Public Accounts Committee on April 23rd, 2013

[Corinne Charette]

Thank you very much.

That's an excellent question. In fact, we have done a number of things. The first thing we did was we surveyed our community departmental security officers extensively to understand what they believed were the needs across the community for more security awareness. With them we have essentially developed a Government of Canada security training framework and a security professionals training working group. We recognize that working on the awareness of every public servant regarding cyber-security is also an important part of the effort. Development through the framework of training materials is under way.

As part of the October cyber-month, we also try to participate and stress that to all public servants. We're also working quite a bit on the issue of awareness of good cyber-behaviour on a departmental basis regarding things like, for instance, not opening up all attachments when they come in through e-mails, because despite the best spam filters or filters in general, there are very clever ways of luring people into accessing e-mails that are in fact bearing malware.

We're also currently nearly finished developing an IT policy information notice that will go out to departments on what they need to do to secure portable media, and to raise awareness of the fact that portable media are a way to introduce threats if you load them into government systems. So we're working on a number of areas to raise awareness within the community at all levels, at the employee level, at the IT level, at the departmental security officer level, as well as with all executives to ensure that everyone understands their role in maintaining proper security.

[The Chair, NDP, David Christopherson]

Sorry, Mr. Dreeshen, time has expired. Thank you.

We have two more spots left. The next one will be Mr. Allen. I understand you're going to share your time with Madame Blanchette-Lamothe and that is fine. You have the floor.

[Malcolm Allen, NDP, Welland, ON]

Thank you, Chair.

To Mr. Ferguson, on page 10 of the English version of your report at paragraph 3.20, you said you identified $780 million in funding approvals. You said you were unable to specifically find out where it was allocated. At the bottom of the paragraph, you said you also identified a further $200 million.

Is that a cumulative thing, sir, so $780 million plus $200 million? Is that what's being said to me in that paragraph?

[Michael Ferguson]

That's right.

[Malcolm Allen, NDP, Welland, ON]

We're now approaching $1 billion, $980 million to be precise, so my question to the departments is this. Based on the fact that we are unable to tell the Auditor General how we spent the money especially on the cyber-aspect, first, can the department track those pieces?

Also, through you, Chair, I would like that to be set back as a line item, to determine how that money was allocated across those 13 departments, because now we're talking $1 billion. I'd actually like to know where it went, including the stuff that didn't go directly to cyber. I'd like to know just exactly how that piece was spent. I'll leave that for you, Chair, to rule on and to instruct the witnesses accordingly.

I'll now turn the rest of my time over to Madame Blanchette-Lamothe.

[The Chair, NDP, David Christopherson]

Madame.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

Thank you.

I have a question about the January 2011 intrusion mentioned in the Auditor General's report.

This intrusion, which was quite serious, was aimed at obtaining information, taking control and extracting information of a sensitive nature. We know that reacting to that attack was costly and that it took time to recover completely.

What do you think about a mandatory mechanism that would provide notice in the case of loss of data or unauthorized access to data? It might ensure better protection of the personal information of Canadians in the case of a cyber attack.

If that is not an option you are considering, what do you plan to do to protect the personal information of Canadians?

[The Chair, NDP, David Christopherson]

Who would you like to answer that, Madame?

Is there anybody who wants to? Somebody jump in, please.

[Robert Gordon]

Mr. Chair, I'd be happy to answer that—

[François Guimont]

Mr. Chair…

[The Chair, NDP, David Christopherson]

Mr. Guimont, you have the floor.

[François Guimont]

Mr. Chair, if I may answer this question which, if I've understood it, has to do with protecting personal information, in some way, like the third pillar of the strategy mentions.

I am thinking only of Canadians. People are responsible for protecting their own information. That is the first thing.

Furthermore, regarding the government systems where my colleague, Mr. Long, works, I would simply like to note that we have a very high number of email systems and that we are moving toward a single system.

We also have over 200 data centres. Some of them are a little older, some a little newer; it is a mix. We are moving toward about 20 data centres.

All that means that we are trying to close windows that may be at risk and susceptible to cyber attacks. Of course, if that information includes personal information, we are reducing the risk of Canadians' personal information being made public.

Those are the two examples I would give of what we are doing.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

I have one last question for you.

A little earlier, my colleague asked if our cyberspace is secure, and you answered that that was pretty much the case. However, we know that the Auditor General's report expressed doubts about our capability to respond to and prevent cyber attacks.

What could be added to the action plan that you put in place and to all your resources to maximize our efficiency in countering cyber attacks and our capacity to respond to them?

[François Guimont]

I joined the department in November and, since then, the issue of cyberspace has been a priority for me. It was not so much my decision as it was the nature of the issue; we talk about this issue a lot within the department. That is my first observation.

Furthermore, I am also speaking for my colleagues in the federal government and in the private sector. I have had discussions with John Manley, of the Canadian Council of Chief Executives. I also want to meet with a group of people who could help us better understand the dynamic within the private sector.

I would say that there is an awareness, and that is where we need to start. I do not want to say that it was absent before, but we realize that, with the development of cyber threats, we need to work together more than we did before. This is not a magic formula, but if there was something to put on the table that could be important when it comes to protection, I would say that it should ultimately be better cooperation, a good exchange of information, action plans and following up on the actions we take. I know that there are more, I acknowledge it now. I think that is the recipe for better prevention of threats.

[Lysane Blanchette-Lamothe, NDP, Pierrefonds—Dollard, QC]

With respect to follow-up…

[The Chair, NDP, David Christopherson]

Sorry, Madame, time has expired.

Mr. Saxton, you have the floor.

[Andrew Saxton, Conservative, North Vancouver, BC]

Thank you, Chair.

I'll share this time with my colleague, Mr. Dreeshen. I propose that he begin and then I'll wrap it up.

[The Chair, NDP, David Christopherson]

That's a funny way of going about that, but okay, we're good with that.

Go ahead, Earl.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much.

I kind of just jumped in, so that's the reason for that.

For the Auditor General, if we could go back to 3.21, I just want clarification because of the question that Mr. Allen had presented over there. It says in the first sentence, “Of the $780 million, we did identify that about $570 million was approved for Communications Security Establishment Canada”. Then, if we go to the bottom of that paragraph, it says, “Nevertheless, Public Safety Canada officials informed us that about $20.9 million of the remaining $210 million was directed toward cyber protection”.

To me then, it is the $570 million plus the $210 million that made up the $780 million? So, I believe when I heard Mr. Allen say that makes it nearly a billion dollars, it wasn't really that?

I was taking that from what I had read there.

[Michael Ferguson]

We have Ms. Loschiuk to deal with the question.

[Wendy Loschiuk]

When we identified the allocations of funding, we were trying to track it all and see where it had gone. We could only break it down as far as what's in this report. What we were able to identify was that, as you explained, $570 million went to one organization, plus we wanted to know where the remaining $210 million went, to other organizations.

In the course of looking at the work, though, we were also able to identify that there was some ongoing funding over the course of many years and that was the other $200 million, although we don't have a whole lot of detail on that information. There's just ongoing funding to departments.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you, then. I just wanted clarification on that. I didn't see where that other $200 million was in the report. I was just going with the $570 million plus the $210 million.

I'll give my time back to Mr. Saxton.

[The Chair, NDP, David Christopherson]

Very well.

Mr. Saxton.

[Andrew Saxton, Conservative, North Vancouver, BC]

Thank you, Chair.

First of all, I'd like to thank Public Safety for providing the action plan that our committee had asked for through a motion dealing with the Auditor General's recommendations. My thanks also for the action plan that was released on April 18. Those were both very helpful.

I'd now like to ask the deputy minister to kindly explain and give an update on the three pillars, which are: securing government systems, partnering to secure vital cyber-systems outside the federal government, and helping Canadians to be secure online.

[François Guimont]

Thank you, Mr. Chairman.

I hope, Madame Clairmont, that your voice will allow you to bring the update to the committee. I would appreciate that.