Public Safety Committee on Feb. 4th, 2019

[Deborah Chang]

Just to add some additional data points, we did a study of our own hacking community. One in four hackers have at one time found a vulnerability but not reported it because the company didn't have a channel to disclose it. To Jobert's point, there are definitely many people out there, one in four hackers in our own community, who wanted to do more and couldn't without a safe harbour.

We're happy to work with any office to draft any law to put in the provisions, but it would just generally given the authority for a vulnerability disclosure policy. The Hack the Department of Homeland Security Act of 2018 was just passed in January, and those requiring the DHS to have a vulnerability disclosure policy in a bug bounty pilot.... And so the language—I want to say it's about six or seven pages long—authorizes the creation of VDP in a bug bounty pilot for that agency. The Hack Your State Department Act was introduced by Congress earlier this year. So there are texts of language that are out there, but we can certainly help draft that language.

[Ruby Sahota]

Thank you.

[The Chair, Liberal, John McKay]

Mr. Motz, you have five minutes.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Waterhouse, I want to get back to the question we finished with before, the electromagnetic pulse attack.

In your opinion, where do you think we stand as a country in being prepared for such an attack and for dealing with one moving forward, not only against our power grids, but against any other possible targets for this sort of attack?

[Steve Waterhouse]

I saw the transition and the preparation during the Cold War period. What I mean by that is that during the seventies and eighties, computer systems in the armed forces throughout the world were susceptible to that kind of threat. Data processing rooms were built to withstand any EMPs. As time progressed and by the end of the Cold War, it was considered too costly to proceed that way, so we went on—and by “we” I mean different companies—to buy commercially available off-the-shelf computers. This is how we became vulnerable today.

Unless you have a duly prepared room to withstand any EMPs, any system is vulnerable. The telco infrastructure is vulnerable; any cars on the road that are highly electronically enabled are vulnerable.

To that extent, Mr. Motz, we are, I'm sorry to say, doomed, if one gets out and is blasted 400 kilometres above North America. North America itself will be down and we'll be living back in the way of life of 100 years ago, getting heat from wood stoves and communicating using the smoke from their fires.

[Some hon. members]

Oh, oh!

[The Chair, Liberal, John McKay]

—along with pigeons.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

—along with pigeons, yes.

We've heard from a couple of my colleagues' questions, as well as from HackerOne's sub-comments, suggestions that we can do more to get more subject-matter experts involved in this particular industry in this country.

From your perspective, what can government do to increase our capacity to deal with this from an ethical hacker perspective?

[Steve Waterhouse]

I'm not sure I'm following your question, sir.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

We have a limited capacity, a limited number of subject-matter experts, in this country to deal with what they're doing in the United States, with the volume of ethical hackers existing there.

From your perspective, is there anything that government can do to increase our capacity?

[Steve Waterhouse]

Currently, we have agencies such as CSE and the cybersecurity centre that are beginning initiatives to foster and enable some hackfest festivals throughout the country, or conferences to that effect.

As an example, I was at the hackfest festival in Quebec City in November, which for the last 10 years has been fostered by CSE. They have a preview of what's going on with the latest and greatest hackers who are around to do the hacks through whatever technological means they have at the time. It's a pool of resources they can go to to get the best from the latest and greatest they can find. There is “Atlantic con” or Atlseccon, and there is another security conference in B.C., and others across the country. In this way, the agencies are active in figuring out what's happening on a real-time basis.

I believe that with CCC's being what it is today—I mean, it's alive—it will become more invested. That, for me, would be one positive point: having a government agency always be present in letting the community know that people are....

Minister Gould just disclosed at that hackfest festival in Quebec City that Canada wanted to have more hackers present to help the Government of Canada fend off any bad influences in the next election. That was a first. Everybody was stunned by the announcement. This was a positive point, by which the government was letting the community know that they wanted everybody to pitch in and do the best we can not to have a situation like what happened in the States.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I have one last question and I don't know how much time I have left.

Over the years, the cost of having your own business tested for outside penetration has always been high. There has been push-back from companies saying they can't afford this. It's almost the opposite: they can't afford not to do it.

Have the prices come down? Is there, not from a price perspective, some incentive through which we can give private companies, from HackerOne's perspective—small businesses, and even our large corporate businesses—the opportunity to ensure that they are at least resistant to outside attack?

[Jobert Abma]

Before I founded HackerOne, I used to be a penetration tester. One of the reasons we started the company to begin with was that we believed we needed a scalable model that would apply to every organization on this planet, and that would also be affordable for everybody on this planet. As you pointed out, penetration testing, our consultancy, has been very expensive.

We believe that the more the company has to protect, the more they need security. Because of that, everybody on this planet should be able start their own vulnerability disclosure program. At HackerOne we have offerings that are free for open-sourced and community organizations. We have help or products available for people to establish that process for their organization, even without any incentives on the platform itself. By that, we believe we will enable every organization on this planet to improve their defences against a data breach.

[The Chair, Liberal, John McKay]

Thank you, Mr. Motz.

Mr. Spengemann, you have five minutes.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

This is a perfect segue. I want to pick up where Mr. Motz left off. I think it's specifically relevant to small businesses to be mindful of the obstacles to developing good cyber-infrastructure. We have a lot of start-ups that are data-intensive, where the protection of data matters early on in the corporation's lifetime, and there's a disproportionate cost borne by those kinds of businesses versus our large banks.

Besides the U.S. and Canada, are there any other jurisdictions you could point to where partnerships have been established between companies like yourselves and the public sector to establish baseline levels of security that provide a common good for the small business community, upon which further models can then be built as the companies grow and have more specialized cybersecurity demands?

Either of you, or both, could respond.

[Jobert Abma]

I can share some thoughts.

The problem we've seen with small organizations is that it is always a trade-off of risks. There are checklists available, or policy documentation, around what to do as a small organization. Unfortunately, it is up to the organization to implement some of those best practices that have been established. We've seen organizations, especially smaller organizations, treat those more seriously, especially as they become, as you said, more data-intensive.

However, we have not been able to establish a checklist based on the vulnerability data that we've seen on a platform level yet, but we do expect that will happen in the next couple of years.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Just to follow up before we go to Mr. Waterhouse, is there something the public sector could supply? If you had a wish list vis-à-vis the public sector, whatever jurisdiction you're operating in, what could it supply to make your job easier?

[Jobert Abma]

We would be happy to work with third parties to establish that. I don't have a more concrete answer for you right now.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

I'm thinking along the lines of wikinomics for baseline security for small business, or a neighbourhood watch, whatever model one wants to apply. It was already touched on in earlier dialogue.

Mr. Waterhouse, do you have thoughts on this?

[Steve Waterhouse]

Yes, sir.

Some of this documentation exists already, from the NISC in the U.S., which I can say has been projected internationally and is a good way for any business to start. That documentation has been formatted for very large enterprises as well as for SMBs.

Definitely, if an SMB is serious about protecting its data, it will go through that. However, my coming from that background of SMBs, I know that they don't have time to do that. What will be needed is really something that is a one-click-stop shop. They would just have to pay for the bare minimum and have a list of whatever mandatory verification that would be done and could be satisfactory to them. But what would that satisfaction be? Would it be for the payment card industry? Would it be satisfactory for privacy issues, and so on? There's no clear guidance by which the owner of whatever coffee shop can verify, is my business satisfactorily safe in itself and for customers, and so on, and do I offer Internet access to the customers? If so, how do I do it?

I go so many times on the road, and a bad habit of mine is to verify the security in these coffee shops. Most of the time, you find you have access to the cash register as well as the operation in the back hard drive that has all the backups in it, and access to the Internet. That's the kind of purview. These SMB owners just want to make it work, because they have so little room, and cash, to get resources.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Do either of you, HackerOne or Mr. Waterhouse, have comments on the Canadian labour market with respect to folks who would provide good cybersecurity? How are we doing in terms of people going through programs and being trained, whether in the public sector, the Canadian Forces, or the private sector? Is there enough of a labour force out there for us to tap into if we're doing more in that sector as a government?

[Steve Waterhouse]

I'll start with the first question. As you saw, there are so many statistics out there to say there's a lack of cyber-expertise. As testimony to that, my calendar shows that I have a reduced number of opportunities to teach and train people in it. One reason is that the costs have been going up for a few years, but another is that the people are not committing to do that job. It's a very demanding job. You have to know a lot. You have to know so many operating systems from however long in the past, and also to be able to adapt to the newest, latest and greatest ones that are coming around.

That said, we do have universities with good programs in place to train those people. I just finished doing a microprogram in cybersecurity at the master's level with the University of Sherbrooke. We had 15 people in the class. It was an awesome program, but we had only 15 people. I would have liked to have 115, because those people were really eager. They wanted to enhance their knowledge—they're professionals in the trade—but it was one of the rare occasions they had to do so.

Back in the old days, in 2003, I was with the University of Winnipeg, and that was when the first certificate came out. But the adoption is not present. It's not as forthcoming as in many countries, where they have this in their school systems.

[The Chair, Liberal, John McKay]

Thank you, Mr. Spengemann.

Mr. Dubé.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I just want to go back to the issue of the next generation of 5G networks, which are still being researched, and the metaphor that Ms. Dabrusin brought up. They are cardboard boxes that an armoured truck is driving between people, but I think they're also devices. In the last meeting we had an interesting conversation about the number of devices that are now going to be in play because of the next generation networks and the speed capability—things like robots being involved in surgery and the possibilities for agriculture with drones.

I'll start with HackerOne, then go to Mr. Waterhouse as well.

I was told that price isn't the only consideration. As the market attempts to develop affordable devices for things such as smart homes and all of the other uses you can think of, is there any concern about a race to the bottom, where security will be sacrificed? You could have the Fort Knox of networks, but ultimately, if people have crappy firmware—if you'll forgive the expression—or lousy devices, the whole thing could be for naught.

Is that a concern? How would we address it?

[Jobert Abma]

This is one of the problems we haven't figured out yet—“we” meaning the world. We are seeing that there is going to be a bigger problem in that if an organization does ship firmware that contains security vulnerabilities, at some point it might not matter, because the companies will be getting away with it.

With some of the recent changes that we are seeing, there are more consequences for an organization that is neglecting security, and I think that's a good thing. Consumers demand higher standards, especially when they buy certain products. I also believe that with some of the regulations being changed, where the government can demand that organizations comply with certain standards, it's going to be very important for us to make sure that organizations do not have a chance to ship firmware that has not been tested. That, I hope, will in effect mean that we're avoiding a race to the bottom.