Public Safety Committee on Dec. 9th, 2020

[Scott Jones]

That's a very profound question.

In terms of the allocation of risk, I think the banking example is an excellent one. Not only do they have cybersecurity elements, but they also do have a substantial amount of anti-fraud, so if they see something that's out of character, it tends to trigger their fraud controls. I've always been quite impressed with that

I think we've all fallen victim to something like debit card skimming and things like that at some point. Hopefully nobody has, but I had my debit card skimmed once. I think there are some elements there.

Risk is one of those areas where it's really about how to minimize the risk. I'm not sure about risk transference. It's a challenging question. I think, in that case, the question would really be whether you are doing something that's absolutely negligent or not.

Again, that's probably a question best left to a lawyer, not to a cybersecurity engineer. It is something where—

[The Chair, Liberal, John McKay]

Thank you, Mr. Van Popta.

Mr. Van Popta has actually anticipated the question I would like to ask. Maybe we can get to it towards the end because I think it is a live issue.

With that, we have Mr. Iacono, for five minutes, please.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Thank you, Mr. Chair.

Thank you, Mr. Jones, for being with us and keeping us up to date with what's happening in the world of technology.

My fellow citizens in Alfred—Pellan, as well as Canadians in general, are concerned by partial data collection. The concern is related to cyber-attacks and the use of data by commercial businesses for targeted advertising. This, of course, is unacceptable to many people.

Can you tell us how we can teach citizens how to properly protect their personal data?

[Scott Jones]

Thank you for that question, which I think really does go to the root of some of the things we talked about in the national cyber-threat assessment.

The amount of personal data that's out there on us now is quite extensive. One thing that's been noted is that in any cyber-attack, not only do they have things like your usernames and passwords that they've stolen from other places; in many cases, they also have the answers to your security questions—your mother's maiden name, your first pet, what school you went to and things like that. Those things that we always relied on as kind of a second barrier to security are now just the same as the password type of thing. It's critical.

To protect information, I always ask, “Why does somebody to know this? Are they asking something that's legitimate?" If I'm going on and buying an online purchase and they ask for my social insurance number, they don't need that for the purchase. I'll walk away. They need to start collecting the minimum amount of information viable. The second thing I think about is the risk I am taking on. Of course I do online shopping, not just because of the pandemic but also because it's convenient for me. Where is it going? Who's behind this service? Is it using a third party payment system? That can protect you financially. In reality, though, things like credit cards do have good protection.

It really boils down to, “Do they really need to know?” Over-collecting of information is something we certainly look at. Even when we designed the cyber centre, we made it so that there's a phone number people can call for help. We looked at the minimum information we absolutely needed to be able to respond and help the person, and then we did a privacy assessment on that to protect it. That's something I think every business should be looking at: . “Do I really need to know all of this? Do I really need to keep the history of every purchase they made?" Maybe they do. There could be a real reason for that. That's something I think the privacy commissioners have advice on.

From a cybersecurity perspective, the more information we put out there and the more information we put on our social media accounts, the more vulnerable we're making ourselves. Frankly, we're giving them the information they need to target us.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

Thank you.

For several years, we have been aware of the illegal activities and transactions that take place on the deep Web. For example, there is drug trafficking, prostitution, arms trafficking and even contract killings.

Can you tell us if we have been able to put in place means to reduce these worrisome activities and track the criminals in question?

[Scott Jones]

I think that investigators at the RCMP, or perhaps at the Sûreté du Quebec, for example, might be in a better position to answer about the investigation phase.

One of the risks we see is that the dark web is certainly facilitating cybercriminals and cybercrime tools. There is an entire ecosystem out there where you can go on and say, “I want a tool that's going to allow me to do this.” Let's say you want to target this type of organization, or even a specific organization. They'll bid and tell you what it will cost. You can pay for 24-7 support or you can pay for a custom tool to be developed for you to achieve your goals.

Then there's the organized crime that goes behind all of that. It is a large enterprise out there. It's facilitated by the dark web and anonymous payment systems like Bitcoin and online currencies. One of the key challenges is that the entire system is designed to be anonymous and to not have attribution.

[Angelo Iacono, Liberal, Alfred-Pellan, QC]

I see.

As far as cyber-attack tools are concerned specifically, since they are technologically advanced materials, it is reasonable to assume that their manufacture is not easily within reach.

Are you able to tell us, today, who these manufacturers are? Are we able to stop them from selling the equipment on Canadian soil? More importantly, are we able to seize anything in the marketplace that can be used to hurt us?

[The Chair, Liberal, John McKay]

Unfortunately, Mr. Iacono has gone over his five minutes. It is an important question. Perhaps you can circle back to it in another answer.

Mr. Kurek, you have five minutes, please.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Mr. Chair.

Thank you, Mr. Jones. This is very enlightening. It's certainly an important subject, especially in the circumstances we find ourselves in regarding COVID. I hope to get through a few questions.

Are there any areas in which Canada is at a higher risk, or is more susceptible, due to evolution in the use of the Internet since the start of the COVID-19 pandemic and the explosion of online capacity required to deal with the pandemic?

[Scott Jones]

Let say there are a few areas where we would say that we have to be very careful about the increased risks. One thing is that with so many of us working from home, the fact is that it has changed our technology environment. We're mostly working outside of our organization's perimeter, so in terms of a lot of the defences we relied upon, many Canadians are now working from home and connecting directly to the Internet.

There are ways to try to minimize and mitigate those risks. Those are some of the things we published, but this is probably one of the biggest risks; it's the fact that we're now outside of the defensive perimeter that was set up. In some cases, we're not. For example, I never leave our defensive perimeter because of the way we have set up our remote access. We designed this to work remotely so that I could work from home and stay behind our full suite of cyber defences. In the majority of the government, it's like that.

For a lot of organizations, though, one of the things we have encouraged them to do is to make sure they are either doing something similar to the design we have for government or supplementing with other defences that are there.

That would be one of the major risks, but also, then, we're holding more data at home, and we're having conversations like this, although this is a public forum. There are things like that where we just need to be conscious of what we're doing as well.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much for that.

Obviously, health infrastructure is at the front of everybody's mind with the advent of COVID over the last 10 months or so. Have we seen an increase in the threats faced by our health care systems?

How is your organization able to assist in ensuring that the briefings don't get to just the federal government, but that the information is getting onto the ground to ensure that for local hospitals, local clinics and doctors who are working from home—and, in many cases, Canadians who are video-conferencing with their doctors—the whole system is protected?

[Scott Jones]

That question really goes to some of the heart of what we've been doing. The goal is to not have this information sitting inside of the federal government, but to get it out to into other hands. I mentioned this earlier when I talked about the weekly call we do with the health sector. That includes our provincial and territorial colleagues, but also any organizations that come to the table. That grows every week as more people sign up for it, and we're happy to walk through what we're seeing on cybersecurity, including advice and guidance.

In general, though, when we also see.... This is where we do leverage in terms of what our foreign intelligence mandate can tell us in terms of where targeting is happening. We have gone out to specific organizations where we see things and have given them tailored advice because they're a system of importance to the government. Really, it's about getting that information into the hands of somebody...our goal is to get it before they are a victim so that they can proactively take steps to protect themselves. That's what we do every week, and we do it consistently.

Then, of course, we publish a number of alerts and advisories that go to sectors. We published the threat assessment for the health sector, and we made that public. We sent it to the health sector ahead of time as well to say what it was that we were going to be saying about things they needed to be aware of. We're really trying to raise the knowledge of the sector, but also to work with them on what solutions will work as well. Our goal is to encourage them to share within the sector best practices—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I apologize. I have about a minute left, and I'm hoping to get in one last question. I don't mean to cut you off.

We are in what is being considered an “infodemic”. There's a ton of information, a ton of misinformation and then a whole bunch that's somewhere in the middle, and I think that's what makes conspiracies believable, because there's always that little bit of truth.

Specifically, regarding the integrity of Canada's democracy, I would ask for your comments on threats to Canadian democracy, elections or any infrastructure associated with that.

[Scott Jones]

That's big.

We're really talking about some of the things we've highlighted in our first and second “Cyber Threats to Canada's Democratic Process” reports that we've issued to really try to highlight some of those. It remains a challenge.

Now, I think the response isn't necessarily a cybersecurity response. You'll see Elections Canada stepping in about disinformation. You face this as members of Parliament and as candidates at some point, etc., and how to combat that.... It is one of those areas where, from a cybersecurity perspective, we're very limited in what we can do, because it is just bad information being posted somewhere, frankly, and we're not in a position to be the arbiters of truth.

But it is something where we always are looking to say, number one, how do we bolster our cybersecurity? The goal of the report itself was to debunk some of the threats and some of the misinformation that could be out there and to say, no, this is how democracies work. You can't go online and just change Canada's vote tallies, as there are procedures in place, etc.

[The Chair, Liberal, John McKay]

We're going to have to leave it there, notwithstanding many efforts south of the border to change the vote tallies.

Madam Damoff, you have five minutes, please.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you, Mr. Chair.

It's wonderful to have you here, Mr. Jones.

Thank you for your work and for your report. It's really helpful. You are presenting it in a way that Canadians can understand. A lot of this is far beyond our knowledge. It's important to simplify it so we know what we're talking about.

Back in 2018 you said you were “confident sufficient safeguards exist to deal with the risks of telecommunications hacking or spying by China”, but you acknowledge that risk could increase with the introduction of 5G.

This week's Citizen Lab came out with a report. I don't know if you've seen it, but it said that Canada's 5G strategy shouldn't “be designed to solve a Huawei problem”, but it should address a 5G problem “to ensure the resiliency, security”.

I'm wondering if you could speak a little about that and about what kind of strategy we should be looking at as we move and companies move to 5G.

[Scott Jones]

I'll have to be careful because the policy decision is still pending.

In general, what we're looking at when we're looking at anything approaching a 5G network is that the system needs to be secured in layers, everything from how it's maintained to who's accessing it, to the variety of equipment itself, to whether the software used is open source, publicly scrutinizable or closed, meaning it comes from a particular vendor, and then it's also how we leverage it. That's one of the things where modern telecommunications offer a significant advantage now.

We used to rely on the network itself for security and how you transmitted because encryption couldn't be used. It was too expensive. Our devices weren't fast enough to do it. It is a challenge, when you talk about the law enforcement context.

Encryption offers protection for private information that you're transmitting. It's hard to observe. Encryption is now enabled more and more on our devices by default. All of the Government of Canada websites mandate that they're encrypted. So encryption itself is protecting confidentiality and the ability to know what I'm saying or what's happening.

The second piece is the integrity, knowing that when I send a message, nobody is modifying it. That's one of the areas where we need to think about end to end. For example, if the city is facilitating an ambulance to get to the hospital and is changing the lights, you want to make sure that it's not sending green, green, where traffic will cross—things like that. That's the integrity of the message, meaning that the message you want to send is getting there exactly as determined. You use encryption for that. You don't really care if somebody sees the message; you just care that they can't change it.

Then there is availability: we need the networks to be there. That's where we really look at a robust strategy talking about vendors building better equipment and better software. How is it tested? It's international in scope to make sure that it meets minimum standards, but you also have multiple vendors in place. We want a multi-vendor strategy. We want diversity in the market. We want these things in every section regardless of the type of network or the type of equipment. We're always better off than when it's a monopoly.

We really want to leverage all of those things. That's what I think the Citizen Lab report was getting at. It said it's multi-faceted. There's not one solution to the challenge we face; you need to apply multiple different aspects of security. That's certainly what we try to layer into any security program we do. It's not unique to the next generation mobile network versus a fixed network or anything that's.... For example, we use the same security modelling for the incredibly high-speed network I have at home right now.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I'll be quick because I only have a minute left.

Canadians had expressed concerns about the COVID app and giving away their private information, which we know is not the case. Yet the same people will upload a photo of themselves to an app that will automatically age their face, without even thinking that all of that was going to a Russian company. How do we get past that? You see it on social media all the time, where people are providing access to photos and private information. Let's share personal information that ends up being used for security questions, and you answer them openly on Facebook. How do we educate Canadians about that?

[Scott Jones]

It's certainly a challenge, and I wish I had an answer to that question. It's certainly one of the challenges we face.

The COVID alert app was a frustrating experience because of that exact concern. From my perspective, the application was built in the open. We tested it with commercial providers to make sure that we had done everything we could to test for vulnerabilities or just coding errors. It was open sourced. Privacy commissioners reviewed it, but it still persists. It just comes with, “Well, it's the government”.

I saw a cartoon. It was the 1950s. It read, “I can't talk. The government might be listening on the phone”. And now, you say, “Hey, listening device”, which is one of those home speakers we have, “tell me what I'm doing?” It's recording everything we're saying. It's this dichotomy out there, where people are....

I wish I had a great answer.

[The Chair, Liberal, John McKay]

Who knew Siri was out there in 1950?

Madame Michaud, you have two and a half minutes, please.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I would like to thank my colleague Ms. Damoff for her interesting question. And the answer, in fact, was just as interesting.

I am particularly interested in the task force that was created, and in which the centre participated to protect the 2019 federal election from foreign interference, especially given the fact that an election could come sooner than expected. This is worrisome.

I can't help but think of all the things we've seen on TV, for example The Great Hack and The Social Dilemma. I don't know if my colleagues have seen them, but there's definitely something worrying there.

What specific measures have emerged from this task force to counter misinformation campaigns or foreign interference in federal or provincial elections?

Are there any specific actions or recommendations that have been made by this working group?

[Scott Jones]

I'm going to assume that you're talking about the work of the security and intelligence threats to the elections task force that CSE chaired on behalf of the community.

We're doing a few things. We did work with Elections Canada to support them overall on cybersecurity. I could go into a lot of detail on that, but so could the Chief Electoral Officer and his team.

One of the aspects for us was also making sure that every registered political party that wanted to was getting regular cyber briefings. My team did that on an ongoing basis throughout the campaign to make sure that we shared any cyber-threats that we were seeing. We also contextualized it to say what was really important and what they could be expecting to see. That tended to be with the officials inside of the party.

We also had the hotline set up where political parties could call if they needed assistance with something, such as fake social media accounts, etc. Most of the social media providers were fairly responsive to those types of things. We would try to ensure that connections were made there.

It does remain a challenge. That's one of the areas where we are always looking for ways to connect.

On the other hand, one of the things that has been repeatedly reinforced to me is that if, for example, you are impersonated on social media, I cannot make a complaint on your behalf. You have to do that. The social media companies are quite adamant about that. It's one of the areas where, if something like that does happen, we try to facilitate and hopefully accelerate getting a resolution. We did see some incidents like that where parties asked for some support.

Then, of course, in the report itself—the first and second ones—were the threats to Canada's democratic processes, where we really try to lay the groundwork for what cyber-threats we expect to see to Canada's democratic institutions.

[The Chair, Liberal, John McKay]

Thank you, Ms. Michaud.

Mr. Harris, you have two and a half minutes.

[Jack Harris, NDP, St. John's East, NL]

Thank you, Mr. Chair.

Mr. Jones, could you tell us what's the difference between cyber defence and cybersecurity?

We know your agency reports to the Minister of Defence. As my recollection of defence critic, I don't think you're part of the department. The military, of course, has to protect it's own infrastructure, equipment, communications and all of that.

Is your agency involved in defence planning in any way? You talked about table-top exercises with the electrical power grid people. Do you engage in these kinds of exercises with the military in terms of defence planning or scenarios planning for military activity?

[Scott Jones]

We are part of the Department of Defence and we report to that minister. We report to the minister, but we are a separate agency under Defence. I almost slipped back seven years there for a second.

With “cyber defence” we're really talking about when we're actively doing something to prevent a cybersecurity incident. We're taking a block. We are the cyber defenders of the Government of Canada. We take over two billion actions a day, over and above those that are available commercially to protect the Government of Canada. We have a cyber defence part of our program.

“Cybersecurity” is the broader term that we use. That's also about the proactive measures. Rather than just taking action at the point of compromise, it's building those defences and building it to be secure from the start. It's security by design. That's really, in my mind, where we differentiate cybersecurity from cyber defence. Cyber defence really is about that action you take to protect.

In terms of our work with the Department of Defence, obviously they are responsible for the defence of their systems. They're the experts on military equipment, but we do provide a number of services. One would be cartography and the encryption systems that they use to protect all Canadian forces operations. That's a 70-year partnership where we've worked with them on those types of things. We certainly work with defence on any exercise planning.

We would also do that with any other organization to say how we respond to any cybersecurity incidents. We really look for opportunities to raise that bar proactively. We would do that as part of our mandate.