National Defence Committee on Feb. 7th, 2023

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

Switching gears, I'll address my next question to Dr. Shull.

There have been growing concerns over the use of social media and the information Canadians wilfully provide international companies on our cybersecurity. How does social media consumption make us easier targets for these international cyber-threats?

[Aaron Shull]

There is traditional cybersecurity, which is usually unauthorized access to systems and data. What you're talking about—and I really liked the question—goes a bit deeper, to societal resilience. We're talking about people and people's views of the world.

When we think about disinformation, misinformation or malinformation, the point is that people are persuadable. There are sophisticated influence campaigns that are taking place all the time to try to change our discourse, to sow societal division and to pull people in different directions, when we need to be uniting. The point here is that many of those capabilities are commercial and off-the-shelf. The highest profile example was the 2016 election in the United States, when the Russians got involved.

The point here is that the system didn't malfunction. It functioned as it was built. What we have is social intermediation with platforms sitting at the middle of our social discourse, and their incentive is profit. Their incentive is eyeballs. That's what we've built for ourselves.

It's a bigger conversation than just the cybersecurity stuff, but it's a great question.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

To add to that, what kind of access or power are consumers providing companies when agreeing to these terms and conditions?

[Aaron Shull]

That could be the subject of a Ph.D. dissertation.

I would say, to read all the terms of service that you've agreed to all year, there is some estimate that it would take the average individual something like 200 days.

I think the broader point is that we have built our entire system based on consent, which is a fallacy. It's a lie. The fact is that we don't know what we're consenting to. For a case in point, one company stuck in their terms of service that if you agreed to their terms, then they would own your soul forever, so now there's one company in San Francisco that just doesn't know what to do with all the souls that it owns.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Going back to you, Dr. Wark, as we have you in the room, how do you see Canada's current investment in infrastructure compared with that of other countries like the United States, for example?

[Dr. Wesley Wark]

I'm sorry, but you're talking about investment in infrastructure...?

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

I mean in comparison with that of other countries like the United States.

[Dr. Wesley Wark]

I would say we have a long way to go in deciding what we want to do about critical infrastructure. Let's put it that way.

We're waiting for a critical infrastructure strategy, which has been under study by the federal government. You will have seen a reference to Bill C-26, which refers to critical infrastructure. We have a list of critical infrastructure that dates back to 2009. In other words, it hasn't been updated since that time, which is the last time we had a critical infrastructure strategy.

The starting point is going to have to be to decide what we mean by “critical infrastructure”. Once we've done that—that will be an important but not an easy step—then we can think about regulating the terms under which critical infrastructure functions and what we expect of them in terms of, particularly, cybersecurity strategies.

There's some of that under way, obviously informally. Some aspects of critical infrastructure have done a terrific job in terms of ensuring they have very high levels of cybersecurity. The major banks are probably a key example of that. Across the board, the system is very diverse.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

That's excellent. Thank you very much.

[The Vice-Chair, Conservative, James Bezan]

Mr. Sousa, you have the floor.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

Thank you very much.

Thanks to both of you for your presentations. I appreciate them. I appreciate your highlighting some of the issues as they relate to the war in Ukraine and Russia and the various actors out there in foreign bodies who are creating stress for all of us.

You did talk a little bit about the cognitive warfare, the misinformation and those sorts of issues that are also prevalent and creating some havoc—tactics not necessarily to hold us ransom but rather to feed us misinformation.

Can you tell me, besides the foreign actors, how prevalent that is on our domestic soil?

[Dr. Wesley Wark]

Thank you for the question.

First of all, we're coming up with a more sophisticated understanding of what's going on in the information space. It's important to understand that we make distinctions among three different categories of information out there that may be troubling to us.

One is misinformation, which is defined by CSE, among others, as information that is false but not deliberately disseminated as being false. In other words, someone believes it even though it's untrue. There's, of course, a great deal of that and a lot of it circulating on social media channels. We saw its impact, for example, in the “freedom convoy” events in Ottawa and across the country last year.

Another form is disinformation, which is defined as information, often deliberately put out by foreign state adversaries, that is deliberately deceptive and untrue and designed, for various reasons, to undermine the state of a society. There are certain actors out there, including Russia and China, that are particularly good at disinformation. Russia has taken a lead, and we've seen a lot of that in the Ukraine war.

Then there's a third category, which I think really deserves a lot of attention, that CSE and its American counterpart have defined as malinformation. This is the grey area between disinformation and misinformation—the manipulation of information that's partly true and partly false to achieve certain objectives.

We're coming up with a more sophisticated understanding of how these different aspects of false information circulate and have an impact, but we're only at the beginning of a study of this. Frankly it's very difficult to know what to do about it other than trying to block foreign state actor activity.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

The concentration is certainly on the foreign side. Are you not looking as much at what is happening domestically here?

[Dr. Wesley Wark]

In terms of intervening in the domestic space for political discourse, that raises important charter protection issues.

It's much more straightforward, although technically still very complex, to deal with something that is clearly improper and illegal, which is foreign state activity. This is why CSE, among other departments of the federal government, has a mandate to deal with foreign state disinformation.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

How effective are AI and quantum technologies? Is this part of where these foreign state cybersecurity measures are being taken?

[Dr. Wesley Wark]

AI is certainly an enabler. Artificial intelligence has already been used already in various ways. Quantum computing and quantum applications are for the future, and I am no expert on them. Frankly, I hope not to be here when they're finally introduced. They are for the future. We can speculate a lot about what they might look like, but we're not there yet.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

Are we winning against these cyber-threats from Russia and China?

[Dr. Wesley Wark]

That's a good question.

I think we are holding our own. The reason I think it's particularly important to pay attention to the Ukraine war is that it's a laboratory for cyberwarfare. It's really the first significant laboratory we've seen. Everything that's been used by Russia against Ukraine, and the way in which Ukraine has responded, is very important for us as a matter of study. We're in a fortunate position to be able to study this.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

Is Ukraine being effective in their counterattacks on this?

[Dr. Wesley Wark]

They are. I would say that they are partly because they have had long experience in this, going back to 2014 and the initial Russian incursion into Crimea and elsewhere. They've been ramping up their capabilities. They've not only been developing domestic capabilities and having popular support to do that. They've also had a lot of assistance from key allies in the west and from all the Five Eyes partners.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

When you're looking at the infrastructure being deployed by Canada relative to some of these efforts by foreign players, are we partnering now with NATO and others to enable us to fight cybersecurity collectively? In so doing, are we exposing ourselves to yet other actors?

[Dr. Wesley Wark]

I think it's an interesting question.

I think the key alliance network in which Canada participates and where we're able to do significant work is the Five Eyes partnership. Many of the Five Eyes members, or at least some of them, are also members of NATO—Canada, the U.S., the U.K.—so it spills over into NATO. The Five Eyes is the key partnership for enhancing cybersecurity. A lot of work is going on there, I think, behind the scenes.

Very quickly, I would like to draw the committee's attention to one of the problems we have in Canada. CSE has a certain mandate. You see it in their cyber-threat assessment, which CSE officials have mentioned. They want to talk about strategic threats to Canada—that is, foreign state active threats—because that's in their mandate. There's a whole other world of threats to Canada and Canadians, including through cybercrime, which is not CSE's issue. It is the issue of the RCMP.

This is just a plea to the committee that, if you have the time in this study or in the future, we really need to have a look at how the RCMP is able to deal with this vast world of cybercrime and its impacts.

[The Vice-Chair, Conservative, James Bezan]

Thank you.

Welcome to the Standing Committee on National Defence, Mr. Desilets.

You have 16 minutes. Please go ahead.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Did you say “16 minutes”, Mr. Chair?

[The Vice-Chair, Conservative, James Bezan]

It's six. You have six minutes.