Public Safety committee  I think that investigators at the RCMP, or perhaps at the Sûreté du Quebec, for example, might be in a better position to answer about the investigation phase. One of the risks we see is that the dark web is certainly facilitating cybercriminals and cybercrime tools. There is an entire ecosystem out there where you can go on and say, “I want a tool that's going to allow me to do this.”

Public Safety committee  Let say there are a few areas where we would say that we have to be very careful about the increased risks. One thing is that with so many of us working from home, the fact is that it has changed our technology environment. We're mostly working outside of our organization's perimeter, so in terms of a lot of the defences we relied upon, many Canadians are now working from home and connecting directly to the Internet.

Public Safety committee  That's a very profound question. In terms of the allocation of risk, I think the banking example is an excellent one. Not only do they have cybersecurity elements, but they also do have a substantial amount of anti-fraud, so if they see something that's out of character, it tends to trigger their fraud controls.

Public Safety committee  Thank you for that question, which I think really does go to the root of some of the things we talked about in the national cyber-threat assessment. The amount of personal data that's out there on us now is quite extensive. One thing that's been noted is that in any cyber-attack, not only do they have things like your usernames and passwords that they've stolen from other places; in many cases, they also have the answers to your security questions—your mother's maiden name, your first pet, what school you went to and things like that.

Public Safety committee  I think one of the areas where we have been doing significant outreach, and that we've been doing with our colleagues at the Canadian Security Intelligence Service, is really to help to inform universities of the threats they are facing, as well as give them some practical advice.

Public Safety committee  I wish I had an answer to that question. I don't know. The way our mandate is structured, one of the things we don't do is collect information within Canada. We rely on statistics, like from Statistics Canada or anything that is published by other organizations. I haven't seen a figure that monetizes the loss to Canadian institutions, both short and long term.

Public Safety committee  I'm not an expert. That question's probably best for some of the areas where they're used to these university partnerships. When we've been meeting with some of the organizations, one thing that has been emphasized to me is that research is done globally and partnerships are really important.

Public Safety committee  I'm not sure I understood the question. I'm sorry.

Public Safety committee  Thank you. I'm sorry for the trouble in understanding that. There are a few things that I would want to highlight. I think that when we're looking at any new technology or new development that's out there.... There is some misinformation around 5G, but I will set that aside to really focus in on the security aspects of this.

Public Safety committee  We certainly don't want to blame the victims for this. It is hard, I understand, just keeping on top of all of this. The first thing that we say to businesses, as well as individual citizens, is to just turn on auto updates—on our phones, just slide it to auto updates. However, the industry does need to make this easier.

Public Safety committee  That's an excellent question. I don't want it to sound as if we're blaming Canadians for this, because it isn't easy, nor do I want to blame businesses. The problem with the technology world is that we've made it too hard for business to keep up to date, and a small business owner should not also have to be a firewall expert and a networking expert and a computer expert.

Public Safety committee  One of the things we've done, which we started early in the pandemic, was to simply work with providers—partners around the world and commercial providers—to take down anybody that was impersonating the Government of Canada. I think we've all gotten the calls from someone pretending to be from a government agency.

Public Safety committee  That's a fairly in-depth question, but I'm happy to try to answer it. I think there are a few elements. Certainly, the broader Internet and the broader aspect that we face in terms of technology is that it is a global supply chain, and there are a number of vulnerabilities that are in the software.

Public Safety committee  I think there's a challenge. My goal is cybersecurity, so in raising the cybersecurity bar in this space, one of the things we're encouraging all Canadians to do, frankly, is to take some steps to raise that bar across the country with some basic security elements. Some easy steps can be taken that would increase our security bar.

Public Safety committee  I think that one of the things that's really important is that my role here is to advise and implement on policy, and policy decisions go before the government and the elected officials. I have to be careful not to take away our.... It's not my goal to.... I'm not elected, so I really respect—