Public Safety Committee on Feb. 8th, 2018

[Timothy McSorley]

Our concern isn't regarding CSE's powers to be able to help support and improve critical infrastructure. It's regarding the information sharing that could be triggered by a threat to critical infrastructure in combination.... For example, we see opposition right now to pipelines being built across Canada. In the past, we've seen indigenous action to block a train line or protests that cause disruptions. We're concerned that the way SCISA is currently worded, and how SCIDA eventually will be worded, will continue to pose a threat to legitimate dissent and protestors' actions in Canada by including critical infrastructure as it's currently defined.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

I think I'm out of time.

[The Chair, Liberal, John McKay]

Thank you very much, Ms. Dabrusin.

Mr. Dubé, please, for five minutes.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I want to go back to the information-sharing issue again, because there was a report in LaPresse a few weeks on an RCMP operation that essentially collects information from the DEA on Canadians, which circumvents the warrant system and all the other legal and accountability measures that would normally be in place for that type of thing.

I'm wondering about it in this context, where departments are exchanging information. If you're working with Five Eyes Allies, let's say, and the RCMP is taking that kind of action, and that information can then be shared between departments, I just want to elaborate—beyond even the legislation—on this notion of this ecosystem, almost, that exists and that I think people are underestimating. It seems on the surface to make sense that Canadian department A should share information with Canadian department B, but insofar as it goes beyond that, I'd like to hear some of your thoughts on that.

[Laura Tribe]

One of our concerns, beyond just intergovernmental, inter-Canadian departmental information-sharing, is how that feeds into the Five Eyes network and all the different agencies within it. I think the DEA providing information to the RCMP is a great example of that.

I think one of the big concerns we have is that we don't know, or have any information about, how many information-sharing agreements Canada has. We don't know whom they're with. We don't know what all of them are about. When we give our information to the Canadian government or it's being collected, we don't know where it could end up. Conversely, when we take part in agreements with other countries, we don't know how that information could end up back in Canada.

One of the concerns we have, and one that our community continues to express, is feeling that no matter what the information it is, eventually anyone can get it within the Five Eyes agencies or within any of the related countries' departments. Once it's in one dataset, it's in everyone's. There are a lot of concerns around that when it comes to accurate record-keeping and how that data can be misused. I think Maher Arar is a great example of how that data can be misused to demonstrate some of its more extreme consequences.

It also comes to simple things like no-fly lists. It comes to all kinds of things where simple mistaken identities from a different agency outside the Canadian government can give us a total spiral of how our information is handled domestically, and vice versa. I think that's where outlining who can share what information and with whom, and what those information-sharing agreements are, would go a long way.

[Timothy McSorley]

Ms. Tribe has summarized our concerns really well.

I'd just add that one of the recommendations we're making is that, especially for the proposed CSE act and CSIS, proactive roles should be put in place around the disclosure of foreign intelligence-sharing, as well as around SCISA and SCIDA, and that we have clear definitions on what foreign information-sharing is taking place and how it can take place. We should keep in mind, as Ms. Tribe said, that we don't know where that information could eventually end up.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Something that has come up a few times—and the minister has evoked interest in this, but nothing has really come of it yet. Do you both believe that there should be an oversight and complaints mechanism specifically for CBSA, which is currently the only body dealing with national security that doesn't have that kind of thing in place?

[Laura Tribe]

Yes, but I think Tim may have more to say on that.

[Timothy McSorley]

We believe there needs to be an independent review body for CBSA. As I mentioned, we believe that CBSA should be added to the complaints mechanism for the NSIRA for its national security activities. That fact that so much of what CBSA does isn't specific to national security, and the fact that it is an evolving and changing definition, means there needs to be a review agency for CBSA on its own.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

There's a sense that everything the CBSA does could be considered national security because it involves the flow at the border. Is there any concern that this definition is not tight enough even for the work that existing bodies such as SIRC currently do when they have to follow the breadcrumbs leading to CBSA?

[Timothy McSorley]

I think because national security can be viewed broadly.... In fact, by including CBSA in the complaints mechanism, it would open up NSIRA to be able to dig into what's happening at the CBSA. In this case they will be able to go further.

However, at the same time, we need clarity on what constitutes national security so that on the other side it can't be shrunk in private to say that national security only means situations where somebody gets flagged on a no-fly list, or something like that, and that everything else, for example, refugees and similar issues, aren't considered.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you.

[The Vice-Chair, Conservative, Pierre Paul-Hus]

Thank you, Mr. Dubé.

Mr. Fragiskatos, you have the floor for five minutes.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Thank you very much, Chair.

Thank you to both of you for being here today.

For the sake of full disclosure, almost 20 years ago, Steve Anderson, the founder of OpenMedia, was my roommate at Western University, so please say hello.

In any case, I want to begin with Ms. Tribe, if I could, and follow up on some of the questioning we've heard with respect to CSE.

This committee has heard a great deal of testimony on the threats to Canada's critical infrastructure: hydroelectric systems, nuclear energy, the banking system, and in particular health information. I take what you say about CSE seriously, although I disagree because I think we have to have an offensive capability that can protect that critical infrastructure.

From your perspective I'd like to understand how you would advise this or any Canadian government to guard itself from the very real threats that exist in the cyber network or cyber sphere? It's not a loaded question; I'm sincere in asking it.

[Laura Tribe]

The biggest concerns we have are that there aren't checks and balances in place in the way that the proposed CSE act is currently worded. There's 90 pages' worth of report and recommendations put forward on it specifically by Citizen Lab and CIPPIC, which gets at a lot of the details.

Fundamentally, though, we are concerned that the scope is too broad, that it lets CSE do too much without the accountability and checks and balances needed to make sure it's used only if someone is targeting something like our energy infrastructure.

[Peter Fragiskatos, Liberal, London North Centre, ON]

I want to read a quotation for you. It comes from James Lewis, currently senior vice-president at the Center for Strategic and International Studies, who says that the most effective way to provide sustainable and long-term protection against cyber-attacks is through offensive capabilities and the destruction of opponent networks and systems. If we continue with an orientation that is strictly defensive, in his words, it's “the equivalent of a static defence, defending fixed positions rather than manoeuvring, and conceding initiative to opponents...”.

The nature of national security is changing constantly. Our Five Eyes allies have the ability to carry out an offensive cyber approach. I'm not simply speaking about the United States—middle powers like New Zealand, Australia, and Canada have this ability already. In fact, we've heard at this committee that we are behind those countries.

What would you say to someone like Professor Lewis, who states that if countries like Canada choose not to act, we're always going to be on the defensive and we can't pre-empt attacks on our critical infrastructure. This pre-emptive capacity is important for the safety and security of this country and its citizens.

[Laura Tribe]

There are two responses to that. In the first place, that is a very proactive military solution or militaristic-style solution, which is fundamentally not what we're hearing from our community as the approach they're looking at. It might look and feel different because it's being done online, but its the exact same approach—we need to get them before they get us. This is just a difference of opinion, and we might have to agree to disagree.

[Peter Fragiskatos, Liberal, London North Centre, ON]

I think we will, yes.

[Laura Tribe]

I think the idea that we need to keep up with everyone else is what has gotten us here in the first place. That's the challenge we're facing. Just because other countries are doing it doesn't mean we have to. I think CSE already has immense powers around hacking and disruption, and we are looking to ensure that there is transparency and oversight in the system.

[Peter Fragiskatos, Liberal, London North Centre, ON]

If your banking data were to suddenly be hacked and disappear, if the vital health information that doctors need to access were to disappear, if our electrical system were to suddenly collapse, what would you say then? If we're simply on the defensive and not acting against threats in an offensive way, I think the security of the country would be compromised. Do you see that point?

[Laura Tribe]

Absolutely, I see that point. I think that we are focusing so much on trying to get them before they get us that we're failing to recognize where we're weak, where we're vulnerable. We are also ignoring some of the powers we already have. Of course, I agree that if our health information were to suddenly disappear, that would be a concern.

There are a number of abilities CSE might like—abilities that we might like them to have—that might even be proposed within the CSE act. But this doesn't come with the limitations we need to ensure that it's only being used for things like our health information. I think the scope is too broad. The clarifications are not there to provide the trust that Canadians need. We weren't consulted on it. We were never asked in the consultation what we thought about giving CSE new powers. I think that's where our community's concern comes from.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Final question where does terrorism—?

[The Vice-Chair, Conservative, Pierre Paul-Hus]

Thank you, Mr. Fragiskatos.

I'd like to thank the witnesses for being with us today.

We will now take a quick break, to bring in our next panel of witnesses.

Thank you.

[The Vice-Chair, Conservative, Pierre Paul-Hus]

Good afternoon, Mr. Nesbitt. Can you hear us?

[Professor Michael Nesbitt, Professor of Law, University of Calgary, As an Individual]

Indeed, I can. Thank you.