Public Safety Committee on Feb. 15th, 2024

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Thank you for your trust. I'm grateful for it.

I have two points to make.

First, this matter is subject to judicial review. We talked about this, and Minister LeBlanc referred to this earlier. I don't want to play lawyer before the committee. However, as you know, in the case of a judicial review, the measures taken must be proportionate.

Second, in terms of national security, some of these orders must be secret for a reason. I'll provide an example, and you'll immediately understand the issue. If we find a flaw in a system, obviously we don't want state and non‑state actors to take advantage of the flaw before we can fix it. That's what we would be risking if we were to release all our orders.

Think about a cyber attack. In the case of 5G technology in particular, it will be decentralized. The weakest link in the chain could be attacked. In keeping with the interests of the company, the organization and Canadians, we should have the opportunity to issue a secret and confidential order in this type of situation, saying what must be repaired.

As we said, there will be feedback. We can report on the situation. The issue is that, in our democracies, state and non‑state actors who want to harm the country don't play by our rules. If I release information stating that the weakest link in our system is found in a given telecommunications system or service, I'm practically summoning the bad people before we've had time to repair the breach in our system.

I think that this would put the whole network at risk. That's why, in some cases, we must keep this information secret and confidential to protect national security.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Now we're moving on to Mr. Julian, please.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

I want to thank the ministers for joining us. They're always welcome here.

We would be delighted to see you more often in the committee, Mr. LeBlanc.

[Dominic LeBlanc, Liberal, Beauséjour, NB]

Not as often as I would like, Mr. Julian.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

As you said earlier, this is an issue of national importance. We know that the number of cyber attacks keeps increasing.

The government tabled this bill in June 2022. We're still studying it. Everything is happening slowly. It's 2024, and the bill hasn't been passed.

Why doesn't the government seem to consider this a priority when we know it's a major issue?

[Dominic LeBlanc, Liberal, Beauséjour, NB]

Mr. Chair, I would like to thank my friend and colleague Mr. Julian for his question.

I admit that things haven't moved forward as quickly as we would have liked.

Mr. Julian, you're a House leader. You know that the parliamentary process can often be slowed down by other issues at certain times. This isn't an excuse at all. I agree that we would certainly have liked to see the bill passed before 2024. I don't disagree with you.

We're ready to do whatever we can. This includes working with this committee on amendments and making sure that all our departments' resources are available to help you move forward if the committee decides to proceed.

I accept this criticism in good faith. I acknowledge the urgency, and we'll do our best. I don't need to remind you that I've been the Minister of Public Safety only since July. You and I worked together over the summer. You know all about this.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you.

I'll move on to another question.

We've heard testimony. Mr. John de Boer from BlackBerry testified that, from September to December of last year, there were over 5.2 million cyber-attacks, and 62% of them targeted critical infrastructure. We heard from the Canadian Bankers Association that the number of priority one cyber-attacks has tripled over the course of the past year.

Is the government—Public Safety and Industry—tracking the number of cyber-attacks across all sectors? Do you have that information available? To this date, we haven't been able to consolidate the number of attacks by sector. In fact, in many cases, we've been told by witnesses that they simply don't gather those figures.

[Dominic LeBlanc, Liberal, Beauséjour, NB]

Thank you for identifying what we think is one of the positive elements of this legislation, the obligation to report. We take the good faith of many of these important private entities in working with the Government of Canada, but it probably isn't at the level that it needs to be. That's why the positive obligation to report would ensure that we have reliable and accurate data on the alarming increase that you identified.

The Communications Security Establishment as I mentioned at the beginning, would be the federal agency that would be in a position to gather this data and share it across the government. The briefing's I've had from Public Safety and from the director of CSIS and others confirmed that alarming trend.

Patrick, you may have details on what we or the CSE are tracking. Could you briefly provide Mr. Julian with that information?

[Patrick Boucher, Senior Assistant Deputy Minister, National Cyber Security Branch, Department of Public Safety and Emergency Preparedness]

To add what Minister LeBlanc said, currently, all reporting is done on a voluntary basis, and that's great when it happens, but obviously there are gaps in that. Part of this legislation as a foundational piece, as Minister LeBlanc said, is to make sure we regularize that reporting so CSE can take that information in, utilize the expertise that resides at CSE and propagate that out to build resilience in other sectors as well.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, but that actually wasn't my question. I certainly understand how Bill C-26 attempts to correct that problem. What I'm asking is what the figures are now? Do you have figures you can share with us, even if they've been reported on a voluntary basis, that indicate the extent and scope of cyber-attacks in Canada?

[Patrick Boucher]

We can definitely go back to talk to our partners at CSE, which is under the portfolio of DND, to see if there's some readily available information related to that.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

That would be very helpful for the committee to have.

[Dominic LeBlanc, Liberal, Beauséjour, NB]

I'm happy to ensure we get that information as quickly as possible to share it with the committee.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you very much.

Mr. LeBlanc, one of your other portfolios is foreign interference in our election process. We've been talking about the Communications Security Establishment. They flagged late last year that Russia's, China's— and I think we can add to that allegations of India's—cyber-threat activity includes “attempts to conduct...attacks against election authority websites, accessing voter personal information or information relating to the election, and vulnerability scanning on online election systems.”

We've seen foreign interference have a dramatic impact in the United States in the election of Donald Trump and in the United Kingdom in the Brexit referendum. In what way would Bill C-26 reinforce our election system, our democracy, to protect against those cyber-attacks that have had such a marked influence in other democracies?

[Dominic LeBlanc, Liberal, Beauséjour, NB]

I certainly share your concern. I think you are absolutely right about the risk. This is, as I noted, a U.S. election year, so those same actors who we understand had some success in 2016 will be at it again this year. This is a subject for another committee, but Canada Elections Act amendments may come in the coming weeks. The fact that we have a paper ballot system is, the Chief Electoral Officer says, one of the best ways to secure our voting system.

In my conversations with the Chief Electoral Officer, we're obviously governed by his advice and his recommendations. I think where this legislation might bump up into the important job of securing election systems is, for example, if the Canada Elections Act were to allow people to apply online for a mail-in ballot—I'm just using one example off the top of my head—where those requests would go across the telecommunications channels people have, the private businesses my colleague referred to. That is not an Elections Canada system per se, but it's vital for people having access to democracy. So if we're working on making voting more accessible in 2024, 2025, it will necessarily involve the Internet, it will necessarily involve telecommunications systems.

The voting process per se is a paper ballot, but Elections Canada is very concerned about this. We've invested in this and we've allowed the Communications Security Establishment to work with Elections Canada to strengthen their systems. As my colleague would know, we've had Government of Canada officials be available to political parties to help them secure their systems. It is a source of concern we share and we're prepared to do everything we can in that regard.

[The Chair, Liberal, Heath MacDonald]

Thank you so much.

We're moving on to the second round.

Mr. Lloyd, please, for five minutes.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you, Mr. Chair.

Thank you to the witnesses for coming today.

Ministers, building resiliency for natural disasters, building resilience against cybersecurity threats, these are things I think all Canadians and all parties can get behind. We know there needs to be increased investment in cybersecurity and resiliency, but something both ministers said today gave me some pause, when they referred to this bill as giving the government, in their words, “emergency powers” and “extraordinary powers”. I think it's very concerning to Canadians who want to know why the government needs “emergency powers” and “extraordinary powers” when we're really talking about trying to boost resiliency against natural disasters and trying to get companies to invest more in cybersecurity. Why does the government require legislation that gives them the power to conduct courts in secret, to announce legislation or block people from being part of the telecommunications sector in secret? Why are these emergency powers needed when what we need to do is get more investment in cybersecurity?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'll be happy to respond to that.

First, thank you for saying this is not a partisan issue. I think, like you said, we're all trying to do the best thing.

I'll give you a very concrete example. In 5G, I think everyone would agree that this is going to be very decentralized. When you go from 4G to 5G, it's a different world. We're not in the same kind of network. The future will be that you have intelligent products, so that everything is interconnected. If we were to find that there is a failure or an intrusion in the network that could have a systemic effect, you would want the Minister of Industry in the future to be able to say, “You, stop,” or we disconnect that particular person or entity that is the source of the infection of the entire network that could have a systemic effect. The kind of power you need, you need to act very quickly, because you're talking about—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Why do you need secret courts, Minister?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'll tell you. It's very simple, because you would not want the actors, the ones who are trying to infiltrate our system, to be aware that you're asking them to plug the gap—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

What safeguards are you going to put in to ensure that this power is not abused? We've had lots of witnesses talk about how concerned they are about these powers, and you've called them “emergency powers.” It's very concerning.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

People should be equally concerned that today—imagine—the Minister of Industry doesn't have the power to ask that particular entity to plug, for example, the failure in their system that could have a systemic effect that could affect millions of Canadians. The check and balance on that, I would say, as a lawyer, is you have judicial review, and under judicial review you have proportionality and the Charter of Rights and Freedoms. All of these bills and legislation still apply.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

The Privacy Commissioner has stated that there isn't proportionality in this bill. What can we do to bring more proportionality to this bill?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I would say that under judicial review, as you know, it's well established in jurisprudence that you need to have proportionality in terms of the act of the government, but I think you should see it in a positive way. Imagine the reverse of not having the power, and you come to know that somewhere in the network someone is infiltrating, which could have a systemic effect and be damaging both economically and otherwise to millions of Canadians. Think about the reverse.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you for that, Minister.

Minister LeBlanc, Canada has faced over the past few years a significant issue, in that nearly 100 churches have been burned down or attacked in this country, most recently, the Blessed Sacrament Church in Regina. Leading up to Christmas there were four churches in Alberta that were burned down. We haven't heard anything from you, in your role as public safety minister, to denounce these attacks. I just want to give you an opportunity today to assure the Canadian people, the Christian community and other communities of faith that you denounce these attacks against churches in Canada.