National Defence Committee on Feb. 10th, 2023

[Kristen Csenkey]

What I would pose here is that, when you talk about cybersecurity issues that become major cybersecurity threats, we have to back it up a bit and understand that cyber illiteracy is also a major issue for a lot of businesses and people. When we have cyber-incident reporting, that's good, but we need to sort of back it up and go from the start.

We need to ensure there are cybersecurity considerations for particular projects, for particular—

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Mr. Chair, she's not answering the question, so let's go to Mr. Rapin.

Should the public be made aware, when there's a cyber-attack under way on our major systems in Canada?

[Alexis Rapin]

I’ll answer in French, if I may.

My opinion is that yes, there should be more transparency. Of course, as researchers, we are biased because we want more information to do our work, but I think it is obviously in the public interest to have more transparency. What we see is that people do not necessarily feel like it is about them, when it is. It’s what we see with the incidents you gave as examples. People are suddenly shocked by what is happening and they do not understand what is going on, because there is very little public debate on cyber issues in Canada, since there is little information to go on.

It would be good for everyone if we could get more transparency on these issues.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Generally, how long does it take for entities to realize that their system is under attack versus dealing with a software glitch?

[Alexis Rapin]

I wouldn’t be able to give you any specific data on that.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Canada has not yet experienced a totally debilitating cyber-attack. Can you tell the committee what a full-on attack would look like?

[Alexis Rapin]

The example we often hear about is a cyberattack on the electrical grid. That could cause a lot of damage. We saw examples of that in Ukraine, in 2015 and 2016, if I remember correctly. Hundreds of thousands of people were without electricity for hours. I don’t know how vulnerable Canada’s electrical grid is.

[The Chair, Liberal, John McKay]

Mr. Rapin, I appreciate the difficulty in responding to that question, but it's still a good question. Maybe there's a possibility you could, if you have the opportunity, write a response. It may be a way to handle that.

We'll go to Mr. Sousa for three minutes.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

Thank you, Mr. Chair.

The previous testimonies talk about what seems to be a worldwide threat. This is not just Canada. We talk about the Five Eyes and the partnerships we try to engage with other states to protect ourselves and to protect the world, in essence. It affects our supply chains and ways of businesses, not just politics and elections, and not just defence. There are real economic consequences to some of these issues.

We also heard about silos and how there seem to be silos within Canada. There is greater co-operation being developed, but there are also silos around the world, even within the Five Eyes. You, yourself, mentioned that you don't know all the issues, so how do we then provide co-operation with other states and, at the same time, protect our own national security. We don't want to divulge too much information.

I am also concerned about cognitive warfare and fake news, these other incidents that take place to disrupt our way of life and our democracy. I've heard a lot of solutions and no solutions. That seems to be the answer. There's very little that we can do, because we're still trying to learn and keep up.

We heard an answer that “they don't tell us”—this Big Brother, this matrix that exists. Who are “they”?

[Alexis Rapin]

When I mentioned transparency… It can be for various types of entities.

The federal government could be more transparent. Nearly a year ago, Global Affairs Canada was hit by a major cyber incident. My sources give me very good reason to think that Russia was behind the incident and that it didn’t take long to figure out that it was the culprit.

For the time being, the government is very reluctant to disclose that information, even though it would be in the public interest and it’s important for Canadians to know.

[Charles Sousa, Liberal, Mississauga—Lakeshore, ON]

I'm going to pose the same question to you, Ms. Csenkey, because what I'm hearing is what we're always hearing—that there are a number of groups that are responsible, and they are trying to co-operate to find a solution while at the same time protecting our national security.

How do we provide the solutions you're talking about in regard to silos, where we are aware that there are discussions but there's the notion of transparency without divulging national security issues, even with other states, even beyond the Five Eyes?

[The Chair, Liberal, John McKay]

Very briefly, please.

[Kristen Csenkey]

There's a lot of content there so I'm going to try to be as quick as possible.

I would say, number one, attributions are difficult at the best of times when identifying cybersecurity attacks, motivations, the individuals or groups or states responsible for these attacks. That does make it difficult. For example, it could be a cybercriminal group that is attacking a certain target for the purpose of profit. It could be a group that is working on behalf of a—

[The Chair, Liberal, John McKay]

I apologize again, Ms. Csenkey, but I'm going to have to cut off Mr. Sousa.

You have a minute, Mr. Garon.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Ms. Csenkey, if you could submit a written response to the committee for the previous question, I would appreciate it.

Mr. Rapin, is diplomacy still a solution with China in trying to prevent cyberattacks, or should we be looking at a more preventive approach?

[Alexis Rapin]

I’m not sure I can answer your question.

I can tell you that in the US, where I think they realized much sooner that economic espionage by China, for example, is a massive problem, the Obama administration tried a diplomatic approach.

At the time, President Obama went to meet his counterpart in China and an agreement was negotiated to try to put an end to economic espionage. From what we were able to find out, it worked for about a year. In any case, there was a major decrease in Chinese economic espionage activities. At the next crisis, or for various reasons, economic espionage started up again.

I am not saying that to discredit the diplomatic approach. Diplomacy plays a role in certain aspects.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Diplomacy is therefore not enough.

[Alexis Rapin]

I would say that it has its limits, depending on the circumstances.

[The Chair, Liberal, John McKay]

We're going to have to again leave it there.

You have one minute, Mr. Boulerice.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you, Mr. Chair.

Mr. Rapin, it worries me to hear you say there have been 93 known cyber incidents in Canada since 2010, and that they are happening more often. It’s not surprising that they are coming from China, Russia, Iran and North Korea. There are espionage, surveillance and intelligence operations.

Are these cyber incidents or cyberattacks aimed at public infrastructure such as agencies and departments, or at private companies such as banks, with information being sought about members of the public?

[Alexis Rapin]

It’s not easy to say. Based on the public, open‑source information we use, the type and number of Canadian entities that have been targeted are often unclear. For example, we use reports from cybersecurity firms indicating that Canadian entities were hit. We don’t know whether there were many entities or just one or two; we also don’t know whether it’s companies, government bodies or other entities.

[The Chair, Liberal, John McKay]

Thank you, Mr. Boulerice.

Mr. Kelly, you have three minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

I want to continue talking about the 93 specific incidents that you've recorded since 2010. You said that China, Russia, Iran and North Korea are the primary...or perhaps all 93 of them can be attributed to those four countries. You talked about economic espionage, but you also talked about the surveillance of activists. Do I take it from that you're talking about dissidents in Canada, diaspora communities? You talked about the number of people who are affected.

Can you tell me how many Canadians would be victims of these kinds of attacks or the targets of these attacks? Give us more information on how these geopolitical cyber-incidents affect individual Canadians and what sort of harm is caused by these incidents.

[Alexis Rapin]

It’s difficult to give a number because these incidents can take different forms and be more or less aggressive, depending on the person being targeted. In the case of the Uyghur community, it can be extremely aggressive. In other cases, it can take other forms. Last December, for example, Amnesty International Canada was targeted by a cyberattack that likely came from China. The degree of involvement of the targeted actor varies, and the aggressiveness of the attack therefore does as well.

I think we’ve listed three countries that have so far targeted activists, NGOs or dissidents in Canada. Chronologically, the first was Saudi Arabia, which targeted a dissident living in Canada. That was brought to light by Citizen Lab at the time. Next was China, which targeted Uyghurs in particular and conducted operations against members of Falun Gong. More recently, we’ve started to see Iran doing similar things. It is currently suspected of conducting electronic espionage in relation to demonstrations.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

May I just ask you, on that point with respect to China and the use of cyber-incidents against the Chinese diaspora in Canada—against their citizens and Canadian citizens—are Beijing's diplomatic offices in Canada involved in these attacks? Is this coming strictly from outside or is this with the co-operation of their diplomatic missions in Canada?