Evidence of meeting #97 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cse.
A video is available from Parliament.
12:45 p.m.
Liberal
The Chair Liberal John McKay
Thank you.
Mr. Dubé, you have five minutes, and then, shockingly, I might exercise a chair prerogative and ask a question or two of my own.
12:45 p.m.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
Thank you, Chair.
This is perhaps for our representative from the Department of Justice, but in the charter compliance statement, there is mention about the expectation of privacy when it comes to publicly available information, which would be considered low for that type of information.
How is that concept changed in law in terms of the expectation that people have? I say that as someone who's not a lawyer. In other words, going back to that example, I think very few people are really aware of information that could be purchased legally, for example, that could technically fall under that definition. Is the expectation of privacy and the reasonable expectation of privacy changed in the advent of the use of things such as social media, where we can arguably state that there's a lack of knowledge on that front?
12:45 p.m.
Director General, Strategic Policy, Planning and Partnerships, Communications Security Establishment
I know that Doug is here more in the policy capacity than a charter expert capacity, so I'm happy to address that.
There are a couple of things to keep in mind. One, again, is that it will be reviewed for lawfulness. With the ministerial authorizations that we will have or will seek that capture any information that comes into our possession, where there would be reasonable expectation of privacy, when we put together those authorizations, the Department of Justice is part of reviewing those authorizations, which are like affidavits, to make sure that we've sufficiently captured that space.
As the publicly available information is laid out here, the idea is that it was public, it was intended to be public, so to that degree, any information we acquire under those provisions would have to meet those kinds of tests, and those tests will be reviewed and commented on going forward.
12:45 p.m.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
If we take the example of assessing the nationality of an individual or organization, can you walk me through what that means specifically?
12:45 p.m.
Associate Chief, Communications Security Establishment
As my colleague has already mentioned, this is not new. CSE has to take these kinds of unknown entities and elements of information and try to flesh them out to understand exactly what we're dealing with. It could be as simple as a Google search. It could be looking or working with other databases that are out there that might help us contextualize this. In the case of an IP address, there are registries that exist online that tell you where an IP address is geographically registered.
12:45 p.m.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
When you say “other databases”, that's pretty wide open. Can you give an example of something such as that? That seems troubling to me, that kind of phrasing, with all due respect.
12:45 p.m.
Associate Chief, Communications Security Establishment
Probably the best I can do to reassure you is to say that we've had a commissioner who has reviewed CSE's activities for privacy for more than 20 years. In assessing our activities and looking for privacy concerns or lawfulness, he touches on these kinds of activities, the open source research that we do to support our activities, because a lot of our activities require this to be effective. To my knowledge, he has never found any issue with the degree of research that CSE has done, the sources that we have accessed, or how we have handled and managed that information.
12:50 p.m.
Director General, Strategic Policy, Planning and Partnerships, Communications Security Establishment
No, that's correct.
I guess the other thing to underscore is that, again, these activities are in furtherance of our mandate. I think there's an important thing to underscore here, and it's something we haven't had the opportunity to talk about much yet. Keep in mind that some of those activities involve us doing cyber-security on Government of Canada networks and systems. They're the same networks that hold taxpayer information and employment insurance information—very sensitive, private Canadian information. Our sensors block up to a billion malicious cyber incidents a day. Those are cyber-threat actors looking for vulnerabilities or indeed trying to attack.
I mention that because I recognize, in the discussion about the degree to which private information is.... Are we dealing with both security and the privacy of information in a reasonable and proportionate way? I'll underscore as well that part of our mandate is actually protecting the private information of Canadians. The degree to which we do these activities is in furtherance of that kind of information protection mandate.
12:50 p.m.
NDP
Matthew Dubé NDP Beloeil—Chambly, QC
In terms of the measures you take that aren't known to the public, this is the challenge, right? You mentioned that there are some things you do with regard to protecting the privacy of information in terms of, for example, what's in proposed section 25 and that kind of thing. Is there any way in which we as parliamentarians can be made aware of what's being done? Unfortunately, from my reading of the bill, it seems that these measures are there, you're saying you take them, and beyond that we don't necessarily know.
12:50 p.m.
Associate Chief, Communications Security Establishment
On our website we do have a fact sheet that outlines the measures we take to protect privacy at the moment. As technology evolves, as information evolves, we need to make sure we are staying current and are adopting more and more effective measures to protect privacy. So they are not captured in legislation, they are captured in ministerial authorizations. The minister can lay out his expectations and he can increase those expectations and any parameters in terms of how we work as part of those authorizations, which are required to be renewed every year.
12:50 p.m.
Director General, Strategic Policy, Planning and Partnerships, Communications Security Establishment
If I may, I answered incompletely a previous question about what changes for us under this legislation. We talked about mandates and other things. The accountability and review measures build upon the existing robust measures we've had to date with the CSE commissioner, but that element of NSIRA, the review agency, with the committee of parliamentarians gives that element where folks who are cleared and can see the full aspect of what we do, whether in an unclassified or classified space, can review us for all those elements of reasonableness and proportionality.
The legislation also makes more transparent—as transparent as you can be in a piece of legislation—the activities that we undertake, under what restrictions we do them, and the prohibitions and so on. We are trying to put out more and more on our website. We are a clandestine agency that needs to act clandestinely in order to understand the threat picture and protect Canada. But we're getting out there. We're on Twitter. We're pushing out reports on democratic institutions and threats against democratic institutions. We'll always be looking for ways in which we can share more about what it is we do.
12:50 p.m.
Liberal
The Chair Liberal John McKay
Mr. Dubé is well past his time.
I do have a question, if you don't mind. I want to pick up on the exchange between Ms. Bruce and Mr. Fragiskatos concerning the private infrastructure, if you will.
This conversation has largely been devoted to public infrastructure. It reminded me of a conversation I had last week with a representative of the banking industry. His comment was that when we feed information into the security services, it just disappears and we never hear from them again. It seems to me that this cyber infrastructure is actually shared between the private and public sectors, and that Bill C-59 doesn't speak to—it's not obvious, at least—that private infrastructure piece. This issue has consumed the British. The British government has intervened quite actively in protecting private infrastructure.
First, on Bill C-59 as is, what contribution in terms of a framework does it make? Second, what is the next piece, if you will, in addressing that issue?
12:55 p.m.
Associate Chief, Communications Security Establishment
The bill does not refer specifically to critical infrastructure, but I think it makes reference to non-governmental systems, which are tantamount to critical infrastructure, because as you say, our global information infrastructure is made up of public and private enterprises.
In that space, CSE, which is currently focused on defending and blocking activities on the government infrastructure, is limited right now to providing advice and guidance only to critical infrastructure owners in a way such that the information is available to the general public.
In this regard, Bill C-59 opens up CSE to take the expertise that has been developed—the tools, the capabilities.... In fact, some of that capability has been exposed to critical infrastructure owners in the form of a tool called “Assembly Line”. We've put it out there. It's a tool that was developed in-house, but we've made it available to others who can use it to help triage and understand malware that might be affecting their systems.
CSE would be able to go even further with this legislation to helping critical infrastructure owners who request our assistance and whom the minister has designated as eligible to receive assistance from CSE.
12:55 p.m.
Liberal
The Chair Liberal John McKay
How will that occur in a formal way? I can think of institutions that have massive structures, possibly as large as government structures. How will that operate in a practical way so that everyone's interest is protected?
12:55 p.m.
Associate Chief, Communications Security Establishment
It's a good question.
As the legislation firms up and we understand what the scope is, should these authorities be granted it will be up to CSE to work with Public Safety, critical infrastructure owners, and the minister to look at where the risks are and to start designating and prioritizing, because as you point out, it will be impossible to address all of the concerns and all of the infrastructures that exist in Canada.
12:55 p.m.
Deputy Minister, Department of Public Safety and Emergency Preparedness
Some of this falls under the ambit of the Minister of Public Safety. You're asking a framework question on the way in which the government is going to approach it. This is an important building block. It was a gap within CSE's mandates that they were constrained on the help they could provide in the existing context.
As I said before, the government is conducting a cyber-security review. The results of that will be available shortly, I hope. One of the key pieces in this—and here I would add that Public Safety manages the relationship with critical infrastructure sectors—is about knowing where to go, who to call when there's an issue. It's not about the size of the systems; it's about having the right connections. Right now, they sometimes call CSE, and they call our critical cyber-emergency response team, CCIRC, at Public Safety. We need to do a better job of coordinating that.
Much of this information is in an ecosystem where it needs to get shared really quickly, and that's a key role that CSE can play. It's about technical expertise. I will use the analogy of a fire. We send firefighters to a fire. In this instance, it might be one firefighter, because it's actually just a connection that needs to be made so that people understand that there's a fix, and this fix can be applied across the entire infrastructure.
There's an unnamed large American company that dealt with a lot of people's private data. It was one simple fix that was missed, and it had a profound impact on the entire organization.
It's important to frame this. I think we will see a further elaboration in the coming months. This is one important building block.
12:55 p.m.
Liberal
The Chair Liberal John McKay
Thank you, Mr. Brown, for that penultimate word.
Colleagues, we have one more day on this. We have two witnesses scheduled for next Thursday, but a certain unnamed academic has suggested that we hear from the Civilian Review and Complaints Commission for the RCMP. They are available, and I propose that we add them to the list. That will do it for Thursday. I also propose that the subcommittee get together Thursday afternoon, after we have heard the witnesses, and sketch out how we'll get to clause-by-clause.
With that, I want to thank each and every one of you for your contribution to our deliberations. You've certainly been very able and responsive to all of the questions we've asked.
The meeting is adjourned.