Transport Committee on March 24th, 2022

[Dr. John de Boer]

Last year's budget, budget 2021, allocated $791 million Canadian to cybersecurity. That was somewhat of an increase from budget 2019. On a per capita basis, as I mentioned earlier, Canada spends $20 on cybersecurity. When you compare that to what the U.K. spends on cybersecurity, which is $52 Canadian, and the U.S. spends $34 and France spends $37, we are well behind.

In terms of whether we are spending enough, the short answer is no. The Canadian business sector spent $7 billion on cybersecurity last year. That's clearly also not enough, because the Insurance Bureau of Canada indicates that 47% of our small and medium-sized businesses spent zero dollars on cybersecurity last year. So there is much room for growth.

We need to catch up to our allies in order to boost our defences. Part of that is mandating it. Part of that is for the government to fill, perhaps, a market failure, which is that cybersecurity is looked to as a cost centre and not prioritized. This needs to be prioritized at the highest level.

[Melissa Lantsman, Conservative, Thornhill, ON]

I'm cognizant of the fact that you mentioned in your opening statement that, I think 186% was the number you used, in terms of increased incidents over a year. I think I mentioned that earlier in this committee. Given that number and given what you know, I'm a little perplexed by the fact that our last round of officials didn't have any kind of assessment on critical transportation. I'm wondering if that's a gap that we have.

What is your risk assessment of a foreign threat, in the case of this study, by Russia? What is your assessment of the threat it poses to critical transportation infrastructure at the present moment?

We heard a lot about financial institutions. We heard a little bit about our critical infrastructure when it comes to oil. In terms of transportation, is there any way of knowing, if we've never studied it and we have no assessment?

[Dr. John de Boer]

I would rely on some of the assessments that have come out of the U.S. government. The U.S. government has publicly indicated that this threat is real and persistent. President Biden issued a strategy, a maritime cybersecurity strategy, last year, which documented significant gaps in the port system, as well as in ship systems. Many of these systems, whether it be ships, trains or planes, are built to last 30 years. What that means is that they contain legacy systems, outdated IT systems that have not been patched. The vulnerability is vast; it's deep, and the threat is persistent and real.

The U.S. Justice Department in October 2020 charged six Russian intelligence officers affiliated with the NotPetya malware attack that crippled the shipping giant Maersk and also attacked TNT—now FedEx.

There is evidence out there that some of these attacks, some of the largest, most impactful attacks, are state-based.

[Melissa Lantsman, Conservative, Thornhill, ON]

Thank you, Dr. de Boer.

[The Chair, Liberal, Peter Schiefke]

Thank you very much, Dr. de Boer.

Thank you, Ms. Lantsman.

Next we have Mr. Rogers.

Mr. Rogers, the floors is yours. You have six minutes.

[Churence Rogers, Liberal, Bonavista—Burin—Trinity, NL]

Thank you, Mr. Chair.

Welcome to our guest.

Mr. de Boer, it's mind-boggling when you talk about all this cybersecurity. Just this past year in Newfoundland and Labrador we had a major attack on the health care system, which was crippled for a number of days. It created all kinds of problems for the health care system in the province. Some serious gaps occurred. Medical records went missing, and there were all kinds of problems that the health care professionals had to deal with. It took a considerable amount of effort and time on behalf of the provincial and federal people to resolve many of the issues. It was such a serious event that the premier and people in Ottawa wouldn't even talk about it publicly for security reasons.

I'm not sure even now if it's totally resolved, although it seems to be, and there's not much discussion in the public realm anymore.

In your view, how could this be prevented in the future? What's done is done, but in the future, how could this be prevented, or can it be prevented from happening again?

[Dr. John de Boer]

It's a great question, and the answer is, yes, it can be prevented.

We have technologies out there in the market today that are prevention-first technologies. Essentially, they leverage AI and machine learning to predict and prevent attacks before they are executed. We have moved beyond traditional technology, which basically adopted what is called a signature-based approach, similar to how we dealt with a COVID-19 vaccine. You need a patient zero, and then you model it and trace it, but now we've moved ahead of that. We have technology that, if put in place, can prevent that.

Second, mandatory cyber incident reporting for critical infrastructure will automatically create an incentive—or a stick, if you will—for entities to put in place better defences. They don't want to have to report their cyber incidences, but if they do, and if it's time-bound, at least we can move quickly to contain it.

Another key vulnerability that can be addressed, and it's being done in the U.S., is actually to get developers of software that's embedded in critical infrastructure and government systems to produce what we call a software bill of materials or an ingredients list that will list all of the components that are in that software so that they can quickly determine the provenance or origin of that software, where it comes from, identify whether vulnerabilities exist and be able to remedy them.

The reality right now is that people who buy software have no idea what's in it. There's no way to verify whether or not that software was built using cybersecurity practices.

[Churence Rogers, Liberal, Bonavista—Burin—Trinity, NL]

I'm not sure you can answer this in the time I have left, but I have a follow-up question.

I get the impression from your comments that you took a lot of examples and illustrations from what the U.S. is doing and what they plan to do moving forward. How would you characterize Canada's preparedness to deal with issues of cyber-attacks on our transportation networks? Which ones would be the most susceptible to attack? Would it be airlines, marine or rail service traffic? How do we better protect against these cyber-attacks?

[Dr. John de Boer]

All of them, unfortunately, are susceptible. All of them contain legacy IT systems that are not protected and have open-source software that could contain back doors. They depend on supply chains where they are trusting those suppliers, those vendors to implement secure practices, but they perhaps do not verify them.

All of them are susceptible. That's why we need to move quickly to get these critical infrastructure operators, transit operators, to take action to report cyber incidents, to develop cyber incident response plans and to undergo cybersecurity vulnerability assessments. Finally, it's not just about having a plan on paper. We need to verify that they put that in place.

[Churence Rogers, Liberal, Bonavista—Burin—Trinity, NL]

When I listen to all of the advice you're giving us—and Ms. Lantsman mentioned this as well—it sounds like we have to spend much more money in order to be properly prepared. Is that an accurate assessment?

[Dr. John de Boer]

BlackBerry, together with the Canadian Chamber of Commerce and its members, has put forward a budget submission. We are calling on the government to double its investment in cybersecurity. That would bring us up to what our peers in the G7 are spending on cybersecurity. So, yes, we need to spend more, and we need to spend it smartly. There are also initiatives that won't cost money that we can do right now, as I mentioned, in terms of cyber incident reporting.

The final thing I'll mention very quickly is that we need leadership at the top. Describing that cybersecurity is a priority. President Biden is out there almost daily talking about cybersecurity. We need to take that type of leadership as well.

[The Chair, Liberal, Peter Schiefke]

Thank you very much, Dr. de Boer, and thank you, Mr. Rogers.

[Churence Rogers, Liberal, Bonavista—Burin—Trinity, NL]

Thank you very much.

[The Chair, Liberal, Peter Schiefke]

The next speaker is Mr. Lemire.

Mr. Lemire, I welcome you to the committee. You have the floor for six minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

I would also like to thank the entire technical team.

Mr. de Boer, in 2021, the Government of Canada chose BlackBerry for its needs in terms of secure productivity and communication as well as critical event management. As this statement leaves a lot of room for interpretation, I would like to know your views on this matter.

What exactly is the nature of the cybersecurity services that BlackBerry provides to the federal government?

[Dr. John de Boer]

Mr. Chair, BlackBerry provides a range of services from our unified end point protection and unified end point management services, which protect mobile devices. We also provide secure communications to the Government of Canada, which are certified by the Canadian cybersecurity entity CSE as well. It's primarily oriented to secure communications and unified end point management, which, again, is about secure mobile technology.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

According to a report published in 2017 by the Communications Security Establishment, the federal government alone is subject, every year, to more than 2,500 computer intrusion attempts by foreign state actors.

Mr. de Boer, can you tell us approximately how many cyber-attacks the federal government has been targeted with since it began collaborating with BlackBerry in 2021?

[Dr. John de Boer]

It's hard to say. I don't have the precise numbers on the government. Again, our remit is focused largely on secure communications and on mobile technologies. We don't monitor the overall security posture of the Government of Canada.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

If you can't give us numbers, can you talk about the nature of the attacks? Since the beginning of your mandate with the federal government, have you felt that the seriousness of cyber-attacks targeting Canadian institutions has been increasing?

[Dr. John de Boer]

I don't have visibility personally on that type of information, on the seriousness of those attacks. I can only comment on what's been in the news and what I've seen on a personal basis. I'm afraid I'm not able to provide you with a precise answer to that question.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In your speech, you talked, on the one hand, about the security of devices and the risks that anyone could be subject to cyber-attacks. On the other hand, you talked about the legal obligation of companies to report cyber-attacks on critical infrastructure.

As a contributor, would you be able to give us any information on that? If you provide a system, you have access to it. Are you in a position to help the government receive this data so that it is more transparent?

[Dr. John de Boer]

BlackBerry regularly collaborates with the Government of Canada, the Canadian Centre for Cyber Security and others, whether it be related to vulnerability disclosures or other threat assessments.

One thing I would like to offer, though, is that a lot of the emphasis has been on information sharing. I think there's room to emulate what the United States has done again here, which is collaborative planning. This is a preventative approach to dealing with upcoming potential events. That's what I would emphasize.

It would be much more robust public and private sector collaboration with the government, where there is two-way communication and we are engaged in collaborative planning for potential events that may come our way.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

I think you can see that—

[The Chair, Liberal, Peter Schiefke]

Unfortunately, Mr. Lemire, I can see the lights indicating that there is a vote in the House.

Do I have the consent of the committee to continue, or are there those who see fit for us to adjourn?

Mr. Clerk, how long are the bells? Do you know?

[The Clerk of the Committee, Mr. Michael MacPherson]

They're 30 minute bells.