Science and Research Committee on Nov. 22nd, 2023

[Richard Cannings, NDP, South Okanagan—West Kootenay, BC]

Just to finish up here—I don't have much time—you mentioned that the PRC is by far the biggest threat, and this is why we're studying it specifically. Can you perhaps let us know what other countries are of concern? Is Russia? Who is active in this space?

[The Chair, Liberal, Lloyd Longfield]

You have about 15 seconds.

[David Vigneault]

I can add quickly that yes, Russia is, of course, of concern, It is less so in terms of sucking up all of the information the way the PRC does, but it is much more specifically a concern for technology that is right now under sanctions. They're trying to go around sanctions to get access to those technologies.

[The Chair, Liberal, Lloyd Longfield]

Great. Thank you.

It was a really good round of questions and answers, and having both of you here is really helpful for our study. This is the last hour of our study. We hope to have a report generated by our analysts, and you're really helping with that.

We'll go to Mr. Soroka for five minutes, please.

[Gerald Soroka, Conservative, Yellowhead, AB]

Thank you, Mr. Chair.

Thank you to the witnesses today for coming.

Director Vigneault, why do you think it is taking so long to get a high-risk entities list from Minister Champagne, and how critical do you view such a list for Canada's national security integrity for academic research?

[David Vigneault]

I think that Minister Champagne was here earlier in the week to explain, so I would not want to put words in his mouth. I figure the minister's testimony is on the record.

On the second part of your question, sir, I think that it is very important that we identify risks, both in terms of protecting and in terms of transparency. That's transparency with us, transparency with foreign investors who are looking to engage with us and transparency with universities that are trying to determine how they should devise their own systems to protect their own systems. Yes, it is very important.

[Gerald Soroka, Conservative, Yellowhead, AB]

Given Huawei's extremely recent patent filings in collaboration with Canadian universities in sensitive areas like 5G and AI, how does CSIS assess the risk these partnerships pose to national security in Canada?

[David Vigneault]

This is, I think, the crux of the issue here. The PRC has been very transparent in its approach. It has put in place new legislation that forces any company, any organization and any person of Chinese origin to collaborate with the intelligence service. In the case of a company like Huawei, irrespective of their intent—I will not speak about their intent at the moment—they are under an obligation, if required, to share their information.

If we go a little above and beyond this organization, I think that any kind of data they access, including every kind of personal identifying information about Canadians in different research projects like facial recognition, is of concern, because what we know both through intelligence and through open sources is that there is an organized system to take all of this data, to collate it, to apply artificial intelligence algorithms against it and to develop an advantage for the PRC that is then turned to aggressive tactics and also to the development of military technology to turn against us.

[Gerald Soroka, Conservative, Yellowhead, AB]

We're basically giving them the information to fight us with the research that we're doing, so that is very concerning.

Minister Champagne also claimed, during our last meeting, that creating non-binding guidelines is somehow better than just banning entities that pose risks to national security. Does CSIS believe that non-binding guidelines are enough to protect against high-risk entities?

[David Vigneault]

Mr. Chair, I think what is important here is the behaviour of the people.

Right now, we have seen a change in behaviour. Everybody on the granting councils and in universities wants to work together. Everybody understands the threat, and if you develop an ecosystem of compliance, I think the people who do not want to comply will become fairly evident in all of this, and we'll be able to direct our activity more specifically at these people.

I'm agnostic, from a national security point of view, as to whether they are voluntary or not.

[Gerald Soroka, Conservative, Yellowhead, AB]

I'm very concerned about the fact that universities seem to be more concerned about getting money from partnerships than national security. Do you feel this is also potentially true?

[David Vigneault]

Shawn, do you want to take this question?

[Shawn Tupper]

If I may, part of that challenge is changing the culture. There's a long history. Our universities have established partnerships for quite some time. Part of what we're doing, and part of why we have non-binding guidelines and why we've been engaging for a period of time, is to start that education process. As I said earlier, it's to make sure that people are able to make informed decisions on their own and not rely solely on the government.

I think it's an incremental approach to getting toward those areas where we say these institutions and these technologies are the most sensitive and need to be dealt with.

[Gerald Soroka, Conservative, Yellowhead, AB]

Director Vigneault, at the Five Eyes conference, you raised warnings about Beijing's actions in Canadian universities. Where, specifically, is the Liberal government falling short in countering these threats?

[David Vigneault]

Mr. Chair, thank you for the question.

I will focus my comments on a national security point of view. I would say that what we have seen is a fairly significant change in the last four or five years. It's not just from an intelligence point of view and with us sharing more, but that everybody else is realizing that the environment has changed. The threat coming at us has changed in its intensity, in its velocity and in the number of actors.

I am, on the one hand, comforted by the fact that people are taking this very seriously; on the other, I'm very nervous about the intensity of that threat.

[The Chair, Liberal, Lloyd Longfield]

Thank you.

It was a bit over, but it was important to get that thought on the table.

Thank you for the question, Mr. Soroka.

We'll go to Mr. Turnbull for five minutes, please.

[Ryan Turnbull, Liberal, Whitby, ON]

Thanks, Chair.

Thank you, Mr. Vigneault, and the whole panel here, for attending today. It's a very important conversation.

Mr. Vigneault, I appreciate the work that you do. I know you testified at the procedure and House affairs committee when we did extensive work on foreign interference. I really appreciated your and Ms. Giles' testimony there.

You mentioned an increasingly complex threat environment, which I think we can all agree is the case. Really, it is at the heart of where our concerns are coming from. I think you said the PRC is the most sophisticated actor. You've also mentioned an ecosystem approach.

I think sometimes people are looking for a very simple solution for a very complex problem and a very complex risk environment that are evolving quite quickly. This is what I've heard from you in the past. I've heard you reiterate that today.

Could you speak, Mr. Vigneault, about the importance of that ecosystem approach and why that's more effective than, say, something like a blanket ban, which is perhaps not the most effective approach?

[David Vigneault]

I think we are in a world where some of what matters—the information and the data—resides in government hands, but most of it does not. With the way the technologies are evolving and the way the research is evolving, what we need is.... Even if you were able to build a Fort Knox in one area, if you leave the back door open, it's not going to work.

From that point of view, when I talk about the more complex threat environment, we're dealing with actors that are extremely agile in understanding our system. They have access to a lot of expertise, both inside and outside the country, to understand how our system works. We see these attempts to adapt their tactics and their techniques to what we are doing.

Here's a concrete example from the not so recent past. After Parliament changed legislation, we saw some indications of some actors being able to understand how that legislation works. They were essentially finding a way to be able to accomplish their objective through bypassing the new legislation. It's a bit of a cat-and-mouse environment in which we need not just the intelligence service or the federal government to be on their toes very quickly; it requires all of the members of that ecosystem to be on their toes as well.

[Ryan Turnbull, Liberal, Whitby, ON]

I appreciate that response, because it relates to things you've also said about the importance of deepening the relationships and about the importance of behavioural change from various different actors in that ecosystem to effectively neutralize the threats or to respond effectively.

Would you agree with that?

[David Vigneault]

Yes, Mr. Chair. I would agree with that.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. Great.

When we had NSERC here, they talked about having reviewed about 2,000 applications for alliance grants. They referred 62 of them—less than 4% of those applications—to Public Safety Canada for an in-depth review. I assume that CSIS gets involved at that point. I note that 34 of those were denied, so it's a little more than half. That's an interesting statistic.

Without getting into details that you of course wouldn't be able to reveal, how does CSIS utilize intelligence and how does it collaborate with Public Safety Canada to do that review?

[Shawn Tupper]

That speaks to that whole-of-government approach.

We lead that work at Public Safety Canada. We engage with our partners. We review the applications that are referred to us. We do assessments of the technology and the issues that come to the floor. We look at the partners and we give advice back. That is based on a collaborative effort that is based on an intelligence perspective. It also looks at our economic interests and our economic security. Those things all come into play as we assess and give advice back, and in some cases, as you note, we deny the applications.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

Is there a threshold that you use for the risks when you assess?

I'm also interested in how the intelligence is used. I know, Mr. Vigneault, that in past conversations you've expressed how one piece of intelligence is not all that useful, and that it's a compilation over time that takes quite a bit of time. I know CSIS holds a lot of that information and gathers quite a bit of that intelligence. How do you utilize that, and what's the risk threshold? Those are my two questions.

[The Chair, Liberal, Lloyd Longfield]

Be very brief. You have 15 seconds.

[Shawn Tupper]

There are no specific thresholds, because we have to do individual assessments on a case-by-case basis. We have to look at the parameters, the elements, of each and every file to make that determination.