Public Safety Committee on Feb. 8th, 2024

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay, thank you.

I'd like to go to Mr. Loewen and Mr. Finley.

Mr. Finley, when asked by Mr. Shipley about the number of incidents, you said that nothing has been reported to date, but there may have been incidents reported to the cyber centre.

Can you explain to us, number one, whether you'd be aware of incidents that were reported to the cyber centre? Is that part of the situational report that you receive? I find it a bit surprising, quite frankly, that there's nothing reported to date. I'm assuming that means it's above a certain threshold of incidents. If you could clarify your remarks on that, that would be helpful, because, as Mr. Shipley mentioned, BlackBerry just testified to over five million attempted cyber-attacks in the last 90 days that it has been able to head off. It seems to me that the energy sector would be a target of these bad players.

[Christopher Finley]

Yes, certainly, I can clarify my remarks.

The energy sector is a target; there's no question. In answering the question, generally, there is no reporting requirement on cybersecurity incidents currently to the Canada Energy Regulator. What we do is work closely with regulated companies and the cyber centre, and we encourage voluntary reporting between our company and the cyber centre, and they create non-disclosure agreements.

They collect information, and they will share that information out to industries in a form that is not disclosing details of what those incidents were. That's, I guess, what this bill would do. It would strengthen that mandatory reporting and allow us to get access to that information more freely than now.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Currently, you have no access to that information. Would it be fair to say that currently there is no sharing of best practices? If there is an attempt on an energy company, the information on how to stop that attack wouldn't be available to other companies in the energy sector.

Would that be an accurate depiction of how the situation is today?

[Christopher Finley]

I think the way the situation is now, in terms of reporting to the CER, there is no mandatory cybersecurity reporting, unless it meets a definition in the onshore pipeline regulations for another type of incident, such as operation beyond design, or something more significant.

That information is reported voluntarily to the cyber centre, and again, they produce reports. It may be a question for the cyber centre. They do produce threat risk reports and they distribute them within our industry and more broadly, so that certainly companies do have information or access to it to take measures to put the right mitigation in place.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Okay. I appreciate your honesty on this. It's disturbing to me. Would that not mean, for example, that on the shutdown of the Colonial gas pipeline, which has been referenced by other witnesses, the information about how to stop that type of attack would not necessarily be available to Canadian energy companies and to the energy regulator? Or is it that we're getting information about attacks outside of Canada, but within Canada attacks are not necessarily shared in any way to ensure that energy companies, in this case, are able to bulwark themselves against a repetition of that attack?

[Christopher Finley]

I certainly think that, through the bill, it could be more structured and more formalized. Then those mechanisms would be in place to share that information officially. As you can appreciate, some of this information comes with some cautions in terms of how widely it can be shared due to confidentiality.

Again, we do have relationships, informally, with the cyber centre and with other federal departments and agencies to get that information. Through our compliance verification activities, we do look at companies' programs and systems to make sure that they are doing everything they can, that they are connected with the cyber centre and getting the latest threat and risk briefings, and that they are taking the measures they can take.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

The chair's been very generous. I just have one further question, specifically on Colonial gas.

Were you given access to the information about that attack and how to prevent an attack of that nature in the future?

[Christopher Finley]

That's a pipeline that was in the United States, so non-officially but certainly through various working relationships that we have with our staff in different departments, we've learned about that incident. However, I'm not prepared to comment on the details of that.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Finley.

Thank you, Mr. Julian.

We're moving into the second round. We have pretty good timing here.

Mr. Lloyd, you're up for five minutes.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

Thank you to the witnesses for coming.

My questions are going to focus on the Canada Energy Regulator.

I think there's been a little bit of confusion with this bill. Some people who are watching this might believe that if we don't pass this bill or if it gets delayed, companies won't be spending on cybersecurity. However, it's pretty clear that companies are spending a lot on cybersecurity. For example, a major integrated oil company, Cenovus, has announced in its 2024 budget that it's spending over $100 million on cybersecurity. It certainly seems that many companies across many sectors are taking this issue very seriously.

However, we just had witnesses in the last panel—I believe from Electricity Canada—who were concerned about this bill because they believe that it might not necessarily lead to a massive increase in spending on incident reporting and incident prevention but will massively increase the amount of money that companies have to spend just to comply with the legislation.

I'm wondering if you can comment. Do you foresee, under this legislation, the compliance costs for companies increasing significantly?

[Chris Loewen]

As I mentioned in the opening remarks, the proposed legislation is very well aligned with what we already have in place. At the CER, we already have a robust regulatory framework that involves inspection officers, inspection officer orders, the issuing of non-compliances, the use of administrative monetary penalties, and the conduct of inspections. Companies are already well familiar with the need to have cybersecurity programs in place in order to detect and prevent the threats.

In terms of the overall impact on the CER-regulated industry in terms of cost, I think that some of that detail needs to be determined through the development of regulations, which have not yet been developed or proposed. With regard to the other part of it, I would point to the fact that what the bill is proposing is, in large part, a formalization of the powers and the oversight framework that we have in place, but extending it further so that it formalizes, as Mr. Finley noted earlier, the reporting relationships, the information gathering and the sharing of that on the government side.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

If I'm clear from what you're saying, at least for CER-regulated industries, many of the practices for cybersecurity that are in this bill are already in practice. Just to summarize what you said, this bill is really just formalizing something that already exists. I think it wouldn't be a stretch to say that across a number of other sectors, including the CRTC, these practices, and in some cases regulations, already exist to ensure cybersecurity.

I'm concerned that the government is looking at formalizing this and also increasing its powers, when Canadians should be somewhat assured that, at least in your industry, there already is significant spending by the private sector on this.

Electricity Canada also said that there was a concern that this new, formalized legislation could create a chilling effect. Rather than having a very good relationship between, for example, yourself and the designated operators underneath you, where you have a very open dialogue about cybersecurity and what needs to be done, there could be a chilling effect where lawyers are advising companies to give the government only the information that's necessary under the act.

Can you comment on that chilling effect? Do you agree with Electricity Canada that there's a bit of a threat that this chilling effect could occur?

[Chris Loewen]

Thanks again for the follow-up.

To clarify, what we see already with respect to our relationships with industry is a patchwork of voluntary interrelationships with respect to reporting, usage and gathering of information.

When I use the word “formalize”, I'm saying that this is a beneficial aspect of this bill. I think industry is well prepared to implement the aspects of the bill associated with that. It will strengthen our ability as a government to prevent cyber-threats and assist our regulated industry to detect and mitigate any potential cyber-threats in the future.

With respect to the comments of Electricity Canada and the chilling effect, our experience with respect to the pipeline industry and threats to the environment, safety and other areas has been that clarity around reporting—which I expect would be something that will be developed in the regulations—not so much sets a floor, but helps with the expectations around that.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Loewen. Your time is up.

Mr. McKinnon, go ahead, please.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Thank you, Chair.

My questions are for the energy regulator.

You mentioned reporting requirements and so forth, and good data. This intersects with information we heard from previous witnesses around the need for consistent and concise definitions, so that the data can be captured across the different industries and in different situations and have meaning.

Would you have comments on that?

[Chris Loewen]

I think that any time you can bring consistency and clarity to a sector, it's a benefit and it's a benefit for everyone.

At the CER, we have a long history of implementing our regulatory framework with respect to the onshore pipeline regulations and other regulations. The usage of things to help with the clarity around reporting requirements, such as event reporting guidelines and other directives and guidance materials, is welcomed by industry and helps them understand the expectations of the regulator. I think that, overall, it strengthens the protections in an industry. I do see that as an aspect of the particular requirements in this bill.

The regulations, as I noted earlier, are still to be developed. Should the bill pass, I'm looking forward to working with the lead departments and agencies on this bill to provide advice.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Do you feel that these definitions are best dealt with in regulation, or should they be incorporated into the bill itself?

[Chris Loewen]

Not being the lead on the development of this, I would prefer to say that regulations are an area that provides some flexibility in terms of development going forward and any amendments that might be required in the future, rather than having to amend legislation.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

There was also discussion earlier about the United States undertaking an effort to provide a consistent set of definitions across their various 52-some regimes.

Is that something that would benefit us? Is it something that we are, perhaps, participating in, in any way?

[Chris Loewen]

I don't know if I can speak to the specific situation that you're describing, but what I would suggest is that the coordination and co-operation that we have with our counterparts in the United States, such as the Pipeline and Hazardous Materials Safety Administration, which regulates pipelines, have been very good.

Consistency of definitions is definitely something that is welcomed by industry. Consistency and a coherent regulatory framework are, I would say, a welcome development when a network can be put in place.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

When we talk about cyber-incidents, it seems very generic, very abstract. I wonder if you can give us some clarity on the kinds of incidents we're dealing with. What sorts of attacks are we looking at? Who are the bad actors here? Is it some hacker in his mom's basement or is it international? Could you give us some insight on that?

[Chris Loewen]

I'll say a few words, and then I'll turn it over to my colleague, Mr. Finley, to colour that in a little bit.

It ranges. It goes from the person in the basement to a nation-state actor.

I think earlier, when we were discussing incidents and reporting, one of the distinctions that the CER drew was the difference between an attack on an information technology network—that is the network that provides your email and stores your documents and passwords—and then the operational technology network, which is the systems that are used to operate pipeline valves and other systems. To date, there has been no successful attack that we're aware of in Canada in the CER's regulated industry on an operational network. Within your information technology networks—the ones with passwords, etc.—yes, those have happened quite frequently.

Mr. Finley, did you want to colour that in a little bit?

[Christopher Finley]

Yes, as my colleague mentioned, the majority of attacks are on IT networks; they're ransomware, typically by cybercriminals and nation-states. We don't have all of that information at our fingertips, but that is the kind of information that we work closely on with the Canadian Centre for Cyber Security, which does collect that information.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Finley.

Mr. McKinnon, thank you so much.

We'll go to Mr. Julian, please, for two and a half minutes.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thanks very much, Mr. Chair.

Ms. Wright, at the CRTC, do you track in any way incidents of cybersecurity breaches among telecommunications companies and other companies that are under your jurisdiction?