National Defence Committee on Feb. 7th, 2023

[Alia Tayyeb]

Maybe I could take that one from the beginning. It's a great question. It's something that we talk about a lot at CSE and the centre for cybersecurity.

We're lucky, in a way. Statistics-wise, we do have a great deal of interest in our organization. We have an interesting mission. A lot of people are interested in this topic. With our cyber centre taking a more public profile, we have certainly developed greater inroads into the public in terms of awareness and that has translated into a great deal of interest in working here.

We hire a variety of people from different technical fields; it's not all one type of profession. We have engineers, mathematicians, cybersecurity experts, etc. We also have a wide variety of jobs available.

Having said that, as Sami indicated earlier, it is a competitive space, so we do need to innovate and we do need to make sure that we're keeping up with our competitors in this space. That's why some of the initiatives we have taken on are in terms of making CSE an excellent place to work and all the initiatives it takes to become a top employer in Canada, such as providing an environment for people to be innovative and, also, fostering an inclusive environment, where you can continually bring in new people to the sector who might not have considered it before, particularly women or individuals from different ethnic origins—

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you for that. Just due to the nature of my time, I'm going to keep going.

[Alia Tayyeb]

Sure.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

We know there are a lot of remaining challenges with regard to financial compensation or what have you, but I'm going to move along.

As bodies are continuing to change their mandates, how do you see the relationship moving forward between cyber command and the Canadian Armed Forces? How can we ensure that we're optimizing both their areas of expertise and their resources?

[Alia Tayyeb]

Thanks very much. That's a fantastic question.

We've found an excellent partner in the Canadian Armed Forces in terms of what we call “force generation”: developing a new workforce to be interested in the cyber domain.

CSE also works very closely with U.S. Cyber Command in this field. We do talk about workforce strategies in terms of building the expertise we need in order to have successful tools to meet the challenges of the future.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

We recognize that one of the CSE's central aims is to carry out active cyber-operations. Given the different bodies, such as Foreign Affairs and National Defence, would CSE be operating independently or in conjunction with these different bodies?

[Alia Tayyeb]

Thanks for that question.

Indeed, we definitely do not work independently. We work very closely with the Canadian Armed Forces and the Department of Foreign Affairs.

The Department of Foreign Affairs, in fact, is required for active cyber-operations. The Minister of Foreign Affairs is required to provide her consent for those operations. We work very closely in the planning and development of those operations and assessing the risks.

On the CAF, we essentially have a combined workforce, where we have embedded officers in both areas so that we continue to work effectively on this aspect of our mandate.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

Earlier in your testimony, there was a comment with regard to recruitment being highly challenging and that the retention of the current workforce is extremely difficult. Perhaps I'll allow you to continue with those comments.

Perhaps it was your colleague that was speaking to struggles with retention.

[Sami Khoury]

Thank you.

No, actually, I meant that we are investing in retention and making sure that we continue to be an employer of choice: to provide our staff with an environment where they can thrive, with the training opportunities they need. We are also, on retention—

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

I'm sorry to cut you off. I have one last question.

Just so you're not repeating yourself, do we have enough personnel currently to fully meet the operational requirements?

[Sami Khoury]

Thank you again.

We're constantly hiring. The demand on our services is growing. We are busy hiring as much as we can.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

[The Vice-Chair, Conservative, James Bezan]

Okay.

Ms. Lambropoulos, let's try this again. You have five minutes.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you for being with us today to answer some of our questions.

As I was about to say earlier, the CSE is working with partners in Ukraine to monitor, detect and investigate any potential cyber-threats and to help them take measures to address any of these threats.

Have we seen Russia using cyber-operations in order to harm Ukraine during this war? Can you tell us if this has had an impact on Ukraine's ability to defend itself? Also, as Canadians, can we draw any lessons from this?

[Sami Khoury]

Thanks for the question. I'll take a first stab at it and maybe turn to my colleague Alia for a follow-up.

Before the invasion of Ukraine started, we had been communicating to our partners the threat of Russian cyber-activities. Russia is a formidable cyber-actor, and we have been communicating as much as possible for people to take the threat seriously.

From a Ukrainian perspective, they've been the victim of Russian cyber-aggression since 2015 and 2016, when it affected the power grid. Over the years, Ukraine has been building resilience. With the help of the west tipping them off, they have fended off a number of cyber-attacks that Russia unleashed on Ukraine in the early days of the war.

We have learned a lot from these cyber-attacks that Russia has unleashed on Ukraine. We have quickly turned around and published or issued cyber-flashes, so that, in case there is any spillover effect in North America, or at least in Canada, we are prepared to share as much as possible with critical infrastructure and businesses about what some of these indicators are.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Would you like to add to that, Ms. Tayyeb?

[Alia Tayyeb]

Yes, indeed. Maybe just further on the aspect of your question in terms of what we've seen Russia do in Ukraine, I think there has been a considerable amount of information—including in open sources—documenting Russia's use of cyber-tools against Ukraine in its most recent conflict and the use of those cyber-attacks and cyber-threats against Ukraine in conjunction with their kinetic attacks, the most prominent example being the disabling of satellite communications over Ukraine in the lead-up to the war.

For us, what we would call “hybrid warfare”, the use of cyber-tools along with kinetic tools, has been well documented in this conflict, both by the cyber centre and, in fact, by Microsoft, which did an excellent study on mapping out those two capabilities and how they were used together in this conflict.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thank you.

Based on what you're telling me, Russia is of course a great actor in this regard. You mentioned in your opening remarks that cybercrime is the most likely threat to impact Canadians, and that there are quite a few actors that pose a threat, including China, Russia, North Korea and Iran, which pose the greatest threats. How do these actors differ in their goals and their capabilities?

[Sami Khoury]

Thank you for this question.

We have called out those four nation-states in our third national cyber-threat assessment. They have a variety of motivations to go against Canada by targeting Canadian individuals, by compromising some technology through worldwide campaigns, by targeting Canada's economic value or by pursuing financial gains.

For example, we know that Iran is using cybercriminal tools to avoid attribution. This is one of their techniques. China is going after research, technical data, business intellectual property and military capabilities. North Korea is very much interested in enhancing its economic value by stealing credentials and then stealing funds.

They each have a motivation to conduct those activities or to at least go after a certain aspect of Canadian society to further their own interests.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Ms. Tayyeb, would you like to add to that? You have 30 seconds.

[Alia Tayyeb]

I think Sami described it well.

We are constantly surveying the space in terms of looking for new tactics and techniques that are used by ransomware actors to target Canadians. It is an evolving space, and it's something that requires a dedicated effort to follow up on to make sure that we continue to protect Canadian infrastructure.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thanks to both of you.

[The Vice-Chair, Conservative, James Bezan]

Thank you.

Now we'll go to our rounds of two and a half minutes.

Go ahead, Madame Normandin.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Mr. Chair.

I'd like you to talk about co‑operation between governments and information sharing. Canada is part of the Five Eyes alliance. Under an international cyberspace policy, Canada asks governments to report on malicious activity.

Is the co‑operation between governments free-flowing, or is it more of a give-and-take relationship? For example, Canada will get information if it hands over information. Not getting information makes a partner reluctant to share any.

What does that co‑operation between countries look like?

[Alia Tayyeb]

The information-sharing mechanism is very effective and very transparent, especially between the members of the Five Eyes alliance. We work in partnership to address all the threats we've discussed today.

We have very close relationships with our partners in those organizations. We have other allies all over the world that we share information with. These threats affect all of us. I would say that we have very good relationships in this sphere.

I'll pass it over to Mr. Khoury now.