National Defence Committee on Feb. 7th, 2023

[Dr. Wesley Wark]

Thank you for the question.

I would say this is something that successive privacy commissioners have been particularly keen on pursuing—and not just federal ones but provincial ones, including the previous Ontario privacy commissioner—to try to build a better model for consent that doesn't require us, as Mr. Shull suggested, to read through hundreds of pages of abstruse technical language, which none of us do.

We clearly need a better model for consent, and we clearly need better restrictions on efforts to use consent on the part of social media companies. I think there is a real role for the Government of Canada to play in that regard in terms of setting guidelines, as challenging as that might be, because the giant social media platforms will not like it, but it's something that I think we have to tackle.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

If I could just switch a bit, there was discussion previously—and Mr. Shull, I know you can't contribute but we could have a discussion in terms of what you put in your written testimony—on providing more incentives for small businesses to up their game in terms of cybersecurity. In the previous panel today, Ms. O'Connell was asking about what municipalities needed to do as a tax on that infrastructure and how they are being provided with supports, advice and what have you.

Mr. Wark, would you argue that this support needs to be provided to municipalities and other levels of government as well?

[Dr. Wesley Wark]

I'm sorry that Aaron can't take that question. I'll try to answer for both of us to the best of my ability.

I think the suggestion that Mr. Shull made about tax incentives is certainly one way forward. Regulation, at least of what we might determine to be critical data infrastructure and communications, is another. Bill C-26 may have an interesting impact in that regard, depending on what Parliament does with it. It's certainly worthy of study.

I think the conclusion that we've come to, which CSE has also spoken to, is that, while there are pretty high levels of cybersecurity capabilities, awareness and implementation on the part of the major private sector actors in Canada, including the financial sector and other aspects of critical infrastructure, the real problem is with small and medium-sized enterprises. They have neither the resources nor, perhaps, even the understanding of the degree to which they are vulnerable to cyber-attacks

I think the small and medium enterprises are the area of focus, as well as figuring out ways to help them up their game in cybersecurity in ways that are affordable and understandable to them. That is the challenge.

[The Vice-Chair, Conservative, James Bezan]

Again, thank you very much. Your time has expired.

We're going to move on to our five-minute round.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Mr. Chair, I'm sorry.

Before you move on, could we ask the witness Mr. Shull if he can answer in writing to the committee? I think these are important questions.

[The Vice-Chair, Conservative, James Bezan]

He's not online anymore. Is he?

[The Clerk of the Committee, Mr. Andrew Wilson]

He is. He's turned off his camera.

[The Vice-Chair, Conservative, James Bezan]

He's listening in.

Mr. Shull, if you could respond to all of these in writing, that would be great.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Yes, if he wishes.

[The Vice-Chair, Conservative, James Bezan]

I know it's a bit more work, but we appreciate the input.

Moving on, Mr. Kelly, you have five minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

All right.

In addition to, or maybe in expansion of some of what you said in your opening remarks, can you give us some description of the impact of a potential successful cyber-attack on civilian life in Canada?

[Dr. Wesley Wark]

I thank you for the question.

Mr. Kelly, we've seen a few examples of attacks on Canadian holders of data and private information over the years. We haven't seen crippling attacks at this stage, I would say. Probably the worst of the attacks that we've seen goes back a number of years now. That was the hack into the National Research Council. It took a long time to rebuild systems in response to that attack.

We're learning as we're going, so I don't have an example to offer you other than these isolated incidents, but we're learning as we go.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

During the study that took place less than a year ago—it was a broader study, but we looked at cybersecurity—there was discussion about the gaps that exist between the Canadian Armed Forces and the Canadian Security Establishment.

In the time since then, would you say that the gaps still exist? Have they been adequately filled? What are the gaps between our institutions?

[Dr. Wesley Wark]

Mr. Chair, I'd answer that question by saying it would be interesting to hear from CFINTCOM, in particular, on that, because that's the organization within DND that is most affected by developments.

What we've seen recently—it was highlighted in the defence “Strong, Secure, Engaged” strategy in 2017, and perhaps will be reinforced in the update, whenever that appears—is that the Canadian Armed Forces decided it needed a much enhanced capacity to engage in cybersecurity and have cyber-capabilities for its own offensive and defensive operations. It has been attempting to build up an independent, stand-alone capability in that regard under its own mandate. CSE has been able to assist it.

It's not so much that there are gaps between CSE and CFINTCOM, as I would understand it. It's more the question of how well the Canadian Armed Forces and, particularly, CFINTCOM have been able to build that cadre of cyberwarriors that they need.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

You talked about resources, too, a bit in your opening statement. We're very familiar with the extraordinary cost of ships, jets, tanks and whatnot.

Is there a budget shortfall? Are there additional budget demands necessary to successfully undertake proper cybersecurity? Is it more a question of hiring the right personnel? Are there hardware and important budgetary items that cost money that we're deficient in or should budget for in the future?

[Dr. Wesley Wark]

Thank you.

I think the answer to that question is that probably everything comes into play. I think the key challenges for CFINTCOM in particular in building its capabilities are partly technological—having access to the best kinds of systems they'll need—and also in terms of human resource capability. It's about finding that kind of talented pool of either civilian or armed forces members who can contribute to a sort of cyber cadre within the Department of National Defence. In that respect, they face the same challenges, although perhaps magnified, that CSE faces in terms of maintaining the workforce, which was the subject of questions here and that CSE responded to.

I think it's a particular difficulty for CFINTCOM. It's also the case that armed forces are not necessarily institutions that change rapidly, culturally, and we've seen this in many respects.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you. I have less than a minute left.

For these systems that you say we need access to, what kind of budget is necessary to ensure that we have adequate systems in place?

[Dr. Wesley Wark]

I couldn't really answer that question, to be honest. I'm not sure it's a huge price tag. It's just being able to identify the systems and acquire them. That is probably the key challenge.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

The speed of procurement is a factor, then.

[Dr. Wesley Wark]

Yes.

[The Vice-Chair, Conservative, James Bezan]

We're running out of time here. We have to be judicious in these last few minutes.

Go ahead, Mr. Fisher.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you very much, Mr. Chair.

Thank you to our witnesses for being here today.

We've heard a fair bit today about critical infrastructure. Ms. O'Connell asked about it in the last panel, and I think Ms. Kramp-Neuman talked about it as well. I'm wondering particularly how certain sectors could be a target for state-sponsored cyber-attacks as a means to attack Canada without the use of conventional military means.

I am interested in thoughts from both of you, but perhaps one we'll get in writing and one we'll get from Mr. Wark. I am interested in the sectors that you see as being under the greatest threat. I think about the Rogers outage and I think about how that impacted people all across Canada. I think about natural disasters like Fiona. It outlined our reliance on power, telecoms, gas and ATMs. The fact is that the Internet was once a luxury, and now it seems to be a necessity. You can't do a thing when something like this happens.

I am interested in your thoughts, Dr. Wark, on which sectors you see as being under the greatest threat.

[Dr. Wesley Wark]

Thank you for the question.

I'm going to surprise you, perhaps, by saying that there is one sector that we have not typically considered being part of critical infrastructure but that we need to consider in the future, and that's space. Increasingly, we're going to rely on space-based platforms for critical infrastructure, communications, monitoring of climate change impacts and a whole range of things.

My hope is certainly that in the forthcoming critical infrastructure strategy the government is working on, they will include space as a new sector. I would say that is probably the most vulnerable area, because it is so new and because it is changing and developing so rapidly. There's a Canadian role to play there. Space is a big one.

The other thing I would say is that signals intelligence agencies, CSE and Five Eyes and other ones, have said that what we're facing are probing attacks at the moment by foreign state adversaries who are trying to figure out how our critical infrastructure systems work and where the vulnerabilities are. Will we actually see attacks on those systems, short of war? That's very hard to know. Probably, the answer is that it's not likely because it has such an escalatory impact, but there are certain aspects of it, in particular in terms of democratic practices and election infrastructure, for example, that can be vulnerable.

I would say that space and those critical infrastructure systems that feed our democratic needs around elections in particular are two key issues.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thinking about Fiona and Atlantic Canada, does a natural disaster provide an opportunity for a cyber-attack, acknowledging the reliance on such things as the energy sector, the banking system and so on?

[Dr. Wesley Wark]

That's an interesting question. I don't really know the answer to it.

I think for those adversaries that might be paying attention, it would be a thing to look at to see how well a country can respond or recover and where the vulnerabilities might be exposed in terms of critical infrastructure, communications, services and so on. It's probably more in the field of study than anything else.