Evidence of meeting #149 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cybersecurity.
A recording is available from Parliament.
4:25 p.m.
Liberal
4:25 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
Thank you.
As was indicated, both Israel and Australia are known as powerful cybersecurity countries. With stronger cybersecurity firms, as well as by attracting investments in both your countries to deal with cybersecurity, are your countries under similar attacks to those we have had in Canada? Do you experience the same number and the same type that we do, or do you have more of somebody trying to pierce the systems?
4:25 p.m.
Prof. Jill Slay
May I answer?
4:25 p.m.
Conservative
4:25 p.m.
Prof. Jill Slay
Last week we publicly announced a major attack on Parliament—on all our email and all our service. The Prime Minister talked about it on Monday. They also attacked each of the three major political parties. This morning I woke up to find that a huge Melbourne hospital has had an attack with ransomware and that patient records have been garbled and can't be properly decrypted.
I would say that you must not see yourselves as the sort of poor country cousins in any way. We are all under the same amount of attack. As the Five Eyes in particular, we rely on each other to support each other. I think the level of attack is pretty high at the moment though. For us, that's because we're facing a general election, but there are other political issues. I see it from both a political and a criminal point of view. There are nation-states and cybercrime, and it's only growing.
4:30 p.m.
Prof. Yuval Shavitt
I think it's probably the same worldwide. Maybe Israel gets a little bit more because of the Israeli-Arab conflict, but in general, we're all suffering.
4:30 p.m.
Conservative
Glen Motz Conservative Medicine Hat—Cardston—Warner, AB
Fair enough. Thank you.
Canada is one of only two of the current Five Eyes allies who have yet to declare a position on Huawei. The director of our Canadian Security Intelligence Service, CSIS, has publicly expressed concerns about state-sponsored espionage through the next generation of 5G. We know that Australia was at the forefront of barring this company from participating.
Dr. Slay first and then Dr. Shavitt, what would Canada's willingness to do business with Huawei mean, in your opinion, for the longevity of Five Eyes?
4:30 p.m.
Prof. Jill Slay
I have to say that it's a sovereign issue. It's really for Canada to decide.
Obviously, I can't speak for government. I just speak for myself. I think it would be easier for the Five Eyes partnership, just thinking from a technical point of view, if we had a common view on Huawei. But I think the announcement yesterday from the British, which was a halfway announcement that perhaps we might be able to deal with this, which says perhaps, with effort, we can provide the kind of assurance...would also then complicate the system for Canada.
I'm a very black and white person and a very black and white engineer, so I'm comforted by the fact that the federal government is not going to buy Huawei. I'm also the Optus chair, and Optus funds a lot of the research at my university. Obviously, Optus was the company that had the relationship with Huawei for 5G. I felt myself in huge conflict because I was called the Optus chair, so I was highly relieved when I didn't have to deal with that issue.
From a political point of view, I think for maintaining the solidarity of the Five Eyes, I would hope that we could come to the same kinds of conclusions. But I think there will be other people having that discussion this week.
4:30 p.m.
Prof. Yuval Shavitt
It's a risk management thing. As I said in my initial statement, we know from the Snowden report that American companies collaborate with the American government, so there's no reason to suspect that in other countries it doesn't work this way, especially not in China. It's risk management. How much would you invest in order to avoid having Huawei in Canada? Of course it's going to cost you more for equipment.
I would say that if you decide to use Huawei, you need to put in place monitoring equipment and monitoring facilities to make sure that funny things don't happen.
4:30 p.m.
Liberal
February 20th, 2019 / 4:30 p.m.
Ruby Sahota Brampton North, Lib.
Okay.
I'll start with you, Professor Slay. It was a bit worrisome to hear you mention that you were targeted and that you had Ph.D. students enter your classroom in order to do so as well. Can you explain why you were targeted? I think you stated that everyone in your type of position in academia would potentially be under a threat. How would IP be something that would be linked to you in your position?
4:30 p.m.
Prof. Jill Slay
I think it is part of the international understanding, which has already been stated, that basically, in the same way that China might want to just collect as much data as it can from the system, China has had a much more systematic way of sending Ph.D. students to Australia, the U.S., and, I presume, Canada. Those of us who are deemed to be leaders in our country end up with many Chinese students wanting to be our Ph.D. students.
With one of my very first Ph.D. students, I was working on a project with the police. It was in a public university, so it wasn't classified data. Nevertheless, without going into details, the IP was stolen and taken back to China. I was there, unfortunately, without knowing when it was handed over. Since that time, I have been very cautious about what's going on.
4:35 p.m.
Brampton North, Lib.
I've read a little bit about the political parties being hacked. Do you know what kind of data? I know you're going into an election. We are also going to be having a federal election in October of this year. On another committee I sit on, we've been talking quite extensively with the democratic institutions minister about the potential threats Canada faces as do many countries around the world regarding elections and protecting democratic institutions.
What kind of wisdom can you give us from the experience that Australia has been having?
4:35 p.m.
Prof. Jill Slay
I don't think we've formally announced—and I don't think we will be able to formally announce in the short term—whether any data were stolen. We actually don't know. That's from the parliament service. The greater concern has been raised with the [Technical difficulty—Editor] parties, the three major parties, and the fact that very little finance is being made available to them.
It's only in the order of $70,000 a year to actually secure their systems. However, on their systems, they will have all the data of memberships, donations and things like that. Those are the things that are causing public debate this week. We, like you, will be remembering what happened or what was claimed to have happened in the U.S. election. We're being assured by government that it was caught very early and that it's under control, but I don't think there will be much more of a public statement, to be honest. We have to all be careful.
4:35 p.m.
Brampton North, Lib.
Do you feel the lack of a public statement is due to wanting to protect the integrity of the system there and not wanting people to be fully aware of what may or may not have happened?
4:35 p.m.
Prof. Jill Slay
They're not ready to announce anything. Attribution is hard and that's part of the discussion. It's easy to pretend to be a nation-state setting up in a different nation-state. We can't tell where the attack is actually coming from. We very often cannot tell where the attack is coming from, because people are very good at espionage and hiding themselves, pretending to be somebody else.
4:35 p.m.
Brampton North, Lib.
We've had those conversations, as well, when it comes to private companies. Many people are not revealing the breaches that are occurring due to public scrutiny or shame.
When it comes to our democratic institutions, do you think we should be trying, through the Five Eyes at least and through other democracies, to work together in order to lessen the potential threats, and how so?
4:35 p.m.
Prof. Jill Slay
We should be and I think we are. There is probably a lack of under-reporting publicly, but I'm pretty sure that within international organizations, within governments, there is also a lot of sharing. My experience is that there is a lot of sharing, whether it's law enforcement or whoever. I don't think we're necessarily constrained by those things.
It might be smaller companies that don't want to acknowledge they have been breached. However, particularly in Australia, there is more of an openness now to talk about it, particularly since before Christmas, the government, Alastair MacGibbon, the deputy secretary, the prime minister's adviser, did made it very clear that many companies have been breached, and there is more openness, more willingness to accept that because there's just so much of it.
4:40 p.m.
Liberal
4:40 p.m.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
Thank you, Chair.
Very quickly, I want to hear from both of you. We've talked a lot about foreign state actors as a threat. There has been a certain level of reporting here in Canada about domestic actors operating, not necessarily related specifically to cybersecurity, but in the digital space.
From a cyber perspective relating to our study, has there been any concern, in both Israel and Australia, about domestic actors and malicious actions that have posed a risk for either government or private individuals? Perhaps Professor Shavitt could answer and then Professor Slay.
4:40 p.m.
Prof. Yuval Shavitt
Of course, you're always afraid of criminal activities. Criminals identify the Internet as a great place to make money very easily. Yes, you have to be protected also against domestic attacks.
