Evidence of meeting #48 for National Defence in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cse.
A recording is available from Parliament.
3:50 p.m.
Deputy Chief of Signals Intelligence (SIGINT), Communications Security Establishment
I very much appreciate the question. I think it's an extremely important one.
I don't think that I'm the best placed to answer that question, given that I think the Canadian Armed Forces would be best placed to handle questions of that nature.
3:50 p.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
Is CSE concerned about the ongoing research partnerships between Canadian universities and China's National University of Defense Technology, recently reported on in The Globe and Mail?
3:50 p.m.
Deputy Chief of Signals Intelligence (SIGINT), Communications Security Establishment
Indeed, as part of our foreign intelligence mandate, we do report on any foreign adversary activity that is directed towards Canadians, including approaches to our research work or intellectual property or economic investments, so that is absolutely a topic that we would be monitoring and reporting on to our government clients.
3:50 p.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
How did you learn about the July 8 network-wide Rogers outage?
3:50 p.m.
Deputy Chief of Signals Intelligence (SIGINT), Communications Security Establishment
I think I would best turn that one over to my colleague, Sami.
3:50 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Thank you for the question.
We monitored. We have good partnerships with all of the telecom operators, and shortly after the outage, we were in touch with Rogers to ascertain the nature of the outage.
3:50 p.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
Did you call to ask, or did they initiate the conversation to let you know what was happening?
3:50 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
I called to ask.
3:50 p.m.
Conservative
3:50 p.m.
Liberal
Emmanuella Lambropoulos Liberal Saint-Laurent, QC
Thank you, Chair.
Thank you to our witnesses for being here to answer some important questions with us today.
I understand that CSE is working with its partners in Ukraine in order to determine whether there are cyber-threats, if cybersecurity—
3:50 p.m.
Conservative
The Vice-Chair Conservative James Bezan
Excuse me; we don't have interpretation. I've stopped the clock.
February 7th, 2023 / 3:50 p.m.
Bloc
Christine Normandin Bloc Saint-Jean, QC
Mr. Chair, could you ask the member whether she's wearing the right headset?
We just received a directive from the House of Commons asking us to make sure we wear the proper headset in order to protect the health and safety of the interpreters.
3:50 p.m.
Conservative
The Vice-Chair Conservative James Bezan
Ms. Lambropoulos, is that the correct headset that's been issued by the House of Commons? It is.
Can you just wrap it naturally around in front of your face? Try that, please.
3:50 p.m.
Liberal
3:50 p.m.
Liberal
Emmanuella Lambropoulos Liberal Saint-Laurent, QC
Can we pass it to another colleague? I'll try to get to a space that's a little bit easier to hear from.
3:50 p.m.
Conservative
The Vice-Chair Conservative James Bezan
Okay, I appreciate that.
Ms. O'Connell, you can have the six minutes.
3:55 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
Thank you, Mr. Chair.
Thank you to our witnesses for being here.
I think the work that CSE does is really important, and most Canadians probably don't even realize the quality of our services here and the technology. I appreciate the opportunity to hear a little more and share with Canadians a little more about some of the work you do.
Some of the issues that are very topical, of course, in the media are private sector ransomware attacks. Where I'm from, outside of the GTA, SickKids hospital was in the news for sure, and we had a lot of reporting on that. Could you maybe speak to the process or what role CSE can play when there's a private sector non-governmental ransomware attack and how you try to work with clients, or the mandate or non-mandate you have in dealing with private sector attacks?
3:55 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Thank you for the question. I'm happy to speak about that.
Regarding ransomware, when we issued our third national cyber-threat assessment, we continued to highlight the threat that ransomware poses to Canadians and Canadian organizations. It's a serious threat, as we can see in the health care sector, in critical infrastructure, in businesses and so on.
There are a number of ways that we work with the private sector to mitigate or to address the threat of ransomware. We constantly publish alerts and cyber-flashes to draw attention to what may be new vectors of ransomware or new techniques that cybercriminals are using in ransomware.
Every time we have an opportunity to speak to a business community, we speak about the threat of ransomware. Sometimes we get tips if our partners have seen precursors of ransomware being deployed in Canada, and we will tip the organization and tell them that they might want to look here because we have information to indicate that there might be a precursor to ransomware.
Unfortunately, sometimes we either hear through the media that there was ransomware, that a certain organization has fallen victim—
3:55 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
I'm sorry. I don't mean to cut you off. I'm just limited in time.
Following up on that, is there any requirement for the private sector, for example, to notify the Canadian government of something. I could see that some businesses might not want to share that they've been vulnerable. Is there any sort of requirement? What do you do in that event? Is there something you can recommend to this committee as we take on this study in that area?
Again, you have my apologies for interrupting. I'm just limited in time.
3:55 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Thank you. There is no requirement for the private sector to report to us ransomware incidents, and many of them don't report it. As a matter of fact, in 2021 we've only had reports of about 300 ransomware incidents to the cyber centre, which is probably under-reporting for a number of reasons.
As soon as we hear of an incident, we reach out to offer our assistance. Sometimes it's accepted, but more often it's declined.
3:55 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
Thank you.
Following up on that, critical infrastructure is an area of particular importance. As my colleagues here know, I was in municipal government before and looking back at my role there, we really were not briefed. Municipalities or regional municipalities often hold a lot of the responsibility over water systems and critical infrastructure—it might be bridges in some cases—depending on the jurisdiction.
What work is being done to ensure all orders of government have the proper training or tools needed within their organizations to even be aware of what the threats might be, since they often hold the responsibility or authority over critical infrastructure?
3:55 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Thank you for the question.
We have a number of programs or regular engagements with various critical infrastructure sectors, including municipalities. We hold regular calls with them. I personally get invited to speak at their annual events or at their conferences to share with them the latest threats that we are aware of, that we are seeing or that are affecting them.
We do have an outreach program with our partnership team, which is constantly out there talking to municipalities, to critical infrastructure operators, to the health care sectors and so on, to try, as much as possible, to make them aware of the services of the cyber centre.
4 p.m.
Liberal
Jennifer O'Connell Liberal Pickering—Uxbridge, ON
Thank you.
Just quickly, in terms of talent retention, CSE would be competing with cyber and technological experts—