Public Accounts Committee on April 23rd, 2013

[Robert Gordon, Special Advisor, Cyber Security, Canadian Cyber Incident Response Centre, Department of Public Safety and Emergency Preparedness]

We've been engaging the private sector from two perspectives.

The first one is encouraging them, through showing them the products that the government will actually produce back, to show them the value in their telling us what's going on. We've had very positive feedback from them. The number of reports that we're producing each year has gone up, and the input we're receiving from the private sector is going up.

I recently was at a session with the Canadian Electricity Association where they were very pleased with the response from the government. They were encouraging their membership that the more information they provide to the government, the better quality the information is that the government's going to be able to put back.

The results of those ongoing discussions is that the quality and quantity of the reporting we've been producing in the last two years has been going up significantly. There's still more work to do and we'll be undertaking that as we go along.

[The Chair, NDP, David Christopherson]

Thank you. Sorry, time has expired, madam.

We'll move along to Mr. Shipley. You have the floor, sir.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Thank you very much.

Thank you, witnesses.

In the Auditor General's comments, he talked about critical infrastructures that are privately or provincially owned. The federal government has an important role in helping to prevent attacks and to reduce vulnerabilities. It has access to information that may not be available. They can collect and analyze threat information, establish partnerships and stakeholders.

There's a lot of non-directive contact or authority by the federal government. You mentioned partnerships in your comments. Do you feel there are appropriate partnerships with the private sector and government now?

[François Guimont]

Thank you for the question.

I'll say a few words, and then I'll turn to my colleague Madam Clairmont.

I think our partnerships and involvement with all levels of society, including Canadians more directly, have to evolve with the threat environment we're in. That's the first observation I would make.

Secondly, if we want individuals or companies to equip themselves and respond correctly, they need information—I very much agree with that premise. We have taken steps to be able to share with people fairly sensitive information that needs to be security cleared, so that they are aware of what they may be facing and their response is proportional to the knowledge of what the environment is showing.

I'll turn to Madam Clairmont for more information on that.

[Lynda Clairmont]

I think we're reaching out to the private sector on a number of levels and in a number of ways.

One way is through CCIRC, through our CSIRT, the computer security incident response team. That's where we're encouraging, as Mr. Gordon said, that companies reach out to us when they have a vulnerability or see something on their system. The more we're getting out to them, the more they're seeing that there's a value added from CCIRC, the more they're approaching us. That's developing out as well.

We're dealing with the private sector through the critical infrastructure sectors, which meet fairly regularly; through multi-sector forums, where we're briefing at different levels; and also the cross-sector forum, which brings together all the sectors and deals with issues of common interest, of which cyber-awareness is one.

We continue to engage at various levels with various stakeholders, both here and with our allies in the private sector. As Monsieur Guimont said, I think it's a work in progress, and one that is more like a journey than a destination, if I could put it that way.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Thank you very much.

That helps to outline a bit about the growing need as well as the development of working with the private sectors and other levels of government too, because there is a lot of sensitive material that we maybe just don't understand or don't have access to.

Mr. Guimont, I want to go back to your comments about the funding that had come through, the $90 million and an additional $155 million over five years. You talked about the 15 hours, and you touched on how that works with the different time zones across Canada.

Can you tell us how it actually works with the time zones across Canada? The reason I ask is that you said, in those off times, there haven’t been any calls needing to be responded to. I'm not sure of the exact words so I paraphrased it.

Could help you me with that? How does that work across the country, then, with the four and a half hours of time zone difference? How does that work, with not having someone there during those off hours? I know the phone system is there but—

[François Guimont]

Yes, indeed. The 15-7 essentially represents what I would call a normal workday, business hours, from one coast to the other. That is the premise. Seven days is exactly that, so a full week.

I'll let Madam Clairmont or Mr. Gordon address.... There is someone, probably through a rotation, who is to be available for phone calls if and when they manifest, but I will let them expand on that.

[Robert Gordon]

There are two dimensions to my response. One is that in addition to the on-call availability of being able to reach out through the telephone system to one of our operational response staff, we also have available the Government Operations Centre, also part of Public Safety, which is staffed 24 hours a day, seven days a week. So in the event that there was ever a disruption in our ability to reach out to our on-call person, they have the immediate availability of someone 24-7 in the Government Operations Centre.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Is that as a backup agreement?

[Robert Gordon]

That's correct.

[Lynda Clairmont]

It's part of Public Safety.

[Robert Gordon]

Yes. They're also part of the escalation process, so if an event became significant, the Cyber Incident Response Centre would reach out to the Government Operations Centre to draw in a broader range of government response, in a number of ways, and also to reach up to more senior levels within the government if it were required.

The other thing is, when we're dealing with our clients—the people who would likely be phoning in, the business clients—the nature of the cyber-attacks we're dealing with are things where the identity of that attack occurs over a period of time. It's not likely that you sit and watch it occurring in live time, so typically the companies watching this will see it and will be working during the day—hence, we’re working essentially the same hours—because the detection of these attacks can actually take many days to occur and there'll be a lot of analysis going on by the companies themselves. Once they see that, they will then contact the Cyber Incident Response Centre.

A similar program is also in place with our allies. The United Kingdom, Australia, and New Zealand run the same system.

[The Chair, NDP, David Christopherson]

Sorry, time has expired, Mr. Shipley. Thank you.

Mr. Byrne, you now have the floor, sir.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

Thanks, Mr. Chair.

My question is to the Auditor General.

Mr. Ferguson, would you be able to describe the value of action plans to Parliament, and to you as an officer of Parliament, in reviewing progress on a legislative audit?

[Michael Ferguson]

Mr. Chair, I think I'll use the example of this chapter, where we identified that those action plans didn't exist at the time of our audit and because of that, we didn't have any way, really, to measure the progress that had been made in this area.

I think that sums up the value of an action plan. It lays out what needs to be done, when it needs to be done, and then you can measure progress against it.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

Thank you very much.

In your opinion, would it be true to say that whether a department was a principal focus of an audit, or part of an audit but not necessarily a number-one priority—for example, there were approximately 13 departments that were included, that were touched by this particular performance audit.

Would it be valuable to Parliament and to you as an officer of Parliament if each and every department that was a subject of the audit tabled an action plan in response to a legislative audit?

[Michael Ferguson]

In general, it would depend on the recommendations we made. If it's an action plan in response to one of our audits, we would expect the department or departments to which our recommendations were addressed to be the lead on producing an action plan. If they felt they needed to get more information from some of the other organizations, then we would expect them to do that.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

Do the action plans that have been tabled at the committee today meet those qualities and characteristics?

[Michael Ferguson]

I can't give an opinion on that. We haven't looked at the action plans in any detail.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

The action plans, I understand, were released just recently, but it was indicated from Public Safety that an action plan was released last week.

Mr. Guimont, was the action plan that was tabled before the committee today identical to the action plan that was released last week?

[François Guimont]

The management action plan, as per the request of the committee, is specific to the recommendations of the OAG—systematically, blow by blow. We've tabled that. It was developed and tabled, and if I remember correctly, it's been carried out, except for one or two actions.

The other action plan is the more comprehensive action plan that the OAG has been looking for. We very much agree with him. We have now developed it, though it took a while, and now it is published. We rendered that plan public on April 18, I believe. By the way, it includes multi-departmental actions, so that departments are committed to carrying out certain tasks against a deadline of sorts. Along the lines of what the OAG is saying, it is grouped under the various pillars that we have for the strategy, which makes sense because that's our framework.

Departments, including my own, are expected to deliver a number of things. We have combined existing, ongoing, and completed tasks. The bottom line is that the comprehensive action plan includes some of the elements we produced as a management action plan in response to the OAG report.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

Thank you very much, Mr. Guimont.

One of the issues that was flagged for me is that a parliamentary committee receives a two-page action plan so that Parliament can hold the government to account on a critical issue like cyber-security. But what has been issued by the department for public consumption was—I assume as a communications method—a more comprehensive action plan, and the two don't seem to mesh for me.

What's tabled here is an item of record before a parliamentary committee, but what you're telling us is that you produced a much more comprehensive action plan that was not tabled before Parliament. Still, we're supposed to hold you to that standard. Is that correct?

[François Guimont]

In reality, just to be clear, the management action plan tabled before the committee as per your requirements, which we acknowledge, included having to develop a more comprehensive action plan. Our action plan for the OAG, for the committee, was developed very quickly, because we needed to be able to answer the various recommendations of the OAG. The more comprehensive action plan took some time. It was a fair amount of work and consultation to get the buy-in.

[Gerry Byrne, Liberal, Humber—St. Barbe—Baie Verte, NL]

With respect, I have to interrupt. You said you issued the comprehensive management plan last week, and you issued the more important action plan to the committee today.

[The Chair, NDP, David Christopherson]

Give us a response, and then time will have expired.

Madam.