Public Safety Committee on Feb. 6th, 2019

[Christopher Porter]

Yes. Thank you for the question.

The targeting of small businesses is an issue that's near and dear to my heart on the policy side. First off, although it's not directly my expertise, I think the move to the cloud has made it possible to get high-quality security providers in much more scalable ways, where you pay per bandwidth or per seed or per licence as opposed to a large capital fixed cost. Even as opposed to a few years ago, those solutions are much more affordable. However, to stop a world-class actor you need more than just the technology. You need some sort of organizational infrastructure where you're training and keeping employees, and threat hunting. That is beyond what small businesses can do for themselves.

At FireEye we offer managed defence, where we'll manage your network for you. Even with that, that's a 95% solution. To me, the policy failure that this House could address.... At least in the States the policy failure has been that you tend to pick a few industries to defend, and to defend the biggest companies that are there, because those are the ones that are most obviously a threat to national security if they're compromised.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Right.

[Christopher Porter]

What we're not as good at in the west is death by a thousand cuts, so actors that destroy 1,000 small businesses won't get the President's or the Prime Minister's attention, but one big compromise will. I think that's a policy failure that should be addressed. In Canada, I would recommend that you, even though it's very difficult, at least say it's a priority for you to defend everyone, not just the biggest businesses and not just these siloed industries. It may be a very large Herculean task, but it would be nice to see that at least as a stated priority to start working towards.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

That's very helpful. Thank you.

Thanks, Mr. Chair.

[The Chair, Liberal, John McKay]

Mr. Paul-Hus, you may go ahead for seven minutes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

Thank you for being here today, gentlemen.

I had the opportunity to meet Mr. Reiber in Silicon Valley, back in October. That's when I got the idea to have the committee meet with a representative from FireEye as well.

My first question is about where Canada stands globally in the cybersecurity arena as compared with the United States.

Clearly, the U.S. is a superpower and therefore a target of choice. With China and Russia, you are somewhat of a natural choice. In Canada, we are still seen as the good kid, the nice guy, if you will. From a military standpoint, the U.S. has a huge army, in comparison with Canada's rather small one. However, we've always said that we would work together to defend ourselves should a problem arise.

On the cybersecurity front, given the current American defence infrastructure, private organizations and even public ones such as the CIA and the Department of Homeland Security, do you think that, in the event of an attack, co-operation between our two countries would be possible and you would be able to help us?

[Jonathan Reiber]

For some reason the translation didn't come through, so I'm relying on my high-school French, which is not terrible. I'll try to answer.

Your question is, it seems to me, within the evolution among CIA and DHS and the military, how much do they collaborate for common defence, and could they help Canada? Is that part of the question?

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

If Canada is a victim of cyber-attacks, is there a possibility that the U.S. could help Canada quickly?

[Jonathan Reiber]

Sure. That's what I thought. Yes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Are Canadian laws obstacles? Do you know?

[Jonathan Reiber]

Under article 5 of NATO, for everyone who is a member of NATO, there is a resolution that says a cyber-attack, if it triggers a certain point, would require a common defence.

One interesting thing about cyber-attacks so far is that they haven't crossed a threshold that has immediately made a clear statement for a warranted military response in a way that would necessarily be required. I would say the Russian attack on the 2016 presidential election, looked at historically, certainly qualifies as an instance when a counter-offence action by the military would have been warranted. I think that others in the Obama administration have said the same thing. The difficulty in that particular instance is that the decision calculus is complicated, and I won't go into that because that's not really the nature of the question.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thanks. I just have seven minutes.

Talking about the relation between the public sector and private sector—you worked at the CIA, the Pentagon and now you're in the private sector. Here in Canada we try to find how we can work with the private sector because, as we know it's more difficult to have a public servant working in that kind of business.

[Jonathan Reiber]

Sure.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Do you think Canada must switch to have the same way of work that you have in the U.S.?

[Jonathan Reiber]

I think this is an evolution we've gone through. Really since 2014, there's been a significant push to build connective tissue between the private sector and the government. Certainly, I think it's immensely valuable. We had a ramp in terms of defence innovation fellows—the U.S. Digital Service and the Defense Digital Service, those two components—that brought people in from the outside. It was tremendously helpful.

I recommend to every country that's dealing with cybersecurity issues to find a way to build connective tissue to allow tech entrepreneurs to work in the government, and likewise to have people from the national government to work in technology, for certain.

[Christopher Porter]

It's interesting in cyber work because 95% of the attacks that are happening are on private sector networks against private sector victims. Often, in the United States and elsewhere, the first to know about it might be the private sector. Governments can have more powerful responses and their investigations can go more in depth. The private sector doesn't replace government work, public sector work. It's complementary.

It's important to know, for example, that at FireEye some of our core teams that are discovering crimeware are based out of Canada. Even though we're proudly a U.S.-founded company, we're an international company in terms of our workforce. That's rapid information sharing across borders, which also is sometimes difficult for governments to do.

To answer your question, yes, I do think that Canada and the U.S., as the closest of allies, would come to each other's aid in principle under appropriate circumstances. I would defer to my colleague on what those are, but at a working level, absolutely, Canadian and U.S. researchers work together every day and exchange information on threats. I think you'll find that not just in times of crisis, but every day.

[Jonathan Reiber]

Yes. I think there's obviously a deep level of co-operation between the intelligence services and the security services for incident response. I know there's a trilateral commission among the U.S., Mexico and Canada where that co-operation happens. It obviously happens between the two allies themselves.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Okay. Thanks.

I wanted to hear your view about the Chinese company Huawei. There's a debate here in Canada about that company—some people say there's no issue, while others say there is. The U.S., Australia and New Zealand have decided to ban Huawei. What is your view?

[Christopher Porter]

For FireEye as a company, it's not an issue that we follow. We're looking at software threats, not the sort of hardware threats that are alleged.

I absolutely understand in principle why, particularly for government networks, you would want all your telecommunications equipment made by your own country or by a close ally. I think in principle it makes sense, but I don't know anything non-public, other than what I read in the newspapers, on the Huawei issue.

[Jonathan Reiber]

I wouldn't comment specifically on Huawei. I would say that we've been dealing with issues of supply chain risk since...gosh, I wouldn't want to say how far back in history. Certainly since the dawn of the crypto-analytic platform in signals intelligence, supply chain problems have been paramount.

There's a diminishing marginal rate of production if you decide you're going to try to pursue every single chip in the universe to make yourself secure. For certain elements of, say, a national security community or the public safety community, I think it's perfectly reasonable to say, “We are going to now manufacture a certain number of chips on our own”. But the cost is quite significant, and it alters how people do things economically. I don't think you could possibly do so in any kind of global way across sectors for an entire economy. You could probably do it for a number of subsectors.

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus.

Mr. Dubé, you have seven minutes, s'il vous plaît.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair.

Gentlemen, thank you for being here. I apologize for my tardiness and missing your presentations. It's a problem when you're alone here; you can't separate yourself in two. I was stuck with some media upstairs.

I do want to ask about the role of the private sector. It's something that has come up quite a bit, and I think it's one of the underlying tensions in this field of navigating what role the public and private sectors have to play.

I'm just wondering if you see any concerns over the fact that a lot of these things are being offered as services. There's always this notion of wanting to protect what you do best and the clients that you have versus another company operating in the same field. Is there any concern that the sort of regular rules of business and industry might undermine any kind of uniformity or ability to have standard practices and ensure that everyone's on a level playing field when it comes to our own interests here or in the U.S., for example?

[Christopher Porter]

I think you'll find that, at least within the information security community, a large majority of the biggest companies work together on standards and exchange information, even with peer competitors, for example, collecting threat intelligence. We often co-operate behind the scenes in the public good by exchanging information.

Standards setting is generally great for existing enterprises. I don't share your concern. I understand where it would be that way in theory or principle, but I haven't seen that when I've worked in the private sector. I have people I consider good friends and colleagues in many different companies. You compete for individual contracts, but overall, that doesn't hold back standards setting.

For example, I would point to the tech accord community that Microsoft leads. A lot of that public policy work looks at what sort of standards we as a community can have and how we can work together for the public good. That's still competing for individual contracts, and still keeping competitive business secrets to ourselves—you're right—but how can we work together, as well, to make sure those services do get delivered?

The example I always give is that, at least in the the old west, banks were relatively undefended from physical threat. As governments have played a larger role, and as physical security markets have matured and there have been more standards and regulation, those physical security companies make more money than ever. That sort of regulation didn't hurt their ability to either provide services or be successful as businesses.

[Jonathan Reiber]

I concur with my colleague's statement that the standards community has done a good job of rising up in this way. I think the NIST cybersecurity standard that was passed after the initial effort to pass cybersecurity legislation in 2011 and 2012 was a very positive outcome from an earlier effort to try to come up with a mandate or a set of standards. I would refer you to the NIST standard.

I would also say that to prevent a focus on one technology, or one part of the problem against another, the information sharing and analysis organizations that have cropped up within the different centres have facilitated sector-specific development of cybersecurity requirements. The financial service sector in the United States is, in this way, the most mature of the bunch. The FSISAC, Financial Services Information Sharing and Analysis Center, is a good resource for understanding how the sector meets its own interests when it comes to cybersecurity.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you for that.

I'm just wondering if, as we look to the future, and put it more in lay terms.... I think we talk a lot about the cost of using services. What you offer other companies, if you're a company, to protect your own data, if you're collecting customer information and whatnot.... I think those are some of the high-profile cases.

I'm just wondering how you see, going forward, when some of the risks might not be from business X stockpiling data for a rewards program, let's say, but more in what they're selling. In other words, if you're selling any kind of household device, with the proliferation of smart devices and things like that.... Is there a concern that there might be a lot of investment, a lot of money spent to protect your own interests, but not necessarily the interests of the end user, who is purchasing equipment or devices from a given company—for more required updates, and things like that?