Public Safety Committee on June 7th, 2022

[Juliette Kayyem]

I don't even want to pretend to know what the strategy is, but now, unfortunately, we—being the Ukrainians with the support from both of our countries—are likely to be in some long slog that is less transparent because it's not in the major cities. The media, the U.S., Canadians, we will all get less interested in it.

In terms of vulnerabilities, we may get back to an era when there was no disciplining impact, and ransomware and other actors were able to run freely, utilizing Russia and its capabilities. It may look less state-sponsored, but it is state-sponsored.

[The Chair, Liberal, Jim Carr]

Thank you very much.

Ms. Michaud, I now turn to you for a six-minute block of questions whenever you're ready.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Thank you to the witnesses for being here today. We certainly appreciate it.

I'm going to turn to Ms. Kayyem.

I want to read something that appeared in the Washington Examiner about your book, The Devil Never Sleeps. Here's what the article said:

[It] emphasizes that government and private-sector leaders should no longer focus all their attention and resources on disaster prevention.

Instead, they must learn how to plan accordingly and use all available tools to minimize the negative consequences when disaster does arrive.

You say that we should have anticipated Russia's invasion of Ukraine, and that we should have considered what would happen and how we would respond. You talk about focusing less on prevention.

I'd like you to talk more about that. We've heard from a number of experts who said that Canada was not adequately prepared to deal with threats or cyber threats, as compared with other Five Eyes countries, for instance.

How, then, should Canada have prepared, or be prepared going forward, for possible threats to its critical infrastructure from giants like Russia?

[Juliette Kayyem]

Thank you for that question.

In some ways, the limitations that exist before a war, such as your capacity or your access to intelligence, will exist even during it. Thank you for the mention of the book. I will say that I've spent 25 years in what we call “all hazards”. Essentially, I'm not looking solely at cybersecurity. I'm looking at the vulnerabilities that nations like yours and mine have. I've been working a lot on the notion of a North American regional response capacity in cyber and climate change, because the kinds of attacks that we're seeing now and the kinds of vulnerabilities that we're seeing now are going to take a combined U.S.-Mexican-Canadian focus, just given our capacity.

That we need to focus our sense of success on whether we can respond and minimize the harm is particularly true in this space. Something that I would urge you to push on the private sector, which has essentially.... This is probably a little crude, but they have essentially focused almost all of their security efforts on “left of boom”. In other words, if we can stop the breach, we'll try to stop bad things from happening and stay, as I like to put it, on the left side of boom. One thing that can be pushed is to ask what their response planning is, what sort of tabletops, if they have a cyber-attack.

The most important thing I'm going to leave you with is this. The bifurcation of cybersecurity and physical security, which has happened in your country and my country, has to be remedied somehow. As we see in all of these attacks, there's really no such thing as a cyber-attack any more. It is a cyber and physical attack. What's happened in a lot of these companies, as I know you're aware of and what's happened even in some of our government institutions, is that both the cybersecurity apparatus and the physical security apparatus—the traditional gates, guns and guards, as we call it—have been built. There are not a lot of synergies between them if there is in fact a cyber-attack, and I think we have to really push that on the private sector.

There will always be physical consequences. These are rarely just issues about privacy or private information or reputation anymore. The adversary wants there to be disruptions and, worse, even destructions.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Chair, I'm going to use my remaining time to ask Professor Barker a quick question, seeing as he's the expert on computers and data repositories that safeguard confidentiality.

In May 2022, the University of Ottawa released the following publication:

How Canada can adapt to a deteriorating security environment, a report by the task force on national security of the graduate school of public and international affairs.

In it, the authors urge the government to create a government-wide, top-secret cloud, as many of our allies have done in various forms. This cloud would include vast amounts of data stored by every department and agency, providing a concrete way of protecting the data in the event of an attack.

What do you think of the idea of creating a top-secret cloud to store confidential government information? Would that be a good way to protect against cyber-attacks?

[Dr. Ken Barker]

I would first challenge the question a little bit. I don't know what a “top secret” cloud is. If a cloud is a shared resource that people have access to for lots of good reasons, then in order to make that top secret you have to do it with access control. Access control is basically just a system where your top secret data is stored and you limit the access to it in some way.

[The Chair, Liberal, Jim Carr]

You have 10 seconds, please.

[Dr. Ken Barker]

Thus, I don't actually think.... The vocabulary is maybe populist, but it's not the right vocabulary.

[The Chair, Liberal, Jim Carr]

Thank you very much.

Mr. MacGregor, it's over to you for a six-minute slot. The floor is yours.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you, Mr. Chair.

Professor Kayyem, I'd like to start with you. I wish we'd had you here before our last meeting, because our previous meeting was with the emergency preparedness minister, Bill Blair. The committee had the opportunity to question him on his role. As you're aware, the Department of Public Safety and Emergency Preparedness was split. We now have two ministers responsible for those two respective areas.

With regard to a lot of what you've been talking about, when I look at the minister's mandate letter for emergency preparedness.... You can read it there online. Our committee ultimately wants to table a report with specific recommendations.

Looking at what our Minister of Emergency Preparedness is responsible for, is there anything you would like to see in that report for the minister to specifically focus on?

[Juliette Kayyem]

There are two areas that I would focus on, given my understanding, which is not as deep as yours.

The first is the cross-border emergency management capacity. If there is a cyber-attack in Detroit, say, in the auto industry, in the OEMs, what capacity, what communications and what structures are in place that are going to essentially treat it as a borderless response? Because it has to be. It's going to impact both countries. It's going to impact, as we've seen with some of the protests recently, border crossings and our capacity to move across the border. Primarily, that would be one.

There's the other thing in terms of what the mandate should be for the emergency manager, because I agree with you. I think the distinction between public safety and emergency management can be hard at times. I said one requirement, but there are two requirements. What is the minister requiring in terms of what we call, in my space, “all hazards” response? In other words, you can't focus just on what the cyber-response is going to be. It's going to have all sorts of impacts. The same is true of climate and the same is true of a terror attack. The consequences are going to be generally the same.

I sometimes think—and I know you certainly do—that in the way the government is structured, and in the way the ministries are structured, we put information security off to the side in protecting our networks. I would just get much more forceful in terms of what reviews are being conducted, what capacity there is, what the consequences would be physically of a cyber-attack on major industry and then what we are doing to close that gap between information security and physical security.

I will tell you that I now advise a lot of companies to not have chief information security officers, chief security officers, and to just have chief preparedness officers, because it's too hard to figure out what the risk might be.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you.

Mr. Shipley, I'd like to turn to you.

Can we make any recommendations? What kinds of investments are there in the field of deterrence? Can we make people who are potentially considering a cyber-attack, whatever form that may be...? Are there good defensive options? I'm just thinking of the old adage that the best defence is a good offence. Is that kind of capability being developed?

[David Shipley]

I don't have specific insight into what CSE's operations are. We do know that legislative powers were granted and the ability to conduct operations has now begun—

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Does this exist in the private sector, then, that you are aware of?

[David Shipley]

We absolutely do not want the private sector shooting back, because, first of of all, attribution is really hard. I ran cybersecurity for a university. We got hacked all the time and were used as a platform to attack government entities, private sector entities, etc. If someone started shooting back at my university because from their perspective we were the originating source, they would be hitting the end target. It's a fun little shell game.

Attribution is really hard. The private sector absolutely should not be shooting back. That should be a sole responsibility of the federal government, and it should be exercised. I think the challenge from a policy standpoint is, what's policing and what's military? We need better clarity on that, and we do need to flex. It's important that government actually speak forcefully about this.

We saw this with the Biden administration after critical infrastructure attacks in the United States. It was straight from the top: Don't mess with us. Who is the minister that actually is going to respond here in Canada?

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

You mentioned the mandatory incident reporting. We have seen problems through other studies that we've conducted. Whether it's on ideologically motivated violent extremism or it's a firearms study, when you don't have the appropriate range of data, you make poor decisions at the top. If you want to expand on that, how important is it that we have a full picture of the range of threats coming at us and can deploy our resources appropriately?

[David Shipley]

My greatest concern right now is the threat to Canada's health care sector. Obviously, we're still in the pandemic. We're still recovering. When a hospital goes down, it goes down for weeks. Cancer patients don't get timely care, other surgeries are delayed, etc. We don't have good information sharing in this country. We've had multiple hits. We had an entire provincial system hit badly, and we don't have those lessons shared out.

[The Chair, Liberal, Jim Carr]

You have 10 seconds, please.

[David Shipley]

Imagine if we had airplane crashes and we didn't investigate them or share the lessons learned. Well, you're going to get more airplane crashes.

[Alistair MacGregor, NDP, Cowichan—Malahat—Langford, BC]

Thank you for that.

[The Chair, Liberal, Jim Carr]

Thank you very much.

Colleagues, we now move into a second round of questions.

To lead off, I'll call on Mr. Lloyd for a five-minute block.

Sir, the floor is yours.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

My question is going to be to Mr. Shipley specifically on Russian disinformation. I get concerned that sometimes we have partisan blinders on in this committee. This is not just a far-right phenomenon.

Would you agree that the Russians will and have exploited actors across the whole political spectrum to advance their agenda?

[David Shipley]

We've seen evidence of that from the United States and others. The objective can be to simply put each other at each other's throats. Whether left or right, they don't care. As long as we don't trust each other, don't communicate, can't politic and our democracy looks like it doesn't work, then their system looks legitimate and their aims are achieved. It's about paralyzing us.

Now, what frightens me is that there's some evidence that some of the trucker groups in Canada were being influenced by content farms that just wanted to sell crappy T-shirts and hats. Our democracy is being torn apart so someone can sell anti-prime ministerial T-shirts.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

One really compelling case that we saw on the eve of Moscow's invasion of Ukraine was members of Parliament from the left of centre saying that Canada should not support Ukraine because it is a fascist state. That was being said. That is parroting Russian propaganda, and it was all the way into Canada's Parliament.

Would you agree that this was a significant case of disinformation?

[David Shipley]

I'm not familiar with the specific instances of that. However, based on what you're saying, I'll add that we've had warnings from our intelligence agencies talking about influence operations against MPs of all stripes, from various nationalities that have interests, whether it's Russia, China, etc. This is part of the game, and this is what they do, whether to score points, to try to keep us disengaged in this conflict or whatever the national aim, that's part of it. It's part of the importance of educating MPs and politicians about protecting themselves.

One thing that concerns me is how protected our political parties are in general from cyber-operations, influence operations. The hack of the Democratic National Committee in the States lays bare that what happens when a party isn't secure can have dramatic impacts on a country's course.