Public Safety Committee on March 22nd, 2018

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

Welcome, everyone.

In part 3 of the bill, proposed section 4 of the new Communications Security Establishment Act states that the Governor in Council may, by order, designate any federal minister to be responsible for the CSE. According to the summary we have, this suggests that any cabinet minister could be designated as the lead for the CSE.

Based on your expertise, which minister would be most qualified to perform those functions? Do you think it would be the minister of Foreign Affairs, National Defence, Public Safety and Emergency Preparedness, or another one?

[Greta Bossenmaier]

Mr. Chair, as the chief of CSE, I can answer that the way the legislation is laid out, we report to the Minister of National Defence. He is the responsible minister for the Communications Security Establishment.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

In your opinion, the Minister of National Defence must remain the minister responsible for your agency, even though Bill C-59 involves some kind of integration that suggests that the Minister of Public Safety and Emergency Preparedness could play a greater role.

As I understand it, you believe that the Minister of National Defence is the one who should take responsibility for the CSE. Is that correct?

[Greta Bossenmaier]

For Bill C-59 and the CSE act in particular, CSE is responsible to the Minister of National Defence.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I would now like to talk about information.

The amount of information you gather is huge. I cannot even imagine the amount of intelligence that goes into Canadian networks. That said, there are two parts: government networks and civilian, or private, networks.

Are you able to collect information from private networks? You are not only dealing with the government aspect, but also with the private aspect.

[Greta Bossenmaier]

I want to ensure I'm understanding the question correctly, Mr. Chair. I'm taking that this is with respect to our cyber-defence mandate, under which we have a responsibility to protect Government of Canada systems and to provide advice and guidance for systems of importance to the Government of Canada. As I noted in my earlier remarks, this legislation would allow CSE, upon the request of the owner of a network outside of the Government of Canada and for a system that the minister has designated to be of importance, to work with that system owner to help protect their systems from cyber-attacks. We're not focusing on Canadian information—it's not part of our mandate—but we could be asked to help protect a system of importance from a cyber-attack, which could include something outside of the Government of Canada.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

For example, if CSIS needs information, does your centre have to look for it in private networks, for example in emails, on behalf of CSIS?

[Greta Bossenmaier]

Sorry, I'm not sure I understand the question.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Suppose I communicate with someone and CSIS suspects that communication would endanger Canada's security. However, it must obtain evidence. Under your mandate, do you have systems that allow you to get that evidence? Is that how things work on your side?

[Greta Bossenmaier]

Dom, do you want to pick that up based on your earlier conversation?

[Dominic Rochon]

In that particular example, CSIS would be interested in you as a Canadian. They have a legal mandate to do that. They could leverage us under our assistance mandate. We always talk about part (a) as foreign signals intelligence, part (b) as cybersecurity, and part (c) as our assistance mandate. Today, as with this new legislation, if CSIS is interested in you, they have to have a legal mandate to go after you, meaning they have to get a warrant. If they show us that they have a warrant, at that point in time they wouldn't have access to our systems. They would ask us to act on their behalf. We would then use our capabilities to help them collect information. Any information that we collect is segregated and is given back to them and is their information. Effectively, we're acting on behalf of CSIS.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

If someone outside the country, for example from another government, contacted a Canadian, it would therefore be possible to get that information. You would need a warrant from a judge, of course.

[Dominic Rochon]

Yes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

That's great.

I—

[The Chair, Liberal, John McKay]

Unfortunately—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

That's it already?

[The Chair, Liberal, John McKay]

I'm sorry.

Ms. Dabrusin, you have five minutes. Go ahead, please.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

I want to bring it out a few layers. We've been getting into some details. I'd like you to clarify some things. You said that a billion times a day there are cyber-attacks on Canadian systems, and then, when you were speaking with Mr. Dubé, you talked about threat assessment and the changing environment that you're dealing with in your threat assessments.

Can you help me understand? In Bill C-59, what are the new tools you have that help you to respond to astronomical numbers, those so large I can't even say the word? Maybe you can help me with that.

[Greta Bossenmaier]

Sure, and I will ask Scott Jones, our deputy chief of IT security, to come in.

Perhaps to answer the question, Mr. Chair, I'll go to three different pieces of the proposed legislation.

First of all, to prevent cyber-attacks, we need to have not only good capabilities and tremendous Canadian men and women working on this but also good intelligence to try to understand what those threats are before they even come to Canada. In the legislation, there is a strengthening of our ability to ensure that we can continue to collect foreign signals intelligence, including that relating to cyber-threats. That's a piece of it.

The second piece I would draw attention to is that the cybersecurity aspect of the legislation talks about us being better able to share threat information with the private sector, and it also talks about us being able to—again, at their request—help defend their systems. That's another way this legislation would strengthen our ability to help do cyber-defence for Canadians.

The third piece I would focus on is the defence of cyber-capabilities. If there was a cyber-attack, instead of us sort of standing back with a shield with which we would try to protect against these billion malicious attempts per day and waiting for them to happen, if we could go and say, “Let's try to stop that cyber-attack from even happening”—there could be a server outside which we know is now trying to infiltrate a Canadian system and steal Canadians' information—we could, through this legislation, which would be a new piece for us, try to stop that attack before it got to our shores and into our systems.

With that overview, maybe I'll ask Scott Jones, our IT security—

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

If I can talk about that, part of what you're saying is that, in fact, the hope is we will reduce it from the billion down to the lower levels. Can you just explain it? When we're talking about this one billion number, what are we talking about? Can you clarify that for me?

[Greta Bossenmaier]

Of course.

Scott.

[Scott Jones]

Really, when we're talking about a billion malicious actions, we're talking about the gamut, all the way from people poking at our systems, looking to see where they're vulnerable, up to people trying to compromise or install malicious software called malware, or basically exploit any vulnerability that exists. It's a wide range of activities, but what we're trying to do is counter the full range, no matter where it originates. We want to counter any malicious activity that's coming at the Government of Canada, and the number is astonishing. I think that's really where we are going into a few different areas. Number one is making it better. How do we work to make the systems that we have more defendable? That's working with the commercial sector, and that's being able to share more information, being able to share some of our tools and techniques, and pushing it forward.

We've shared some of our tools publicly. We have a system called Assemblyline which we have made open-source and publicly available to anybody who could leverage that. That's how we, for example, defend the government and look at millions of malicious files a day.

The second piece is providing that level of defence that fills the gap between the best available commercial and the state-of-the-art threat activity that we're facing today. Bill C-59 would allow us to then use that on critical systems of importance, as designated by the minister, but also with the informed consent of the system's owners. Informed consent is something that's particularly important in this case.

The third piece is general information sharing, whether that is providing advice and guidance or being able to share what we're seeing, what's going on, and very much clarifying our authorities to share information.

That's where we kind of layer all these things together and start to deal with those billion events.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

[The Chair, Liberal, John McKay]

Thank you.

Thank you for those astronomical and astonishing answers to very penetrating questions.

With that, Mr. Calkins, you have five minutes. Go ahead, please.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Thank you, Chair.

I have some questions. I'm just really concerned about the overall security. I formerly was an IT professor at a college before I actually came here as a member of Parliament. That was a long time ago, 12 plus years, which means that my IT skills are basically non-existent anymore. Notwithstanding that, I have some questions. I understand the difficulty and the enormity of the task that's actually there, and I want to highlight that. Can you tell me how many people are actually employed by CSE to do the preventative or proactive elimination of threats? What size of a crew do we have working on that? Is that a number that you can share with the committee?