National Defence Committee on March 10th, 2023

[Tim Callan]

Yes, the human being is always a weak link in every digital system. It's very easy to build mathematically pure cryptographic solutions that can't be defeated. It's much harder to teach people not to fall for tricks. We call this social engineering. It has been going on since before there were computers, and it continues to be a very viable attack.

We can build our computer systems to help defend people against these kinds of tricks, and you do this with things like cryptography. By putting that in place, I can ensure that it is very difficult or impossible for a worker to give access unwittingly to a criminal, as long as I build the right systems in place. These are the kinds of things that government and enterprises can pay attention to and build. This is one of the areas where we see that enterprises and government continue to be remiss in not doing everything they're able to do.

In terms of the Internet of things, this is another area where things could be much stronger than they are. We can build cryptographically secure systems that prevent devices from being methods of ingress or possible areas for disruption to our systems, our infrastructure, our manufacturing, our transportation, etc. Once again, we often see that these devices do not have the best of breach security. This owes itself to problems like cost, form factor size, available power and available bandwidth, and these other factors drive enterprises or manufacturers to skimp on security. The consequences of that are potential attacks. We've seen a lot of them against automobiles. We've seen a lot of them against infrastructure.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Mr. Callan.

As I don't have much time to speak, I would also like to ask Ms. Cianfarani some questions.

Ms. Cianfarani, I would like to hear your comments on the rigidity that the government sometimes has with regard to security clearances. For example, I've had people tell me that they applied for a position at the Communications Security Establishment and they were blocked at the last stage of verification because the Royal Canadian Mounted Police, or RCMP, was a bit strict on issuing security clearances.

Couldn't we allow ourselves to be a little more open so that there is better collaboration between the private sector and the public sector, so that people can more easily make the jump from one to the other?

Are federal security standards too strict? Aren't they simply inappropriate?

What can be fixed to ensure better collaboration?

[Christyn Cianfarani]

I assume you're talking about security clearances and classifications. I can't speak to how the agencies are screening to let in individuals with those clearances. What I can say is that because we face this on the defence file, we take a view in this country that we want the fewest security clearances possible. We think that clearing fewer people will make us safer, meaning that fewer people having access to that kind of information and knowledge will make us a safer country, because there will be perhaps fewer leaks or things like that.

Other countries have taken a very different approach now. They're starting to declassify more and more information. We've actually seen that in real time in Ukraine, where the U.K. government's GCS is declassifying information in real time to show everyone a picture of what is going on. We're seeing that as well in the updated national security strategy coming out of the United States, where they're saying they're going to declassify more information to make the public more aware.

Whether it's screening, whether it's agencies or whether it's the contract security program in this country that does it for National Defence, the lens through which we do that needs to change. I think the idea that we need to keep people out instead of bringing people in and making them more aware needs to change.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

To what extent does the fact that departments work in silos prevent collaboration with the private sector?

[Christyn Cianfarani]

I think it greatly hinders our co-operative effort. We see it on a regular basis within government entities: DND-CAF to the security agencies, and the security agencies to the government. Not to bring in the proceedings of yesterday, but you saw it in real time in foreign interference in the government itself holistically between departments—foreign affairs and public safety. We saw it in circumstances in Ottawa in the convoy situation, where government agencies provincially and municipally, and actually across the federal government, were not harmonized on approaches or information and threat sharing. We see it and feel it on our end in the private sector, where very often we're asking ourselves what is going on, whether we need to be aware, whether the threat is increasing or decreasing.

I think our siloed behaviour is a hindrance to this country, and it's a shame, because we're such a small nation.

[The Chair, Liberal, John McKay]

We're going to have to leave it there.

We have Ms. Mathyssen for six minutes.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you, Mr. Chair.

Thanks to the witnesses for appearing today.

Ms. Cianfarani, you talked about institutionalized standards, and of course we've seen a lot of back-and-forth overall between governments in terms of the idea of procurement and not having these longer-term, neutral, non-partisan types of plans, which has really gotten in the way of what I think you're talking about in terms of what the industry can do, what it can provide, how it can plan itself and how it can build, especially when small and medium-sized enterprises, as you said, are the majority of Canadian businesses.

Would you discuss some of the points around the fact that even now we seem to be shifting it again? We had a government that went sole-source for some procurement projects, and then it was refuted by another government saying we needed an open bidding process. That took a very long time and cost a lot of money. Now we seem to be shifting back to that idea of urgent operational requirements, and a lot of procurement projects are focusing on that to actually bypass that open-source procurement.

Can you talk about what that does to the industry overall from a cybersecurity perspective and also in defence procurement overall?

[Christyn Cianfarani]

We've been talking a lot, and this is under the defence policy review, the defence policy update, around a concept of continuous capability sustainment or agile procurement.

There is a time and a place for competition. Typically, nations compete when there are two foreign vendors and there is no Canadian incumbent. That is the normal way in which we see it happen around the world. When there is a Canadian incumbent—and what we're talking about here on the cyber side is that you would want to have an already trusted, curated Canadian business that you are prepared to deal with—then in that particular case, sole-sourcing is not and should not be viewed as a shortcut to the process. It should be a solution to agility.

Where it goes sideways is when you don't understand that most nations use the process of sole-sourcing or agile procurement to sustain, maintain and grow their businesses within their own country, meaning that national security is economic security. They fundamentally understand that by investing in a Canadian company, and by doing that in an agile way with trusted sources or trusted individuals, we can effectively be investing in our economy.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Wouldn't it be the case, then, that the larger companies consistently would already have an edge, but more so would eliminate the ability for those small and medium-sized enterprises to truly compete at the same level?

[Christyn Cianfarani]

Well, they don't compete at the same level. Small businesses are generally part of the supply chain.

There are two ways in which small businesses generally get directed contracts. Either you have a niche technology—that typically gets sought after by agencies and these are directed, very targeted purchases—or you have platforms or larger projects where you have a vendor of a chip, a plane or whatever, and that OEM has an entire supply chain. In those cases, what you want to do is get in on the ground floor in being a supply chain partner, a trusted partner to those OEMs. This means that you want to position your defence industrial base or your industrial base as players within that supply chain.

This is where we come to the idea of needing to ensure that we are trusted supply chain partners, by making sure that we have the appropriate regulations in place so that we don't end up with non-tariff trade barriers—in other words, those OEMs saying that we can't play in their sandbox because we are not certified. That's the way in which we ensure that the smaller business gets a piece of the action, if you will.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Okay. We are seeing quite a lot of that within procurement. One company can't do it all. They do outsource all of those pieces. They do try, especially if there are requirements in terms of Canadian procurement, indigenous procurement, for example, to meet some of those percentage standards, or what have you.

But, again, how can we ensure that those are mainly Canadian, if they are the puzzle pieces to create the overall larger standard, and that they're not actually just consumed, as we're seeing in the telecom industry, by the larger company?

[Christyn Cianfarani]

It can happen. There isn't a one-size-fits-all. There are various incentives you can use. In our country, we have what we call an offset policy or an industrial and technological benefit policy that is applied at the time at which you do procurement. That incentivizes prime contractors to use Canadian businesses within their supply chains in order to get Canadian government contracts. You can do those kinds of things.

You can also dictate the terms of your requirements and say, “I want you to work with that vendor, because they have that technology.” You can specify it in the way you do business. In the case of cyber and agile procurement, we would argue that you already have pre-trusted Canadian firms and you could simply source directly to them, which would expedite the process. You already have your trusted partners with the proper classifications that you need, and you would be able to go back to that base again and again.

[The Chair, Liberal, John McKay]

Thank you, Ms. Mathyssen.

Colleagues, again we're at the same problem. We're going to try to run a full 25-minute round. We may be chewing into the second hour, but I think it's appropriate that we do that.

We have Mr. Kelly for five minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you, Mr. Chair.

In the CADSI report, it's noted that while in Canada we take years and sometimes decades, adversaries and allies both have demonstrated their ability to deploy new cyber-capabilities in months or weeks. Just how broken is PSPC?

[Christyn Cianfarani]

Well, we're trying to apply to agile procurement a model that wasn't designed for agile procurement. What we're suggesting isn't that the current model is broken. It's that the current model is being inappropriately applied to technology.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

So the PSPC model is an inappropriate model for cybersecurity.

[Christyn Cianfarani]

Yes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. Thank you.

The urgency, from your report, is rooted in the fact that cyber-threats go faster than government decision-making processes. What does the government have to do to be able to actually make timely decisions to protect Canadians in the realm of cybersecurity?

[Christyn Cianfarani]

Well, in a model, time is the enemy. In our report—and the report you're referring to, I assume, is the 2021 report “Procurement at Cyber Speed”—for those of you who have it, page 18 is a good read. There are really three things that could be done.

You start to create these umbrella projects that procure capability. As I suggested, you break down those barriers, so you have trusted partners and there is a capability development and sustainment that is resident within a country, and you allocate funding at an umbrella level.

The other thing you could do is have more flexible funding. Right now, we have a whole approvals process. It goes through Treasury Board and there are about 200 steps if you take the old model. You would get rid of all that sausage making, if you will, and you would consider a vote of funding that has the flexibility of vote 1 and the ability to acquire new capability of vote 5.

Then, the last thing you could do is fast-track the approval and contracting process by, as I said, setting guidelines, which is where you have technology and services made by Canadian nationals with Canadian security clearances and trusted, curated Canadian businesses where taxes are paid in Canada and IP rests in Canada—boom. I can buy that.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. Thank you.

A number of years ago, the government operations committee studied procurement by small and medium-sized enterprises. You talked about the differences and how so many vendors in cybersecurity and cyber-defence are in fact small enterprises. The committee heard that small enterprises just can't cope with the requirements of the current procurement system and that it is so complicated and so impossible to deal with PSPC that only niche vendors get involved, niche vendors whose whole business model is simply figuring out how to game the procurement system. You have de facto sole-source contracting because there are just no competitors.

Is that a particular issue within procurement for cybersecurity?

[Christyn Cianfarani]

I think you would have heard from the agencies that gave the testimony that effectively they don't procure. I believe what they're doing is looking at that system and imagining that if they had to apply that system to procuring cyber-technology, boy, would that be an impediment, which is potentially one of the reasons why they don't do it. Is the system cumbersome and somewhat unwieldy, and is there a whole cottage industry around how to use it? Absolutely. That is why we're frequently here at the table saying that this can be made much better. Particularly for cyber, there are many ways in which it can be made much better and much more agile.

[The Chair, Liberal, John McKay]

You have 20 seconds, Mr. Kelly.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

For the next 20 seconds, would you like to elaborate on the recommendation from your report on the modernization of cyber-procurement?

[Christyn Cianfarani]

Well, as I mentioned, there were those three things. I don't want to reiterate them more than I already have, but again, there's the concept of umbrella projects, where there's a big chunk of funding and you can allocate it to subprojects, meaning that I could buy various technologies, try them out and integrate them into my enterprise in a very expedient manner, and the funding doesn't have to go continuously up through Treasury Board for various approval levels. Once I get a base chunk of funding, I can start allocating it through projects.

Lastly, there is this fast-tracked process, by which if a subproject meets a number of criteria that we believe are good economically and security-wise, we can procure in an agile manner without having to go through all 200 steps to make that happen.

[The Chair, Liberal, John McKay]

Thank you, Mr. Kelly.

Ms. O'Connell, you have five minutes. Go ahead, please.