Public Accounts Committee on April 23rd, 2013

[Lynda Clairmont]

The plan we tabled with the committee today is the action plan that responds to the audit, but it's not the action plan that responds to the entire cyber-security strategy, which was released in 2010. The 2010 cyber-security strategy had a number of actions under the three pillars, as Monsieur Guimont said. The action plan that was posted on the website, which was mentioned in the OAG audit, is our response to the government's way of laying out the actions they are taking in response to the strategy that was released.

[The Chair, NDP, David Christopherson]

Mr. Byrne, you'll be up again in four slots, so if you want to pick up on this then, you certainly can.

Mr. Aspin, you have the floor, sir.

[Jay Aspin, Conservative, Nipissing—Timiskaming, ON]

Thank you, Chair.

Welcome to our witnesses.

Mr. Guimont, I too took Fortran and APL, so I share your astonishment.

[Voices]

Oh, oh!

[Jay Aspin, Conservative, Nipissing—Timiskaming, ON]

The OAG report made a number of statements about the progress with critical infrastructure sectors. Could you elaborate on what progress has been made?

[François Guimont]

Indeed. I'll say a few words, and then I'll turn to Madame Clairmont.

The first point is that essentially we have a 10-sector table—for instance, transportation, finance, energy, water production. There are 10 of them.

Second, we have a cross-sectoral table, where we essentially extract and meet together these various sector tables so that we have a common agenda.

The three basic functions that these tables, either the cross-sectoral one or the sector ones, deal with are critical infrastructure overall: multi-hazard-type risks that we may be facing. So it's cyber but it's not only cyber. To the point I was making earlier, cyber-threats now have taken more space and time, and we are focusing on that very point.

We deal with partnerships and relationships through those tables, with information sharing so that we bring people up to speed on various issues that they may be facing or that they are facing. We share that, and generally speaking we deal with risk management issues.

I'll turn to Madame Clairmont to add to this.

[Lynda Clairmont]

Actually, Bob was going to lead on this one.

[Robert Gordon]

Thank you.

There are actually some very specific actions we've been able to take in addition to the broad ones that Mr. Guimont was speaking to. We've established, on the risk management perspective, a number of guides and planning guides that are useful to a cross-range of critical infrastructure sectors.

We've also engaged in a United States action plan for critical infrastructure. We've engaged with the Americans on a regional resilience assessment program where we're actually doing cross-border assessments. For example, in New Brunswick this past year we completed six assessments. The first round was looking at the physical issues relating to it. This would be things like the cross-border sections or the border crossings at Woodstock and Edmundston, the port of Saint John, the Irving Oil plants, and the LNG plant, where we've actually undertaken those assessments and provided the advice back to the owners and operators of those systems on how they can improve the security of those.

We are now moving those out across Canada. We are doing another pilot in Ontario, and another one in Saskatchewan. We'll be adding into those a cyber component.

We've also established a number of information-sharing...both a framework to guide the sharing of information within critical infrastructure sectors, and information-sharing gateways to facilitate some of that sharing as well.

[Jay Aspin, Conservative, Nipissing—Timiskaming, ON]

Thank you.

If I may, Mr. Guimont, I know you alluded to this previously, but I wonder if you could focus in on what the Government of Canada has done to ensure that Canadians can use cyberspace safely.

[François Guimont]

It's the third pillar. We've had a campaign website, and Canadians can ask questions and get some information. But as I said earlier on, while we provide this information, at the end of the day they have to assume some responsibility, and I think they are. People are more sensitive to cyber-realities than they were five years ago, let's say, or three years ago. Frankly, it's also because of the media stories that have existed out there.

I'll turn to Lynda, or to....

[Lynda Clairmont]

I can start it off.

In addition to our Get Cyber Safe website and Stop. Think. Connect., which I mentioned earlier, we're also working with the U.S. and other allies around the world to have a cyber-awareness month, which is in October. We're doing all kinds of activities with the private sector and with citizens to enhance cyber-security awareness.

One example is working with stores that sell a lot in terms of telecommunication—iPods and other stuff that kids would use. There is safety information inside, but we're having pamphlets that.... We would give them out so that parents would see them more, as opposed to children.

So there are number of things we're working through and coordinating, inside of Canada with the provinces and territories, but also externally with international partners.

[The Chair, NDP, David Christopherson]

Real quick, Mr. Aspin, please.

[Jay Aspin, Conservative, Nipissing—Timiskaming, ON]

Are we safe in cyberspace?

[François Guimont]

It's an interesting question because certain threats in the environment we live in may be a bit more static in time.

Mr. Gordon was explaining to me, Madame Clairmont, and other specialists, that the cyber-world evolves very quickly. When you think about it, it's a world where you don't need much. You need minimal, technical apparatus, servers or computers, brain power, and time on your hands, if I can use that terminology.

It is an evolving threat in that sense. I think we are as active. We have a strategy, players are involved, and we have resources. I don't think one can put his or her guard down. The cyber-world evolves quickly and we have to keep up with that reality.

[The Chair, NDP, David Christopherson]

Very good, thank you.

Monsieur Guimont, I appreciate the shortness of that answer.

Moving along, Monsieur Giguère, you have the floor.

[Alain Giguère, NDP, Marc-Aurèle-Fortin, QC]

Thank you, Mr. Chair.

I would like to thank the witnesses for being here.

First of all, I would like this document to be tabled. It is the Action Plan 2010-2015 for Canada's Cyber Security Strategy.

I would like to point something out to Mr. Guimont.

You say on page 7 of your report that you are going to spend $155 million in over five years and, on page 6 of the same report, it says that that amount will be spent over four years. That is a difference of $30 million. I would like the numbers to be a little more balanced in future.

Mr. Auditor General, in paragraph 3.20 of your report, you say that $780 million has been spent since 2001. You also indicated that a $200 million-budget had been approved especially for cyber security, which did not correspond in any way to the funding related to activities to protect against cyber threats. Still, that is a lot.

Can we know where the money went? How is it that, with such a budget, all the services did not manage to establish a security service against cyber threats?

[Michael Ferguson]

In terms of the budget what we lay out in the chapter is the fact that when many of these budgets were allocated cyber-security was considered to be part of a bigger security apparatus, early on. As has been discussed, the cyber-world is something that has evolved. Early on, it was just considered to be one of a number of threats.

Really, what we identified here was.... Because it was folded in with funding for other types of threats, it wasn't possible for us to separate how much money was just for cyber-security. Also, what we were looking for, in general, were overall plans, so that we could see what activities were supported to be conducted and then measure progress against it.

[Alain Giguère, NDP, Marc-Aurèle-Fortin, QC]

Thank you very much.

We saw that, of the $780 million, $570 million was given to the Communications Security Establishment Canada. After spending so much, how is Canada better protected? I would also like you to give us a detailed report on how that $570 million was spent, please.

[François Guimont]

I will turn, if I may, Mr. Chair, to my colleague from CSEC.

[Toni Moffa]

Thank you.

As I said earlier, and as the Auditor General mentioned, the numbers that total the $570 million include program activities for cyber-security that are not necessarily directed at cyber.

The investments we made in our activities for our contribution to cyber-security include improving and increasing intelligence production on foreign cyber-threats, because that's part of our foreign intelligence mandate. Also, we improved our capacity to detect and analyze threats on federal government systems. On those government networks, particularly the ones that are run by Shared Services Canada, that consolidate Internet connections for the government's systems, we deploy technologies that are able to detect cyber-threats that are not detected by commercial technologies because they are based on classified information about threats. That gives federal systems an added layer of security.

We do detection and analysis of the information we find there. As threats occur or are occurring, we can notify departments and provide mitigation advice on how to stop those threats from happening, and also longer-term advice so they can strengthen their systems to stop those problems from recurring.

With part of the funding we received, we run an IT security learning centre—

[Alain Giguère, NDP, Marc-Aurèle-Fortin, QC]

I would still like details on how the $570 million was spent…

[Toni Moffa]

Detail on the spending?

To answer that question certainly would reveal our level of capability in these areas, which we would consider classified information. It would not be prudent to disclose to those who seek to do us harm.

I will try to provide you an outline of the various activities, but the actual level of investment in those areas, particularly on our technological capabilities, is something we consider classified information for national security reasons.

[The Chair, NDP, David Christopherson]

We're starting to get into some constitutional grounds here.

Mr. Giguère, your time has expired, but I'll forward you an opportunity if you have a comment about the information you're requesting, so I can get a sense of where this may or may not be going.

Did you want to pursue this, sir, or are you satisfied with the answer you have? If you are, that's fine. We'll move on.

[Alain Giguère, NDP, Marc-Aurèle-Fortin, QC]

No, I cannot be satisfied with an answer like that.

Canada has invested significantly in the Communications Security Establishment Canada, to the tune of $570 million.

We were told that work has been done and that Canada is better protected than before. Unfortunately, the report indicates that we are not…

[Andrew Saxton, Conservative, North Vancouver, BC]

On a point of order, Chair, I believe my honourable colleague's time is up. You're extending his time.