Public Safety Committee on Jan. 30th, 2019

[Scott Jones]

We collaborate very closely with the National Cyber Security Centre in the U.K. We are trying to apply lessons learned. Part of it is that they're further along. We're about 121 days into the cyber centre stand-up and they're a couple of years in.

We are looking at how we can improve that. We've seen them do things like.... I think they have a few initiatives in the U.K., for example, on getting girls to code and reaching out to younger people. We've sponsored some events like Hackergal, and we sent out some of our professionals to mentor. This is something that doesn't necessarily scale easily, just because it's hard to send everybody across Canada—we're a giant country.

Whom can we partner with? How can we get more people interested in the digital side? We are looking at other ways of communicating. One of the campaigns we've seen around the world is to reach out to seniors, in terms of cybersecurity: “Go and talk to your grandkids and ask these questions.” It seems to be very effective. We're waiting to see how effective it is, and we're trying to see how we can reach out in different ways, but I think education is one of the key things.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Would you be able to send us some of the links that you referred to and what you are already putting out there? What I've always looked at is the Citizen Lab, which has a security plan and information as well, but it would be really helpful for us to have the best tools that we can be conveying.

[Scott Jones]

Yes.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

I was reading an article from The Financial Post, and it was referring to OSFI's role in collecting information on different security breaches. We've talked about a few different information sharing models. How does OSFI fit into it?

I'm just trying to keep track of all the different organizations here.

[Scott Jones]

With OSFI's role in the regulatory space.... We certainly work with them, but one of the key things for us is that in the cyber centre, by not having a regulatory function, we can be turned to earlier. We obviously support a broader government, so we do work with OSFI. We try to work together when there's an incident.

Certainly, especially in the financial sector, one of the key things is that it's all about confidence. We want to make sure that whatever's happening we can maintain consumer confidence. We can do our part, but we don't speak on behalf of the government for monetary or financial policy.

How do we coordinate? We do have partners with them. They would be brought in as one of the major stakeholders if there was an incident in the financial sector, into some of the incident management things that Eric mentioned.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

They deal with the federally regulated entities. Money lenders and those types of shops that you might find at the end of the street, do they have information sharing requirements? Who's watching what they're doing?

[Scott Jones]

We're hoping that they will call us. We've made our information available, but right now they don't have any mandatory reason to report to us.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

All right.

Ultimately, our personal information, depending on the institution we're working with, might have different standards and regulations, at least for information sharing.

[Scott Jones]

As far as I know, there would be no mandatory reporting for anything that's outside of that regulated space. We do get a number of reports from businesses that are looking for help.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

One last thing.... I know I have only about half a minute left, but the other part that was missing on OSFI's regulatory powers was that the federal banks might be actually outsourcing a whole lot of their security to companies that are outside of Canada. Who monitors that? Who monitors the relationship with these outside providers to make sure that they're keeping things up to snuff?

[Scott Jones]

One of the things we mentioned is the cyber-threat assessment, but we've also been working closely with businesses about the supply chain and how they're applying security constraints throughout their supply chain.

For a lot of the bigger incidents, it tends to be a breach as you've outsourced further things. Usually, it's not the first degree of outsourcing; it's when you get to the second. It's about making sure that you're building in security requirements and that they cascade, but also that companies are aware that outsourcing a function doesn't mean outsourcing the accountability for the information. That's something that I know a number of companies are concentrating on, but we also highlight it in the national cyber-threat assessment, for exactly that reason.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Ms. Dabrusin.

The chair has one final question.

The last time you were here, Mr. Jones, you described the security approach as a kind of layering approach. You said that you had a certain openness with certain vendors where you could examine code and various things. When Professor Leuprecht was here, he talked about a system of switches and tables and the ever-evolving way in which that goes.

Are you still confident that the approach you are recommending, namely this layered approach, is as appropriate for a 5G network as it is for a 3G and possibly a 4G network?

[Scott Jones]

The approach for 5G is under review right now in terms of the approach for Canada. I'm very confident of the relationship we've built with Canada's telecommunications providers and the work we've done to increase the cybersecurity elements regardless of the network. The collaboration we have in terms of how we respond to incidents is something we'll need to continue, no matter what. We need to continue to build multiple layers of security, regardless of where the technology comes from.

In my job, I actually trust nothing. I assume that there are vulnerabilities in every single piece of product we have, so how can we layer more and more protections on? That includes when the data gets to the cardboard box. That shouldn't be a cardboard box; your data should be encrypted at its destination, and it should be protected. It's not about protecting the castle walls; it's about making sure you have the vaults of the really sensitive information properly protected.

Information security is evolving, as well, in terms of how we can protect that, how we can keep information protected and encrypted. Also, we have to start thinking about whether we need that information and for how long. Maybe it's not necessary to keep it that long.

It is the layered approach, and it still needs to continue.

On the 5G question, that's something that's being studied right now, and there will be specific recommendations coming out of that.

[The Chair, Liberal, John McKay]

With that, I want to thank both of you for coming and informing us, and we appreciate your appearance once again.

This meeting is adjourned.