Evidence of meeting #13 for National Defence in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was threat.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Cherie Henderson  Assistant Director, Requirements, Canadian Security Intelligence Service
Sami Khoury  Head, Canadian Centre for Cyber Security, Communications Security Establishment
Benoît Dupont  Professor and Canada Research Chair in Cybersecurity, Université de Montréal, As an Individual
John Hewie  National Security Officer, Microsoft Canada Inc.

3:30 p.m.

Liberal

The Chair Liberal John McKay

Colleagues, we have quorum, so I will bring this meeting to order.

There are a couple of points just before we call on our witnesses.

First of all, our colleague Rob Oliphant has COVID. Of course, he was at the meeting on Wednesday with us, and some of us had pictures with him. Mr. Motz, wisely apparently, didn't. Just in terms of your own health, you should be aware of that.

You'll notice that our second panel now has two witnesses, whereas before, it had three witnesses. Our third witness, Mr. Tadej Nared, wrote to the clerk this morning and said that he, too, has COVID. He was hoping to be able to tough his way through it, but it's apparently a little bit more difficult for him, so we'll have to make sure to have the opportunity to invite him back.

Cheryl.

3:30 p.m.

Conservative

Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON

Will we invite him back?

3:30 p.m.

Liberal

The Chair Liberal John McKay

It's just a question of an opportunity to invite him back. That's the issue.

Having said that, I see that we have two witnesses who apparently don't have COVID. That's a good start.

We have Cherie Henderson, assistant director, requirements, for CSIS, and Mr. Sami Khoury is head of the Canadian Centre for Cyber Security at the Communications Security Establishment.

Mr. Khoury, I am intensely jealous of that tie. That is a beautiful tie. I'm sure there is a story behind it.

With that, I'll call on Ms. Henderson for her five-minute opening statement.

3:30 p.m.

Cherie Henderson Assistant Director, Requirements, Canadian Security Intelligence Service

Mr. Chair, members of the committee, good afternoon.

I'm Cherie Henderson, the assistant director of requirements at the Canadian Security Intelligence Service. Thank you for the opportunity to appear before you once again this year, this time to discuss cybersecurity, which of course is a very important topic.

As Canada's principal government agency responsible for investigating threats to the security of Canada, CSIS also investigates cyber-threats. As such, we employ all our investigative tools to collect intelligence on cyber-threat actors' exploitation of cyberspace to conduct espionage, sabotage and foreign-influenced activities against Canada and Canadians. CSIS also co-operates with a wide range of domestic and international partners.

Our unique value lies in our ability to collect intelligence on the nature and scope of hostile cyber-activities and the intentions of the actors behind them. This intelligence supports the mandates of our Government of Canada partners, enabling them to better formulate foreign and domestic policies, protect critical Canadian entities and strengthen our nation's overall cybersecurity posture.

Under the CSIS Act, the service also has the legal authority to use threat reduction measures in order to reduce cyber-threats to Canada. One of the most important challenges to address in protecting our national security is the sharing of timely and actionable intelligence. CSIS is addressing this particular challenge in a number of ways, including through regular outreach and partner engagement. We have delivered briefings to partners on the espionage and foreign influence threats posed by state cyber-actors, as well as the potential national security impacts of ransomware attacks carried out by criminal groups.

With today's rapidly evolving technology, we are witnessing an unprecedented level of change in the threat environment. It has become more complex, increasingly fluid, less predictable and consequently more challenging. Threat actors are conducting activities in the online space, simultaneously taking advantage of the technology that enables them to disguise their activities and their identities. Moreover, cyber actors have more opportunities than ever to conduct malicious activity as our world becomes increasingly interconnected.

We investigate the criminal elements as well as the hostile state cyber actors who conduct malicious activities to advance their countries' interests, whether they be political, economic, military, security or ideological. Hostile state actors seek to compromise computer systems by manipulating their users or exploiting security vulnerabilities to gain access to trade secrets or to achieve various objectives through the disruption of critical infrastructure and vital services. These types of activities are not going away, and in fact are currently on an upward trajectory.

CSIS has observed persistent and sophisticated state-sponsored threat activity for many years. We continue to see a rise in the frequency and levels of sophistication of this threat activity. Canadian companies in almost all sectors of our economy have been targeted and compromised.

Unauthorized, malicious access to Canada's critical infrastructure can have drastic consequences for the safety and security of Canadians. If you think about all the systems we rely on in our lives, including systems that support our telecommunications, energy, transportation, supply chain, health and financial activities, any interference with these systems can have unforeseen impacts on our personal safety, our well-being and our national security.

For example, the COVID-19 pandemic has given rise to an unprecedented number of individuals working from home offices, which are much less secure environments. This new standard of work increases the risk of exposure to malicious cyber-activities on networks and sensitive information. We have all heard accounts of cybercriminals conducting ransomware acts on companies and public institutions, including hospitals at the height of the pandemic.

The increasingly interconnected and global nature of security threats means that CSIS cannot fulfill its mandate in isolation. There is tremendous co-operation and ongoing work within the security and intelligence community to provide the Government of Canada with the best intelligence and advice possible concerning cyber-threat activity.

Today's global threat environment requires that each partner use their unique mandate and legal authorities to protect Canada and Canadians. That is exactly what CSIS has been doing and will continue to do.

Again, thank you for the opportunity to discuss this issue with you today. I am pleased to answer any questions.

3:35 p.m.

Liberal

The Chair Liberal John McKay

Thank you, Ms. Henderson.

We now have Mr. Khoury, for five minutes.

Go ahead, please.

March 28th, 2022 / 3:35 p.m.

Sami Khoury Head, Canadian Centre for Cyber Security, Communications Security Establishment

Thank you, Mr. Chair, and members of the committee, for the invitation to appear today.

My name is Sami Khoury. I'm the head of the Canadian Centre for Cyber Security, often referred to as the Communications Security Establishment's cyber centre.

CSE, reporting to the Minister of National Defence, is one of Canada's key security and intelligence agencies, with the five-part cyber-centric mandate derived from the CSE Act introduced in 2019. We use our technical expertise across all five aspects of our mandate, and we do so to keep Canadians safe and secure.

I'd like to give you an overview of the current cyber threat landscape.

Clearly, the cyber threat environment is rapidly evolving. Cyber incidents, including those involving critical infrastructure, are increasingly numerous and sophisticated.

People rely on the Internet for a growing number of important daily activities, from banking, government services and health care to business and education, which puts them at risk. We saw that during the pandemic, when people had to become more reliant on digital infrastructure. Threat actors took advantage of the pandemic and stepped up efforts to exploit human and technological vulnerabilities.

In addition to this increase in cyber incidents, I'd like to highlight some of the specific trends we've observed.

We assessed that cybercrime remains the most likely threat to impact Canadians. Now and in the years ahead, Canadian individuals and organizations will continue to face online fraud and attempts to steal personal, financial and corporate information. We also assessed that ransomware directed against Canada will continue to target large enterprises and critical infrastructure providers. The protection of these organizations and networks is crucial to the productivity and competitiveness of Canadian companies and vital to Canada's national defence. While cybercrime is the most likely threat to impact Canadians and Canadian businesses, the state-sponsored cyber programs of China, Russia, North Korea and Iran pose the greatest strategic threat to Canada.

If you'd like to learn more about the cyber threats facing Canada, I encourage you to read CSE's “National Cyber Threat Assessment 2020”.

I am aware that Russia's invasion of Ukraine is a current cause of concern for the committee. I can't comment on our specific operations today, but I can confirm that we are keeping a close eye on cyber threat activity associated with those military manoeuvres.

Today, we're not aware of any specific threats to Canadian organizations in relation to events in and around Ukraine. But as the situation evolves, I can assure you we continue to monitor the cyber-threat environment in Canada and globally, including cyber-threat activity directed at critical infrastructure networks.

Although the trends I have outlined today seem quite worrisome, the cyber centre is working tirelessly with stakeholders and building strong partnerships across Canada to develop a shared awareness of the threat landscape and promote the necessary measures to protect and defend against them.

We continue to provide advice and guidance—largely informed by Russian cyber threats—to help Canadians and Canadian businesses become more cyber safe.

CSE is also sharing important cyber threat intelligence with Ukraine so that it can better defend its networks.

We are working with the Department of National Defence and the Canadian Armed Forces to support intelligence co‑operation and cybersecurity.

As Canada's cyber-threat environment rapidly evolves, we must all play our position. Cybersecurity is a “whole of society” concern. It will take all of our expertise and collaboration to protect Canada and Canadians.

Thank you again for the opportunity to appear before you today. I'm pleased to answer any questions you may have.

3:40 p.m.

Liberal

The Chair Liberal John McKay

Thank you, Mr. Khoury.

Thank you, Ms. Henderson.

We now go to our six-minute round.

Ms. Findlay, go ahead, please.

3:40 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

Thank you, Mr. Chair.

Thank you for being here with us today. We very much appreciate it.

Ms. Henderson, what type of cyber-threats does Canada face on a daily basis and what portion of those attacks are state sponsored?

3:40 p.m.

Assistant Director, Requirements, Canadian Security Intelligence Service

Cherie Henderson

My understanding right now is that Canada regularly suffers thousands of cyber-threat attacks on a daily basis all across the country, and numerous organizations are under that attack. I wouldn't have for you actual stats on which particular countries those are coming from. I would leave that to my colleague Sami, but what I can say.... Or the quantity...let me correct that: I wouldn't know the quantity from each particular country. Sami may have better stats on that.

What I can say is that we certainly use all of the tools that we have in our tool box to investigate any of those threats—

3:40 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

I understand that, but when I was minister of national revenue—which was some years ago now, the Liberals are happy to hear—we suffered through thousands of cyber-attacks daily at the Canada Revenue Agency. I've been told that it has proliferated since then and it's much, much more. Would you agree that it's an ever-increasing issue?

3:40 p.m.

Assistant Director, Requirements, Canadian Security Intelligence Service

Cherie Henderson

Yes, I would. It is an ever-increasing issue, and it's something that we all need to be alive to.

As we have moved forward in technology advancement, there has been much more cyber-activity in that area and many more cyber-actors. Historically, we focused on state-sponsored attacks, but with the proliferation of tools, many more actors have entered the arena.

3:40 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

For either of you to answer this question: What sectors of Canada's economy would you say are the most vulnerable to cyber-strikes?

3:40 p.m.

Assistant Director, Requirements, Canadian Security Intelligence Service

Cherie Henderson

I can start with that one.

This is one of the things I worry very much about. The service investigates and tries to do a lot of outreach to inform our research industries and our companies that are involved in research and development. As you know, Canada is a top leader in research and development and has a lot of very valuable intellectual property.

There are numerous countries out there that would like to get their hands on that research without having to put the money and investment into it. For all those industries, we really work on outreach to try to increase that awareness so they can protect themselves.

We are also very focused on our critical infrastructure. Critical infrastructure is necessary to maintain our day-to-day lives, and that is another area that is very vulnerable and would need to ensure a very high level of protection and awareness.

Perhaps I can pass this to Mr. Khoury for some further comments.

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

Do you have some comments on that, Mr. Khoury, on the most vulnerable sectors of Canada's economy?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

Thank you for the question.

From the cyber centre perspective, our priority is to defend Canada against all sorts of cyber incidents, regardless of the sector, but we are paying particular attention to the critical infrastructure sectors to make sure they have the necessary tools to protect themselves.

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

I'm not sure, but perhaps Mr. Khoury is better to answer this. In terms of cyber-threats, how would you rate these state actors in their cyber-attack capabilities: China, Russia, North Korea and Iran?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

In our national cyber-threat assessment of 2020, we called out the capabilities of the four of them—Russia, China, North Korea and Iran—as being state-sponsored programs of the greatest strategic threat to Canada. It's difficult to compare one against the other, but I would suggest that in the current context we have to be mindful of the geopolitical tensions and the Russian cyber-threats.

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

How would you rate a cyber-threat posed by Anonymous?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

Anonymous, like many other organizations, brings a certain level of threat to the cybersecurity of a country. We've seen some of them align with Russia and some of them align with the Ukrainian cause in the context of the current geopolitical tension.

Again, we learn as much as possible from all of the incidents, and that's why we encourage all victims to report to us so that we can learn and promote new cybersecurity practices. We take all of that information, digest it and put out new advice and guidance.

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

Are you aware that Huawei was involved in a hacking attempt of Australia's telecom, Australia of course being a member of our Five Eyes alliance?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

I will defer to Australia to comment about the nature of the incident that—

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

I didn't ask you for the nature of it. I said, are you aware that it happened?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

We track the activities of Huawei and other telecom operators around the world, and that helps inform the security of the Canadian telecom infrastructure.

3:45 p.m.

Conservative

Kerry-Lynne Findlay Conservative South Surrey—White Rock, BC

Are you also aware that China Telecom Americas, China Unicom Americas and ComNet have also been accused of spying for the Government of China?

3:45 p.m.

Head, Canadian Centre for Cyber Security, Communications Security Establishment

Sami Khoury

Again, we track all of these reportings. They help formulate the position of the cyber centre on how to protect the Canadian telecommunication infrastructure.