Thank you, Mr. Chair.
I will make my statement in English. However, I will be happy to answer your questions in English or French.
The statement was distributed to you beforehand, so I will skip some parts of it.
Harvard University’s Belfer Center's cyber-power index ranks Canada in eighth place as a comprehensive global cyber-power. The CPI characterizes Canada as a high-intent, low-capacity cyber-power with notable strengths in cyber-defence, cyber-norms development initiatives and surveillance. By contrast, Canada’s intent and capability to conduct cyber-enhanced foreign intelligence and offensive cyber-operations place it in the middle of the CPI pack, lagging behind Russia and China and its Five Eyes partners—in particular, the U.S. and the U.K.—as well as the Netherlands and Israel. On the one hand, CPI’s evaluation of Canada reflects two decades of Canadian cybersecurity initiatives. On the other hand, the ranking shows that Canada has a strategic cyber-deficit.
For 20 years, cyber-diplomacy has largely failed to generate broad agreement on international norms to constrain malicious behaviour by state-based and state-tolerated actors in cyberspace. To deter and constrain bad behaviour, western states need to engage using active and offensive cyber-measures. This is what the U.S. doctrine of persistent engagement has been enabling since 2018. However, no U.S. ally comes close to matching U.S. resources and capabilities.
The 2019 passage of Bill C-59 expanded the role and impact Canada could have in cyberspace by authorizing CSE to conduct offensive cyber-operations. The addition of these capabilities to CSE’s mandate was hailed as a major step. In theory, the combination of foreign intelligence, active cyber-operations and defensive cyber-operation mandates enables the full spectrum of cyber-espionage, sabotage and subversion operations. Canada now has the capacity but lacks the political will to demonstrate independent international leadership to reduce instability and uncertainty in cyberspace.
I propose a cyber-doctrine of functional engagement to bolster tacitly accepted cyber-norms. Regularly employing cyber-capabilities is the most effective way for Canada to reduce uncertainty in cyberspace and limit threats to its national interests.
Due to Canada’s resource constraints and limited foreign policy ambitions, functional engagement prescribes that Canada employ the full range of its cyber-capabilities to establish and reinforce a limited set of clearly defined and communicated focal points to deter and constrain unacceptable behaviour.
Instead of continuously and globally employing cyber-capabilities to change the overall balance of power in the international system, functional engagement calls for Canada to employ its cyber-capabilities more narrowly, in specific instances when a malicious cyber-actor conducts activity that is antithetical to Canada’s focal points, such as by directly degrading Canadian sovereignty and the security of its people; degrading or subverting international law and the integrity of international, electoral or democratic institutions; and undermining Canada’s economic security, competitiveness and prosperity.
The proposed cyber-doctrine of functional engagement seeks to shape adversarial behaviour cumulatively by strengthening tacitly accepted cyber-norms within the limited resources and unique character of Canada’s historical leadership on foreign policy niches as a traditional middle power.
Thank you for your attention.