagement for cyber, I'd ask you to explain.

[Cmdre Richard Feltham]

If I have time, Mr. Chair, I'll continue.

[The Chair, Liberal, Stephen Fuhr]

Yes, very briefly.

[Cmdre Richard Feltham]

Just to clarify one term, Mr. Chair, “active cyber” is a mixture of what we would consider active defence and what we would consider offence. It's the difference between standing on your castle wall waiting till the guys are coming in through your wall and then attacking them or seeing the guys come to your wall and attacking them there. That's active defence. The other is going to the other person's place to actively attack.

What's the intent? If my intent is to defend myself, I can still be active, but it's to defend my own equities. If my intent is to attack another person's networks, that's offensive. “Active” is a component of both. The NATO community and the broader communities at large are working to understand where those lines lie. If you read the output from the Tallinn Manual, for example, you'll see that there are ongoing efforts from the legal community and military forces within our alliance to understand that better.

Are there agreed-upon rules across all of the alliance and all allied nations? I don't think there are, but it's a growing and emerging conversation that is very rich.

[The Chair, Liberal, Stephen Fuhr]

Thank you.

I know that one person wants to have a couple of minutes to ask a question, but given the time I have left and a couple of housekeeping items that I have to take care of, I can't really go there unless everybody else agrees. I don't have time to give a couple of minutes to everybody.

Did you have anything else, Mr. Garrison, that you wanted to add?

Mr. Bezan? No?

I'd like to give Ms. Alleslev just a couple of minutes to finish off, and then we'll move to our motions.

Go ahead, Ms. Alleslev, for a couple of minutes.

[Leona Alleslev, Liberal, Aurora—Oak Ridges—Richmond Hill, ON]

Thank you very much, team, and Mr. Chair.

I wanted to close out on the conversation around whether you felt comfortable having an unclassified conversation. There are many of us around this table who've had and have security clearances and therefore did not ask questions that we knew you wouldn't be able to answer. You commented that you're comfortable with the answers you gave; I think the level of conversation was therefore based on the questions we asked and that there perhaps are more classified levels of conversation that we have obviously not had today.

It's particularly in this space that we look at the overlap between our health and well-being domestically, in terms of both civilian and military infrastructures, and then that of our allies, in terms of what information we communicate between those two. I wonder if you could comment on that.

[Len Bastien]

I wouldn't want to have misrepresented the fact that in a classified environment with the right situation, with all the conditions met, a classified conversation in certain key areas would not be a richer dialogue between committee and us as witnesses. What I would simply offer is that in the line of questioning we received today, there were great questions that allowed me to talk about our business and to talk about our situation in the world and our relationships with our partners without compromising national security or safety.

[Leona Alleslev, Liberal, Aurora—Oak Ridges—Richmond Hill, ON]

Thank you.

[Len Bastien]

You're right. Should the questions—

[Leona Alleslev, Liberal, Aurora—Oak Ridges—Richmond Hill, ON]

Thank you. We didn't ask the questions that would have put you in a position of not being able to answer.