Evidence of meeting #146 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cybersecurity.
A recording is available from Parliament.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
But in this case, CSIS is engaging foreign actors. That's the understanding I have from the announcement today. Is that accurate?
January 30th, 2019 / 4:55 p.m.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
We're using whatever tool is the appropriate one at the time. If Bill C-59 is passed by the Senate, gains royal assent and comes into force, then we would re-evaluate how we approach these problems, given those new—
Liberal
The Chair Liberal John McKay
Thank you, Mr. Dubé. We're going to have to leave it there.
Mr. Picard, you have seven minutes.
Liberal
Michel Picard Liberal Montarville, QC
Thank you, Mr. Chair.
Gentlemen, I imagine that when people report cyber fraud or cyber attacks, this confidential information is not made public. Is that correct?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
That is correct. As we've said repeatedly, we have a tendency to re-victimize the victims of cybercrime. We publish, and we punish them. We're looking for them to take ownership and respond. Our goal is to help them recover, to help them defend, and then to share the information widely.
Liberal
Michel Picard Liberal Montarville, QC
According to what I understand, the fact that companies report cybercrime does not necessarily mean that they increase their security or protection systems. They only report the incident.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
No. However, one of the trends I have certainly seen with larger companies and boards of directors is that cyber-risk is becoming the number one topic. I think we're starting to see that trend now. It is becoming a huge reputational risk, but also a huge business continuity risk to organizations, so they're taking it seriously.
Liberal
Michel Picard Liberal Montarville, QC
Let's see the risk from the business standpoint and the chair of the board's standpoint. When you look at the expenses required for security, there comes a point when you evaluate the expenses needed for the security of the system and the losses caused by the reputational risk compared to the amount you have to pay to reimburse the victims. When reimbursement is cheaper, you forget about security and go for the cheaper way.
Do you discuss this aspect with companies? Do they realize that it's not just a question of losing money, but that, along with the money, there's information attached to it?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
In our discussions, and the discussions I've had with numerous companies' C-suites or boards of directors, it's very much about the reputational damage. It's hard for them to calculate the cost of that. We certainly saw reputational damage in some of the larger U.S. breaches. I think the key thing for us is that—you're right—the equipment we're buying does not come secure by default. It's very poorly built, and that's getting worse with the Internet of things. That's a dynamic that we have to change, and we're encouraging industry to ask for security to be built in. They shouldn't have to pay extra. There are security features that should come in as part of any piece of equipment.
Liberal
Michel Picard Liberal Montarville, QC
Most of our discussions have been about technology to increase our security and protect our information. They have centred on the tools as such. One of the problems we can't get around—and correct me if I am mistaken—is the human factor. It is the only uncontrollable risk faced by any enterprise.
Does this mean that despite the important technology that may not even exist yet, but which may be developed, it will be impossible to protect ourselves because of the human factor?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
When you look at this, you're absolutely right. The human factor is part of cybersecurity. We tend not to put security on top of our products sometimes if it makes it harder for a user. It's all about usability.
I think part of it is also education, but you can't rely on that. For example, some of the cybercrime tools and some of the cybercrime spear-phishing types of things that we've seen are incredibly sophisticated. Even I—and this is my daily business—could make a mistake. You have to hope for education but rely on further measures that are kind of layered in a security approach, because relying on a person—and certainly, punishing a person—is the wrong approach for this. It is very easy to make a mistake, to click too quickly, etc., and some of them are incredibly well structured.
Liberal
Michel Picard Liberal Montarville, QC
What I had in mind was more in the way of a simple error due to distraction. We know the principle of indirect attacks, through software. Our problem is psychological piracy. The person is then deliberately in the system.
For instance, when I was a member of the Canadian Bankers Association, we were presented with an electronic payments terminal that was supposed to be unhackable. But it only took three weeks for that to happen. It was not due to human error, but really to malicious intent from the inside.
What solutions do we have to manage the human factor?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
I think there are a few. Typically, we would call that the “insider threat” side of things, where somebody who's going....
There are a few ways to do this. Number one is actually the credentials that we talked about earlier—making sure that people can do only the things that are absolutely necessary as part of their jobs, from the IT perspective.
The second one is having a program to look for these types of activities, things that start to spike. If we're a business, we tend to look at fraud detection as something that's being done to us from the outside. Sometimes fraud comes from the inside as well. There are internal losses and things like that, so it's about using some of those tools on the inside.
The third is one of the things with insider threat—and there are colleagues in the government who are probably better positioned to talk about this. It is the care of employees, so that if they get into situations where they turn to crime, there is a better outlet for them. Part of that is how to give them another outlet when something's going badly.
Certainly, from the intelligence side of things, from the CSE internal side, we've spent a lot of time on our internal security program to help our employees so that they don't ever get into situations like that, to manage the insider threat. It's always something you have to be vigilant against, and it is something that is typically overlooked. We don't like to treat our employees like they're criminals.
Liberal
Michel Picard Liberal Montarville, QC
We were concerned last Monday when we were told that the means of certain foreign states are far superior to any investment Canada may make to be up to date in high technology.
If we think we cannot invest what is needed to develop the necessary means, do we have to convince private enterprise to become part of the solution by becoming stewards or watchdogs of the market?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Right now we're not finding difficulty with the private sector in terms of engagement. They are very willing to come to the table, partner with us, report incidents, work together collaboratively when they see something, or when we see something. I think Canadian industry very much wants to be part of the solution, but to your point earlier, it is expensive. You do have to spend money. If you're running closer to the margins, then cybersecurity is about how to work together to build it in.
We're not seeing an unwillingness for Canadian industry to invest. Sometimes there is a capacity, and certainly not all organizations have a cybersecurity organization that is capable of actually dealing with this, but then you turn to outside providers or places where it's already baked in.
Liberal
The Chair Liberal John McKay
We're going to have to leave it there, Mr. Picard. Thank you.
Mr. Motz, you have five minutes, please.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
Thank you, Chair.
I thank both of you for being here.
We all hear of scams that happen, whether they happen to ourselves, or to our neighbours or family. They usually originate from overseas. Constituents have told me—and I've certainly investigated a number of these myself over the years—that when they threaten to call the police, the scammers become brazen enough to basically scoff at them and say, fine, we're over in whatever country you name, and your police can't do anything to us.
In your new mandate now as the Canadian Centre for Cyber Security, what role do you play in ensuring you get involved in helping the police? What tools do you offer to police to go after this or to try to mitigate the exposure of this, not only for helping the police and their tools, but also at the other end, hopefully rolling out more aggressive strategies for the consumer so they are not a victim?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
If you look from the policing perspective, certainly our goal is to try to get people to go to the police when they are victims of these types of scams, so the police can take action. I think that's one of the first things, to encourage people that the police aren't going to come and seize their computer, to get them to report so they can take action.
The second piece, though, is the education piece. That's the part we would be the lead on, to try to help Canadians understand what these threats could look like so they can be vigilant against them. The fact that the constituent actually challenged back and said, wait a minute, this is a scam and I'm going to call the police.... Then they went back, but they knew to challenge that it was a scam and not fall for it. That's an excellent thing.
My dad hangs up the phone. He made me promise not to reference him in this, but my dad just hangs up the phone because he knows it's a scam and doesn't believe anything anymore. I am worried about the day when somebody legitimate calls now, but the fact is that he knows to do this.
I think one of the key things is how we can make Canadians aware so that, number one, it's not such a stigma that you're a victim. It tends to be a more vulnerable part of the population that falls for these types of scams. Number two is that they report it. Number three, here are some simple things people can do. Number four, how can we work with industry to make us all a little more resilient and have some national level of defence? If you don't get that spam email because Canadian companies have blocked it, that means you can't click it.
How can we start to work on some of those types of outcomes about leveraging industry, and leveraging the fact that we have a commercial sector that actually wants to protect its customers as well?
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
When you mention leverage, are you talking regs, yes or no?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
We're talking partnerships right now. We take a partnership approach.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
When we're looking at various threat levels to Canada, one expert has mentioned that you need to weigh the impacts of an attack and the probability of an attack. We heard just before you gentlemen came in, and we've heard it before, that the probability of a bank being hacked is low and the probability of an individual being scammed is significantly higher, but the impacts are both significant.
If the backbone of our communication systems were compromised—that is, the systems that carry all of our personal information, government information and banking information—is that one of the largest threats to Canada's security? Is our Internet itself maybe the most critical system we have?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
We tend to approach it from the point of view that we never trust the thing below what we're working on. For example, if Eric and I are communicating, sending emails back and forth, we always look and say that we can't trust the network, because the way the Internet works, that communication could be routed all the way around the world and go through every single country, so we use encryption. That's how we would protect the communication.
We always look at how to layer in protections, assuming that something else is not secure. The more you look at that and the more protections you layer in—more things like encryption, security, account management credentials—the more security you get.
At one point, though, you can only do so much before you make it so unusable that users either switch, or they go around your security. That's one of the things the industry has to balance, but I think one of the key things is that the entire industry needs to improve its security. You should not have to know how to secure the basic things that are going into your home. You shouldn't have to investigate how to enable security. It should come and help you do that from the very beginning. The second you turn that device on, it should help you use it in a secure way. “Secure by default” is the term we use.
Liberal
The Chair Liberal John McKay
Thank you, Mr. Motz.
If the Prime Minister phones with your Senate appointment, it's probably a good idea to hang up.