National Defence Committee on Jan. 30th, 2018

[Len Bastien]

Thank you for the question.

The concept of cyber being borderless is an actuality. The biggest threats that we monitor and pay attention to come from the Internet, a network that we all interoperate in because we have to.

When we create interoperable environments with our allies, we take the same prudent approach by creating firewalls and gateways that can control the traffic such that we can monitor it and manage our equities. It's not an open network that is unfettered. To give you the impression that somehow we're interconnected with our allies without any protection would be wrong. We do a lot to manage our security inside the Department of National Defence.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Canadian troops have been deployed in Latvia. The purpose of that deployment is to have a physical presence on the ground with regard to Russia. At the same time, we know that there are cyber-attack and cyber-defence operations.

Are there a lot of Canadian resources allocated to defence in Latvia?

[Len Bastien]

Mr. Chair, I agree with that statement. With our allies, we have invested significantly in that part of the world.

I believe you were asking about what risks or threats we are worried about. Let me explain how we operate inside National Defence.

Cyber, although relatively new, is an established environment of military operations, like land, air, and sea, and as is done for land, air, and sea, the institution of National Defence prepares capabilities inside the department. I'm mandated to help prepare the cyber equities for eventual use in deployed operations.

That said, it's actually the commander of Joint Operations Command who utilizes those capabilities to operate and control his mission. I can't comment on how he's using those capabilities. I can tell you, however, that I am accountable and responsible to prepare them, to generate them, and to get them ready for his use, and we do a lot to make sure that the men and women of the Canadian Armed Forces deploy with the best possible chance of success. Our cyber equities being deployed are the best we can possibly produce for them.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I don't know if you can answer this question, but I'd like to know if Canada is currently conducting offensive operations.

[Len Bastien]

Thank you for the question, Mr. Chair.

Let me tell you that cyber-defence operations have been a part of our reality for many years. We've been doing this for a long time, with no real concerns. It's an area of expertise that we've developed and enhanced over that time. Recently, in the announcement of our policy of “Strong, Secure, Engaged”, there is explicit direction from the government to make even further investments in cyber, in cyber-active operations. That will involve the opportunity for us to use offensive cyber capabilities to enhance our mission success.

I'm going to hand it over to Commodore Feltham, because he can provide some more tangible information around what that might look and feel like.

[Cmdre Richard Feltham]

Thank you, Mr. Chair.

In terms of what Canada writ large is doing, I can't comment on it because I'm not there, but from a DND perspective, as Mr. Bastien mentioned, the recent policy has just given us the policy to do active cyber. That's to say that this is nascent. We are learning how to conduct this business. We are working with our partners within government and with our allies around the world in order to learn how to get into this business. I have not been involved in any offensive cyber operations to this date.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Fine, thank you.

[The Chair, Liberal, Stephen Fuhr]

Mr. Garrison is next.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

Thank you very much, Mr. Chair, to you and to the witnesses for being here today.

I want to start with some questions on procurement. We have discussed many aspects of procurement in this committee, but I think there are two concerns that I would like to talk about here.

Have we put in place restrictions on who can bid on contracts in the area of information management, given our concerns about cybersecurity? I know that we've had previous concerns raised about bids that might be launched by state-owned companies from another jurisdiction, about those dangers, and also about the abilities of people to put Trojan horses, let's say, or other kinds of things into IT systems. Are there any restrictions currently in place? Are you planning restrictions on who can bid on information management systems, given the problems of cybersecurity?

[Len Bastien]

Thank you for the question, Mr. Chair.

The function of procurement within the government is centralized with another department, PSPC. Within our department, it is authoritatively controlled by another assistant deputy minister in charge of materiel. I can tell you from experience that we have used the national security exemption when we're dealing with sensitive national security issues or concerns when procuring IM/IT capabilities. On the integrity of our procurement or supply chain, I would have to defer that question to my colleagues, who are the experts and the authoritative voice in that area. I don't procure my own contracts. I need to use those authorities to do that.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

Surely you're consulted on the criteria that go into the contracts by those who are actually doing the procurement, so I guess I would go back to you again and ask you if you are inserting those concerns into the contract, because I think they will be a growing concern as we press forward.

[Len Bastien]

I can assure you that we do set the high-level requirements for the scope of the contract for the capabilities we're seeking. I can tell you that there is a significant effort to shore up our supply chain integrity within the government in general. I'm aware of that, but it is not under my control. Naturally, when setting my high-level requirements, I would obviously seek out the best and most secure capabilities needed to get what we want.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

I guess my question, then, is more general. When you talk about high level, it sounds as though these are exceptional circumstances. My question goes to the more basic circumstances of allowing, through procurement, portals to be created that would allow access to our information.

[Len Bastien]

I can see why that language would have given you that impression. I can assure you that although I mentioned high-level requirements, it's not taken for granted that...

We're significantly aware and involved in making sure that the capabilities we are procuring are compliant. There are many checks in place, not only during the procurement process but also during the design and implementation, to make sure that the integrity of the capability we're procuring does not create a risk or a threat for national defence.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

Thanks very much.

I want to ask a second question about procurement, which came about in kind of a strange way in my riding. I met with a constituent who is having trouble, as a small business owner, with intellectual property law in Canada and the ability of companies to retain ownership and control of, in this case, information technology.

I wonder if we're running into that problem when it comes to our efforts in cybersecurity. Certain of the large corporations try to retain control and ownership in ways that restrict the use of the technology once it's purchased.

[Len Bastien]

I am aware of the situation you're describing. I have been asked as an authority and have been involved in allowing the intellectual property to be released for use by industry and in future bids. In fact, the MDA contract win with NATO is an example. They worked with my organization in the past and asked for permission to use the intellectual property that was created in their bid with NATO, and they actually won the business as a result.

I can tell you that I have experience with the positive outcome of that situation. For any other details in the area of procurement and intellectual property, I have to defer to my colleague ADM in materiel in National Defence, because that is his authoritative lane.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

I appreciate the positive example there. We have had, in other areas of defence, examples of attempts to prohibit the use of certain technology. The most famous example is between Britain and France over missile technology. The French government attempted to use its national law to prohibit use of intellectual property, as Britain chose to do so.

Do we have any examples of that kind of thing happening at this point?

[Len Bastien]

Mr. Chair, my best answer to that is that I have no awareness of any examples in my domain that I could cite to ratify anything like that.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

At the beginning you talked about working with NATO and Five Eyes, but in all your discussion you talked about protocols with NATO.

Do we have similar protocols in existence for our Five Eyes partners, as we like to call them?

[Len Bastien]

The invitation to the board today was focused on NATO. However, in our introductory remarks, we did open the dialogue to—and frankly, our new defence policy is explicit in—talking about how important our partners are. We consider NORAD, the U.S. bilaterally, the Five Eyes, and NATO to all be very valuable partnerships and alliances.

We have significant investments in the Five Eyes realm. We participate actively in several governing bodies that include intelligence and defence forums, which I participate in personally. We take these relationships seriously. We've benefited from and contributed significantly to meeting with our colleagues in these other nations. Doing so allows us the opportunity not only to establish interoperability by default, as with all of our guiding principles, but also to benefit from each other's investments in certain areas, including cyber.

It's a tremendous forum for us to take advantage of, and I can assure you we participate in several levels, both on the military and on the civilian side, to make sure we keep those relationships healthy.

[The Chair, Liberal, Stephen Fuhr]

Thank you.

Darren Fisher is next.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you very much, Mr. Chair.

Thank you, gentlemen, for being here today. You've provided an awful lot of detail in your remarks. Thank you also for providing those ahead of time.

We know that Canadians are not immune to data breaches. We just saw that Bell was hacked. What is NATO doing to ensure that its infrastructure is safe from data breaches?

I think about the way the cyberworld is probably changing on a daily basis. I'm also interested in whether we are supple enough. Is NATO able to respond and react quickly to new cyber-threats?

[Len Bastien]

Mr. Chair, I would again restate the fact that in the established policy among NATO nations, it's the nation itself that is accountable for its own cyber concerns, which fall back to us to manage.

Your query into the cyber-health or well-being of NATO is outside my ability to answer, simply because it falls back to the fact that the mandate of cyber for NATO rests with the agency. We do participate in the supervisory board of that agency—the board of directors, essentially—where we ensure resources and policy are in place for them to succeed. Operationally, however, they're accountable to the North Atlantic Council, so it's very much NATO business. We couldn't possibly speculate as to the threat and risk of NATO cyber.

I could ask Rich to describe our awareness of how they are set up to handle incidents or how they are set up to react, but I'm not in a position to state the relative health of NATO cyber at this time.

[Cmdre Richard Feltham]

Yes, Mr. Chair, thank you again.

I would reiterate a couple of points that Mr. Bastien raised earlier: the NATO pledge clearly specifies where the responsibility for cyber lies, and that is within each nation's own constructs.

In terms of working in coalitions, I described earlier the federated mission network, the deployed networks that adhere to some protocols that we've all agreed to, but I would comment on one point when we're talking about collaboration and moving forward to ensure that NATO nations can improve their individual cyber capabilities by working together. I referred in my opening remarks to an example of a smart defence project. All that means is that we're sharing data in the multinational cyber defence capability delivery program—

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

The MN CD2.