National Defence Committee on Feb. 7th, 2023

[The Vice-Chair, Conservative, James Bezan]

I will just pause you for a quick minute. We're getting French interpretation on the English channel.

Okay. Please try again.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you.

Just on retention or recruitment, I would assume we'd be competing in this space with Silicon Valley, etc. What is the strategy to ensure we continue to retain and recruit the best talent in this space?

[Sami Khoury]

Thank you again for this important question.

Recruitment is challenging, and it's a highly competitive space out there. We are trying to hire for a number of positions, for a variety of positions, and to ensure that we hire Canadians who represent the rich and diverse society in which we live.

Currently we are modernizing our multidisciplinary recruitment effort to attract the top talent and investing in a student program and a co-op program to make sure that our talent pool is rich. We are very engaged in communities to raise cybersecurity awareness in presentations to students to get them interested in the STEM field and are also investing in the retention of our current workforce. We have been named as a top employer three years in a row.

[The Vice-Chair, Conservative, James Bezan]

Your time has expired.

Ms. Normandin, you may go ahead for six minutes.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Mr. Chair.

Ms. Tayyeb and Mr. Khoury, thank you for being here.

My questions are along the same lines as Ms. O'Connell's.

Can you tell us about the similarities between what you do and what the Canadian Armed Forces does? We've heard from witnesses that there are problems.

My question is about human resources.

Does the challenge of recruiting people and the fact that the private sector is such a competitive employer create risks when it comes to security?

[Sami Khoury]

We are very mindful of the challenges associated with the current employment landscape. We endeavour to attract talent from all over Canada. We do not focus only on the national capital region. We try to hire people from all over the country with expertise in different areas. We also try to hire students, including those doing co‑op placements. It's not only professionals who join our organization. We have employees who bring a lot of talent to CSE. That's where we are focusing our efforts.

We are also exploring the possibility of hiring people willing to live in regions in order to support cybersecurity activities. We aren't just hiring people willing to move to Ottawa. People can provide support locally.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

I would be remiss if I didn't ask about the hot topic, McKinsey & Company. We've talked a lot about that firm in recent weeks. We've also talked a lot about IT and other services being contracted out to various private firms.

Does CSE engage in similar contracting?

If so, how do you ensure those services are delivered securely, knowing how many clients those firms have?

[Sami Khoury]

Thank you for your question.

To my knowledge, we don't have any contracts with that firm. I can send you more information in writing after the meeting, if you'd like.

As far as the security of contracts is concerned, each department is responsible for safeguarding its data. Our job is to establish security standards for various contracts, but not individually. Departments are responsible for adhering to those standards.

I hope that answers your question.

[Christine Normandin, Bloc, Saint-Jean, QC]

If I understand correctly, your organization doesn't have a contract with McKinsey & Company, specifically.

Do you have contracts with other firms, then?

[Sami Khoury]

As far as I know, we don't have contracts with other firms. Again, I'd be happy to follow up in writing.

[Christine Normandin, Bloc, Saint-Jean, QC]

I'd appreciate that. Thank you.

From time to time, you conduct defensive cyber operations, and that requires ministerial authorization. How quickly are you able to get that authorization?

Is there anything that would make the process more efficient and help you respond more quickly, for example, when you're dealing with issues related to a certain situation?

[Alia Tayyeb]

Thank you for your question.

We are always looking for ways to improve how we do things. We recently made a programming investment, and mainly, that helped us improve our ability to work with our foreign affairs colleagues. They play a very important role in our approval process.

I think what's important here is that we work very closely with our colleagues, both in the cyber centre and at Global Affairs Canada. They are responsible, with us, for providing assistance and advice in terms of our operational planning. However, we have been able to respond very quickly to threats as they have emerged.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

Other challenges facing the Canadian Armed Forces have to do with procurement and security clearances. It takes too long for the armed forces to acquire the high-tech equipment it needs for a specific project and too long for prospective employees to receive their security clearance. I'd like you to comment on those issues.

[Sami Khoury]

I can answer that. Thank you.

The pandemic certainly disrupted the supply chain, and we are having just as much trouble as other departments when it comes to acquiring electronics and networking equipment to build our capacity. We are mindful of that. We try to work with companies to speed up the delivery of certain products, but we are just as affected by the situation as their other clients.

[The Vice-Chair, Conservative, James Bezan]

Ms. Mathyssen, you get the last six minutes in this first round.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you, Mr. Chair.

Thank you to the witnesses for being here today.

I wanted to pick up where Ms. Normandin was in terms of discussing those contracts. They are certainly on a lot of our minds as of late.

Mr. Khoury, in terms of that information, those recommendations that you make to a lot of those departments, government departments, critical infrastructure and those contractors who are handling specific information, delicate information, private information and sensitive data on behalf of government, how do you provide them with those best practices? How do you monitor how they follow that in each department?

You said that they have to do it themselves, but do you play a role at all in that provision and monitoring?

[Sami Khoury]

Thank you for the question.

We come up with the various information security standards that are out there: protected A, protected B, protected C. We communicate those standards. They are sort of promulgated through Treasury Board. With each of these levels of classification, departments are aware of what information is classified as protected B or protected C, or what is secret and what is top secret. The departments themselves have to live by those standards. We don't audit them per se.

Sometimes we get pulled into specific projects. At that point, we provide some security advice to the project and ensure that the information security of the project is commensurate with the classification of the information. We don't review on a contract-by-contract basis what information is being provided to the contractor. I'm talking about it from an IT perspective, because my primary concern is cybersecurity and IT security.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

In terms of those private contracts, they would have access to delicate information. Other than the department monitoring itself, do you or CSE not see any potential problems with that within departments? Do they not have any obligation or accountability to report to you?

[Sami Khoury]

Each department has a departmental security officer. We have a community of those who meet on a regular basis. Treasury Board is the policy arm of our community. We would work with them to ensure that the information is promulgated as much as possible, but we don't go and audit departments to understand how it is that they are handling the information at the proper classification level.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Do you see that as a potential problem, though? This may be something we could recommend going forward, so that there is more communication between those departments and CSE or your centre specifically, in order to have better information on problems that could be happening across departments with sensitive information.

[Sami Khoury]

Thank you again for the question.

I think departments know how to reach out, whether it's to Treasury Board or to us, if there is any clarity being sought on what is the proper classification of information. I personally have been in a number of conversations where we talked about the level of the classification of the information at hand and what is the proper security profile that we need to apply to the IT system in order to protect that information. Those forums exist today, and those channels exist today.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Quite literally, it's in your name. You're the centre. You're supposed to be bringing a lot of this information together. My concern is that, for some of these contractors, if you were to see patterns, it would be more helpful, I would assume, but in terms of those companies who may be repeat violators of those best practices in terms of cybersecurity for those departments, would you be able to see those patterns?

Also, we have seen in the United States, for example, that a company like Deloitte has actually been seen to release very sensitive information. In 2017, in that massive data breach, for the Department of Defense, Department of Homeland Security, the State Department and the National Institutes of Health, they leaked passwords, IP addresses and sensitive information.

When you see that happening internationally and then those same companies are being used here in Canada across the board within our own government, do you provide any of that feedback or any of those warnings? Do you recommend not using those companies that have had these problems? Do you monitor that? Do you track that? Do you provide those recommendations?

[Sami Khoury]

Thank you again for the question.

I would defer to PSPC on anything that has to do with contracting. Our role is very much to review the security architecture sometimes, and we would work with them.

Departments have the responsibility to do the SA and A of their systems. They review the security accreditation of their systems, and we get involved in those accreditations. Before the system goes live, obviously if it contains sensitive information the department will have to accredit that it has met the security baseline that the cyber centre has established. Sometimes we are part of the project, so we get involved in that.

On repeat offenders and contracting issues, I would respectfully defer that to PSPC.

[The Vice-Chair, Conservative, James Bezan]

We're going to have to cut it off there. We're slightly over on our time.

Ms. Kramp-Neuman, you have the floor for five minutes, please.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you, Chair.

Thank you to the witnesses.

Here's my first question. Due to the competitive nature of cyber-employment opportunities, is it safe to assume or accurate to assume that the Canada security establishment struggles in acquiring employees with the actual skills that are required for cybersecurity and to combat cyberwarfare?