Public Accounts Committee on April 23rd, 2013

[Michael Ferguson]

Thank you, Mr. Chair.

At the time of the audit, we noted that CCIRC's mandate was to operate 24-7. We noted it wasn't doing that at that time. Since then, we are aware that CCIRC's timeframe has been expanded.

What's important for us is that there be some way that, around the clock, incidents can be gathered so that the information can be acted on as quickly as possible. Whether that is the incident response centre having its doors open 24-7, or whether there are other ways of doing that, the fundamental issue is to make sure coverage is there 24-7, one way or another.

I can't give you any assurances about what's been done since the audit or whether the changes that have been put in place are effective that way. Certainly, for us, fundamentally what would be most important is that there is somebody who is available to collect the information around the clock.

[Malcolm Allen, NDP, Welland, ON]

I noticed, Mr. Guimont, in your presentation you said we're up to 15 hours a day, seven days a week, which is an update from where the audit was. I suppose that's a positive. It's closer to 24 hours than the eight hours it was before. Then you're relying on a new telephone system, so that people are accessible 24 hours a day.

I hate to be naive about this and I'm not trying to be flippant, but that assumes you're awake by the telephone. If you're a heavy sleeper, you don't hear the telephone, and you're on call, what did we accomplish? I think the answer is self-evident: not much. I'll answer my own question.

The reality still is, sir, do you not believe that someone on active duty, not on-call duty...? Those are two different things. Being on call means you're available. I'm assuming the 15 hours are probably not the overnight hours, which are the on-call hours that people normally do. Are you saying to me that the on-call individuals are supposed to be awake at that time? Does that mean they're working that shift, looking at the phone to see if there is anybody contacting them?

[François Guimont]

Thank you for the question.

The first point I would make is that the 15-7 is meant to cover our time zones from coast to coast. That's the first point, if you were wondering why we picked up 15. The second point I would make is that we tried to strike a balance between good user resources and providing that responsive service. We felt that 15-7 plus 24-hour phone line accessibility did that. The third point I would briefly make is that in that period that we've now augmented our capacity, there hasn't been a phone call that came in that would have indicated to us that there's a challenge, so we haven't faced that situation.

I'm looking to my colleague here, but I'm not aware of any calls. Until it doesn't work, I would suggest that we're equipped right now to give a good response to calls, should they come in.

[Malcolm Allen, NDP, Welland, ON]

We don't do that with fire services, sir. We don't put them on call. We actually put them in the station, not looking for the fire but being there just in case. I would suggest security threats, because they haven't happened, doesn't mean to say they won't happen.

[The Chair, NDP, David Christopherson]

Thank you, Mr. Allen.

[Malcolm Allen, NDP, Welland, ON]

It means we actually need to have someone there.

[The Chair, NDP, David Christopherson]

Thank you, Mr. Allen. Time has expired.

We'll move to Mr. Kramp. You have the floor, sir.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

Thank you, Mr. Chair.

Once again, thank you to all of our witnesses for coming here today. The thing that has struck me, of course, is the entire difference in technology from 20 years ago to today. If you were to mention cyber-security 20 years ago, people would have blinked their eyes and asked what you were talking about. Now, with the global expansion of IT technology, etc., it really presents a whole different ball park in which, in my personal opinion, there's no way you can do the job alone. This is where the partnerships, quite frankly, for the public are absolutely critical as well.

My thought would be, recognizing that no man is an island in this matter, we need to have as much input as possible from areas that we've not even considered. Quite frankly, cyber reaches into every niche, corner, and cranny, potentially, on the globe. So we have to have buy-in from the public as well to aid and assist us with this.

Where can Canadians go to learn more about cyber-security, to alert them to the possibilities and the vehicle by which they can participate in solving some of our own problems? We have to be able to engage Canadians to assist. How do they do it?

[François Guimont]

Thank you for the question.

Mr. Chair, may I go back for a second to the earlier statement that things must have changed a lot in 20 years? When I was doing science and I was testing my abilities vis-à-vis my staff when they were briefing me on cyber-issues, I made reference to my having learned Fortran and APL. They shook their heads as if I were in a different world. Yes, things have changed a lot. I'm not even sure those languages exist anymore.

Going back more specifically to the question, the third pillar of our cyber-strategy deals with empowering Canadians to take the right action. I find in the question a very important statement to be understood. It goes back to the earlier question as well about rules and responsibilities. There are a lot of us around the table and there's a reason for this. We all have a piece of the action on cyber-safety, cyber-security. What's true in government is also true in our society. We need the private sector—big, small, medium—our colleagues from the provinces and territories, and we need each and every Canadian. The third pillar addresses that very point, and I think it's fair to say that we have a very active campaign on cyber-safety that speaks to each and every Canadian. In my words, “tricks” or things have been provided that they should be affording themselves.

Members of the committee will probably know, as a result of background, that 80% of Canadians are now online, either for business reasons or social reasons, so there is exposure there. The government is not there to do and tell them everything, so there is an empowerment component to the cyber-strategy that is quite important. We have a campaign and we have put money into that campaign, but at the end of the day it's for each and every Canadian to also assume their responsibilities, and rightly so.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

Thank you.

Engaging them is one thing, but how far do we go with this? The concern I have, of course, is that Eaton's doesn't tell Simpsons their business. We have a lot of people who with a tremendous amount of information could be more damaging, so we don't want to aid and abet as well. How do we protect the integrity of what we're trying to do and still be transparent about our capacity, without giving away the shop to people who might potentially abuse it? How do you draw that line and what are your thoughts on this?

I'm not sure who would answer this best.

[François Guimont]

If I may, Mr. Chairman, I'll ask Madam Clairmont to answer.

[Lynda Clairmont, Senior Assistant Deputy Minister, National Security Branch, Department of Public Safety and Emergency Preparedness]

In terms of awareness, on Public Safety's website we have what we call “Get Cyber Safe”. It's a website where citizens can look at various things they can do to keep themselves safe. We are of the same mind as you are in the sense that it is a partnership. It requires the private sector, levels of government, and also our citizenry.

In addition, we're linked to “Stop. Think. Connect.”, a cyber-awareness program that is co-sponsored in part by some private sector companies in the U.S. The Department of Homeland Security also offers citizens opportunities to assess their cyber-risk profile.

[Daryl Kramp, Conservative, Prince Edward—Hastings, ON]

That's fine, thank you.

Mr. Long, this government introduced the shared services initiative in 2011 and obviously the intention is to make information technology more secure. Have you been able to find that effective balance between security and transparency? What are your thoughts on that?

[Benoît Long]

Thank you for the question; I appreciate it. Yes, Shared Services Canada's mandate clearly outlines the steps we need to take to secure the infrastructure. So we've already started consolidating that infrastructure across the 43 departments, harmonizing the practices and the approaches that are taken in every department to secure those systems.

As you can imagine, before our creation every department would do what they could in their own ways at different levels of spending and of effort. Clearly now we're able to do this horizontally to ensure consistency, and also to ensure compliance with standards that are established through the Treasury Board. That is an important step forward.

Now we're also redesigning those services to have security by design to embed security principles, to embed security throughout the means by which those services inside the government will be consumed, and that's been fairly important.

Finally I would add that on the procurement side we've enhanced the security requirements that exist with the prospect of being able to secure both the goods and services that we purchase as a government through the department. That will enhance our ability to deploy and ensure the safety of that equipment and the services that leverage it.

[The Chair, NDP, David Christopherson]

That's very good. Thank you, time has expired.

Now Madame Blanchette-Lamothe, you have the floor.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

Thank you.

I would like to talk a little bit about sector networks. First of all, people say that Public Safety Canada should ensure that all sector networks are fully established and operational, as set out in the national strategy and action plan.

My first question is simple. Are the 10 sector networks now operational? Can you provide me with some information about that development?

[François Guimont]

To my knowledge, the 10 networks are active. The Auditor General's observations were related to a certain point to the fact that the sectors were not all equal.

We are currently working on developing a document that will provide directions, because not all these sectors were managed by Public Safety Canada. We chair an intersectorial table, where members come and we can coordinate our work, but different sectors are managed by different departments. Therefore, we are developing a guide that will be ready in December 2013. A draft version will be available in June 2013. It will help the various departments ensure that the sectors are complete and that the activities in those sectors are as well.

The sectors also have a certain responsibility. It is not just incumbent upon the government to gather these people together; they must also create the links they need within their sector to ensure they are well represented. So we are going to increase the number of meetings because I think it is important. These sectors do not work only on cyberspace, but also in terms of general infrastructure. We are going to increase the weight given to the cyberspace issue in these infrastructure tables.

We are doing what we need to with respect to the Auditor General's observations, which we feel were appropriate in that area.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

I imagine that you have addressed the issue with representatives that sit on these sector networks. We see that six out of 10 sector networks do not have representatives from industry groups considered to be the main stakeholders.

Are you saying that you are in no way responsible for that and that nothing will be put in place to improve the participation of sector networks?

[Lynda Clairmont]

I guess the issue was: are all the members of the various sectors participating in the sector networks?

One thing we're doing, which we're on track to finish in June of this year, is to reach out to the sectors and to the departments that are involved with them, and ascertain whether they have the correct membership on each of the sector networks. That work is under way—just to confirm that.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

If the composition of these networks is not satisfactory, are you going to take some responsibility and ensure that everything will be done so that it is satisfactory?

[Lynda Clairmont]

Yes, absolutely we will. It's a partnership, though, so we'll want to consult with the sectors, with private sectors, to see who they think is most appropriate. Absolutely, our role is to coordinate these things and make sure they happen, and that's what we're doing.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

Will you be able to keep us informed about your progress in that respect?

[Lynda Clairmont]

Yes.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

Thank you.

As for the private sector, we see that not all stakeholders are reporting to the CCIRC on attacks. It seems to be a problem. In fact, Mr. Ferguson mentioned in his report that without thorough knowledge of what is happening on the ground, it is difficult for the centre to analyze the situation and provide advice on the matter.

What could you do to improve reporting from the private sector?

[François Guimont]

If I may, Mr. Chair, Mr. Gordon will answer that one.