National Defence Committee on Jan. 30th, 2018

[Len Bastien]

That's a very true statement. Thank you.

Mr. Chair, as I mentioned earlier, we participate in several fora. There is the top secret environment in which the Five Eyes intelligence agencies CIOs meet twice a year. We have a technical road map towards interoperability. We have a cyber health card that we are all mandated to provide to each other and report back to our national security advisers on. There are checks and balances in place for us to communicate to our allies our well-being in cyber at just about every level. I could take it down to the secret level, where the military command, control, communications, and computers board meets regularly and speaks to the cyber well-being of our secret network. We do communicate back and forth amongst our allies.

[Leona Alleslev, Liberal, Aurora—Oak Ridges—Richmond Hill, ON]

Does that include our civilian infrastructure as well?

[Len Bastien]

We do provide updates to our allies in those meetings in that forum as a national update. At the beginning of every one of those meetings, nations are asked to speak to the goings-on of their government or nation's capital or broader perspective that would be relevant to the mandate or—

[Leona Alleslev, Liberal, Aurora—Oak Ridges—Richmond Hill, ON]

I'm not referring just to government infrastructure. I'm talking about our domestic infrastructure, such as our hydro plants and our Facebook—or the Americans' Facebook that we use—that has been able to shape uprising.

[The Chair, Liberal, Stephen Fuhr]

I'm going to have to hold it there. I let that run long. I'm happy to give the other parties a little bit more time. I think we need to get to that social media aspect of the information part and I hope we do, but I'm going to give the floor to Mr. Bezan.

I'll give you an extra minute.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you, Mr. Chair, and I want to thank our witnesses for being here and for their testimony.

I want to follow up on what Leona was just questioning on. I think all of us look at cyber-defence maybe a little bit differently from the way it's been implemented. I look at National Defence, I look at our Canadian Armed Forces, and if a foreign nation flies a fighter jet near our airspace, we scramble our jets to intercept and escort them out. If a submarine popped up in the Gulf of St. Lawrence, our navy would be there immediately to defend our sovereignty. If little green men landed on Vancouver Island, I know that National Defence would ensure that our troops were on the ground to counter that, yet you're saying that if a foreign entity attacks our cyber infrastructure, if it's civilian-based—whether it's our banking systems, our subway systems, or our power grid—we're going to sit back and let Public Safety be the lead rather than have National Defence defend our sovereignty.

Is that policy, or is that legislation?

[Len Bastien]

Let me clarify your scenario. I believe I said that at the request of the government, National Defence equities can be brought to bear in any of the environments, including cyber, to address a national concern or interest or national security. I didn't say there was policy or legislation to prohibit us from doing that; I said we wouldn't unilaterally make that decision. It would be a decision taken by the government and administered through the Canadian Armed Forces.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

When a foreign entity is doing the attack, doesn't that automatically become a national security matter that has to be dealt with by National Defence?

[Len Bastien]

Rich, would you like to elaborate?

[Cmdre Richard Feltham]

I think it's important to know what our mandate is and what the government wants National Defence and the Canadian Armed Forces to do. Right now, as it stands, our mandate is to protect the Canadian Armed Forces networks and provide support when we're asked.

Coming back to an earlier point, Mr. Chair, in terms of domestic infrastructure, do we report to NATO on the status of our critical cyber and domestic infrastructure? I'm not aware that's what the Department of National Defence and the Canadian Armed Forces do. Unless we're given a mandate to support civilian infrastructure, that is not within our current mandate.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Let's take it to the NATO level, then.

You guys have your working groups and joint operational commands. NATO members have had some hard lessons learned. We have troops sitting in Latvia with the enhanced forward presence and we have troops sitting in Ukraine. Operation Unifier is not necessarily a NATO operation, but Ukraine, Latvia, Estonia, and other partners have been attacked. Power grids have been taken out and subway systems and transportation systems have been interrupted through cyber-attacks. What lessons learned have been shared at the NATO level that we've been able to take back and share with our civilian suppliers of those services here in Canada?

[Len Bastien]

Those are excellent examples.

At this stage of our cyber interoperability evolution, as Rich mentioned earlier, to our awareness there is no hot wash, so to speak, among the nations, among the allies, that would provide those lessons learned in the current construct.

We do share at the most senior levels, in the most classified environments around intelligence—top secret, for example—more open and easier communication. It's simply a smaller environment to have to manage. The broad environments of the nations of NATO and their cyber-exploits that occur, frankly, regularly, we do not necessarily manage or monitor.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

But I thought NATO had stood up a centre of excellence on cyber in Estonia. Aren't we tapped into that, making use of lessons learned? I just assume that they're taking attacks on civilian infrastructure as lessons learned to be shared among other nations by making sure we have the appropriate firewalls and cyber-defence posture.

[Len Bastien]

We are participating in that centre of excellence. It is relatively new in its evolution. It will grow and evolve quickly. I'm sure we will get more value as time goes on.

We do learn from the exploits around the world. Globally, if a vulnerability gets exploited, the entire community reacts by addressing the vulnerability, learning from it, and patching for it. We're not complacent when these events occur. We're very aware. It may not necessarily even be through our alliances with NATO or Five Eyes that we find our way to a return to service or a state of compliance by reacting to those exploits. It's done through the normal operation and maintenance of our cyber environment.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

NATO's article 5 is summed up as an attack on one being an attack on all. It was only used once, on 9/11, and of course it was civilian infrastructure that was attacked. With Bill C-59, there's going to be a cyber-offensive posture provided to the Department of National Defence and the Canadian Communications Security Establishment. What would be classified as an article 5 in the cyberworld?

[Len Bastien]

It's a very good question.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

I know it's hypothetical.

[Len Bastien]

The impact of an event is a case-by-case issue. It's measured as it would be in any other environment.

To try to answer your question, I would offer that a cyber-event would now be considered or looked at like any other kind of kinetic event from a military perspective, and it could qualify for article 5 if the impact to the nation was deemed sufficient to invoke that policy. It's really not for me to comment what it would take to get there.

I don't disagree with you that it's the industries of our nations that are vulnerable to these kinds of attacks. I just want to clarify our mandate for you here today, which is that we engage to help and provide service to Canadians through the national defence institution, so that you have a good understanding of what to expect from us should something like that happen.

[The Chair, Liberal, Stephen Fuhr]

Thank you.

Go ahead, Mr. Robillard.

[Yves Robillard, Liberal, Marc-Aurèle-Fortin, QC]

Thank you, Chair. I will share my time with my colleague, MP Fisher.

Sir, can you please highlight some of the merits that granted Canadian company MDA this $15-million contract to deliver NATO's Project Triton?

[Len Bastien]

Thank you for the question, Mr. Chair.

I didn't bring the details of that contract exchange with NATO with me today. It was meant to be an example of the value of return on our investment in exposing Canadian industry to the agency at NATO that spends upwards of 450 million euros a year. A lot of the work and contracting was not getting to North America. It was staying in Europe, and we were motivated to see Canadian industry have a better share in that market. It was meant to give you an example of the success, if you will, of our investment in working with the agency. If you like, we can return to you more details of the scope of what that contract will mean to MDA, but we'll have to bring that in later. I didn't bring it with me today.

[Yves Robillard, Liberal, Marc-Aurèle-Fortin, QC]

As a follow-up, can you elaborate on Project Triton and how it contributes to the maritime and control information systems project?

[Len Bastien]

Thank you, sir, Mr. Chair.

As I have stated, the details of that contract.... That contract was not with National Defence but with the agency at NATO. My awareness of that is limited to the extent I've shared with you today, namely of its success for Canadian industry and its value. Should they be available, we will gladly provide you with details of the scope and requirements of that contract. I didn't bring them with me today.

[Yves Robillard, Liberal, Marc-Aurèle-Fortin, QC]

Thank you, sir.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you, Mr. Chair.

Gentlemen, you both mentioned initiative 65 and cryptographic capability improvements. I'm hoping you can expand on that a bit and give me some examples of some of those improvements.