Public Safety Committee on Jan. 30th, 2018

[Raymond Boisvert]

Yes.

With your permission, I will make a few comments in English, since I mostly work in English currently.

There's no doubt about the threat capabilities of Russia. They have been demonstrated through the interference in democratic processes through western Europe and in the United States and increasingly in a number of specific states in the U.S. Russia's malicious intent in supporting autocratic regimes from Syria and elsewhere is clear. Those are much more predictable and traditional types of quasi-military activities. In the hybrid warfare threats that we've seen them conduct, they are using proxies in Internet-type attacks, and in convergence with organized criminal groups in Russia, we have seen them launching a number of important negative effects on jurisdictions, including Canada.

China is a much more complex issue, and I understand the challenges of national jurisdictions like ours. State-owned enterprises and authoritarian capitalism seem to drive a lot of business opportunities and business decisions, but they represent complexities from time to time that I'm not sure we have fully examined as Canadians.

There's also the issue that China is now in the age of self-admitted “sharp power”, and they exercise that power with very little reservation anymore. There's no longer even a question of hiding their intentions. They are taking a very aggressive approach around resources and intellectual property, and they also are very clear in dealing with dissidents and academics. They've arrested some of them, and they punish others, including academic institutions in North America, at their will, so I think there's a value challenge that Canadians have to consider along with the economic opportunities discussion. The Cold War is over, but a new version is rapidly emerging, and I think our focus on counterterrorism is not always our best play.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

We were just talking about warfare. I don't remember if it was here or at the meeting of the Standing Committee on National Defence. I believe it was Ms. Damoff who raised the topic. We discussed certain ill-intentioned activities on the part of China and Russia that targeted Canada.

Earlier, you said that offence is the best defence. Is Canada in a position to conduct offensive operations in order to protect our country, or is that process too complex?

I know it is complex, but I wonder what sort of activities Canada could undertake to protect itself.

[Raymond Boisvert]

In the hyper-competitive world we live in, offence would indeed be the way to go. We are dealing with foreign nations that are in no way subject to the same rules as we are, or to the scrutiny of organizations like the one Ms. Vonn represents; these things mean that the government here must be accountable.

Earlier I spoke about the possibility of a cyber-attack against one of our organizations. It's hard to say if we could easily tell if such an attack came from a particular country or its representatives. In any case, I think it is increasingly possible for us to determine specifically which computers and operations centres we could target, attack and remove from the international communications network.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

The current government had some critical comments to make about Bill C-51. We then proposed Bill C-59 to change certain things. We are often reminded that we must not violate the rights and freedoms of Canadians; we all agree on that. However, in a defensive context, we have to have the means to protect ourselves.

In your opinion, will Bill C-59 excessively constrain or weaken the government's safeguards?

[Raymond Boisvert]

No, I'm of a view.... I very much appreciate the work that Ms. Vonn and her colleagues in other organizations in Canada and the western democracies do. It's an important part of that debate and discussion, but quite often I do feel a little concerned that we spend so much time focusing on what are, I believe, organizations that operate by the rule of law. They're subjected to multiple layers of review, including everything from the Auditor General to the Privacy Commissioner. We now have a number of additional bodies, which, as I said, I've welcomed. I think we live in the age of transparency and accountability, and agencies that operate with these special powers must accede to them, but I also think that sometimes we forget, as we focus on the incidental collection of some Canadians, that despite the characterization, it's not massive, in my view. I know from my time it was minuscule, but it's incidental. It will happen because of the convergence of all the global information and communications infrastructure. It does occur, yet Canadians don't seem to be having the same debate about all those data brokers out there that have hundreds, if not thousands, of unique identifiers about them.

Sometimes I wish Ms. Vonn's organization or others would focus a bit more on that, just to have some sense that Canadians need to look at their data and their privacy and their personal information, and not worry about the security establishments as much because they have rules of engagement and overview and review. We need to look at those who don't.

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus and Mr. Boisvert.

Go ahead, Mr. Dubé.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair.

Thank you both for being here. It's interesting, given the comment that was just made about incidental information, because there's incidental information, there's the publicly available information, and there's this notion that there's clearly an intent in the legislation to expand the powers for this new threat that's being described, but when we ask the chief of CSE to explain why those powers would be used, there's no example that's able to be provided.

This question is for you, Ms. Vonn. I want to understand, because there's a link here. One of the answers that was given to me when these officials were before the committee was, “Don't worry. If you look at part 3 of the bill, in proposed section 25, they have to ensure measures are in place to protect the privacy of Canadians", but that's a very vague notion, because it then goes on to say, “of Canadians and persons in Canada in the use, analysis, retention and disclosure of...” and then goes on to describe the information.

The use of the word “disclosure” is particularly troubling, because that's how the government has rebranded the information sharing that was created under former Bill C-51. I'm wondering if there's some concern about that information. It's seemingly for research and other innocuous purposes by CSE, but it can nonetheless be shared, and I'm wondering if there's some concern about what consequences there might be, in particular if it's being shared with Five Eyes allies, when we see examples like what was reported in La Presse at the end of last week about the RCMP acquiring information on Canadians from the DEA without the proper judicial oversight that would normally be involved if they were doing it here in Canada.

With that very broad portrait I've painted, I just want to understand, because I think a lot of people don't quite understand how maintaining, even with a cosmetic change, information sharing as was brought in by the former Bill C-51has an impact on how these new powers of CSE are going to potentially play out.

[Micheal Vonn]

Thank you.

It's of critical concern to civil libertarians that the public understand that collection, incidental or otherwise, of personal information into national security agencies is not innocuous. In part because we do have these alliances, information sharing does flow in ways that are potentially problematic for those individuals, even with the notion that perhaps we're not exploiting it and perhaps we're not using it.

We're going to try to give assurances, but we don't know what's being used in terms of exploitation. We know it's everything from network mapping to profiling, which has been identified as a huge problem. It definitely resonates with Canadians as a threat to their own personal security. All those aspects of trying to figure out what the jeopardy is for this collection, use, retention, and exploitation are critical. It's critical to figure out those tentacles and ensure that we have mechanisms that are not merely paper mechanisms when we say we have measures. What are those measures? How do we know where they work? Do they cover off all the aspects?

Those are aspects behind the curtain that goes on with national security that most Canadians cannot see. We've come to have reason to distrust, because we haven't seen, for example, the simple definitions for things that would allow us to have the insight that we should have for democratic accountability.

When we see failures of definitions in Bill C-59 around things like publicly available information, to pick up my colleague's point, and a national security agency can acquire data through a data broker using the kinds of techniques that were just being described and ingest that into a system in which information may get shared with allies abroad, you can see the magnification effect of the impact on security of individuals—not national security, but personal security—in relation to all of those data practices.

People are not as alive as we would like them to be to these threats, but they're increasingly alive that these are the problems, as you illustrate.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I'd like to hear from you both on this.

The words “information infrastructure” get thrown around a lot. There's a definition there. We can debate that, but the definition of a foreign entity being attacked or information being collected on them by CSE is not the same as it was when the CSE act first came in. These information infrastructures.... I'm thinking in particular of Ms. Damoff's questions over the last two witness panels about this notion that....

Even when we look at telecommunications companies in this country, we would have blinders on if we believed that things like LTE networks and stuff like that are being developed in a silo. There are obviously international efforts going on to make these networks better and more robust, but while that's happening, these legal definitions of what's.... It just seems that it's a bit out of date in terms of what's foreign and what's not. As soon as we give the power for the minister to identify information infrastructure, inevitably that net is going to be wider than it ever was before. I'm wondering what your thoughts are on that.

Perhaps we could start with Mr. Boisvert and then go back to Ms. Vonn.

[The Chair, Liberal, John McKay]

That's really an important question. Unfortunately, Mr. Dubé has left you one minute to answer it, so could you be very brief?

[Raymond Boisvert]

It's going to be very difficult. It's a very complex world and it's getting more complex. Data is growing exponentially.

It's a two-part play. One part is the opportunity that technology will allow us to do many things. The second part, of course, is that it's an enlarged threat surface for attackers to focus on to break into those same networks to steal personal identifiable information in the same way as is being suggested the security establishment can under warrant, in a predicated investigation—lawful work—go in there.

We have a big problem around data and around privacy and about the invasion or the loss of security of the person. I think as much or more of it is occurring from the threat actor side than from security agencies and others.

[Micheal Vonn]

You see the tension around this when you give the CSE broad, active cyber-powers that exploit vulnerabilities in the system that of course Canadians need to protect themselves against. Are you going to disclose those or are you going to exploit them? It's one of the tensions inherent in this new power.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

If I may, really quickly, like 20 seconds—

[The Chair, Liberal, John McKay]

You have 20 seconds.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

When I led myself to the exercise that CBC/Radio-Canada did with the cellphones and CSE not commenting on what that does for public confidence, is that potentially because those same loopholes are being exploited, and inevitably there's that risk?

[The Chair, Liberal, John McKay]

You're going to have to work that into another answer. I'm sorry.

Go ahead, Mr. Fragiskatos, for seven minutes, please.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Thank you very much, Chair. Thank you to both of you for being here today.

Mr. Boisvert, I want to start by talking about cybersecurity and offensive capability. In your presentation, you talked about a community of like-minded nations coming together and taking cybersecurity very seriously for a number of reasons, not just from a public safety perspective or traditional national security perspective but also for the defence of basic democratic principles.

I wonder if you could talk about where we are—or where CSE is, I should say—in terms of what's being proposed for an offensive cyber ability and how that compares to other middle powers. I won't talk about the U.S., but, for example, the Australian Signals Directorate, the equivalent to the CSE, has an offensive cyber capability. In New Zealand, the Government Communications Security Bureau is the equivalent to CSE. It's not directly involved in mounting an offensive cybersecurity strategy, but that is in effect conducted by the defence force. That's in place there.

Where are we in terms of our Five Eyes allies? Let's look at what they're doing and compare that to what we're doing.

[Raymond Boisvert]

At the present moment, I think we're on the low side of response in terms of investment and I think in terms of empowerment for the security establishment to respond.

I think that may shift. We have a pending government cyber-strategy that may boost us into a new level of the atmosphere, but currently I think Canada is seen as being somewhat trailing its key allies, from the United Kingdom to Australia and New Zealand and elsewhere. To me that's very problematic, because while my responsibility as the provincial security advisor is to help or assist in certain strategic issues around the prosperity agenda, it's mostly around protecting critical infrastructure and around cybersecurity.

With that in mind, as I said, we or they—those who own that critical infrastructure—cannot do it alone. These are some of the large independent agencies of the Ontario government in, let's say, the health care sector, education, transportation. We need to bolster our capabilities to make ourselves on par with places like Australia.

[Peter Fragiskatos, Liberal, London North Centre, ON]

I'm glad you mentioned critical infrastructure, because I wonder if you could tell us how an offensive cyber ability allows us to protect critical infrastructure. You've been very public about concerns around hydro and nuclear power stations as well as health care systems and hacking attacks meant to retrieve personal and private information from Canadians or basic R and D data. How critical is an offensive strategy, an offensive capability, from a cybersecurity perspective, in protecting all of these things?

[Raymond Boisvert]

First let me affirm too that it's really important to understand that the health care sector in general is now the most targeted area of governments around the world. Right up there with .mail and .gov domain addresses, most health care sectors are under attack. Why? It's because data is the new oil. It's the most expensive and most sought-after commodity in the world, and threat actors of all varieties and types are converging upon it. Those are also arguably the least defended sectors of our society, unlike the large government and military sectors.

I think we need to quickly move to a place where we can bring to bear some of those cyber-offensive tools. One example would be to go out into the dark web consistently and look for early indicators of compromise and look for where threat actors are talking about you, talking about your domain and talking about your strategies, as early opportunities to get at them.

There are also the opportunities in a sort of offensive way. Should a massive DDoS attack occur, as we've seen against places like Spamhaus, The New York Times, and other organizations—and they are amplifying in size—without the aid of large agencies, those particular important aspects of our democratic societies will fall. It's about going out there, targeting those servers—of course consulting with the Minister of Global Affairs, and of course with the approval of the Minister of National Defence—and hopefully exercising some sort of kinetic effect on those servers and taking them offline.

[Peter Fragiskatos, Liberal, London North Centre, ON]

I appreciate that.

You've been very clear about the importance of securing critical infrastructure. My colleague opposite has already asked about it.

In the case of the threat of Daesh, for instance, the pendulum swings, and has swung over the years. Particularly after 9/11 there was an emphasis on radical Islam, if I can put it that way, and countering that particular threat. However, can you go over what you said about how important it is to secure our critical infrastructure?

If we're listing threats and ranking them in terms of danger to our national security, do you think critical infrastructure is a more important area to focus on right now than what we've been looking at in the past, after 9/11?

[Raymond Boisvert]

Yes. As I was saying earlier, terrorism is effective because it terrorizes. It has a disproportionate effect. The number of Canadians adversely affected by a terrorist event is very small.

Conversely, though, infrastructure is everything that sustains our life. It's the heat, the lights, the food at the grocers, the petrol at the service stations. All those fundamentals that allow us to exist are all now increasingly built on automated systems—on a machine, on machine learning. It's interconnected interdependencies across the board. That's why those are at risk. They're at risk mostly in the age of fifth-domain warfare. We went from land to sea to air to space, and now it's about cyber. We probably won't see another debate over an F-35 again, because most of that money in most jurisdictions is moving toward information warfare.

They will do what Russia's done in Moldova, Ukraine, and Georgia, which is to go after something and signal. You might just take out something small, then something a little bit bigger, and then something that threatens to be cataclysmic. I think that's really where the big threat is.

Are terrorists using cyber-tools? Not so much yet. Is Daesh going to go from dominating social media to tuning its skill sets toward attacking? I think that's very possible.

[The Chair, Liberal, John McKay]

Thank you, Mr. Fragiskatos.

We have Mr. Paul-Hus and Mr. Eglinski for five minutes.

I'm going to take the immense power of this position and allow Mr. Spengemann the final five minutes, even though we'll have gone past time, if that's all right with colleagues.

There are five minutes for the two of you.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair. I will be brief.

My question is addressed to Mr. Boisvert.

Canada has adopted a laissez-faire approach to Chinese investments in Canadian businesses, in the technology sector in particular. Does that concern you, all the more so since one of Canada's closest allies has criticized us for selling a high tech business that sells satellite communications systems to the Chinese?

[Raymond Boisvert]

I recognize that this is a very complex area, as I have pointed out previously. New opportunities are cropping up. Canada has to deal with a new economic reality, just as negotiations are ongoing with its North American partners.

China represents a real opportunity, but we have to keep our eyes open. As for investments in certain sectors, particularly the technological sector, I do in fact have several concerns.