Public Safety Committee on April 29th, 2024

[Dr. Mitra Mirhassani]

Stealing a car has basically always been a little bit easy, but these days, because of information sharing and the availability of resources online, information is much easier and readily available. Let's admit that our newer generation is more tech-savvy than some of us, so if they are seeking information, they can easily find that information.

There are different resources and there is actually no way to stop those resources from sharing the information about the weaknesses of certain technologies. There is no way for censuring those data sources. Having said that, there are also always stories of young hackers who hack into extremely secure databases and datasets. It's always basically a little bit of interest and intrigue for the younger generation to go for these newer ways to find information and employ it.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

I have one minute. I'll make this very quick, then. From your perspective, what recommendations do you have for manufacturers to improve the vehicle's resilience to getting stolen or cyber-attacks?

[Dr. Mitra Mirhassani]

Unfortunately, there is not just one piece of advice. We have to remember that although we like to have our cars to be smoother, have a lot of safety features, be connected and do a lot of amazing things, the manufacturing of automotive vehicles has turned into a super complex issue, as well as the whole engineering and concept. I'm afraid there is not just one piece of advice that I can give them. You usually ask them to apply a “secure by design” principle, but we are saying that even that design principle and engineering protocol fails to secure such a complex system.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

You're saying, basically, that no matter what they can do, they're still going to get stolen.

[Dr. Mitra Mirhassani]

Unfortunately, there is no way to secure a system or a car 100% and say, “It's done and we are okay.”

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Shipley.

We go to Mr. Schiefke, please, for six minutes.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much, Chair.

I add my thanks to our witnesses for appearing before us today.

Ms. Mirhassani, I'm going to direct my questions to you today. Thank you for bringing your expertise to our committee on this very important issue.

We've had representatives of the car manufacturers appear before committee, and I asked them questions about how much they were investing in research and development to make their cars harder to steal. They weren't immediately forthcoming with that information. I learned that there were submissions to INDU, the industry committee, where they were asked similar questions about what they were doing to make their vehicles harder to steal. I've read all of those, and basically, none of them were forthcoming on what they were doing, citing that they didn't want to share this information as it would tell the criminals what they were doing to stop them from stealing their vehicles.

There was one, however, that I came across, which was submitted by Ms. Audrey Dépault, who's the senior adviser for public policy and development for Tesla and who, without even being requested to submit information, did so anyway because Tesla's actually quite proud of what they've done to make their vehicles—according to the Highway Lost Data Institute of the United States—between 2020 and 2022, the hardest vehicles to steal. We're not talking about the high-end vehicles. We're talking about the Model 3, which actually comes at a manufacturer's suggested retail price below the average now.

There are a couple of things that they include in the basic vehicles, such as the “sentry mode”, which has a live camera, so whenever there's suspicious activity around the vehicle it sends to the owner's phone a live feed of what's happening around their vehicle. They also include relay attack mitigations. We heard from the Montreal police as well as the Sûreté du Québec that we have 15- to 20-year-olds who are buying $100 gadgets on Amazon and stealing the messaging that's coming off the vehicle. Well, they have something that mitigates that attack, and they have what's called “PIN to drive”, which allows the driver to secure a four-digit verification code that must be entered before the vehicle can be driven.

What, amongst what Tesla's doing, to be the most successful...? By the way, I don't drive a Tesla. I have no interest in Tesla, but I'm very intrigued by what they've been able to do. What is Tesla doing that the other manufacturers simply cannot get or are not doing?

[Dr. Mitra Mirhassani]

In terms of identifying the differences among Tesla and the other carmakers, basically, they all make cars but they're making cars very differently from each other. Tesla has its own weaknesses that I'm not going to disclose here.

In terms of auto theft, yes, they have a little more success. They also have bounty hunting and participate in a lot of competitions, basically encouraging people to help them in identification of flaws of their systems. The same sometimes goes for the other carmakers as well.

Some of the technology is easier to be adopted by the other carmakers, but remember that the manufacturing styles among Tesla and the other carmakers are completely different. That renders the ability of some of those carmakers to jump easily into modifying their process, so as a result they are a little slower in adopting solutions that, for example, Tesla—

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Ms. Mirhassani, I'm on limited time here, and I'm really trying to get as much of your expertise into this report as possible.

We're looking at ways we can strengthen our ports. We're looking at ways we can strengthen law enforcement. One of the aspects I really want to get to the heart of is what we can do as far as regulation is concerned, because we've heard that hasn't been updated in almost 20 years.

What do we need to be doing as a government?

What would a regulation look like that we could put in place and would be the most effective in producing vehicles that are harder to steal? What would be included in that regulation, and what would that have to look like for it to be effective now and in the future?

[Dr. Mitra Mirhassani]

Although the regulations haven't been adjusted in Canada, the SAE standards and ISO standards and the world forum for harmonization of vehicle regulations have recently been adjusted.

In Europe, those will be enforced starting in July 2024. This means that vehicles will have to have the secure-by-design principle and some level of testing for security incorporated before they can start selling new car models.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Based on your experience, will that be effective in curbing the rise in vehicle thefts we're seeing in Europe, the United States, Canada and all around the world?

[Dr. Mitra Mirhassani]

I'm a cynic and a researcher, so my answer has that bias in it. I always go by the fact that no vehicle is 100% secure. If we close the door on this side, there will be another way to open it.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

If we were to adopt standards similar to those that have just been passed in Europe, would that be beneficial to Canadians?

[Dr. Mitra Mirhassani]

Yes, certainly.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much for your testimony today.

[The Chair, Liberal, Heath MacDonald]

We're moving on to Ms. Michaud, please, for six minutes.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Thank you to the witnesses for joining us.

Ms. Mirhassani, I'll be asking my questions in French, but first, I'd like to make sure that you are getting the interpretation. I see that it's working. Thank you.

I'll continue along the same lines as my fellow members.

Following the auto theft summit, the government announced that it planned to amend the Radiocommunication Act in order to restrict the sale, possession, distribution and importation of devices used to steal cars. The government reiterated that intention in its recent budget. The amendments would give law enforcement agencies the ability to eliminate hacking devices from the Canadian marketplace. It didn't take long for people's reactions to come in.

Someone from software development firm JuniperOne explained that the software defined radio, or SDR, devices that the federal government is proposing to ban are pretty basic, saying that a Flipper Zero can't be used to unlock or start newer vehicles. As we know, thieves tend to target much newer vehicles. We also know that they don't necessarily have to use a technological device. As Mr. Shipley pointed out earlier, a thief can simply use violence to steal a person's car.

Do you think restricting the availability of these devices is really the way to go, or is it just a waste of time since organized criminals will find a way to get their hands on the devices anyway? Obviously, we need to work on a number of fronts at the same time.

[Dr. Mitra Mirhassani]

Unfortunately, I believe that banning those technological devices is not going to help. The thieves are certainly not going to abide by the law. They'll get them from other sources.

The only thing it did was create a bit of panic in my students, who wondered what they would use to learn. Banning those devices is not going to impact auto theft. It's probably only going to harm training and education.

On one small note, yes, those devices cannot open some of the cars, but we tested them and, unfortunately, they work on some of the new car models.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

The president of Équité Association appeared before the committee, and she talked about vehicle anti-theft technologies that had been deployed by automakers in the United Kingdom, and security patches that prevent the CAN bus or controller area network from being overcome.

Apparently, these technological solutions are rather simple and would prevent vehicles from being stolen, but the push for automakers to deploy them came after some insurers decided to stop insuring the top most stolen vehicle models.

Do you think Canadian automakers should follow suit and deploy these technologies?

Do you think we're going to end up in the same boat, where insurance companies decide to stop insuring certain vehicle models because they are stolen too often?

[Dr. Mitra Mirhassani]

I don't think I can answer on behalf of insurances companies. They have to answer that part.

Yes, there are certainly some technologies we can use to basically make it more difficult. The thing is that although any system is not 100% secure, if we make it difficult or create a process so that it takes longer to attack or get into the vehicle, that could be a deterrent for whoever is trying to steal that car. In a way, if a car takes 15 or 20 minutes to steal because of some of the principal challenges that are placed along the way, that will deter the thieves.

Unfortunately, I can't say what the insurance companies can do. I can only answer on the technology side.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you.

I have a question for Mr. Gray about the Port of Halifax.

Your situation seems to be quite different from the one at the Port of Montreal, which has really come under fire. Its geographic location makes it a hub for exports and stolen vehicles.

I want to be sure I understood something you said earlier. You think that focusing on port security is the last thing we should be doing to combat the rise in auto thefts.

Is that actually what you said? If so, why?

[Capt Allan Gray]

If you were relying on the port as a last resort or as your only defence, it would not be very successful because of the number of issues around documentation. We don't physically open every box because it's sealed prior to arrival. If that was your only line of defence, it would not be a very successful one. We need a broader one.

To me, one of the problems is that we don't have good data transfer from agencies to ports and terminals. We can't access CBSA data because of the way the legislation is written. Once it goes into the CBSA, it can't come out. Therefore, we have issues in data sharing amongst ports, terminal operators and supply chains.

Things like that would help us notice the anomalies. If more data could be shared amongst the agencies, players and stakeholders, that would be there.

The other side is that if you don't have a good security card or clearance system that's deep enough into the system, organized crime will get hold of trusted insiders or threaten people within the chain. That makes it much easier to pass through. Boxes will be missed on that sort of thing.

To me, it's increasing data and also broadening the card for more people.

With the IMO legislation or rules that they're talking about, affiliation with or belonging to organizations that are affiliated with organized crime will discredit you from being able to get a security card. That is a big shift that's coming in many other countries. It's a really important shift.

Even if you don't look at the contraband—I've raised human trafficking and drugs as additional to cars—it's just the fact that terrorism can use organized crime as a means of passing dangerous goods. It's something that has to happen.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Gray and Ms. Michaud.

Mr. MacGregor, please.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you very much, Mr. Chair.

I'd like to start my first questions with SHIELD.

Professor, in your opening statement, you mentioned artificial intelligence and touched on the fact that it's going to lead to a lot more problems in the future. Certainly, at this committee, we've touched on the subject of AI. I have spoken to stakeholders who are experts in the field, and there is a great deal of concern. We are really at the beginning stages of how this technology can be employed, but the use by malicious actors in developing a code to foment cybersecurity attacks is a very real concern.

You mentioned the Internet of things and how so many of our household devices—and, of course, vehicles—are increasingly going to be connected to the Internet. I know from my work on the agriculture committee that this is increasingly the case for a lot of our farm equipment as well, with that real-time data link so that farmers can know exactly how their machines are operating.

I'm just wondering if you could touch on that. Also, I know of AI as an offensive tool, but do you foresee also its applications in defence? Can you expand a bit more on that with this particular problem?

[Dr. Mitra Mirhassani]

Sure.

Yes, AI is currently used in both cases, on both sides, as a tool to create defence and to basically identify, for example, if you are you, through some of the very simple applications. Face recognition on your phone or some of that might have AI to basically some capacity. It's used also on the other side as an offensive to attack the other systems. It's a tool, so it basically plays both sides.

What we at SHIELD are very much concerned with is that AI is usually used as a very good tool, but as long as it's working. What if someone or a malicious actor attacks that tool and breaks it? That will create a lot more problems, essentially, so we have been advocating a lot about responsible and secure AI. With these devices and as AI is basically now going everywhere, it's left to its own devices. No one is thinking about protecting the AI unit itself to make sure that it's working appropriately or as intended.

The problem is that if you are not securing and not taking care of the AI unit that is going to be used for protecting us, if that AI centre's own activity gets attacked, then basically the consequences could be a bit more damaging than what we are seeing in some cases—