Public Safety Committee on Sept. 20th, 2018

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you very much, Chair, and thanks to both of you for being here.

I want to ask a couple of questions related to some of the issues around transparency.

First, because the topic on everyone's mind, for both good and bad reasons, is elections, are there any protocols in place for how you divulge a potential vulnerability, infiltration or attempt to influence once the writ has dropped? In other words, if we're in the middle of a campaign—I've heard it referred to as the James Comey dilemma—how do you make sure that Canadians are aware that there's an attempt being made to interfere in an election but at the same time not break that news and then yourself influence the election in that way?

[Scott Jones]

That really goes to the general caretaker convention status but also to working with Elections Canada. This is something that we are talking to them about, because at the end of the day the nightmare scenario for a public servant would be to ever do anything that would interfere in the election. I can't overstate how much of a nightmare scenario that is for me right now.

[Some hon. members]

Oh, oh!

[Scott Jones]

That's something that we are talking about with Elections Canada, to make sure we respect that, and also for the Commissioner of Canada Elections, to make sure that we respect the independence. That might be the better route. That is something we're discussing right now in terms of how we're going to approach this.

It's a bit of a new world. Normally what we tend to do in the public service is that we kind of turtle. We retreat into the public service and we just do the normal things. Cyber has changed that.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

There are no existing guidelines on how to proceed in the event of that type of event occurring during a campaign.

[Scott Jones]

We're working through the scenarios now.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Okay. Does Elections Canada have the expertise on their end to handle that kind of problem or do they really rely solely on you?

[Scott Jones]

We've been working collaboratively with Elections Canada since before the last election in 2015 in terms of augmenting cybersecurity and starting to discuss these issues. I think we're working through this as we also figure out how to engage with political parties if we find something. How do we share the information that we see if a particular political party is being targeted for activity? I think it's part of working out that protocol.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

There are Shared Services and then Public Safety, but Elections Canada is absent from this centre. Was there no thought of having some part of Elections Canada being part of the centre for any role that they might have to play?

[Scott Jones]

I think we look to liaise with them, but we're respecting their independence. Being outside of the government and more of a parliamentary agent, we look to partner with them and really follow a strict protocol and respect that.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

The other piece I want to ask about is the vulnerabilities equities process that exists within the NSA in the U.S. On the same topic of transparency, I'm wondering about this. More and more, especially with the existence of the centre, I'm assuming that there's going to be more work done to identify these vulnerabilities.

In Bill C-59, a lot of the pieces involve working with the private sector to identify the vulnerabilities and to, in some cases, even study them to a certain extent. I don't want to rehash the debate that we've had quite extensively at this committee, but is there a specific protocol that exists here, in the same way that the NSA has developed one, in order to disclose to the public and parliamentarians, etc., the existence of vulnerabilities in software and such?

[Scott Jones]

We absolutely have a process for that. Our standard process is that we work with the company to try to do it in a responsible way and to not create a vulnerability that somebody could then exploit. Every company takes time to prepare software patches, etc. We want to make sure that they're able to have those patches in place before any public disclosure so we don't get the cybercriminals or any actors that—

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Without getting into the details of a specific vulnerability, is the process and how it happens public?

[Scott Jones]

Not yet. It's something that we've been talking about—how do we share that?

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Okay. I would ask that you endeavour to do better than the last response I got, which referred me to Twitter. The last time I had CSE here they were saying, “We tweet now”, so I just hope for something a little more robust along the lines of the NSA. I can't believe I'm giving the NSA credit, but on this they deserve some, so if you could follow that example it would be greatly appreciated.

I had another question relating to private infrastructure, notwithstanding that I feel this has become a dirty word. It's interesting that in any of these issues related to specific companies, and for some of the concerns, whether it's around Huawei or others, when it comes to private infrastructure, obviously you're talking about liaising with private enterprise. You can look at private electrical grids or you can talk about a private clinic with regard to health information or something along those lines.

What's done there when there's a private infrastructure that might be foreign-owned or not clearly defined as Canadian-owned and there's a little more of that grey zone? How do you operate in that particular kind of context, especially with spectrum and things like that for telecommunications?

[Scott Jones]

We're always looking to provide advice and guidance in terms of just helping to raise the bar initially so that it's more secure. When you're looking at infrastructure, regardless of ownership, if it's Canadian infrastructure, in Canada, we would treat it as Canadian in terms of our work with them. If they were suffering an incident, we would certainly encourage them to report to the Canadian centre for cybersecurity so that we could try to help. At the same time, it's always a business choice in terms of what technology they use, how they implement it, and the need to balance factors—cybersecurity but also affordability and other factors.

Really, it's a combination of a few things. It's advice and guidance and helping to make it more secure. We're trying to publish more and more practical advice and guides. I'd say that in the past, some of our things were—

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I don't mean to interrupt, but my time is wrapping up.

When national security assessments are done when there are foreign takeovers of companies, I assume there's a larger cyber component in this day and age. We've often talked about natural resources in the last 10 to 15 years. Is that something you folks will be involved with in the future, going forward, when those assessments are made by the Minister of Innovation, Science and Economic Development, ISED?

[Scott Jones]

We're designated as part of the Investment Canada Act process. We provide advice to, in this case, the Minister of Public Safety, who then works with the Minister of Innovation, Science and Economic Development.

In terms of the Canadian companies, though, we're also looking to see how we can increase their resiliency so that they're able to defend against these types of cyber-activities. That's part of this as well. But it certainly is a consideration.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Dubé.

Ms. Damoff, you have seven minutes.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you, Chair.

Thank you both for being here.

Mr. Motz and Mr. Dubé both touched on Huawei. My question is maybe a little bit broader. It's about the risks posed by some of the concerns that have been expressed about that company but also the telecom industry in general and the risks we face with that. Is that something this committee could look at in terms of a study? Would that be worthwhile?

[Scott Jones]

The key thing for us, when we talk about suppliers, is that almost everything is manufactured around the globe. Where the final product is assembled doesn't necessarily equate to where, say, the software is written, etc. We work in a global market. That's one thing we really look at: How do we bring security into something where the product of origin, or the company that provides it, is only providing a small piece of what's actually embedded in the product?

On the telecommunications company side, it's difficult for us, because we do work under.... They provide a lot of information so that we can work very proactively in terms of what's coming in the future, so it's competitive information for them. At the same time, I've seen them make substantial investments in cybersecurity without requiring fanfare or government intervention, etc. I think they're taking security very seriously. I'm really proud of the relationship. I think we have found a good Canadian model for working between government and industry on trying to address some of the cybersecurity challenges, not from a very narrow national security threat but broader. How do we make sure we're building a very resilient telecommunications network that spans from coast to coast to coast? That's something we've really been working on.

It is a complicated issue. With cybersecurity, unfortunately, as we were saying, it's really hard to characterize this in 240 characters. That's one of the biggest challenges in the telecommunications sector. It is very complicated and it is broad.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

The other one I want to ask about, which has come up a few times, is elections and the spreading of misinformation. You stated that you think the public has become more cognizant. I'll say that's true to a certain extent, except that there's still the ability to share misinformation broadly on social media. It can be placed there. I have a concern in particular with the fake accounts that have popped up over the summer. It appears to be a government official, it gets shared 5,000 times, but it's actually a fake account.

Those kinds of things are really troubling, because you have misinformation that is still being shared. I've had people come into my office, as I think probably all of us have, to talk about something they read. When I tell them that it's just not true and ask them where they got it from, they say they heard it from a friend who read it on social media.

How are you dealing with that when it's coming from another country, or even internally?

[Scott Jones]

In terms of directly dealing with it, that's one of the challenges we have with an open democracy that encourages communication. We simply don't monitor for that type of thing. We don't direct our activities at Canadians, and on the Internet it's hard to tell Canadians from everybody else.

I think the key thing is that the social media platforms themselves are trying to address this. One of the things is that certainly, for example, if I saw somebody trying to impersonate me—I don't know why they would, but if they did—I would certainly take advantage of the reporting tools they have. They have tried to address this, so it's been somewhat in public.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I'm just going to stop you there for a second, though, because we had Twitter come to the status of women committee, and we were talking about exactly that, and reporting. Twitter told us that Google had the same number of employees just in Ireland that they did worldwide, and they simply couldn't deal with it.

There is a bit of problem there when the social media—in particular Twitter, because I think Facebook has probably done a better job of addressing some of the things they've faced—just doesn't have the staff. They can report things, but they just don't deal with them, so it's an issue. That's an issue from a public safety standpoint, in terms of elections, if the private company is not dealing with that issue.