Public Safety Committee on Dec. 9th, 2020

[The Chair, Liberal, John McKay]

In the scaling of security, surely to goodness facial or thumbprint recognition technology is far more secure than whether my password is “123” or “321”.

[Scott Jones]

Absolutely, it's a much higher hurdle to jump over than if you have a simple and easily guessed password and you reuse your password.

[The Chair, Liberal, John McKay]

Okay.

My final question—and I'm really straining the patience of my colleagues, but who cares—

[Voices]

Oh, oh!

[The Chair, Liberal, John McKay]

—has to do with an example of a friend of mine who made a commentary on several of the countries that you have named. He has a legitimate fear about threats, both cyber and other. He is a member of a diaspora community.

When he took a threat to the local police force, they said it was an RCMP matter. Then when he took it up to the RCMP, they said, “No, that's a CSIS matter.” When he tried to take the matter to CSIS, there was dead silence on the other end.

I think one of the reasons why the diaspora community doesn't report all of the threats out there is that there is no clear way to report these. Do you have advice for my friend, or for Canadians generally, who are actually threatened by foreign state actors, both on a cyber basis and on a physical basis?

[Scott Jones]

I'll have to stick to the cyber advice, which would be our expertise.

First, if you do see something, whether it's a text message that seems to be spam or an email, report that. There are various ways to do it to your service providers. If you fill in 7726, which spells “SPAM” on your phone, and you send your spam text messages there, those go in and they deal with those. In some cases, they do share that information.

Certainly, if people are seeing malicious and threatening emails, or that contain malware or look suspicious, there are ways to submit them in safe ways. People tend not to do that, but there are ways to do it.

Make sure that your systems are always up to date if you feel that you're under threat with regard to cybersecurity. The biggest vulnerability is the system's being out of date—or unpatched, depending on if I slip into techy terms or not.

[The Chair, Liberal, John McKay]

Thank you, Mr. Jones. I'm going to have to end it there or else I'll be facing impeachment by my colleagues.

[Technical difficulty--Editor]

Oh, it's nice to hear some music.

We're having a breach of our own security here.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Chair, I'm voting for impeachment.

[Some hon. members]

Oh, oh!

[The Chair, Liberal, John McKay]

With that, we'll go to Madame Stubbs, for five minutes, please.

[Shannon Stubbs, Conservative, Lakeland, AB]

Thanks, Chair. Your last question was actually extremely important.

I have questions on two topics, and if there's still time and you're amenable, I think my colleague Tako might have a question. I could split my time, if that's possible.

[The Chair, Liberal, John McKay]

Anything is possible.

[Shannon Stubbs, Conservative, Lakeland, AB]

Okay, thanks, Chair.

Mr. Jones, you identified China, Russia, North Korea and Iran as threats to Canada. You probably know that recently Israeli and U.S. researchers found that China was rerouting Internet traffic through state-controlled services.

Would you comment, if you can, on whether you think that's espionage or theft of intellectual property, and what the purpose would be, and also whether CSE has acted or what action CSE has taken to stop China from rerouting Canadian Internet traffic?

[Scott Jones]

A bit of some of that might touch on some classified issues, but I can certainly talk about it and hope I answer your question fully.

There are a few things. Typically, what we're talking about here is that the way the Internet routes itself is that it works on what is the cheapest route, usually meaning fastest. You can pretend to be the cheapest route and fastest, which forces the Internet to direct across it. The technique for that is called “BGP hijacking”, but I won't go into all the techy grossness of it.

That's one of the things that we've been working on in partnership with telcos. I talked about innovation before, and we do look at ways to innovate and work with our telcos to detect this type of activity, and moreover, to ask what are the defensive ways we can do things to prevent this?

It isn't something that happens a lot, but it is something that can happen and it's something that we're looking for. We're looking for ways to mitigate and defend against it, but at the same time, though, not reduce the reliability of the Internet.

It is something where you're talking about big shifts, so it is a bit of a concern. Really, you're talking about being able to mass all the data that's going from one place to another, so encryption is a great defence against that.

With our apps, right now for example we are on an encrypted Zoom channel. You can't publicly just tap into this; you have to be able to sign in, and so on. There's encryption there. When I send a message over any of the messaging apps, and so on, that's encrypted.

Our websites are all encrypted now as well for the government, and hopefully, more and more commercial sites are fully encrypted. That immediately puts a barrier to actually using that information for anything, other than getting a whole bunch of encrypted data that you can't do anything with.

Those are some of the defences.

[Shannon Stubbs, Conservative, Lakeland, AB]

Thank you.

Related to a topic we had touched on earlier, I note that our government's critical infrastructure strategy hasn't been updated since 2009. Therefore, relative to this potential ransomware targeting of large enterprises and critical infrastructure, I wonder whether you can expand with more specifics and more detail about the nature or depth of the relationships you have built with operators of critical infrastructure, those in the private sector, and whether there are established relationships with those in power to make decisions in those organizations in an official way.

[Scott Jones]

Absolutely. We started with the telecommunications sector, where we see from a cybersecurity perspective that they're the root of so much, but then we've expanded that into the energy sector, particularly concentrating on the electricity sector from coast to coast. So we do have partners that we're working with and have absolutely contacted the senior levels of those companies. We always look to grow those partnerships. I just described the work we did with the telecommunications companies. We're looking at doing something similar with the electricity companies—co-development, where they invest with us on how to combat this—to address some of the threats they're facing in research development. One of the criteria is that as we learn things, it has to be shared with everybody in the sector.

If we work with one specific company, we are very conscious never to create a competitive advantage for them. We want to make sure it's going to the whole sector. We're the government; our goal is to make sure that it's coast to coast to coast, and also shared openly so we can all benefit from it no matter where you are. There are bigger companies in Canada, and they have more resources. We've seen them step up. We've seen their senior executives step up. We work with them. I have fairly regular meetings with senior executives from the energy companies, for example, and also from the telcos, just to make sure that we're on track and are addressing the biggest threats. They have a very good understanding of risks. That's growing, but it still needs to grow.

To your point, critical infrastructure is large. There are a number of providers. It is very dispersed in Canada. We are looking for some leaders, but also for organizations like industry associations to bring all of their members to the table and represent them to us.

[The Chair, Liberal, John McKay]

We're going to have to leave it there, Ms. Stubbs.

Who is the next Liberal questioner?

Madam Khera.

[Kamal Khera, Liberal, Brampton West, ON]

Thank you, Chair.

Thank you, Mr. Jones.

I represent the riding of Brampton West, and you may or may not know that back in 2019 we worked really closely with Ryerson University to be a partner to secure a cybersecure catalyst for them. Part of it was funded by the Canadian government as well, and it's a national centre for innovation and cybersecurity in Brampton. The catalyst drives collaboration to empower businesses and to look at the very things you're talking about—innovations, and to get them to tackle these issues.

Do you know about this centre and are there are any opportunities for partnership or collaboration with this catalyst?

[Scott Jones]

Absolutely, we know about them. It's always good to see any organization stand up. We have never claimed to have a monopoly on innovation or on addressing this problem. We try to come humbly to the table with our knowledge, knowing that others have expertise and will come at the problem from a different perspective.

There's always opportunity. We are trying to put out some of our challenges. We've done them through research challenges. CSE has published them. We worked with the NRC to publish some of our research challenges for the more research type of pieces than the development pieces. Then we also have events where and hosted something called GeekWeek in October. Organizations can come and apply. It was virtual this year, of course. Normally it's in person. Over 200 cybersecurity professionals from Canada, academia, industry, government and international come together to start to tackle those problems together. That would be another area where we could contribute and collaborate on research projects.

Finally, we're always open to good ideas. I have a partnership group that looks for places that we can work with together on things like collaborative cyber defence. We're always looking for great ideas and hearing what people have to say.

[Kamal Khera, Liberal, Brampton West, ON]

That's great. Thank you for that.

Perhaps you can talk a little about the fact that your agency is relatively new, having come into force in 2018. Can you perhaps talk a little about what the approach was to addressing and raising awareness of cyber-threats before 2018? Where were some of the limitations and the successes of this approach in working to prevent and address cyber-attacks?

[Scott Jones]

This is going to come across as a little bragging. These organizations all existed. Public Safety Canada, for example, had the Get Cyber Safe campaign ahead of time. At CSE we've had the IT security branch since the late forties or early fifties, primarily based on cryptography but growing into cybersecurity. Then, of course, Shared Services Canada had security operations. We brought all of those together, because we needed to start addressing this whole-of-economy thing.

In terms of what we've done, there's really been a collaborative approach with industry and partnerships. It's not, “We're the federal government and we're here to help.” Rather, it's, “We're the federal government and we want to work with you. You have knowledge and expertise as well.”

The second thing is that we've tried to make our advice and guidance practical. All our guidance, not only for small and medium-sized enterprises, is being rewritten to say, realistically, what should be done by a normal Canadian, not a computer scientist with a Ph.D. We wrote our advice and guidance to be almost inaccessible, and it's now accessible. I'm just really pleased to hear all the comments on the report. I really appreciate the feedback that it is accessible. It was written for every one of us to be able to read.

Third, we have done a lot on collaborative cyber defence, working with industry partners to say that we can solve this problem together. We bring certain expertise to the table. The Government of Canada has very good defences in place that we've built over the last decade. How can we apply those lessons learned? Canadian Shield is an example of that with the Canadian Internet Registration Authority. We do things with our telecommunications companies, critical infrastructures providers and of course the provinces and territories. That's an area where we're still developing our relationships, but we've certainly seen various provinces come to the table and say that we should work together. I can't think of a province or a territory where we don't have some ongoing relationship right now. One of the goals is to make sure there is a pan-Canadian approach.

[Kamal Khera, Liberal, Brampton West, ON]

Thank you for that.

Do I have any more time, Mr. Chair?

[The Chair, Liberal, John McKay]

You have 30 seconds.

[Kamal Khera, Liberal, Brampton West, ON]

I'll give that to my friend Ms. Damoff.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thanks, Kamal.

My question is really simple: Is the COVID app safe, yes or no?