Public Safety Committee on April 24th, 2018

[The Chair, Liberal, John McKay]

It's always dangerous, withdrawing.

[Michel Picard, Liberal, Montarville, QC]

I live dangerously.

[The Chair, Liberal, John McKay]

Are you wishing to speak to a withdrawn amendment, Mr. Dubé?

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Absolutely.

I think the wording more closely resembles the Green Party and NDP amendments, so I would be very happy to move LIB-31.

[The Chair, Liberal, John McKay]

Having enjoyed this movie yesterday, we're going to try to do it again today.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

It is a four-hour flight.

[Voices]

Oh, oh!

[The Chair, Liberal, John McKay]

Is there any debate?

(Amendment negatived [See Minutes of Proceedings])

Apparently, Mr. Dubé is the only one in favour of his amendment. LIB-31 is defeated as opposed to withdrawn.

Now we move to NDP-29.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

Amendment NDP-29 seeks to remove the words “Despite subsections 23(1) and (2)”. The purpose of this amendment is to maintain the protections of Canadians. Section 23 of the Communications Security Establishment Act, which is enacted in part 3 of the bill, protects Canadians from CSE activities. By removing the words “Despite subsections 23(1) and (2)”, we are making sure that the activities carried out in the context of what is set out in section 24 of the same act will not target Canadians.

The subsequent amendments will round it all out.

[The Chair, Liberal, John McKay]

Is there any debate?

(Amendment negatived [See Minutes of Proceedings])

Next is NDP-30.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair.

It's unfortunate not to hear the rationale of the government members—not technically government members, in the committee context, but Liberal members—for voting against some of these amendments.

At any rate, amendment 30 seeks to remove the word “disclosing”. As I mentioned yesterday in another context of the debate, disclosure is the new wording that's used as part of the information-sharing regime that was brought in during the last Parliament under Bill C-51.

This is a suggestion that the Citizen Lab made to ensure that the information that CSE is collecting in the context of any research it's doing under proposed section 24.... By removing “disclosing” we're limiting the risk that the information that's been collected in that context can be shared with other agencies. If the stated goal is to really be studying the information infrastructure in Canada and to be conducting that type of research, then this way we'll be limiting the potential sharing of information where profiles might have been created, even if inadvertently, of Canadians.

[The Chair, Liberal, John McKay]

Is there any debate?

Go ahead, Mr. Picard.

[Michel Picard, Liberal, Montarville, QC]

In the interest of transparency, which our opponents ask of us quite often, we want to keep this provision as it is. I therefore oppose this amendment.

[The Chair, Liberal, John McKay]

Is there any debate?

(Amendment negatived [See Minutes of Proceedings])

We'll move on to NDP-31.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair.

Amendment NDP-31 seeks to amend proposed paragraph 24(1)(b), so that activities it authorizes may only occur on electronic information and information infrastructure as described in proposed paragraph 18(a) of the CSE act. This in only in furtherance of its cybersecurity information assurance mandate. We've heard a lot of this notion of cyber-weapons. The idea here is that we're making sure the establishment is not collecting this type of information in the use of more offensive capabilities, because any back door that exists being used by the good guys—and I don't always care for these terms—could potentially be exploited by bad actors as well.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'd like to ask the officials how these proposed changes might impact this legislation.

[Scott Millar]

This reflects what we do now, and these kinds of activities we've reviewed for the last 21 years. The infrastructure information definition, or the way it's bounded, is to make it clear this does not include information that's linked to an identifiable Canadian. The concern about adding electronic information is that it could be electronic information on those infrastructures and could work against the intent of the whole section, which would possibly pull in information related to a Canadian without meaning to do so. I think infrastructure information keeps it outside that sphere.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'm curious. Mr. Dubé suggested that without this amendment it's possible that, as he indicted, the good guys' information could also be exploited. You're not suggesting that. You're not thinking that is a possibility.

[Charles Arnott]

The way we read this, it would expand in an unclear way what CSE could do. The section we're talking about is saying that certain specific things are not subject to the restriction of not directing it at Canadians or people in Canada. The intent here is to focus on things that have a low expectation of privacy or no expectation of privacy. That's why the definition of infrastructure information explicitly excludes any information that could be linked to an identifiable individual, so again something that has a very low or no expectation of privacy is not connected to a person.

By adding “electronic information”, you're expanding it to all information in electronic form. You're adding that to the carve-out so it will expand what CSE can do. In addition, at the end of that section, I think this amendment would change where it says it's using that infrastructure information to provide information assurance activities on the infrastructure from which the information was acquired. Whereas doing the second part of this amendment, and saying it has to be in accordance with section 18, section 18 is our entire mandate, so again it's broadening that significantly as well.

[Scott Millar]

If I may also add, this is not a back door through which information flows to other folks outside our mandate. Everything we do here still has to be bound within our foreign intelligence and cybersecurity mandate, and the furtherance of that mandate.

[The Chair, Liberal, John McKay]

Is there further debate?

(Amendment negatived [See Minutes of Proceedings])

We'll move on to NDP-32.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

This amendment seeks to clarify the activities that the CSE may undertake. In light of information leaks by Edward Snowden, in particular, we have seen that such tests can cause problems in computer systems.

This amendment seeks to ensure that these tests will be done with the knowledge of the people concerned, even though this is certainly already common practice, which I hope. This would impose the legal obligation to obtain the consent, for example, of a telecommunications company or any person who could be targeted by a system, software or component of the IT infrastructure. This would minimize the impact of any potential problems during these tests that could be detrimental to a Canadian using the same infrastructure.

[The Chair, Liberal, John McKay]

Thank you, Mr. Dubé.

[Michel Picard, Liberal, Montarville, QC]

I'm going to ask the department for help because I have a hard time figuring out what it would be like to ask permission from everyone. It seems physically difficult to me.

[Scott Millar]

Yes. I could expand on that, but essentially that would be a challenge.