Public Safety Committee on March 22nd, 2018

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'm sorry, but let me go to my second part of the question.

You become aware of terrorist propaganda being launched at Canadians, but it's by a Canadian on foreign soil. How do you interpret the act as being able to respond to that? Do you have to let it go or can you respond?

[Shelly Bruce]

We are prohibited from targeting Canadians anywhere, so if there is a direct correlation, and that activity is emanating from a Canadian's communications, it's off limits.

Thank you.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you for that.

Given the fact that we live in a new environment now, we have Canadians who, whether they are homegrown terrorists or they've gone away and come back, pose a threat, will pose a threat, and continue to pose a threat to national security. In your experiences collectively as a group, is there something we need to do to change things so that, if there is an imminent threat to Canadians by a Canadian, you can do something about it?

[Greta Bossenmaier]

Maybe I'll start by answering your question, and then, again, we'll look to Shelly to further my description.

It goes back to mandate. The Communications Security Establishment's mandate is foreign signals intelligence that's not directed at a Canadian or anyone in Canada, which is a foreign focus. Suffice it to say that there are other pieces within the national security apparatus that focus on threats to Canada that may emanate from a Canadian. Some of our partners in that....

Shelly, do you want to speak a bit about how we work with partners in that regard?

[Shelly Bruce]

Looking at terrorist activity is very much a team sport in Canada. The RCMP, CSIS, CSE, as well as others each have a role, and we work together to understand what each of us is bringing with our mandates, authorities, skills, and capabilities. In this case, it may be within the services' remit to be looking at a Canadian outside of Canada who was involved in these activities.

Our legislation currently allows us to provide an assistance role to the RCMP and CSIS. Generally it is for national security agencies and law enforcement agencies, but in practicality, it is mostly CSIS and the RCMP. In that case, if they had the authority, they could ask us for assistance in that space, and we could use our capabilities to assist them as long as it was done within the parameters of whatever legal authority they're operating under.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Last year we learned that Canada's National Research Council was the victim of Chinese computer network exploitation. The damage was in the hundreds of millions. Under your direction, as given in part 3, clause 76, what sorts of things will you do as the chief of CSE to curb these attacks and protect the integrity of our tax dollars?

[Greta Bossenmaier]

A key part of our mandate is around cybersecurity, and it was a core part of our mandate well before this new proposed legislation. One of the cornerstones of what we do is to try to protect, as well as we can, the Government of Canada systems and, more so even with this legislation, systems of importance to the Government of Canada.

I mentioned in my earlier remarks that right now, through the technology and people we have, CSE is deploying very sophisticated cybersecurity defences on Government of Canada networks. Those help us on a daily basis. I've already quoted that we're blocking up to a billion malicious actions per day. The magnitude of these malicious cyber-actions is extremely high, so we work every day to block those actions.

When something actually happens—and we always say that no one is immune in this environment as it's a very challenging environment—we also have a very important responsibility. We work with the implicated department, for example, and with others across government to ask how we can remediate this as quickly as possible to ensure that information is being protected and that services are back up and running.

[The Chair, Liberal, John McKay]

Unfortunately, Mr. Motz, we're going to have to leave it there. I apologize.

Mr. Dubé, you have seven minutes. Go ahead, please.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

I want to go back to the question I asked the minister, but to which I did not get an answer, in my opinion.

In a context where the information can be obtained legally by a company, such as Cambridge Analytica, even if it can be said that it is immoral and that it should be illegal, does that correspond to the definition of publicly available information?

[Greta Bossenmaier]

The whole issue around publicly available information, I understand, has been considered around this table. I'll just try to perhaps add a couple of pieces to it.

For us, mandate is critical. Mandate matters, and it matters throughout the entire piece of legislation that is in front of you, and that includes publicly available information. We can use publicly available information only if it is related to our mandate, our foreign signals intelligence mandate or our cybersecurity mandate. We do not have within our legislation, currently or proposed, any mandate to focus our activities on Canadians, to have an investigative capability, to create dossiers on Canadians. That is not within our current or proposed legislation.

I would start with the fact that mandate matters.

The second piece I would relate is that, as I think has been raised before here, publicly available information—and it's defined in our act—would not comprise information that has been hacked or stolen. This is information that would be publicly available to any Canadians.

Also—

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

If I may, before you continue—

[Greta Bossenmaier]

Yes.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

The part of the bill dealing with publicly available information specifically exempts the prohibition on targeting Canadians. So you might not be actively collecting it, but you are permitted to collect it as part of the research that's being done under clauses 24 and 25, if I'm not mistaken.

You mentioned information that's hacked or stolen, but under the current legislation, arguably, the information that we're discussing in this particular example—I'm sure there are others that we just don't know of—was not obtained unlawfully. So the work Cambridge Analytica—and probably other companies of that sort—was doing for political parties, for example, was obtaining information through Facebook on people, and that's being done legally.

Would that not fall under publicly available information, if a company like that is able to obtain it? There are no legal repercussions because it's not illegal. Could CSE not do the same thing under those dispositions even if incidentally, as laid out in the law, in Bill C-59?

[Greta Bossenmaier]

Mr. Chair, I have to go back to the point that, even on publicly available information, it goes back to our mandate. We would access publicly available information only if it were related to our mandate, and we do not have a mandate that focuses on Canadians or anyone in Canada. For the particular case you're referring to, I understand the Privacy Commissioner is looking into it, and I guess the details around it are still unfolding, so I can speak only to our legislation. Again, it goes back to our mandate. It would be very specific: what's the case for which we would need it? Also, very much, the proposed legislation talks about two other things.

Number one, it says we'd have to have privacy protection measures in place, even for publicly available information. Number two, like every other aspect of the proposed legislation, it would be subject to review by the national Security Intelligence Review Committee. This is not CSE having the authority to go look at any publicly available information. It's very targeted and very focused on fitting within our mandate, and again, with privacy protection measures in place, and finally, with review from an independent review agency looking at all of our activities.

I hope that answers your question.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

That's fair enough.

You mentioned the Privacy Commissioner's investigation, but I'm understanding that both your organization and CSIS have also been tasked with looking into that situation, and so in that particular context, when you're doing the research that's prescribed in the legislation where these exemptions exist, notwithstanding section 25, which talks about protecting privacy, would research not be done on, for example, things like Facebook, as part of this information infrastructure? I don't know if that would fall under the definition of information infrastructure, but if you're being tasked with looking into the situation as well, would you not inevitably come across Canadians' information and be allowed to obtain it even if incidentally under what's prescribed in Bill C-59? And under those circumstances, even though it would be in respect of the mandate—I understand that—while I understand you're taking steps to protect privacy, the information nonetheless could be collected over the course of that type of investigation.

Would that not be accurate?

[Greta Bossenmaier]

You covered a lot of territory there. Maybe I'll start with the piece about CSE being asked by the Minister of Democratic Institutions to look at this issue around democratic institutions.

I'm thinking back and I'm looking to Scott. About a year ago, in about June 2017, CSE was asked by Minister Gould, the Minister of Democratic Institutions, to look at cyber-threats to Canadians' democratic institutions. For the first time in our history we actually produced a report that's available to this committee, if you haven't seen it, which looked at broad cyber-threats to democratic institutions.

We really looked at three different aspects of that. We looked at the electoral process per se, so how the electoral machine works. We also looked at cyber-threats to politicians and political parties, and we also looked at cyber-threats to the media. We came out with an assessment at that time, about a year ago.

The Minister of Democratic Institutions now is asking us to review our threat assessment in light of changes that have occurred over the past year. Even when we put out the initial report, we said that this would probably be an evergreened report based on new information and new threat information.

That's the kind of work we expect to be doing over the coming weeks, to review our threat assessment based on information and activities that have occurred over the past year. This is refreshing it.

[The Chair, Liberal, John McKay]

Unfortunately we'll have to leave it there.

We have Mr. Picard for seven minutes.

Go ahead, please.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

I will ask my questions in French, if you don't mind.

I will go back to a few points that we discussed about Canadian citizens potentially being targeted.

Clearly, the CSE does not investigate Canadians abroad. Also, when there is information that might involve a Canadian abroad, it is ignored; the information is destroyed.

The CSE is a partner with several departments in Canada, but also an international partner. It therefore exchanges information. How does the CSE have to manage information that comes from international partners that are not subject to restrictions when it comes to investigating Canadians?

[Greta Bossenmaier]

Again, it's focusing on our mandate, which is, again, to not focus on Canadians or anyone in Canada. I think it's recognizing that there could be incidental collection as we undertake our activities. It's also focusing on, if I understand the question correctly, how we work with foreign partners.

I'm joined here today also by our chief privacy officer and deputy chief responsible for policy and communications. Again, as privacy is part of his title, I'm going to ask Dom to speak a bit about how we work with partners and deal with private information.

[Dominic Rochon, Deputy Chief, Policy and Communications, Communications Security Establishment]

Thank you for the question.

I'll stay in English and try to answer by looking at this from the angle of foreign signals intelligence.

When we collect information, you're quite right that given the nature of how communications work, we may come across information related to a Canadian. Let me use a tangible example. We're looking at known bad guy X in country Y. This bad guy X is in line with an intelligence priority of the government. It stands to reason that they're a bad person wanting to do bad things that are an affront to national security. We're collecting against this person.

Now this person, unbeknownst to us, could phone you. When we collect that, we need to understand that the resulting call becomes a private communication. The Criminal Code is very clear that it is against the law to collect a private communication.

We have ministerial authorizations that cover the various activities that we use to collect information and that allow us to keep that information, if indeed it is of national security or intelligence interest. As you pointed out, we are to delete it immediately if it doesn't. If the phone call is to you and it's talking about something that is not related to national security, we are to delete it. We annotate that. We delete it immediately, and that is reviewed by our commissioner to make sure we delete these things on an annual basis.

If indeed it has a national security interest, then we keep it, but even in keeping it, we write a report that talks about the conversation you may have had, possibly about blowing up something somewhere that is of interest to Canada. We would still protect your identity in that report, by using a generic term to render your identity illegible.

Then it comes time for information sharing. Where does our report go? Obviously there are domestic agencies within the national security apparatus here in Canada—CSIS, RCMP, and others—that have an interest in reading the report. Now they may have a legal mandate to know the identity of that Canadian, so there are procedures in place to disclose that information to them.

Similarly, when we're writing reports, some of the information is obviously shared with foreign partners, and there are other things that govern that exchange of information. Again, though, if they wanted the disclosure of that information, they would have to show us why it was imperative for them to get that information.

Of course, we're bound by other things. We have a ministerial directive, for example, which was recently reissued by our minister, related to information sharing that may lead to the risk of mistreatment. We do an analysis of what our partners want that information for and what they are going to be using it for, and we do a risk analysis to make sure it isn't going to be leading to mistreatment. There's a calculus that happens before any information is shared.

[Michel Picard, Liberal, Montarville, QC]

The aspect of the issue I wanted to address does not concern so much the information that goes abroad, but rather the foreign partner who informs you that, after their investigation and analysis, they have identified four persons, one of whom is Canadian. This foreign partner is not subject to the restriction of not investigating Canadians and sends you information. Since this is a person of interest to the foreign partner, does it change the status of the person and, therefore, the process you have just explained to us? Do you retain the information and confirm that this person represents a threat or, on the contrary, are you required to reject that information?

[Dominic Rochon]

Without going into too much detail, I would say that the example you give would be within the mandate of CSIS. If that partner has information about a Canadian, we then work in partnership with CSIS.

We would look to CSIS and say, “There's information possibly about a Canadian. That is your responsibility, not ours,” in terms of following up with regard to a specific Canadian.

[Michel Picard, Liberal, Montarville, QC]

The CSE's mandate to protect Canadians from various outside threats goes beyond the military context.

Could the CSE help counter threats that would fall more under FINTRAC's mandate, for example, in the event of terrorist or criminal financing? Let's say that there are incoming communications that suggest that a financed terrorist event is being planned. This brings FINTRAC into the picture. However, it could also involve Industry Canada or other departments. In other words, the flexibility of the CSE support extends to all government agencies.

[Greta Bossenmaier]

I'll talk quickly about the parts of CSE's mandate. From a foreign intelligence collection perspective of the mandate, we have a responsibility to collect foreign intelligence across the intelligence priorities that the government sets. To your point, those intelligence priorities definitely go beyond solely supporting military and Canadian Armed Forces function. They're looking at threats to Canada writ large, and the government of the day determines what those intelligence priorities are.

The information we're collecting is really looking at safeguarding and protecting Canadians from a wide range of threats and risks.

[The Chair, Liberal, John McKay]

Unfortunately, we have to leave it there. Sorry.

I feel bad. I keep cutting you off, Ms. Bossenmaier.

Now we go to Mr. Paul-Hus, whom I've never cut off.