Yes, I'll try to answer your question.
You ask an excellent question.
I think national security has to be defined relatively broadly today. It's not the same context as in the 1950s, when the only real risk was a Russian invasion. You can undermine a country's sovereignty through military interference, but also by making it lose control of its economy. I think that's what's happening right now. The theft of intellectual property in Canada is abominable. It's happening not only in Canada, but throughout the west.
The key element lies in a relatively broader definition of national security. I'm not talking about a definition that is so broad that it is meaningless, as you suggest. Nevertheless, it is not the same situation as in the 1950s and 1960s.
Who should do the protecting? That is an excellent question. That is a matter for the machinery of government, which is the primary responsibility of the Prime Minister.
I don't think the Canadian Forces should be given the responsibility to protect the private sector. Rather, the Communications Security Establishment should be given that responsibility, with the assistance of the Canadian Security Intelligence Service. Indeed, there must be collaboration between the agencies. As I suggested to one of your colleagues, I think a whole-of-government approach is crucial here. We don't have enough resources for either of us to start mucking around; I'm exaggerating, but it's an image to back up my point.
Essentially, the military should be concerned about what is going on outside the country, while remaining very well informed about what is going on here, and it should be up to the CSE to protect the private sector, with the help of a department or other agency. In this regard, we should give the CSE a much more public and much clearer mandate.
In addition, it should be emphasized that when the private sector is subject to cyber-attack, we should always make sure that we talk about it. One of the difficulties we have at the moment is that the target organization never wants to talk about it because of the potential financial consequences. It's true that there is an obligation to report it from time to time, but in very specific circumstances. In the United States, on the other hand, every time there is a cyber-attack, it has to be reported to the federal government. I would suggest that you follow the same rule; I think it would be helpful.