Public Safety Committee on Feb. 13th, 2018

[Scott Millar]

We are subject to the charter, and not all the elements of the charter are here. All legislation and activities are subject to the charter. As to where we interfere with the reasonable expectation of privacy, right now we operate under the understanding that any kind of information is subject to ministerial authorization. The only thing I would say is that Professor Forcese's suggestion on explicit mention is not inconsistent with the implicit requirement of a reasonable expectation of privacy and that this information needs to be covered under the ministerial authorization.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Okay, thanks.

I was reading an interesting piece on the CSE by the Citizen Lab, which said that in providing defensive services, ultimately there may have to be, say, purchases of malware or different types of things of that sort. How would we protect ourselves in our defensive operations from the people who are developing the problems that are causing us to engage in those defensive operations?

[Shelly Bruce]

The purchase of malware doesn't necessarily come from those people who are generating the malware. There are organizations, anti-virus companies, who will allow us to purchase that information from their own legitimate analysis and work. We work very closely with that community to understand what the threats are that are being covered by a commercial software and services so that we can focus, then, on those malware threats that are not currently covered, the more sophisticated ones that are not part of the current complement.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

We've talked a little bit about publicly available information. I think one of the things that is maybe complicating things is that there are different layers of what people consider public. One thing that's been raised by some folks is, what if there is, for example, a hacking incident, and suddenly this information is made public? It's out there, but it was intended to be private in its first instance. How does that fall within the scope of public information? What are our safeguards there?

[Shelly Bruce]

In CSE's instance, that information, anything that has been hacked or stolen and then been made available for purchase, is not included in the definition of publicly available information.

[The Chair, Liberal, John McKay]

Thank you, Ms. Dabrusin.

Mr. Dubé, you have the final five minutes, please.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you very much.

Just on the active cyber operations, the minister of National Defence is the one calling the shots, if you'll allow me to use that expression, and you exist through the National Defence Act. But the CSE—and I know the answer to this, but just for the record—is a civilian organization, correct?

[Shelly Bruce]

That's correct.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

When cyber operations are being undertaken, you referred in your presentation—I'm going with the notes—to “cyber aggression by foreign states”. You are not phrasing cyber aggression as an act of war per se. You also refer to disrupting “cyber aggression by foreign states”. Is there not concern that a civilian organization answering to the Minister of National Defence, in essentially undertaking offensive actions against another state, could be perceived as engaging in an act or war? What would be the legal consequences of that? We've had witnesses who've explained that, because legally you're seen as a civilian organization, that muddies the waters significantly. That's where a lot of the concern comes from. I don't necessarily feel you've addressed that in your comments.

[Shelly Bruce]

There is no doubt that Canada and its allies face an increasing degree of threat from hostile state actors or hostile non-state actors out there. We work very closely with and are part of the National Defence portfolio, as you've mentioned. In the recent defence policy review, the military has declared its interest in working in the cyber domain and developing a framework and a platform for that. You'll note as well that the bill is set up in a way that would allow CSE to assist the Canadian Armed Forces under our assistance mandate, so that we would be able to work more closely with them, depending on the conditions and circumstances of activities that would need to be taken. There is a potential for us to work more closely in delivering capabilities for them on the military level.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Just to be clear, if we need what I would almost call a counterattack to something being done by a foreign state actor, and the military is developing similar capabilities to what CSE has, if you're the Minister of National Defence, how do you respond? Are you looking to the military to take that action, or are you looking to CSE? If the military is developing those capabilities, why should a civilian organization be taking action that a military actor could take against a foreign state?

[Shelly Bruce]

It depends on the circumstances of the activity that is being defended against. In many cases, you will not be able to attribute that activity to a specific individual, but the more important issue is to stop that activity from happening before it becomes a crisis or before it materializes in the Canadian security space.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Which would fall under defensive operations, then, and not active ones.

[Scott Millar]

I would add that the capability exists with CSE now. One of the reasons National Defence and the Canadian Armed Forces have been added to our assistance mandate is that should they engage in cyber operations in support of government-approved military operations, they could leverage our capabilities in that regard. Where it's in a military context, leveraging us, when it's outside of a military context....

We have to keep in mind that some of the things we're talking about here would be, for example, if intellectual property were stolen from a Canadian company, we could perhaps go upstream and render that unreadable. This is not always in the stream of aggression and cyber-war, and that kind of thing. There are civilian uses of this and there are prohibitions built in to keep us within the swim lane of that, whether it's prohibitions against bodily harm and the like.... Having the dual key of the Minister of National Defence and the Minister of Foreign Affairs ensures that the kinds of activities we're undertaking are consistent with international priorities and international law.

[The Chair, Liberal, John McKay]

Thank you.

That completes our first round of questioning, but in keeping with our stellar reputation as the hardest working committee on the Hill, we will have no lunch break and continue with a second round of questions.

I want to canvass colleagues as to whether we could drop it to five-minute questions and just go back and forth, using a similar structure, but for five minutes each. That would give us an opportunity to possibly get in two more questions.

Mr. Dubé.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Using the same rotation, I have five minutes, and I get bumped down five or six speaking spots with only a five-minute round at the outset. Is that....?

[The Chair, Liberal, John McKay]

Well, if you look at the clock, you're cooked if I stay with the current structure. I'd take two five-minute rounds as opposed to one seven-minute round.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

If I discuss for seven and five, then I would get two fives instead?

[The Chair, Liberal, John McKay]

Yes. I know your level of generosity with your time is appreciated.

Mr. Fragiskatos, five minutes.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Thank you, Chair.

Thank you for all of the work that you're doing and for being here today.

My first question is for Ms. Bruce. Could you reiterate the types of acts that would constitute an offensive cyber capability, with particular examples, if you could?

[Shelly Bruce]

Sure.

I would preface this by saying that active cyber operations are meant to achieve an objective that the government has established, and that it's a team sport. That means we each are bringing our mandates, our authorities, and our capabilities to this table. It really is a way of working together to figure out who has the right authority to address the right issue at the right time based on their skills, their mandates, and their authorities.

In the case of CSE, I mentioned some of these operations in my opening remarks, such as interrupting or disrupting ISIL communications, networks, media machines in a way that would stop attack-planning before things reached a crisis pitch. There's also interrupting the spread of ransomware that's being pushed around the world, and interrupting subversion to the democratic process. As my colleague mentioned, we have had instances in the past where sensitive information has been stolen from Canadian systems and is now on foreign systems abroad; therefore, we could find ways to corrupt that data or to make it inaccessible to others who want to take advantage of it and use it for their own benefit.

[Peter Fragiskatos, Liberal, London North Centre, ON]

Finding ways to protect banking systems, finding ways to protect potential attacks on electricity systems, for instance, are they all part of it?

[Shelly Bruce]

Yes, critical infrastructure is included. In the legislative proposal, CSE would receive the authority to take the skills and the technology and the capabilities that have been developed to protect Government of Canada networks and to make that advice, guidance, and those services available to critical infrastructure owners if that critical infrastructure element has been designated by the minister as eligible for CSE assistance, and if that critical infrastructure element system owner has requested our assistance.

[Peter Fragiskatos, Liberal, London North Centre, ON]

I asked the question because I think it's quite important to demystify some of the ideas around what actually constitutes an offensive cyber capability. This is obviously a new means of ensuring national security and I think there are some myths built up around it.

For instance, this committee has heard testimony from organizations such as OpenMedia, the BC Civil Liberties Association, with the former implying quite directly that this committee and Canadians in general ought be on the watch, because the CSE could use this offensive cyber capability to undermine the democratic process of other states. This is not the intent here, correct?

[Shelly Bruce]

No. The active cyber operations directed at foreign entities outside of Canada require the approval of the Minister of Defence as well as the Minister of Foreign Affairs. Necessity, reasonableness, and proportionality are all factors they have to consider. They cannot be achieved by any other means, cannot cause bodily harm or death, but also cannot subvert or obstruct democracy or the course of justice. There's an explicit prohibition there.