Public Safety Committee on Jan. 30th, 2019

[Scott Jones]

Our role as part of the team and the government is to make sure we give the advice on the cybersecurity aspects. There are other aspects in a decision such as that. The timing has been.... Minister Goodale came out and talked about that yesterday. I think the key thing for us is to provide the advice we need to give, in terms of what the next government decision is. In terms of today, we're implementing the policy decision from 2013.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

What is your answer to those who say that we lag behind other countries and that we are dragging our feet? You heard Mr. Leuprecht's presentation; he is a professor at the Royal Military College of Canada and he was very clear on this topic. He is not the only one, because experts from everywhere seem to be saying that this is quite obvious.

As I was saying, from a technical point of view, it is difficult for us to decide. We must depend on people like you to make a decision that is critical for Canada. Do you have enough information today? In September, you said that you were able to ensure the protection of Canadians. Is that still the case today, on January 30, 2019?

[Scott Jones]

Our role is to make sure we provide that information and counsel to the government, so the government can make an informed decision. From our perspective, we continue to work with industry on how to protect Canada's infrastructure today and tomorrow, to make sure we're addressing cyber-threats.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

So, for the moment, we still don't know if Canada can trust Huawei.

Let's leave that company aside for now and move on to the financial sector, and the banks. Mr. Leuprecht also provided interesting information concerning financial transactions, which can now come from anywhere, since the Internet is global.

According to the CRTC, it's impossible to broadcast Canadian content abroad. When you go to the United States or elsewhere, you cannot listen to TVA, for instance, because that network is not accessible. So, there are certain barriers that exist regarding communications. Why do those barriers not also exist for the banks? Do you know? Do you know why from a technical point of view it is possible to have barriers for one activity but not for another? I don't know if it falls within your mandate to answer that.

[Scott Jones]

I'm not sure I quite understand the question. I think the key thing is that, when you're travelling, it depends on whether you can get to the services: for example, connect to your bank. Or is it that—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Professor Leuprecht just told us that the Internet is an open space, but when we travel, we can't watch Canadian TV, so why can't we block communication between banks or whatever?

[Scott Jones]

I think that really goes to it. It is a little bit outside of our mandate, but, fundamentally, we've chosen to have a very open Internet in Canada, where we block very little. Other than specific content providers stopping you from watching, for example, NBC, because Canadian stations have rights, we tend to have a very open Internet. Not all countries take the same approach and some have chosen to filter the Internet and their content. That's just the decision that Canada has made.

[The Chair, Liberal, John McKay]

You have a minute and a half.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

In conclusion, I'd like to talk about China. Things are very sensitive at this time. We know that in diplomacy we have to be cautious, but from the point of view of national security, it is a fact that China often has malicious objectives involving various countries, including Canada.

Do you consider China to be a potential threat to Canada's security?

[Scott Jones]

From our perspective, one of the things we highlight in the national cyber-threat assessment is that we have to be vigilant against every nation-state, and certainly cyber-techniques are within the realm of every nation-state. Some are more aggressive.

Certainly in the past, CSE has been asked to attribute malicious cyber-activity to certain countries, and that's one of those things that we'll continue to do as per government's broader policy. It's something that we are always looking at, but, for me, we don't defend against only one; we have to defend against everybody. If we take a one-for-one approach, we would be focusing on—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Fine, but do you think that Canada should be frightened of China?

[Scott Jones]

I think we should be vigilant against anybody who doesn't hold our values.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus.

Mr. Dubé, you have seven minutes, please.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

Mr. Jones and Mr. Belzile, thank you for being here.

Ms. Damoff asked you some questions on the banks' policy with regard to reporting breaches or problematic situations. For my part, I want to follow up on the questions I asked the representatives of the RCMP on Monday.

Things were not clear. An update of the law now requires that businesses report information leaks to the Privacy Commissioner. Those representatives told us that the new police centre—I too have forgotten the names and the acronyms—does not have the same obligation, and they are trying to work with those organizations. Is there a duplication of efforts? If a bank reports a suspicious or worrying incident to you, do you also report it to the police, so that they can do work of their own?

[Scott Jones]

I think there are a few things. Maybe I'll turn to Eric to talk about some of the specifics. First of all, in terms of our collaboration with the RCMP, we want to ensure that we are never in the way of the police doing their function of investigations and pursuing cybercriminals. That's where we make sure that we're coordinated.

Our role with the banks, with the financial institutions more broadly, is, how can we become proactive against cyber-activity? Our goal is to work to strengthen our defences and to strengthen our information sharing so that we can take action and protect. When there's a specific incident, though, we do protocols a little bit differently.

Maybe I'll let Eric....

[Eric Belzile, Director General, Incident Management and Threat Mitigation, Canadian Centre for Cyber Security, Communications Security Establishment]

This is what I would add on that topic.

When an incident is reported to us, we work in close co-operation with the other organizations. We do a triage, because there are other organizations that are concerned, like the RCMP and CSIS. Together we determine who will manage the incident. We co-operate so that each organization can fulfil its mandate and functions, and we make sure that we do not encroach on the mandate of the other organizations. This co-operation starts immediately.

This is how we have worked for several years. The consolidation of the Canadian Centre for Cyber Security and the creation of the new RCMP cybercrime centre will also help us improve this co-operation.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Fine.

I know it can be difficult to make statements on hypothetical situations. Suppose an enterprise reports a suspicious situation to you, but does not report it to the police for some reason, be it public relations, financial consequences or other things. If there is enough evidence to have you suspect that a criminal act was committed, do you inform the police about the case so that can begin an official investigation?

[Eric Belzile]

Generally speaking, we consult the victim to determine the best approach. Often, if there are conclusive indications of cybercrime, we advise the victims to report the incident to the police so that they can be aware of it and can exercise their mandate.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Fine.

You mentioned the report on cyber threats which was tabled. In your presentation, you said the following:However, we assess that at this time it is very unlikely that state-sponsored cyber threat actors would intentionally seek to disrupt Canadian critical infrastructure.

Is the threat unlikely only in the financial sector or is that also the case for all critical infrastructure sectors?

[Scott Jones]

I think the key thing we were referring to there in terms of nation-states is that they have specific objectives. Absent a major international conflict, etc., we said the threat of disruption was very low, in terms of the threat to Canadian infrastructure, but there is some nation-state interest in private information and in some of the other information that's out there. There are certainly nation-states that use cybercrime tools to generate revenue, especially to get around sanctions and so on.

We always have to be vigilant, and the key thing for us is how quickly we can get information and share information, so that we can take action against any of those types of malicious cyber-activities, but we think the threat of disruption at this time is very low, absent some major conflict. If there is disruption, it's more likely to be a secondary effect of a cybercrime tool—ransomware, for example.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

The other piece I just want to touch on is related to the announcement today on elections. I know that here we're studying the financial sector, but there's another issue I'm wondering about. In the announcement that was made, CSIS seems to be taking the lead with CSE, using its assistance mandate to provide support from that perspective. CSIS is engaged in threat reduction, which is certainly a debate that has been had and that we will continue to have, but not necessarily at this time. Given that we're studying the financial sector, I'm just wondering....

An election is a specific event in time. Time varies, certainly, as we all know. That being said, is there a trend there? Is there a precedent being set for CSIS taking the lead on engaging with actors that might pose a cybersecurity threat, or is this just a one-off for that specific event? For example, if there is a concerted effort in the financial sector—which our study is about—or in any other sector, is this something that's going to be recurring, or is this, again, related to elections specifically?

[Scott Jones]

I think the goal is to leverage the Team Canada approach and bring in the proper authorities. Obviously, it's Parliament's role to debate those authorities and assign them to organizations, so I won't comment on that.

For us, the key thing here is that we want to bring in the right authority. At CSE and the cyber centre, we don't direct our activities at Canadians, so if there is a threat emanating from Canada, the RCMP or the Canadian Security Intelligence Service is better positioned to respond.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Just really quickly, with the 15 seconds I have left, would that structure and who's taking the lead look different if Bill C-59 receives royal assent today?

[Scott Jones]

If it's coming from within Canada, that doesn't change. The provision still says that CSE cannot direct its activities against Canadians.