Public Safety Committee on Feb. 13th, 2018

[The Chair, Liberal, John McKay]

Even though we are a few minutes early, I'm going to call this meeting to order and ask Mr. Brown to lead off.

We're here for two hours. I'm anticipating some order in the first hour when we ask our questions, and maybe a little less formality in the second hour as we dive deeper into Bill C-59.

I appreciate the interest of all of the departmental officials in the deliberations of the committee. This is an opportunity for the committee and various officials to interact on both a semi-formal and a less formal basis.

With that, we'll start with Mr. Brown.

[Malcolm Brown, Deputy Minister, Department of Public Safety and Emergency Preparedness]

Thank you very much, Mr. Chair.

I'll make a few opening comments, and then I think my colleague Shelly from the Communications Security Establishment will also have some opening comments.

I'm pleased to have the opportunity to appear with my colleagues today to discuss Bill C-59, the proposed National Security Act, 2017.

As you can see, I'm joined by officials from the Public Safety portfolio, including the RCMP and CSIS, the Communications Security Establishment, and the Department of Justice.

I want to begin by thanking all the members of this committee for reviewing this bill.

As you know, this bill is the focal point of Minister Goodale's mandate with regard to national security. It is also the result of an unprecedented nationwide public consultation, one in which this committee played an important role.

The consultations undertaken by Public Safety Canada and the Department of Justice involved an online questionnaire, in-person town halls across the country, social media engagement, and much more. In total, tens of thousands of views were heard, collected, documented, and analyzed.

Of course, this committee held numerous meetings of its own on the topic of national security.

The proposed legislation reflects all of this input - from citizens, parliamentarians, community leaders, national security experts, and academics.

Bill C-59 has three core themes.

Number one is to enhance accountability and transparency. This would be done through the proposed creation of an intelligence commissioner and a national security and intelligence review agency, both of which would complement the work of the newly established National Security and Intelligence Committee of Parliamentarians.

Number two is to fulfill mandate commitments with respect to the former Bill C-51. This includes proposed revisions to threat reduction activities under the CSIS Act, amendments to the Criminal Code, improvements to the Secure Air Travel Act, and revisions to the Security of Canada Information Sharing Act.

Number three is to ensure that our national security and intelligence agencies can keep pace with the evolving nature of security threats. This includes measures such as modernizing the CSIS Act, establishing the proposed Communications Security Establishment Act, and making other legislative updates.

In short, bill C-59 is designed to update and modernize Canada's national security framework to reflect current realities. Its overall objectice is to keep Canadians safe, while safeguaring our rights and freedoms.

To ensure that this bill achieves this objective, Minister Goodale signalled his intention for a thorough review and analysis of its contents as it proceeds through the parliamentary process.

Beginning this past summer and continuing through to the new year, officials from Public Safety Canada and from across the security and intelligence community have engaged key stakeholders. In many ways, this has been a continuation of conversations that began with the national security consultations in 2016, which I mentioned earlier.

The aim of these discussions and interactions has been not only to respond to technical questions about the content of the bill, but also, and mainly, to obtain feedback and input about how to improve the bill.

We've had meetings and exchanges with the Office of the Privacy Commissioner of Canada, the Security Intelligence Review Committee, the Office of the Communications Security Establishment Commissioner, and the Civilian Review and Complaints Commission for the RCMP.

We also had a number of exchanges with prominent academics in the field of national security in order to obtain constructive feedback to help ensure the bill achieve its objectives. I can assure you that these discussions were very helpful.

Similarly, we have taken a keen interest in the deliberations of this committee, including the testimony of witnesses and the detailed written briefs made available on the committee's website. I should note that, although separate from Bill C-59, the government announced in June that it would be adopting a national security transparency commitment to be applied across Canada's federal national security apparatus. Public Safety Canada is exercising a leadership and coordination role for implementing that commitment and supporting the establishment and operation of an advisory group. This work will complement the ultimate objectives of Bill C-59.

It is Minister Goodale's aim to have an open and thorough conversation in order to ensure that this bill is the best it can be.

It is in this spirit that my colleagues and I appear before you today. We look forward to responding to any questions the committee may have about the bill.

Thank you very much, Mr. Chair.

[The Chair, Liberal, John McKay]

Thank you.

Ms. Bruce.

[Shelly Bruce, Associate Chief, Communications Security Establishment]

Thank you.

Mr. Chair, distinguised members of the committee, As associate chief of the Communications Security Establishment. I want to thank you for the invitation to appear before you, as you continue your study of bill C-59, which sets out the Communications Security Establishment Act.

I am pleased to be here today to clarify and explain certain aspects of this important piece of legislation.

Let me begin by underscoring remarks made by Minister Sajjan when this legislation was last discussed in the House of Commons. The minister said:

There can be no greater obligation than to protect the security of Canadians at home and abroad. Bill C-59 would provide CSE with the authorities and tools to maintain the highest standards in security protection while adhering to the high standards of accountability and transparency.

CSE has helped protect the security of Canadians for over 70 years by providing critical foreign intelligence about threats to our national security and our deployed forces, and by protecting Canada's most sensitive information and information systems. In order to deliver this important mandate, governments throughout those 70 years have expected CSE to respond to the priorities of the day and to ensure that it stays ahead of evolving global threats and constantly changing technology—and to meet those challenges while protecting Canadians' privacy, rights, and freedoms. That is what the proposed authorities and accountabilities in the proposed CSE act would do. They would provide CSE modernized authorities to help keep Canadians and Canada safe and secure against global threats, including cyber-threats, in a rapidly evolving technological world. They would provide new accountability measures to ensure that CSE's activities are authorized, reviewed, and are as transparent as possible.

As the committee has studied this bill a number of important questions have been raised. I would like to address a few of the more common ones now.

First, I'd like to address the provision in the proposed act around publicly available information. Questions have been raised about how CSE would use publicly available information and what impact that would have on the privacy of Canadians. To be clear, this provision exists only to allow CSE to conduct basic research in support of its mandate from the sorts of public resources that would be available to anyone in Canada. CSE does not and would not use publicly available information to investigate Canadians or persons in Canada, or build dossiers on them. That is not our mandate, and for us, mandate matters.

The proposed CSE act reinforces this by explicitly requiring that CSE have measures in place to protect the privacy of Canadians and persons in Canada in the use, retention, and disclosure of publicly available information.

How would we use that publicly available information? I can provide three quick examples. First, we could use it to provide general background information for a foreign intelligence or cyber-security report. Second, we could use it to assess the nationality of an individual or organization. Third, we could use it to consult technical manuals associated with new technologies or infrastructure.

Under no circumstances would CSE use this provision to acquire information that was unlawfully obtained. Hacked or stolen data would not constitute publicly available information under the CSE act.

This committee has also heard questions about the proposed active cyber-operations aspect of CSE's mandate, including questions on how they would be used and the potential impact on Canadian privacy. As this is a new authority for CSE, I want to clarify what this means. Active cyber operations would allow CSE, within strict legal parameters and with approvals at the highest levels of government, to take action online to disrupt foreign threats, including activities to protect our democratic institutions, to counter violent extremist and terrorist planning, or to counter cyber-aggression by foreign states. As examples, CSE could use active cyber operations to prevent a terrorist's mobile phone from detonating a car bomb; we could impede terrorists' ability to communicate by obstructing their communications infrastructure; or we could covertly disrupt a foreign threat actor from interfering in Canada's democratic processes.

The proposed legislation is also clear in the limits built into this authority. CSE would be prohibited from directing active cyber operations at Canadians, at any person in Canada, or at the global infrastructure in Canada. The act would also require that these activities be reasonable and proportionate. It would specifically prohibit CSE from causing death or bodily harm, or wilfully attempting to obstruct, pervert, or defeat the course of justice or democracy.

Let me underscore the fundamental change in our approach to ministerial authorizations.

Bill C-59 builds on CSE's current ministerial authorization regime by broadening its application and introducing new and important oversight and review functions. Under the act, CSE will seek a ministerial authorization for any activity that would interfere with the reasonable expectation of privacy of a Canadian or a person in Canada, or contravene an act of Parliament.

For CSE's foreign intelligence and cyber-security activities, these would be subject to approval by the Minister of National Defence and the intelligence commissioner. Active and defensive cyber operations are not collection activities and cannot be directed against Canadians or persons in Canada. As such, they would be approved by the Minister of National Defence and the Minister of Foreign Affairs. All of CSE's activities would also be subject to full review by dedicated independent review bodies.

Mr. Chair, I'll conclude by thanking the committee for inviting me and my colleagues here today to testify.

Thank you for your important deliberations on the Communications Security Establishment Act. We look forward to answering your questions.

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Ms. Bruce. Welcome to the committee for the first time, I understand. I hope it's not the last time.

I believe that's the end of formal presentations.

With that, we'll turn to Mr. Spengemann for seven minutes.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Mr. Chair, thank you very much.

Thank you to our witnesses for being here. Thank you for your service and expertise.

I'd like to start with a question to Mr. Brown.

Mr. Brown, I wonder if you could briefly sketch for the committee your assessment of the strategic threat setting that the country faces in 2018, with particular attention to the two principal threats, being cyber-directed activities, and also the risk of terrorist attacks, violence, extremism, radicalization, both domestically grown and/or foreign inspired.

How do those two compare against each other, and are there any other threats that we need to take note of in 2018?

[Malcolm Brown]

In six minutes?

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Not for that question, please. I have a number of other ones.

[An hon. member]

You'd need about an hour and a half for that one.

[Malcolm Brown]

In all seriousness, virtually everything that I say my colleagues will want to refine, correct, and make more precise, but I will take a stab at it.

I think you have identified two of the key issues. There is no question that in the current threat environment, in terms of counterterrorism and the realities we are all facing, both as individuals and as part of any entity that we participate in, whether it's social or professional or as a government in terms of the cyber-threats we're confronting, the reality is that it's multi-faceted.

I would also indicate, though, that I think we continue to face traditional threats. This is clear in publicly released documents both by the department and CSIS that the threat environment is more complex than the ones just mentioned above. It includes the kind of traditional intelligence gathering by countries that are either competitors or wish us ill. I think, as well, in terms of the counterterrorism environment, we continue to face both foreign as well domestic threats.

As I say, I could use up all of your allotted time very easily, but I think that's a snapshot and I'd be happy to take some questions.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

To summarize your answer, is it fair to say that both the risk of violence—terrorism and extremism—and of cyber-attacks are two that cannot be subordinated to, or prioritized over, each other? They are both equally significant in our current study.

[Malcolm Brown]

Well, one of the hardest parts of the jobs that my colleagues in the agencies before you manage is constantly juggling that. The reality is that all those threats you described, plus the other ones I've identified, are constantly the subject of scrutiny by the agencies.

At any given instance, finding the right balance is a very serious challenge.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you for that. That's helpful.

How confident are you that the bill in its current formulation captures what we might describe as “unknown unknowns”, especially in the cyber domain? If you look, for example, at the areas of artificial intelligence and quantum computing and you connect that to the cyber-threat environment, is the bill flexible enough to address emerging issues that we may not have turned our minds to?

[Malcolm Brown]

It's hard to predict the future. I will say that as the bill was drafted, there was an effort to provide.... We recognize we do these things irregularly. The last time a significant overhaul or review with all-encompassing characteristics was undertaken really was a generation ago. I do think that the approach we all took, in terms of the provision of advice—which was reflected in the government's decision—was to create a framework that would in fact be flexible and adaptable enough to respond to emerging threats.

[Sven Spengemann, Liberal, Mississauga—Lakeshore, ON]

Thank you very much.

My next question is for Ms. Bruce.

Thank you for your clarification of the active cyber-operations question. I think the Canadian public is really mindful of some issues that may not be apparent to them in the sense of how complex an environment this is and how identifiable in the minds of the Canadian public actions that ultimately would need to be taken to disrupt a threat are. Your testimony gave a couple of examples, such as disrupting or deactivating a cellphone that may be used in detonation. It's also quite clear that we would not engage actively to threaten lives or to destroy lives. What about the area of collateral damage, for example, having to take down a portion of an electricity grid that might then cause civilian infrastructure problems and potentially put people at risk, though not necessarily at risk of death? People might say, “Okay, what if we inadvertently deactivate power supplies to a hospital?” Are there rules of engagement that could be enunciated with greater granularity than what you've described at the moment which you could tell the committee about?

[Shelly Bruce]

The environment is incredibly complex, as you state. The work that CSE does under its traditional mandates of foreign intelligence and cyber-security allows us to build up a picture of the environment against which an active cyber operation might be delivered. In that sense, an incredible amount of research and work and intelligence needs to be compiled to understand the foreign targets, the foreign infrastructure, what it's connected to, and what the residual impacts might be if something were launched in that space. So a great deal of analysis needs to go into coming up with options for the government to consider, and they also need to consider whether or not they want CSE to conduct an active cyber operation against a greater objective. In this sense, there are some big restrictions around how that works, including the requirement for it to be reasonable and proportionate. Two ministers, the Minister of National Defence and the Minister of Foreign Affairs, need to sign off on that and understand what the implications could be.

I might turn to my colleague to talk about some of the other restrictions and limitations that exist within that space that would guide our decision-making.

[The Chair, Liberal, John McKay]

You might have to work that answer into another answer at some point, because we're out of time unfortunately.

Monsieur Paul-Hus.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

Good morning, everyone. Thank you for being here today. Your comments will be most helpful.

My first question concerns the funding of terrorist groups. The question is for Mr. Brown or anyone else who would like to answer.

Mr. Michael Nesbitt appeared before the committee. He expressed his concern that Canada runs the risk of being a home for terrorist financing and other activities. This is a possibility.

Our party, through my colleague Mr. Tony Clement, introduced bill C-371, which is currently being studied in the House. This bill would address what are known as covert means. It appears that the government did not want to support the bill, arguing that bill C-59 and other Canadian legislation provides the tools required to prevent funding by covert means in support of terrorism.

Could you comment on that?

[Malcolm Brown]

I will answer and my colleagues can add to my comments.

The view is that, in addition to the changes that are proposed in Bill C-59, the framework that is already available to the government in terms of addressing issues associated with terrorist financing is sufficient. Generally speaking, in the context of Bill C-59, the government is open to suggestions. I do think that in the perspectives in the private member's bill that you've mentioned there are some practical considerations that, frankly, make it problematic.

That being said, I think we're constantly challenging ourselves to ensure that all of the agencies have the tools they need to confront the challenges around terrorist financing. There are a variety of steps we can take, and at that I'll let my colleagues jump in, if they'd like, in terms of the tools we have now that, we believe, give us the capacity to respond as necessary.

Gilles.

[Deputy Commissioner Gilles Michaud, Deputy Commissioner, Federal Policing , Royal Canadian Mounted Police]

In practical terms, what we see on the ground with respect to terrorist financing is actually related to all our investigations. We are always looking to discover whether there is a terrorism financing component.

However, we are always faced with the challenge of the use of funds. It is very difficult for us to prove how the money was used because it is used in countries that do not have an information sharing protocol or a protocol that meets the standard required to support evidence in Canada.

As Mr. Brown indicated, we are actively working on this. We believe that, through other mechanisms, we have the tools required to share information and financial data, which give at least an overview of the situation and allows us to focus on certain targets. However, once again, the challenge is still collecting the information and obtaining evidence that meets the standards of Canadian courts.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

All right. Thank you.

My next question is about information sharing. The former director of CSIS told the committee that, although he hadn't counted, the number of times the words “protection of privacy” are mentioned in the bill is really quite astounding. He said he was as much in favour of privacy as everyone else, but that he sometimes wondered whether the fact that we are placing so much emphasis on it would scare some people with respect to national security.

Can you comment on this?

[Malcolm Brown]

I'll let my colleague, Tricia Geddes, reply on behalf of Canadian Security Intelligence Service.

[Tricia Geddes, Assistant Director, Policy and Strategic Partnerships, Canadian Security Intelligence Service]

Sure. I guess I would say that it's quite clear that this bill is able to deliver the effective tools and the authorities that we need, in order to be able to conduct our investigations. Ensuring that we have the confidence of Canadians and that we are able to do so in a manner that protects their privacy is very critical to our ability to carry out our mandate. I think the bill has achieved both of those objectives.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

All right.

We also heard Mr. Fadden speak about China, which has about 200,000 people conducting cyberoperations.

Do you believe that the powers granted by bill C-59 open the door to effective action against the Chinese threat in cyberspace?

[Malcolm Brown]

I will begin to answer that question and then turn it over to Ms. Bruce.

I would say yes, without a doubt. I am sure that the modernization of...

our assets, in terms of our being able to respond, is long overdue, within the concept of a framework.

I will also indicate that the government is in the midst of a cyber-security strategy review and that the results of that will be known in the fullness of time. That's another element of a response to your question.

Would you like to respond, Shelly?