Public Safety Committee on Jan. 28th, 2019

[Voices]

Oh, oh!

[The Chair, Liberal, John McKay]

I don't think it's an issue of courage; it's an issue of the appropriate role of civil servants, etc., but given the passion with which Mr. Motz struggled with his question, I'm more than willing to have you respond in whatever way you see fit.

[C/Supt Mark Flynn]

Okay. We both have something to say here, but I'll let Mr. Lynam go first.

[Chris Lynam]

What I'll say is that the sheer fact that this committee is looking at cybersecurity and cybercriminality is adding to the conversation about what a challenge it is for not only Canada but also others to determine how to deal with this. The more attention that is brought to either the challenges law enforcement has or how we're going to address them or how other departments, including the new Canadian Centre for Cyber Security, are going to make sure that Canadians and also businesses know how to protect themselves better and what to do when they are victims of cybercrime.... From that perspective, I think bringing more attention to the issue is of importance.

[C/Supt Mark Flynn]

I'll add to that. The attention that comes to this has to be in a way that removes, as I stated earlier, the stigma attached to it, because I've seen over the last couple of years that I've been involved in cybercrime as an area of focus that a lot of organizations do not report it because of the stigma. When a large corporation is compromised, if it does not report the information to law enforcement or to other organizations through which we can gain access to the information, there's nothing we can do about it. The more we paint them, as opposed to the cybercriminal who actually perpetrated the offence, as the evildoers, the more that drives that reporting down and the more that takes away from our being able to successfully investigate it.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I really appreciate that. With that in mind, because fewer than 10% of businesses report cybercrime, is it a feasible ask or suggestion that we mandate reporting cybercrime? Is it feasible to say that if you're the victim of cybercrime, whether you are a small, medium or large business, you have a responsibility to report that to the authorities, however that may look? Is that a reasonable expectation from the Canadian public?

[C/Supt Mark Flynn]

There would be an interesting challenge that could occur in that.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Yes.

[C/Supt Mark Flynn]

There has to be a balance, as my FINTRAC colleague spoke about earlier, in the threshold for reporting. The system could be inundated with reports alone.

We're very much focused on the trust and confidence and on finding the right balance in the volume of reporting. Through the national cybercrime coordination unit that's being set up, we'll have that public reporting portal. If we have people reporting to police and police aren't prepared to receive the reports and offer sound advice or guidance, such as you experienced or your constituent experienced, reporting alone will not solve this problem. There has to be a balance between reporting and being able to respond, and we have to have the systems in place to be able to receive and make appropriate use of a report when it comes in.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Motz.

Mr. Dubé, you have seven minutes, please.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair.

I have a few questions about reporting.

The first thing is on the reporting mechanism now that's part of the national centre. I'm wondering how that works in parallel with the new obligations under PIPEDA to report to the Privacy Commissioner, for example. Some of those instances would always be crimes, I suppose, but there's a difference between some of the crimes that might be reported to you versus some lackadaisical attitude towards software patching and things like that. How do those two reporting mechanisms tie together?

[Chris Lynam]

In reality, they're not connected. The obligations under PIPEDA are related to data breaches and the regulations around that where the new public reporting system that we'll put in place is voluntary. It involves either individuals or primarily small and medium-sized businesses that want to make sure they have an ability to let law enforcement know they're a victim. The ability of their doing that can help police in their investigative and intelligence efforts.

To the example that was provided here, unfortunately, there will likely always be cases where that money is not going to be returned, but by having a very robust and modern public reporting system that has strong analytics behind it, we could very quickly understand that perhaps 10 other people in Canada have been victimized by that same person or that same cyber entity, moniker or email address. Because of that level of impact—we can see that at a national level—we can then work with other police services across Canada to go after that cybercriminal. Right now that doesn't exist.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

If that's optional, it's hard for me to imagine why a company, if they have an obligation to report already, wouldn't take advantage of the ability to also report it to law enforcement, but there could be a whole slew of reasons why they might not do that.

Does your unit then look at anything that might have been reported to the Privacy Commissioner but wasn't necessarily reported to police? Now it's out there and is probably public, and the commissioner is going to report on it. What's your ability to tackle that afterwards?

[Chris Lynam]

We're going to do some outreach with the Privacy Commissioner to understand more how they are handling or managing these data breach reports. Again, under that regime, there's no obligation for that information to be accessible to police. There may be some things on the prevention side or things like that which might be useful, but we're moving forward with a voluntary scheme that has the public or businesses report directly.

You're right. We could have businesses that report to both and we would encourage them to do that.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Presumably the reason PIPEDA is now forcing these disclosures to the Privacy Commissioner is to make it public because many of these corporations in particular were keeping it under wraps and then it was only coming out two years after the fact. I guess it's like regular police work. If there's no complaint or reporting, then you see it out there but you can't necessarily act on it.

Am I understanding that correctly?

[C/Supt Mark Flynn]

I'll step in.

If we learn about a compromise that has a significant impact on Canada, there has to be a balance. We will follow up with those companies and encourage them to report to us in detail.

The mere fact that there's been a compromise does not allow us to effectively pursue a criminal investigation. We need much more information than the simple fact of a compromise. It has been challenging at times but we will work with some of those large corporations because it's often difficult to get to the right person to gather the information we need. We do that outreach. We do not have to wait until the organization reports to us. However, it is only an effective investigation when that corporation is willing to work with us in the investigative stages of our response to what's occurred.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Does the unit have an increased capacity associated with it? In other words, from a technical perspective, has the unit provided law enforcement with additional capabilities that didn't exist when the RCMP was doing it? I'm assuming the same type of collaboration under a different name.

[Chris Lynam]

Yes. The unit will not only have new people focused on enabling that collaboration with police services as well as the private sector, but it will be underpinned by a new information management and information technology system to allow information sharing between law enforcement to do some of the analytics, as I mentioned, in the public reporting, to really allow the law enforcement cybercrime capabilities that may be with the local or provincial level to get more capacity.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I want to jump in with the 30 seconds I have left to talk about people. Are there any challenges—

[The Chair, Liberal, John McKay]

You have more than 30 seconds.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Okay. That's good, then, but it is running out.

I want to ask, in terms of people, if there's any challenge finding that specialized skill set with individuals who can be afforded the proper security clearance. It's something we've heard in different fields related to cybersecurity. Is that a challenge you're facing both with the unit and with the RCMP also more specifically?

[Chris Lynam]

I would say, for anybody, whether in the public sector or private sector, who is looking to hire cybersecurity talent, there's only a limited pool out there right now. There are initiatives to increase that to find the right people who have the right technical background or the right critical and analytical thinking who you can bring in and train to the right level. There are some challenges there.

A lot of the approaches we've developed to date are really playing on that. There are a lot of Canadians out there who want to help law enforcement pursue cybercriminals. They are less interested in working in a cybersecurity field or another field. They want to help serve their country. They may not make as much money as they would in the private sector doing it, but we've had some success in that approach.

[The Chair, Liberal, John McKay]

Thank you, Mr. Dubé.

Before I turn it over to Ms. Sahota, there were 28,000 reported cybercrimes. How many resulted in charges?

[Chris Lynam]

Mr. Chair, I wouldn't have that figure in front of me. We can get back to you.