National Defence Committee on March 10th, 2023

[Dr. Christian Leuprecht]

It's a great question. We've tried for 20 years to build norms and consensus around this, and we've made very little progress within the UN and within other bodies.

What you need to understand is that there are people who believe in the liberal rules-based international order—that's about 57 countries—there are countries that are agnostic, and then there's a subset of countries that simply do not believe in that order, so we will never get an international cyber-governance regime, at least not in the foreseeable future, but we can force hostile actors [Technical difficulty—Editor]. We can deter them from bad behaviour if they know that the United States and its allies lay out big, clear red lines, such that there will be serious repercussions for that actor—whether in cyberspace or kinetic, through sanctions or otherwise—for crossing those lines. My opening statement lays out precisely that sort of mechanism.

However, the Government of Canada has been extremely reticent in using the powers that were given to CSE in Bill C-59 once the act received royal assent. The challenge is, then, what is the point of providing those powers if we're not actually going to use them to advance our interests? Canada has always prided itself on being a country that builds and then enforces international norms and rules, but when it comes to cyberspace, by not using those powers we are effectively doing exactly the opposite.

Now that we have those powers, we also need to use them to defend our interests and our allies' interests. The reason we need to use them is that this is a very particular role for the state to play, because private sector actors and other public sector actors do not have active and offensive capabilities that they can employ. Only the state can deploy those capabilities, so only the state can be proactive in either interdicting or, if need be, in cyberspace, also perhaps sabotaging the capabilities of state-based or state-tolerated malicious actors.

[The Chair, Liberal, John McKay]

Thank you.

I'll just take a brief second here. Professor Leuprecht, could you mute yourself when you're not speaking? I appreciate that it may be a bit difficult, but if you could do that, it would help with the quality of the transmission.

Emmanuella, go ahead.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Thanks.

I appreciate your response. I'm wondering, because I'm not super familiar with Bill C‑59, if you can let us know if there are any gaps that currently exist in that bill that create a difference, let's say, between our capabilities and those of the U.S. If it were to become strengthened in times of need in the future, in what ways can it be strengthened?

[Dr. Christian Leuprecht]

It's not about strengthening the bill. It's about making sure that we use effectively the capabilities we have. The U.S. has vast capabilities that it uses on a regular basis, in part to prevent a change in the international balance of power. That is not primarily Canada's objective, although Canada's objective is inherently to uphold the status quo.

Canada's outline in the last paragraph of my statement [Technical difficulty—Editor] three clear focal points of red lines that Canada will not tolerate and where adversaries will know that Canada will deploy, either alone or with its allies, these active or offensive measures as provided for in Bill C‑59. The problem is that Canada has not been willing, by and large, to engage in these measures, with some exceptions of hunt forward teams when it comes, for instance, to issues such as those of Ukraine.

Canada needs to be a bit bolder in how it uses the powers that the agencies have been granted to defend Canadian interests.

[Emmanuella Lambropoulos, Liberal, Saint-Laurent, QC]

Would you say that there is a benefit to acting fast, before something major happens? Do we lose some of the ability to respond to a threat if we wait longer?

[Dr. Christian Leuprecht]

It is a fantastic question, and it hits the nail on the head.

The problem with current political decision-making processes—not with respect to any particular government in this country—for years has been that we dither too long in making key decisions where we need to provide political authority, authorization and direction. The longer we wait, the narrower our margin to manoeuver gets and the fewer options we have in our tool box. We need decision-making processes that are more agile, and we need political decision-making processes that are faster in order to maximize the options available politically to the government and the instruments in terms of operations to achieve the effect that the government intends.

[The Chair, Liberal, John McKay]

Thank you, Ms. Lambropoulos.

Madame Normandin, you have six minutes, please.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you, Professor Leuprecht.

It is always a pleasure to have you with us.

You talked about cyber-diplomacy, mentioning that there are states that get along with each other, that there are states that are a bit more agnostic about cyber-diplomacy, and that there are states that are outright against the international global order. For example, China, Russia, North Korea, and Iran are malicious actors, but they each have their own fairly independent ways of operating according to their own interests.

Can we think that there is some form of collaboration between these countries now?

Could there be two fronts rather than one front of allied countries tackling different actors with different views?

Could there be some sort of consolidation of the ways of dealing with rogue countries?

[Dr. Christian Leuprecht]

That's an excellent question, madam, because it has to do with the political culture and the strategic culture of each of these countries.

For example, Iran primarily has strategic purposes in the Middle East region. Iran is not primarily targeting Canada, the United States or European allies. One of North Korea's primary goals is to steal vast sums of money to fund its nefarious activities. Russia has global capabilities. What differentiates China and Russia from other countries is the scale of the capabilities and a strategic patience to develop those capabilities to optimize certain objectives.

For example, you may remember the computer infiltration of the SolarWinds company systems, about 18 months or two years ago. It was an attempted cyber-attack that probably took 12 to 18 months to plan. It probably took a thousand people to put all the pieces together. These actors have very different capabilities from other states. Therefore, active and offensive measures must be taken to deter them from taking actions that are against our interests.

[Christine Normandin, Bloc, Saint-Jean, QC]

As these actors are very different from each other, we cannot expect that there will necessarily be collaboration between them. It is not something we can consider in the short or medium term.

Is that right?

[Dr. Christian Leuprecht]

There is always co‑operation for tactical reasons, i.e., to challenge the international political order, which Russia and China believe does not serve their interests.

Authoritarian regimes do not trust each other that much. That's why I'm not too worried about this long-term collaboration, especially on the Chinese side, because they have the capacity to act on their own and further their own nefarious interests.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

From our side, we work a lot in collaboration with other countries. Doesn't that carry the risk that we become a bit dependent on them? Why not build our own expertise?

In the long run, isn't there a danger that we won't be able to act autonomously if we do too much work in collaboration with other allied countries?

[Dr. Christian Leuprecht]

Ms. Normandin, it's not a risk, it's a reality. That's what's happening.

Today, Canada lacks the capacity in several areas to be taken seriously by the other G5 partners, particularly the United States, the United Kingdom and Australia. As a result, Canada is excluded from certain collaborative measures in the kinetic field and in the area of cybersecurity. This reduces Canada's ability to look after its interests globally.

There is therefore an urgent need to make investments to develop and expand our country's capabilities in the area of cybersecurity.

[Christine Normandin, Bloc, Saint-Jean, QC]

Thank you very much.

In Quebec, there is a Ministry of Cybersecurity and Digital Technology, which is supported by a group of advisers. I would like to know if the equivalent exists at the federal level.

Are there any groups of cybersecurity advisers who support the work of the ministers concerned? I'm thinking primarily of the minister responsible for national defence.

If this does not exist, should it quickly be put in place?

[Dr. Christian Leuprecht]

I have had the pleasure of having some interactions with the Quebec team, and I find the province's efforts in these areas very interesting. The federal government could learn a number of things from Quebec.

The federal government certainly has more capacity than any province. I think there could be a lot more intergovernmental collaboration, as there is in Australia, where the Australian Signals Directorate, the equivalent of the Communications Security Establishment in Canada, or CSE, has offices in each of the Australian states.

It also seems to me that Canada could be more active. Several countries have cybersecurity ambassadors. Denmark was the first to create such a position, but the United States has as well. We don't have a cybersecurity ambassador, which shows that the way we think about the field of cybersecurity could be updated.

[The Chair, Liberal, John McKay]

We're going to have to leave it there.

Thank you, Madame Normandin.

You have six minutes, Ms. Mathyssen.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you, Professor, for joining us again on this committee.

I want to dig a bit into your conversation with Mrs. Gallant. You were going into a lot of detail about TikTok, the algorithms that are developed and their influential ability, and the mining of that kind of information. Would you argue that this exists across all social media platforms, whether it be Facebook, Google or any of the others?

[Dr. Christian Leuprecht]

Ms. Mathyssen, I wrote a book on this called Intelligence as Democratic Statecraft. It's a great question.

There are considerable differences here. I had for years warned Canadians, when they were very concerned about surveillance by the Canadian state, that they might want to be more concerned about surveillance by private sector companies than the Canadian state. There are considerable safeguards, accountability and transparency processes in place for state surveillance that are not in place for the private sector.

In the case of TikTok, of course, we are talking about a country that not only has no safeguards for either state surveillance or private sector surveillance, but has actively, even just very recently, reinforced its laws requiring private sector companies to share data without any sort of legal or judicial authorization, simply at the behest of the government. Moreover, it has reinforced the presence of the Communist Party of China in all Chinese enterprises.

You cannot, in China, distinguish between the private sector and the public sector the way you would, for instance, in North America. To say that the risk is the same across the private sector would be a fundamental misunderstanding of the ecosystem in which private sector companies operate in China and their relationship with the Chinese regime.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

I absolutely understand that point. It's more about social media platforms overall and their being within the private sector. Ultimately, they have a specific goal that a government needs to monitor.

How can the Government of Canada better create laws to protect people against a lot of these algorithms, whether they're mining for secrets, mining for money or mining to manipulate people? Certainly people can go down a rabbit hole on Facebook in terms of misinformation and disinformation.

[Dr. Christian Leuprecht]

Facebook is a great example, Ms. Mathyssen. Look at the joint investigation by the Office of the Information and Privacy Commissioner for British Columbia and the federal Privacy Commissioner. The problem is that there are currently very limited tools for the federal government to enforce measures against companies that do not follow Canadian rules.

The question I think the committee might want to ask itself is this: What opportunities exist, and what must be done in terms of government enforcement measures? Also, what incentives, through tax incentives, regulations and so forth, may provide opportunities for the government to act?

Within very short order, you will see a report by the Council of Canadian Academies on public safety in the digital age, which will provide very concrete measures on some of this conversation.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you for that.

I will go back to your comments about the streamlining of governments' making those key decisions, the inefficiencies and ensuring that governments have the powers to do so. Could you also talk about the flip side regarding some of those democratic safeguards that exist for a reason?

One of the concerns I would have in trying to get at those bad state actors we are concerned about—and you can tell me if I'm wrong—is that we don't become them.

[Dr. Christian Leuprecht]

I suppose there's always a concern about state intervention in this domain, particularly when it comes to content.

There's probably an opportunity to lay out clearer swim lanes and provide more transparency for the private sector, and perhaps—as I've proposed in the past—for government to lay out voluntary certification measures by which companies behave. They can then get that certification from the government. In return, users know that a company engages in certain cyber-protection or cybersecurity measures, for instance, meets certain standards and, at the same time, will not use data other than for purposes the government intends.

I think a voluntary certification mechanism would give the consumer much greater confidence and provide an opportunity for government to intervene without being [Technical difficulty—Editor].

[The Chair, Liberal, John McKay]

Thank you, Ms. Mathyssen.

Colleagues, we have an extension of 10 minutes. However, we're still going to run out of time. I want to devote the last five minutes to the budget for the travel. That gives us 25 minutes' worth of questions.

[Bryan May, Liberal, Cambridge, ON]

Mr. Chair, I'm sorry, but a number of us will have to be in question period by then.

[The Chair, Liberal, John McKay]

Because of the technical difficulties, we were given this extra time.

Is it the will of the committee to go until 10:55, or to cut off at 10:45?