Public Safety Committee on Dec. 9th, 2020

[Scott Jones]

I think there are a few things we talk about in the security realm. We talk about confidentiality—protecting the information itself—then the availability and then integrity of what's being transmitted so that you can't change it en route.

You're really talking about availability, and I think that's such an important question. There are a few techniques that would be used.

If you're looking to, for example, take me off-line right now as I'm talking, you could do something like a distributed denial of service attack and just overwhelm my Internet connection so that it doesn't know what's good traffic and what's bad. That's something where there are very robust mitigations in place. Canada's telcos have for years been able to defend against this. There are DDoS attacks that happen on the Internet constantly that we just don't know about because they are so well defended against.

Also, then, you have things that will target specific elements of infrastructure. That's usually taking advantage of a vulnerability. That could be flooding, overwhelming it—

[Jack Harris, NDP, St. John's East, NL]

Could we just focus on this ransomware capability?

[Scott Jones]

Yes.

[Jack Harris, NDP, St. John's East, NL]

You shut down somebody's access. You shut it down, so that's a particular capability, never mind a ransom. Are there countries or operations that can do that en masse and are we vulnerable to that as a nation throughout? If we are, do we have any defence against that?

[Scott Jones]

Ransomware typically doesn't work in that way. It's typically used to target, and then it's holding something for hostage, whether it's holding your data for hostage by taking it out of your system and then using that to say that if you don't pay them they're going to release the information, or by encrypting your data and making it unavailable to you. It tends to be done on an organization-by-organization basis.

In terms of a mass ransomware type of thing, we have seen where ransomware will propagate. We saw some examples where it impacted a company, such as Maersk shipping, for example, which was impacted by ransomware, and the National Health Service in the U.K., where ransomware started to propagate and get out of control.

The defence against this is really that you start to block the infected systems and start to do a containment model. At the same time, you start to share the information and innoculate. There are responses in place, and there are things that can be done to protect against it. The worldwide community is pretty adept at dealing with it, but that doesn't mean that there aren't victims of consequence during that process.

[Jack Harris, NDP, St. John's East, NL]

You still think that someone could use that in an organized and coordinated or massive way to attack a country or a country's enterprises, whether it be a hospital or—

[The Chair, Liberal, John McKay]

We're going to have to leave it there. Mr. Harris is over his time.

Mr. Motz, please. You have five minutes.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you, Chair.

Thank you, Mr. Jones, for being here again. I always appreciate the level of expertise you bring to the field. Thank you again for the great service that CSE provides Canadians.

Scott, you've previously appeared before this committee in talking about our approach to protect our mobile and telecommunications systems and networks, namely, through a system similar to the U.K. model, where they inspected everything before it was even installed. As you know, the U.K. has moved away from that model, going so far as to reverse their decision to allow Huawei in light of security issues raised by the security teams in their government.

Huawei, which we all know falls under the Chinese state-controlled company, because of their security laws cannot be safely used in Canada according to various—basically all I've ever seen—independent experts.

Is your team still working on a recommendation on Huawei for the minister, or have you already briefed the minister and provided advice on the best way forward with respect to this company?

[Scott Jones]

I think that one of the things that's really important is that my role here is to advise and implement on policy, and policy decisions go before the government and the elected officials. I have to be careful not to take away our.... It's not my goal to.... I'm not elected, so I really respect—

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I appreciate that, Mr. Jones. I guess, based on that answer, I would say that you have already provided that briefing, and if you have, thank you for doing that. I'm sure that's something that will go a long way to making the decision.

Your report highlights in many parts the use of indirect attacks to gain access to desired systems—going after suppliers, business partners, clients and governments, all with the intent of gaining access to a particular target. We also know that China is one of those countries that have been identified by various security agencies across our country and other countries. It would seem counterproductive to have the system that transfers all of our information, namely the Internet, controlled by a company that falls under the thumb of a country focused on theft, misinformation, espionage and disruption.

Can you help me and Canadians understand why we still don't have an answer on Huawei?

[The Chair, Liberal, John McKay]

Mr. Motz, you've asked twice that an official of the government comment upon a decision of the cabinet. I think Mr. Jones declined to answer that question the first time. He should probably decline to answer that question a second time.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I appreciate your intervention, Mr. Chair. Please take that time off of my five minutes. That would be great.

Mr. Jones, previously—

[The Chair, Liberal, John McKay]

You know I'm always generous with your time, Mr. Motz.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Not as generous as you are with Mr. Harris, but hopefully today will be one of those days.

[The Chair, Liberal, John McKay]

He does very well, I have to say.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Jones, you've testified before that you were looking at how to manage security products—this is really key—in a global supply chain and rolling software updates. That was something that you focused on at one of the last times you were with us. That was in September 2018. It's been two years. Have you come to any resolution on securing hardware and software that brings rise to this concern?

[Scott Jones]

That's a fairly in-depth question, but I'm happy to try to answer it.

I think there are a few elements. Certainly, the broader Internet and the broader aspect that we face in terms of technology is that it is a global supply chain, and there are a number of vulnerabilities that are in the software. There are a few things that we're pursuing.

The first one is really about building up the layers of security and the work that we're doing with various industries. In the context of the electrical infrastructure in Canada, one of the things we are looking for is to build in security, but not just in the products themselves. We're looking at it from a very similar approach to what would have been done in the safety world for the equipment as well, and now also how we can watch and monitor with them that equipment to make sure it's operating as expected? It's about building it to be as secure as possible, knowing that there's likely to be vulnerability. Then, how do you watch to make sure that it's operating as expected so that you can respond quickly? It's also about building in a response capability as well. In the industry, we call that “managed detection and response”, but it's really about knowing and understanding that nothing is invulnerable anymore. The systems are flawed no matter where they're built, and—

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

So it would be a fair point to note that we can't say that we are secure. Saying that it's a permanent battle would be a fair assessment, and we have to be vigilant moving forward. I guess it would then make sense that we would want to only use supplies from trusted countries. That would make sense.

I have a question. You've appeared before NSICOP as well, and as you know, we tabled a report recently detailing serious concerns around foreign interference and influence in Canada and how China has played a role in those concerns.

As a country, we've been deemed to be an attractive and permissive target, according to that report. From your perspective—

[The Chair, Liberal, John McKay]

Mr. Motz, I'm stopping the clock.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

This is a question specifically about what we need to do to change that.

[The Chair, Liberal, John McKay]

Okay, I just want to be cautious about whatever questions, answers and deliberations about NSICOP. That is, in fact, a committee of parliamentarians who are sworn to a high level of secrecy, like you.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Yes.

[The Chair, Liberal, John McKay]

I just want to make sure that you're going to stay within those guardrails. We know that guardrails are important to stay within these days.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Yes, I know that guardrails are very important. I don't want to go to jail for my guardrails. It was tabled in their NSICOP report and thus has already been made public.

[The Chair, Liberal, John McKay]

Okay.