National Defence Committee on Feb. 14th, 2023

[RAdm Lou Carosielli]

That is a very important question, as the CSE and CAF relationship has been a long-standing relationship, and it is continuing through cyber. CSE and CAF work closely day in and day out.

As you would have heard last week from the CSE discussion, CSE personnel are embedded within the CAF teams and CAF personnel are embedded within the CSE teams. We share information. We share tools. We share intelligence between the two organizations and mutually support each other in operations for CSE, as well as in operations for the Canadian Armed Forces.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Is this a formalized relationship? If it isn't, do you have plans to further improve or formalize this relationship?

I saw Mr. Quinn wanted to start. I apologize if I cut you off there.

[Jonathan Quinn]

It's no problem.

I was simply going to add that Admiral Carosielli has outlined the really close operational ties and relationship between DND, CAF and CSE. I was going to add that the close relationship also extends to the policy sphere.

I work extraordinarily closely with my counterparts at CSE on policy questions, and we're fully joined. We collaborate very closely across the board with CSE.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

How would this relationship compare with the one we have with our allies?

[RAdm Lou Carosielli]

Our relationship with our allies is as important as our relationship with CSE. We work very closely with the U.S. Of course, working with the U.S. is important for not only the defence but also the prosperity of North America.

We are very closely aligned with U.S. Cyber Command, so much so that I have a liaison officer embedded within U.S. Cyber Command, as well as numerous personnel who range all the way from cyber-operators to cyber operations planners. This is very important for us. It's an ability for us to have daily conversations. I participate in weekly discussions with U.S. Cyber Command, and that is absolutely critical for us.

We work with U.S. Cyber Command, and our allies within the Five Eyes and NATO, in order to ensure we meet the requirements of our allies and partners, as well as Canada's.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

How does the CAF's cyber capability differ from CSE's?

[RAdm Lou Carosielli]

The CAF and CSE cyber capabilities differ for the principal reason that we do not want to duplicate or have redundant capabilities. CSE has more specialized technical expertise, while the Canadian Armed Forces are typically used for the last mile, in order to ensure that we have intelligence that supports both CSE and the CAF.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

You mentioned that we're providing cybersecurity expertise to Ukraine. When and how do the CAF and CSE work together on operations, and under which circumstances would the CAF operate independently?

[RAdm Lou Carosielli]

The CAF and CSE operate together, depending on what support is required and under whose authorities certain operations are being done.

If a specific military operation is being done under CAF authorities and we need some support in the form of intelligence or tools, we can get that via section 20 of the CSE Act.

Similarly, if CSE is working on something and they need some of our subject matter expertise, there are ways for them to ask for our support. We can provide that and support them under CSE authorities in order to meet the requirements of Canada.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you so much.

I'm going to switch, for a quick second, to cyber capabilities.

When we think about Russia, we certainly always put them in the top four. Perhaps they're even number one when it comes to cyber capabilities. We also thought the same about their military power, until we saw the unlawful war in Ukraine.

Is critical thinking making a comeback? Are their cyber capabilities less overwhelming than we thought? I know they practise hybrid warfare with a bit of disinformation, a bit of cyber capability, and then some traditional combat, as we're seeing in Ukraine.

[RAdm Lou Carosielli]

It is a very important question and it's very germane to what's going on in Russia and Ukraine.

Russia is still a very serious cyber-actor. As you indicated, the top four are Russia, China, Iran and North Korea.

With respect to your comments on cyberwarfare and more traditional conventional warfare, early in the fall we definitely saw a direct link between cyber events and kinetic activity. Just prior to any bombing of an area, we would see an increase in utilization of servers and IT systems that preceded a target being hit shortly thereafter.

There is a link between their cyber activity and their kinetic, conventional activity.

[The Chair, Liberal, John McKay]

Thank you, Mr. Fisher.

Before we go to Ms. Normandin, can you explain what you mean by “the last mile”?

[RAdm Lou Carosielli]

Absolutely, Mr. Chair.

We talk about “the last mile” in-country. CSE personnel do not typically go into war zones or conflict zones, so in Canadian missions the last mile is done by Canadian Armed Forces personnel.

[The Chair, Liberal, John McKay]

Thank you.

Madame Normandin, you have six minutes.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

Thank you for being here, gentlemen.

Rear-Admiral Carosielli, I would like you to talk more about cyber operations. You mentioned the case of Ukraine, which was assisted by Canada as a result of attacks. I would like to hear more about how quickly you are able to get government approval to develop cyber projects.

Is there a problem with the time it takes to get the authorization, or is everything fine? Do you have any recommendations to make regarding authorizations?

[RAdm Lou Carosielli]

Thank you for your question.

Cyber operations by the Canadian Armed Forces may be conducted as long as they receive a mandate to do so during a mission. In such cases, authorizations are given by the Government of Canada or by Cabinet.

Operations are also done under a mandate given by the Communications Security Establishment, the CSE. I believe that, in that case, the approval is given by the Department of National Defence and the Department of Foreign Affairs.

Operations in the course of missions are approved through a very well-established process. As for those coming from the CSE, unfortunately I cannot tell you more.

[Christine Normandin, Bloc, Saint-Jean, QC]

I would like to know more about the supply of equipment that supports these missions. I am thinking about computer equipment, because you often have to be on the cutting edge of technology.

Does the equipment of the Canadian Armed Forces allow them to conduct successful operations?

Should they have access to more state-of-the-art equipment and should it be supplied to them quicker?

[RAdm Lou Carosielli]

Just as is the case for other government departments and for the industry, the Canadian Armed Forces and cyber forces have logistical support issues. They had that problem during the COVID‑19 pandemic, for example.

With respect to procurement in Canada, this requires a full departmental effort. We work with Public Services and Procurement Canada and Innovation, Science and Economic Development Canada to make sure that our projects move forward efficiently and that we find innovative equipment.

We will certainly continue to reach out to industries so that they can maintain an open and competitive supply chain and be aware of what the future holds.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

My next question may be more for you, Mr. Quinn, but please, both of you can answer, if you feel like it.

You mentioned international cyberspace policy. From what I understand, that involves accountability for governments to report malicious activity that is happening on their territory. I would like to know how easy it is to obtain this information from other countries, with a particular focus on the private sector.

Is the private sector an issue in other countries as well as here? Because they do not necessarily want to disclose information about attacks that we may have experienced, for example.

[Jonathan Quinn]

Thank you for your question.

Absolutely, attribution of cyber-attacks and malicious cyber-activity is a challenge. By their very nature, they tend to be intended to be covert action. Canada's position in the statement I alluded to on our interpretation of international law in the opening remarks is really just to be transparent and hold ourselves to account in Canada and to set a standard for our own behaviour in cyberspace and to lay out our interpretation of law.

There is an active effort when there is a malicious cyber-event in Canada to determine where it came from, but as you rightly mention, it is a challenging space. There's a process led by our colleagues at Global Affairs Canada to attribute publicly, when it's in our interest to do so, when those attacks occur and where they come from and to lay out some details, but it's only when there is really strong, defensible proof of the origin of that attack that a public attribution is made.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you.

Are other countries in the world as transparent about the information they give out when they are under attack?

[Jonathan Quinn]

Thank you for your question.

I would say that among our allies and like-minded countries there's a concerted effort to be transparent.

Again, I'm slightly outside of my lane—it's a Global Affairs lead—but as I understand it, I think that publication of various states' interpretation of international law as it relates to cyberspace began as a G7 initiative, if I'm not mistaken. Certainly our like-minded allies are committed to it, and there are efforts to encourage other countries to take a similar approach, but as is the case in a lot of issues in this domain, it's a bit of a mixed bag in terms of different countries' adherence to and commitments to transparency in this domain.

[The Chair, Liberal, John McKay]

Thank you, Madame Normandin.

Mr. Bachrach, welcome to the committee.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Thank you, Mr. Chair.

Thank you to the committee members for allowing me to sit in on behalf of my colleague Ms. Mathyssen to talk about this very important and interesting matter.

I want to also thank Rear-Admiral Carosielli and Mr. Quinn for their testimony so far.

I want to pick up on a few of the lines of questioning we've heard already. Particularly with the events of the last week, I think there's a growing interest and concern on the part of Canadians when it comes to cybersecurity.

There's also some confusion as to where Canada's cybersecurity strategy is coming from. We have the cyber force that you command, Rear-Admiral. We have the Communications Security Establishment—the CSE—under National Defence. We have CSIS and Shared Services Canada. All of these different organizations work together when it comes to protecting our critical infrastructure from cyber-attacks and preventing vulnerabilities. Which department and decision-maker is at the top when it comes to establishing Canada's strategy on cybersecurity?

[Jonathan Quinn]

Mr. Chair, I'll start, and the admiral may have something to add.

It's a great question. It is a complicated space. There are lots of players across government in this area. In terms of the Canadian federal lead for cybersecurity—ensuring the security of government networks, providing assistance to holders of networks in critical infrastructure and that sort of thing— Public Safety has the overall lead.

The Canadian cybersecurity centre was specifically established. It's a CSE body, but it also works under policy set by Public Safety. It has an important role to play there in sharing best practices, providing assistance to Canadian companies, and identifying and mitigating threats.

The Canadian Armed Forces come in. Admiral Carosielli can speak a little bit more to this as well. Unlike other government departments, DND and CAF have the responsibility to defend and secure their own classified networks. That's a bit unique in the federal government.

As I mentioned in my opening remarks, in “Strong, Secure, Engaged”, the government announced its intention to allow the Canadian Armed Forces to conduct offensive cyber-operations as well, in pursuit of Canadian interests. As has been discussed previously, we do those in close partnership with our colleagues at the Communications Security Establishment.

Admiral, did you want to add anything to that?