National Defence Committee on March 31st, 2023

[Tim McSorley]

Thank you very much for your question.

There are multiple ways in which we collect that kind of information.

For some of it, before the creation of the intelligence commissioner, there was the CSE commissioner, who initiated review, and it's the independent review and oversight bodies that often have access to this information and will share that information, although still redacted in a way that protects national security when there are concerns. Sometimes those are still difficult to interpret because of redactions and euphemisms and language. Often, it relies on access to information requests. Researchers will have academic researchers and our own research requesting documents and digging in and trying to find information.

In terms of the issue around Wi-Fi at the airports, that was based both on the commissioner and on the journalists who discovered the information and publicized it, and then, one of the things that I think might—

[The Chair, Liberal, John McKay]

Sir, excuse me.

Charles, can you turn off your microphone, please?

Okay, please continue.

[Tim McSorley]

One of the reasons I have the access to information that I have today is the BC Civil Liberties Association lawsuit that resulted in disclosure. They then had to fight to publicly share the information they obtained, and only recently were they able to publish it publicly.

I guess what ties all of that together is that the information isn't coming from the CSE itself. It's coming from external bodies—from researchers, review committees and lawsuits—and it shouldn't have to be that way.

[Christine Normandin, Bloc, Saint-Jean, QC]

I'd like to hear more about that. You mentioned the importance of transparency and accountability.

Do you have any recommendations on how to achieve greater transparency and accountability?

[Tim McSorley]

Yes, definitely.

One of the things we've seen in terms of both the intelligence commissioner and NSIRA is that they're not receiving the information they require in order to do their review work and, in the case of the intelligence commissioner, their oversight work. We think there need to be amendments made to the CSE Act that make authorizations for their various activities contingent on providing adequate and appropriate information to the intelligence commissioner, as well as examining the idea of providing the intelligence commissioner with a power to make binding amendments to the authorizations that the CSE is seeking—

[The Chair, Liberal, John McKay]

Unfortunately, we're going to have to leave it there. It seems like every time we get into your recommendations, I have to cut you off. I'm sure we'll get them out in the course of the hour.

Ms. Mathyssen, you have two minutes and 45 seconds.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

With that extra 15 seconds, I'll just say thanks to Mr. McSorley for all of those recommendations. I hope that you do submit them to the clerk, please, so that we can have that as part of our record and part of our study.

Within this committee, a lot of witnesses have talked about intelligence silos and Canadian intelligence agencies needing to integrate more for better intelligence sharing, but when you get into, for example, CRA sharing with CSIS or sharing with CSE, there are concerns that we have seen discrimination play a role in investigations of Muslim charitable organizations, for example.

Mr. McSorley, could you speak to the dangers that are posed by that further integration and to what we can do to avoid taking it too far in terms of that discrimination and victimization of some organizations that are quite legitimate?

[Tim McSorley]

Thank you very much for that question.

First, it's clear, as you said, that there is need for collaboration among national security agencies. Some of that does require the sharing of information.

However, as you pointed out, what we have seen is that there are deep concerns about how some of that information is shared and the impact it can have.

For example, again the BC Civil Liberties Association found in their research that CSE was sharing intelligence with the CRA in order to bolster their efforts to counter terrorist financing. However, what we have found in our research is that the CRA, through its efforts to counter terrorist financing, has taken a prejudiced approach to Muslim charities in Canada. It has been operating from an idea that because there are terrorist threats from Muslim-linked organizations, the Muslim community must be placed under greater suspicion. That results in greater surveillance, greater information gathering and sharing and greater repercussions as compared to other communities in Canada.

How this ties back to the study at hand is that the intelligence that is shared isn't known publicly to the organization that it's being used against, so they don't have the opportunity to challenge it. We see that also reflected in, for example, Bill C-26, where there's, we believe, an undue amount of secrecy and the ability to use information and to hide information from critical infrastructure companies that are providing telecommunication services to Canadians if they were, for example, to attempt to appeal or challenge an order made by the minister.

[The Chair, Liberal, John McKay]

Unfortunately, we're going to have to leave it there, Mr. McSorley, again.

Madam Kramp-Neuman, go ahead for five minutes, please.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you and good morning.

I would like to pose my questions to Mr. Nared this morning.

A briefing document your organization provided to a previous House committee indicated that concerns raised by other observers were still valid. In fact, the organization specifically pointed to an article written by Alexander Rudolf, who appeared before this committee earlier this year. In that he said,

Canada needs both a whole-of-government cyber-security response and a very targeted cyber-defence response.

In addition to that, in a document provided to the committee last year, it's quoted that the author wishes to reiterate that,

CAF is not ready to meet even moderate cyber threats (such as hacktivists). And taking into account publicly available information and emerging threats, it won't be ready to meet modern cyber challenges for the foreseeable time.

Could you possibly expand on that? Do you still share this view?

[Tadej Nared]

Thank you for your question.

Yes, I still share that view, because I think it's been a year since that document. I believe I wrote that the basic problem is that the threat environment was specified solely to where the Canadian Armed Forces are stationed at home in Canada and abroad. That is a failure in understanding the cybersecurity environment in general. There is no defence perimeter anymore. Not just Canadian Armed Forces and their members but also their family members are targets for a moderate attacker, a black hat hacker or especially some sort of group such as the Russian group Sandworm. They will attack not specifically hard and secure targets but rather so-called low-hanging fruit first. That means even attacking family members, for example, compromising their home networks and expanding from that point onwards. We had a similar case in Slovenia, in which our emergency response was taken down in the very same manner. It was a failure in strategic thinking.

I'm not familiar with whether that agenda has changed in the past year. If it hasn't, it should be updated and improved.

I hope that answers your question.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

It does, certainly. That leads me into my next question.

You've also been quoted as saying that the genie is out of the bottle in terms of cyberwarfare and that the cyber World War III is already in full swing.

Many observers have pointed out that there's a significant cyber-skills gap in our civilian sector.

Could you expand and share with the committee what it means for the Canadian Armed Forces, which is currently facing a recruitment and retention crisis in its very nascent cyber-operations division?

[Tadej Nared]

Thank you for the question.

To give you an example, as the Ukrainian experience has shown, a war cannot be won without the support of the native population. I think that is a term that quite sticks. It is the same in the cybersecurity sphere. Especially the western countries, the Americas, kind of rely on their ocean for defence, and on overspending for defence also, but that is not a concept that you can rely on in terms of cyberwarfare. Relying on crowdsource intelligence, utilizing everyone who can help and organizing initiatives is the way to go, in my opinion. A closed loop won't solve any problems.

[Shelby Kramp-Neuman, Conservative, Hastings—Lennox and Addington, ON]

Thank you.

Can I leave you with the rest of your time to...?

Go ahead.

[Tadej Nared]

If I may, I would like to take a minute to explain the cyber-damages I was talking about before, because it kind of relates to the subject.

For example, the F-35 program, which cost $1.7 trillion to develop in terms of R and D, got hacked by the Chinese, and all the plans were stolen. That's just one hack. If we combine everything together, we get a clearer picture of where the damages are coming from. That relates to the army, to the air force and to basically every part of modern society.

[The Chair, Liberal, John McKay]

Unfortunately, we're going to have to leave it there. That's a rather unfortunate point at which to leave it.

Ms. O'Connell, you have five minutes.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you so much.

Thank you to all our witnesses for being here today.

Mr. de Boer, you've spoken about mandatory reporting and things like that, but I also want to dive into some of the challenges we've heard in other testimony about the private sector not necessarily wanting to share if they've been hacked or if their systems are vulnerable. I could certainly see that if BlackBerry, for example, which has a reputation for security, ever had a breach: The board or the governance of the company may not necessarily want to promote that a breach happened or that an attack was successful.

How does government partner in order to understand the real-world picture in the private sector, keeping in mind that the private sector might not be interested in sharing this information?

[Dr. John de Boer]

Thank you for that question.

Trust that the information that any company will give over to the government will be treated in a confidential way is really important there. Liability protections and all these things need to be taken into consideration. Currently, that trust has yet to be built fully.

One way to get there is through, for instance, what the U.K. or the U.S. is doing, which is to build a joint collaborative environment or a joint cyber-defence collaborative. Before an incident happens, channels of communication for information exchange and threat information exchange are shared on a voluntary basis, oftentimes, where the private sector gets a better understanding of how the information they give is actually used and flows. It becomes a true partnership between the private and public sector. Right now I think the situation is that there is some hesitancy for regulators, etc., to engage, but I think we all recognize that a closer public-private partnership is essential.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Thank you.

That clarification is important, because when I hear “mandatory reporting”, I don't necessarily think that's confidential. We've had other testimony that it would be public mandatory reporting so that Canadians have a broader sense, but I think that distinction, at least from that perspective, is interesting.

There is also, I think, a significant onus on individuals or individual corporations to safeguard their security. You mentioned in your testimony that your organization has a policy of knowing where every component of the product comes from, but when companies have boards of directors and shareholders and cost-effectiveness is important, that might not be the case. What would your recommendation be to ensure the public is more aware of what they're purchasing—the onus on them—and then what can government do to encourage the private sector to not always look at just the bottom line but also at the cybersecurity piece?

[Dr. John de Boer]

A huge driver of security, particularly in the automotive sector, has been an emphasis on safety, right? When consumers start demanding safety or security, it changes. I spoke earlier about a software bill of materials or an ingredients list. When we buy things at the grocery store, we know exactly.... There is an ingredients list there. It's listed, right?

There could be and there is discussion in multiple jurisdictions about, for instance, a cyber safety rating for IoT devices, whether that be for your fridge or elsewhere. That could be considered. More awareness about whether one product is safer than the other for public consumption could be something that's considered. I think these are important steps, not just to raise awareness, but to also entice producers to build in security up front, because that's not happening.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Do I have any more time?

[The Chair, Liberal, John McKay]

No. Thank you, Ms. O'Connell. I'm going to cut you off. You had three seconds.

Colleagues, I need some guidance here. We've run over our hour.

First of all, I'll turn to the clerk to find out if we know the arrival time of our friends.

We don't? Okay.

I have some committee business that I'd like to do in camera. We had anticipated that our friends would arrive at 10:15. That gives us 20 minutes. It's going to take a few minutes to go in camera. My thought, because this is such an excellent panel, is that we have a two-minute lightning round with each party. There's stuff that could get out. Is that an acceptable idea, two minutes?

[Some hon. members]

Agreed.

[The Chair, Liberal, John McKay]

Going now—

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Are we going in camera first?