Special Committee on Canada-China Relations (CACN) Appearance, Chief, CSE – April 12

Appearance details

Date: Tuesday, April 12, 2021

Location: Meeting to be held virtually

Time: 6:30 to 8:30 pm

Appearing:

• The Honourable Harjit Sajjan, Minister of National Defence
• Jody Thomas, Deputy Minister, Department of National Defence
• Rear-Admiral Scott Bishop, Commander of Canadian Forces Intelligence Command and Chief Intelligence Officer
• Major-General Trevor Cadieu, Director of Staff, Strategic Joint Staff
• Shelly Bruce, Chief, Communications Security Establishment
• Scott Jones, Head, Canadian Centre for Cyber Security
• Second half: 7:30 to 8:30 pm
• Jody Thomas, Deputy Minister, Department of National Defence
• Rear-Admiral Scott Bishop, Commander of Canadian Forces Intelligence Command and Chief Intelligence Officer
• Major-General Trevor Cadieu, Director of Staff, Strategic Joint Staff
• Dan Costello, Assistant Deputy Minister, International Security, Global Affairs Canada
• Weldon Epp, Director General, Trade and Diplomacy North Asia, Global Affairs Canada

Details: The Committee has invited officials from the Department of National Defence and CSE to appear as a continuation of their study on National Security.

Special committee on Canada-China relations 43rd Parliament, 2nd session

• Hon. Geoff Regan, Chair, LPC (Halifax West, NS)
• Garnett Genuis, Vice-Chair, CPC (Sherwood Park-Fort Saskatchewan, AB)
• Jack Harris, Vice-Chair, NDP (St. John's East, NL)
• Stéphane Bergeron, Vice-Chair, BQ (Montarville, QC)
• Peter Fragiskatos, LPC (London North Centre, ON)
• Robert Oliphant, LPC (Don Valley West, ON)
• Emmanuel Dubourg, LPC (Bourassa, QC)
• Jean Yip, LPC (Scarborough-Agincourt, ON)
• Pierre Paul-Hus, CPC (Charlesbourg-Haute-Saint-Charles, QC)
• Lenore Zann, LPC (Cumberland-Colchester, NS)
• John Williamson, CPC (New Brunswick Southwest, NB)
• Hon. Michael Chong, CPC (Wellington-Halton Hills, ON)

Not members, but in frequent attendance:

• Todd Doherty, CPC (Cariboo-Prince George, BC)
• Rachel Blaney, NDP ((North Island – Powell River, BC)

Hon. Geoff Regan, Chair, LPC (Halifax West, NS)

• CACN since 2020
• Former Speaker of the House (2015 to 2019)

Key interests

Natural resources, Chinese investments

Election to the House of Commons

• First elected 1993 to 1997; re-elected in 2000

Professional background

• B.A. in Political Science, St. Francis Xavier University
• Law degree, Dalhousie University
• Commercial and real estate lawyer before entering politics

Committee membership

• Chair of the Special Committee on Canada-China Relations (CACN) (2020-)
  • Chair of Subcommittee on Agenda and Procedure of CACN
• Former member of Standing Committee on Natural Resources (2009 to 2010, 2013 to 2015)
• Former Vice-Chair of Standing Committee on Industry, Science, and Technology (2011 to 2013)
• Former Vice-Chair of Standing Committee on Environment and Sustainable Development (2007 to 2008)
• Former Member of Standing Committee on National Defence and Veterans Affairs, 2001 (during 9/11)

Political and parliamentary roles

• Former Speaker of the House (2015 to 2019)
• Former Member of the Canada-China Legislation Association (2011 to 2012, 2013 to 2015)
• Former Chair of the Board of Internal Economy (2015 to 2019)
• Former Minister of Fisheries and Oceans (2003 to 2006)
• Former Parliamentary Secretary to the Leader of the Government (2001 to 2003)
• Former member of Canada-United States, Canada-France, Canada-Japan, Canada-United Kingdom, Canada-Ireland, and Canada-NATO Inter-Parliamentary Groups, and the Commonwealth Parliamentary Association

Points of interest to CSE

• Speaker during C-59 process; didn’t vote

Other interests

• Chinese investment, natural resources

Garnett Genuis, Vice-Chair, CPC (Sherwood Park–Fort Saskatchewan, AB)

• CACN since 2020

Key interests

5G and Huawei, human rights, Huawei

Election to the House of Commons

• Elected in 2015

Professional background

• Bachelor of Public Affairs and Policy Management, Carleton University
• Master’s in Public Policy, London School of Economics
• Staffer in Prime Minister’s Office
• Vice President of a national research firm

Committee membership

• Member of Special Committee on Canada-China Relations (CACN) (2020-)
• Member of the Subcommittee on International Human Rights of the Standing Committee on Foreign Affairs and international Development, (2020-)
• Former Member of the Standing Committee on Foreign Affairs and International Development (2017 to 2018)
• Former member of the Standing Joint Committee for the Scrutiny of Regulations,
• Former member of the Special Joint Committee on Physician-Assisted Dying

Political and parliamentary roles

• Conservative Party shadow cabinet critic for Canada-China Relations and Multiculturalism

Points of interest to CSE

• Voted against C-59
• CACN, July 2020: Questions on investment of Chinese state-affiliated companies
• CACN, July 2020: “There are a number of companies, Nuctech, Dahua, Hikvision, … with close relationships with the Chinese state that we know play some role in supplying security technology.”
• INDU, June 2020: questioned intelligence capacity of intelligence agency with the present funding levels

Other interests

• China, human rights, infrastructure, international relations, foreign banks

Jack Harris, Vice-Chair, NDP (St. John’s East, NL)

• CACN since 2020
• NDP Critic for Foreign Affairs, Public Safety

Key interests

National defence and security, policing, racial equality

Election to the House of Commons

• First elected 1987 to 1990; re-elected 2008 to 2015 and 2019

Professional background

• Studied at Memorial University, University of Alberta, and London School of Economics
• Newfoundland and Labrador MHA (1990 to 2006)
• Provincial NDP Leader (1992 to 2006)
• Lawyer

Committee membership

• Vice-Chair of the Special Committee on Canada-China Relations (CACN) (2020-)
  • Member of Subcommittee of CACN
• Former Vice-Chair and member of Standing Committee on National Defence (2009 to 2015)
• Former Member of Special Committee on the Canadian Mission in Afghanistan (2010 to 2011)
• Former Vice-Chair of Standing Committee on Justice and Human Rights (2010 to 2011)
• Former Vice-Chair and Member of Standing Committee on Public Safety and National Security (2009)

Political and parliamentary roles

• NDP Critic for Foreign Affairs, Public Safety, and the Atlantic Canada Opportunities Agency
• NDP Deputy Critic for Defence
• Vice-Chair and member of the Canadian NATO Parliamentary Association
• Former member of the Canada-United States, Canada-Europe, Canada-United Kingdom, and Canada-Ireland Inter-parliamentary groups/associations

Points of interest to CSE

• CACN, August 2020: Interest in foreign influenced activities and coordination of RCMP and CSIS.

Other interests

• Defence issues, racial equality, law enforcement, Indigenous peoples

Stéphane Bergeron, Vice-Chair, BQ (Montarville, QC)

• CACN since 2020

Key interests

International relations and trade, families and seniors issues

Election to the House of Commons

• Elected 1993 to 2005, re-elected 2019

Professional background

• Political Science, Université du Québec and Université Laval
• Cadet Instructor Cadre officer, Canadian Armed Forces (1984 to 1993)
• Parti Québécois member of the Quebec National Assembly (2005 to 2018)

Committee membership

• Vice-Chair of Special Committee on Canada-China Relations (CACN) (2020-)
• Member of Standing Committee on Foreign Affairs and International Trade (2002 to 2004)
• Member of Standing Committee on Procedure and House Affairs (1997 to 2001)

Political and parliamentary roles

• Party Critic for Foreign Affairs
• Member of Canada-China Legislative Association (2004 to 2006, 2019-)
• Member of Canada-United States, Canada-Africa, Canada-Germany, Canada-Europe, Canada-Israel, Canada-France, Canada-Japan, Canada-Italy, and Canada-Ireland Inter-parliamentary groups/associations

Points of interest to CSE

• NIL

Other interests

• Families and seniors, heatlh transfers, immigration, human rights, federal-provincial relations

Peter Fragiskatos, LPC (London North Centre, ON)

• CACN since 2020

Key interests

International relations

Election to the House of Commons

• Elected in 2015

Professional background

• PhD in International Relations from Cambridge University, also studied at University of Western Ontario and Queens University
• Political science professor and media commentator

Committee membership

• Member of the Special Committee on Canada-China Relations (CACN) (2020-)
• Former member of the Standing Committee on Finance (2018 to 2019)
• Former member of the Standing Committee on Public Safety and National Security, (2017 to 2018)
• Former member of the Standing Committee on Foreign Affairs and International Development, 2016 to 2017

Political and parliamentary roles

• Member of Canada-China Legislation Association, 2016 to 2017
• Former member of Canadian NATO and Canada-Africa Parliamentary Associations

Points of interest to CSE

• Voted in favour of C-59

Other interests

• Supporting SMEs, international relations, public transit

Robert Oliphant, LPC (Don Valley West, ON)

• CACN since 2020
• Parl. Sec. for Foreign Affairs

Key interests

International relations, national security

Election to the House of Commons

• Elected in 2008

Professional background

• B. Commerce, University of Toronto
• Masters in Theology, University of British Colombia
• Doctor of Ministry, Chicago Theological Seminary
• United Church minister
• Former Chief of staff to Ontario Provincial Minister of Women’s Issues and Minister of Culture and Communications, 1989 to 1990
• President and CEO of Asthma Society of Canada, 2011 to 2015

Committee membership

• Member of Special Committee on Canada-China Relations (CACN) (2020-)
• Former Chair of Standing Committee on Public Safety and National Security (2016 to 2019)
• Former Chair of Standing Committee on Citizenship and Immigration (2017 to 2019)
• Former non-voting member of Standing Committee on International Trade (2019)

Political and parliamentary roles

• Parliamentary Secretary to the Minister of Foreign Affairs
• Member of the Canada-China Legislative Association (2015-)
• Member of the Canada-United States, Canada-Africa, Canada-Germany, Canada-Israel, Canada-Japan, and Canada-France Inter-Parliamentary groups/associations
• Member of the Canadian Delegation to the Organization for Security and Co-operation in Europe Parliamentary Assembly

Points of interest to CSE

• Voted in favour of C-59

Other interests

• China, International relations

Emmanuel Dubourg, LPC (Bourassa, QC)

• CACN since 2020
• Member of NSICOP (2017-2019)

Key interests

National security, international tax policy, Huawei, language rights

Election to the House of Commons

• Elected in 2013

Professional background

• MBA, Université du Québec à Montréal
• Chartered Accountant and Teacher
• Manager and Advisor at the Canada Revenue Agency
• Liberal member of the Quebec National Assembly (2007 to 2013)

Committee membership

• Member of the Special Committee on Canada-China Relations (CACN) (2020-)
• Member of the Standing Coittee on Official Langauges since 2020
• Former member of the Standi Committee on Access to Information, Privacy and Ethics (2017 to 2018)

Political and parliamentary roles

• Member of the National Security and Intelligence Committee of Parliamentarians, 2017 to 2019)
• Former Parliamentary Secretary to the Minister of National Revenue (2015 to 2017)
• Former member of the Canadian NATO Parliamentary Association (2018 to 2019)
• Former Member of the National Security and Intelligence Committee of Parliamentarians (2017 to 2019)

Points of interest to CSE

• Voted in favour of C-59
• CACN, March 2020: question about the decision to be made on Huawei and concerns about national security

Other interests

• Tax policy, international relations, official langauges, trade

Jean Yip, LPC (Scarborough-Agincourt, ON)

• CACN since 2020

Key interests

Asian diaspora communities, seniors issues

Election to the House of Commons

• Elected in 2017 (by-election)

Professional background

• University of Toronto
• Career in insurance and underwriing; holds her Fellow Chartered Insurance Professional Delegation

Committee membership

• Member of Special Committee on Canada-China Relations (CACN) (2020-)
• Former member of Standing Committee on Government Operations and Estimates (2018 to 2019)
• Former member of Standing Committee on Public Accounts (2018 to 2019)

Political and parliamentary roles

• Member of the Canada-China Legislative Association (2020-)
• Member of the Canadian Branch of the Commonwealth Parliamentary Association
• Former member of the NATO Parliamentary Association
• Former member of the Canada-Israel, Canada-Germany, Canada-Philippines, and Canada-Armenian Inter-parliamentary groups

Points of interest to CSE

• Voted in favour of C-59
• CACN, August 2020: “Do you feel that TikTok is a national security threat, and will the ban be effective in limiting China's interference?”

Other interests

• Made a statement highlighting the importance of Asian Heritage Month in May, 2018; riding has a large Asian population
• Seniors issues, international relations, information collection

Pierre Paul-Hus, CPC (Charlesbourg-Haute-Saint-Charles, QC)

• CACN since 2020

Key interests

Immigration, Quebec

Election to the House of Commons

• Elected in 2015

Professional background

• Degree in Political Science from Laval University
• Graduate of the Kingston Staff College in Ontario and Military School of Paris
• Owned PRESTIGE Group Média
• Shareholder of Sélections Mondial des Vins – Canada (the largest wine competition in North America)
• Joined the Régiment de la Chaudière, a reserve unit in the Canadian Armed Forces (22 years of military service). He ended his military career in 2009.

Committee membership

• Member of the Standing Committee on Government Operations and Estimates (2020-)
• Member of the Special Committee on Canada-China Relations (2020-)
• Former Vice-Chair of the Standing Committee on Public Safety and National Security (2020) (member from 2016 to 2019)

Political and parliamentary roles

• Shadow Minister for Public Services and Procurement (2019-)
• Counsellor on the Canadian NATO Parliamentary Association (2020)
• Member of the Canada-Europe Parliamentary Association, Member of the Canada-Israel Interparliamentary Group, Member of the Canada-United States Interparliamentary Group (2020)
• Former Vice-Chair of Canadian NATO Parliamentary Association (2018 to 2020)

Points of interest to CSE

• Raised Question Period: “Mr. Speaker, Canada is the only Five Eyes ally that has not yet made a decision about Huawei's participation in our 5G network…What is the Prime Minister waiting for to ban Huawei from our 5G network and to protect Canadian businesses and citizens?”, March 2020
• Raised in the House: “[my constituents] are also concerned about the government's failure to make a decision about banning Huawei from the 5G network. They know that the communist Chinese regime spies on us and regularly steals Canadian intellectual property, but they do not see the government doing anything to protect them”, March 2020

Other interests

• Veterans, border safety, immigration in Quebec

Lenore Zann, LPC (Cumberland-Colchester, NS)

• CACN since 2020

Key interests

Environmental issues, human rights and racial issues

Election to the House of Commons

• Elected in 2019

Professional background

• Drama, Fine Arts, and Political Science at York University
• Career as a screen, stage, and voice actress before moving back to her hometown of to Truro, NS and entering public life
• Former MLA for Provincial NDP in Nova Scotia (2009 to 2019)

Committee membership

• Member of the Special Committee on Canada-China Relations (CACN) (2020-)
• Member of the Standing Committee on Indigenous and Northern Affairs (2020-)

Political and parliamentary roles

• Member of the Canadian NATO Parliamentary Association (2020-)

Points of interest to CSE

• NIL

Other interests

• Culture and arts, environmental issues, human rights and racial issues

John Williamson, CPC (New Brunswick Southwest, NB)

• CACN since 2020

Key interests

Foreign affairs, taxpayers rights, energy

Election to the House of Commons

• First elected in 2011, defeated in 2015, re-elected in 2019

Professional background

• Economics and Political Science, McGill University
• Economic history, London School of Economics
• Former editorial writer for National Post
• Former national director of the Canadian Taxpayers Federation (2004 to 2008)
• Former Director of Communications in PMO under Stephen Harper (2009 to 2010)

Committee membership

• Member of Special Committee on Canada-China Relations (CACN) (2020-)
• Former member of Standing Committee on National Defence (2013 to 2015)
• Former member of Standing Committee on Foreign Affairs and International Development (2012 to 2013)
• Also former member of Standing Committees on Official Languages, Public Accounts, Health, and Procedure and House Affairs

Political and parliamentary roles

• Former member of Canada-China Legislative Association, 2013 (for one month)
• Former member of Canada-United States, Canadian NATO, Canada-France, Canada-Japan, Canada-Europe, and Canada-United Kingdom Inter-parliamentary groups/associations

Points of interest to CSE

• Publically critical of current government’s dealings with China

Other interests

• CFB Gagetown is in his riding
• Taxpayer rights, energy issues

Hon. Michael Chong, CPC (New Brunswick Southwest, NB)

• CACN since 2020

Key interests

China, immigration, langauge rights, data

Election to the House of Commons

• Elected in 2004

Professional background

• Former acting Chief Information Officer for the National Hockey League Players’ Association
• Worked as a senior technology consultatnt to the Greater Toronto Airports Authority
• Co-founded the Dominion Institute, now known as Historica Canada. Currently sits on Board of Governors
• Degree in Philosophy from Trinity College at the Universtiy of Toronto

Committee membership

• Member of Special Committee on Canada-China Relations (CACN) (2020)
• Member of the Standing Committee on Foreign Affairs and International Development (2020-)
• Former Member of the Standing Committee on Official Languages (2020)
• Former Member of the Standing Committee on Industry, Science and Technoloogy (2018 to 2019)
• Former Member of the Standing Committee on Transport, Infrastructure and Communities (2017 to 2018)

Political and parliamentary roles

• Critic for Foreign Affairs (2020-)
• Former President of the Queen’s Privy Council (2006)
• Former Minister of Intergovernmental Affairs and Minister for Sport (2006)
• Former Member of the Canadian NATO Parliamentary Association (2018 to 2019)
• Former Member of the Canada-China Legislative Association (2016 to 2017)

Points of interest to CSE

• Publically critical of current government’s dealings with China; advocates for stronger diplomatic action on Hong Kong
• Question Period, May 2020 on the Stats Canada leak: “This leak speaks to the integrity of the government. Intelligence at the Five Eyes.... Our four allies have been telling us for years that one of the top two or three threats that democracies are facing is declining public confidence in our key institutions. Democracies have been blindsided by misinformation, disinformation and cyber-attacks...”

Other interests

• Passed The Reform Act in 2015, language rights, immigration, international relations

Backgrounder on the Special committee on Canada-China relations (CACN) - 43rd Parliament, 2nd Session

Mandate

CACN is a Special Committee appointed to conduct hearings to examine and review all aspects of the Canada-China relationship. This includes, but is not limited to, consular, economic, legal, security and diplomatic relations.

Appearances

• February 25, 2021: CSE was invited to appear alongside the Minister of Public Safety and other government officials to discuss the cyber security dimensions of the Canada-China relationship.

Key studies

• Current session (42nd Parliament, 2nd session)
  • Canada-China Relations
  • Hong Kong
  • National Security
• Report 1: Canada-China Relations presented to the House on October 19, 2020

Previous meetings (current session)

• Friday October 9, 2020: Election of Chair
  Geoff Regan (LPC) was elected Chair. Garnett Genuis (CPC), Stéphane Bergeron (BQ) and Jack Harris (NDP) were elected Vice-Chairs of the Committee.
• Monday October 26, 2020: Committee Business
  The Committee adopted a motion to resume its study on the situation in Hong Kong. Upon the completion of the Hong Kong study, the committee will study issues related to national security, including cyber security and foreign influence.
• Monday November 2, 2020: Canada-China Relations
  Appearance from Jeff Nankivell, Consul General of Canada in Hong Kong and Macao, Global Affairs Canada.
• Monday November 9, 2020: Canada-China Relations
  Appearances from the National Democratic Institute, Vancouver Society in Support of Democratic Movement and several individuals from academia and media organizations.
• Monday November 16, 2020: Canada-China Relations
  Appearance from the Hon. Marco Mendicino, Minister of Immigration, Refugees and Citizenship, alongside officials from the Department of Citizenship and Immigration.
• Tuesday November 17, 2020: Canada-China Relations
  Appearance from Shawn Steil, Executive Director of Greater China Policy from the Department of Foreign Affairs, Trade and Development.
• Monday November 23, 2020: Canada-China Relations
  Appearance from the Hon. François-Philippe Champagne, Minister of Foreign Affairs, alongside officials from the Department of Foreign Affairs, Trade and Development.
• Tuesday November 24, 2020: Canada-China Relations
  Appearances from former Ambassadors of Canada to the People’s Republic of China.
• Monday November 30, 2020; Thursday December 1, 2020; Monday December 7, 2020 and Tuesday December 8, 2020:
  The committee resumed consideration of a draft report.
• Tuesday December 8, 2020: Canada-China Relations
  Appearances from Dominic Barton, Ambassador Extraordinary and Plenipotentiary of Canada to the People's Republic of China, and Shawn Steil, Executive Director of Greater China Policy from the Department of Foreign Affairs, Trade and Development.
• Thursday January 28, 2020: Canada-China Relations
  The committee agreed that officials from CSE, CSIS, and the RCMP appear alongside the Minister of Public Safety to provide a briefing on the topic of the national security dimensions of the Canada-China relationship.
• Monday February 1, 2021; Thursday February 4, 2021; Thursday February 18, 2021: Canada-China Relations and Monday February 22, 2021: Canada-China Relations
  The committee resumed consideration of a draft report.
• Thursday February 25, 2021: Canada-China Relations
  Appearance from the Hon. Bill Blair, Minister of Public Safety and Emergency Preparedness alongside officials from Public Safety, RCMP, CBSA, CSIS and CSE.

Potential questions and answers

The National Cyber Threat Assessment report

Procurement

Cyber security

Huawei and 5G

State-sponsored activities

CSE activities and COVID-19

CSE general questions

Recent appearances on COVID-19 (May to November 2020)

The COVID-19 pandemic has required government departments, Parliament and industry to make quick and innovative changes to the way they communicate and work. To commentate on some of the work that the Communications Security Establishment and the Canadian Centre for Cyber Security (CCCS) has done to aid both government and industry partners, Scott Jones, Head of the CCCS, has made several appearances in front of House Standing Committees. This document provides a brief summary of some of the key topics and questions that have been directed at Scott in rounds of questions, most notably at INDU, OGGO and HESA appearances.

Cyber threats

The COVID-19 pandemic has added a new layer of risk regarding our communication networks. Malicious actors continue to take advantage of this heightened level of fear and confusion. Members are keenly interested in how CSE/CCCS have worked to protect not just Government networks, but the networks of the health care sector and Canadians.

Notable questions:

• Has there been any observable decline/increase of cyber intrusions due to the lockdown from certain countries? If so, from what countries?
• Have any of your public or private sector partners come to you asking for your help with a COVID-related incident? If so, is there any determination of the sources?
• How is cybersecurity addressed in the Government of Canada, including cyber threats that may pose a risk to government infrastructure?

Canada-China relations

Top of mind for many Members is Canada-China relations; this includes topics such as Huawei, 5G technology, procurement, and state-owned enterprises. While Canada-China relations may not be directly correlated with CSE’s response to the COVID-19 pandemic, the issues of Huawei and 5G arise in most discussions, as our Five Eyes partners have banned Huawei from their networks. Scott Jones has emphasized the importance of the ongoing security assessment being led by the Minister of Public Safety, but also the importance of assessing all companies and technologies with the same rigour. More recently, CSE appeared to discuss their role in the procurement of security equipment in Canadian embassies abroad.

Notable questions:

• If Huawei is a part of Canada's 5G network, will it pose a security risk to Canadians?
• Other Five Eyes partners have already made a decision on Huawei and 5G networks. Is there something different about Canada that dictates why we have not made a decision?
• Is Huawei considered a higher risk vendor when it comes to a 5G network?
• Do we risk being excluded from information sharing if we move ahead with Huawei?
• Do you have any concerns about Huawei technology in home internet networks?
• CSE just came out with the Cyber Threat Assessment Report and highlighted issues with state-owned actors, naming China and Russia for the first time. What kind of information could state-sponsored actors gain from security equipment in our embassies abroad?
• Going forward, what do we need to do to protect our assets, our people, our data both overseas in embassies and within Canada, to protect from state-sponsored aggression?

Support to health sector

Members have often oriented their questions in regard to the cybersecurity of the health sector and Canadian health institutions due to the COVID-19 pandemic. Most questions directed at CSE focus on cyberattacks on health workers and health organizations, although it’s worth noting that members also have a strong interest in the safety of health data.

Notable questions

• Has CSE been called into deal with intrusions against frontline health workers?
• We know cyber-attacks on health and research organizations can come from many sources around the globe, what plan is in place at Public Safety Canada or the RCMP or both to put an end to an attack, to find the guilty party and then prevent future attacks?
• Can you confirm if there have been any successful breaches on Canadian health research organizations working on COVID-19?

Teleworking, virtual parliament and sensitive information

COVID-19 has led MPs, staff, the public service, and many other Canadians to working from home. Teleworking adds another challenge and level of risk in cyber-security. Members asked several questions regarding the transferring and handling of sensitive information, as well as ways the CCCS/CSE are safeguarding Parliamentary activities over teleconference.

Notable questions:

• Are there any public servants working from home that have been targets of cyberattacks?
• Has any cyber security assessment been done before using Zoom? Since when do you think any Zoom application has been used by the government in any capacity?
• I wanted to follow up on security measures at high level. What are some of the factors and principles that are important when it comes to remote or virtual voting?
• Industry and gov’t went home to work and adopted things like Zoom overnight. There is much talk about government employees working from home in the future too. Many have access to state secrets, military info and personal information; how do we balance the risks of personal safety and security, and national safety and security?

Fraud and scams

Fraud has been an important topic before and during the COVID-19 pandemic. Members continue to question what is being done to protect Canadians and businesses from cyber-related fraud and fraud calls, but particularly when COVID-19 is the lure.

Notable questions:

• In your speech, you spoke about fraudulent websites that were copying the Government of Canada website? How many were detected? Were they all eliminated?
• We’re hearing a lot about phishing scams, such as a senior getting calls about the ‘top up’ on covid assistance and asking for information to access bank accounts to deposit money; how does your organization work with the RCMP and local police forces to investigate something like this? How do you work to ensure the public is aware of these scams?
• During this pandemic, have we invoked our proactive measures to stop or mitigate cyber fraud?

Collaboration and intelligence sharing

Members have shown interest in how the CCCS works with partners such as the RCMP, the Canadian Anti-Fraud Centre (CAFC), and the Five Eyes. While these questions surface outside of a COVID-19 setting, Members continue to ask about whether the rise in COVID-related fraud and cyber-attacks on the health care and research sector has changed these relationships.

Notable questions:

• Was there any exchange of intelligence with other partners such as the Five Eyes, for example, on incidents happening to us and happening elsewhere within our allies?
• According to a media report, the CSE is working in coordination with its partners to ensure COVID-19-related phishing sites mimicking the Government of Canada are removed. Who are those partners?

Research and development

Many questions about academic institutions, R&D organizations and COVID-19-related research have emerged in Committee appearances. There is special concern of foreign actors attempting to attack government efforts to develop a vaccine, and research institutions assisting in that.

Notable questions:

• Has CSE been brought in to deal with any attacks against our own government in the efforts to develop a vaccine?
• What is the intent of attacks against R&D institutions and academia, do you think?
• The health sector has been highlighted here; however, a month ago, the authorities in the US and UK warned that universities are incredibly vulnerable. Have you seen an uptake in cyberattacks on universities? Do you agree with their assessment?

COVID-19, cyber security and the cyber threat environment

Details

• COVID-19 has presented cybercriminals and fraudsters with an effective lure to encourage victims to visit fake web sites, open e-mail attachments, and click on text message links. These e-mails typically impersonate health organizations, and can pretend to be from the Government of Canada.
• CSE's Canadian Centre for Cyber Security, in coordination with industry partners, is taking action that is contributing to the removal of over 5,500 fraudulent sites that have spoofed the Public Health Agency of Canada, Canada Revenue Agency, and the Canada Border Services Agency.
• The Cyber Centre has also been working to protect the Government of Canada through continued monitoring of important GC programs against cyber threats (including CERB), enabling cyber security monitoring/defence for cloud usage across the GC and evaluating cloud applications, including for the Public Health Agency of Canada.
• The Canadian Centre for Cyber Security has also shared advice and guidance to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.
• Cyber security tips for remote work were also issued to help inform and educate Canadians about how to stay safe online, particularly while many Canadians are working from home.

The Canadian Internet Registration Authority (CIRA) Canadian Shield

• On 23 April 2020, the Canadian Internet Registration Authority (CIRA) announced the official launch of the CIRA Canadian Shield.
• The CIRA Canadian Shield is a free DNS firewall service that provides online privacy and security to individuals and families across Canada, based on defensive measures that have already been in place to protect the Government's own systems.
• In December, CIRA announced their 100,000 Canadian-user milestone after only seven months. CIRA Canadian Shield has surpassed its first-year goal of 100,000 users in a little over half a year.
• CIRA partnered with the Canadian Centre for Cyber Security (Cyber Centre) to integrate its Canadian threat feed into Canadian Shield. No personally identifiable information (PII) of any kind is transmitted to the Cyber Centre as part of this process.

National Cyber Threat Assessment 2020

Details

The National Cyber Threat Assessment 2020

• The NCTA 2020 provides an update to the 2018 National Cyber Threat Assessment with an analysis of the interim years and forecasts ahead to 2022.
• The key judgements in this report are based on reporting from multiple sources, including classified and unclassified information. The judgements are based on the Cyber Centre’s knowledge and expertise in cyber security and informed by CSE’s foreign intelligence mandate, which provides us with valuable insights on cyber threat activity around the world.
• The information and analysis in the NCTA are based on information available up to October 20, 2020.

Key findings

• Cyber-crime is the cyber threat most likely to affect Canadians and Canadian organizations in 2020 and in the years ahead.
• While cybercrime is the most likely threat to impact the average Canadian, the state-sponsored cyber programs of China, Russia, North Korea and Iran post the greatest strategic threat to Canada.
• Many of the threats identified in the report involve both technological and human elements.
• Cybercriminals often succeed in their work because they exploit human and social behaviours.

New internet protocol

• China and Russia are notably leading efforts in international forums to change the accepted approach to Internet governance from the multi-stakeholder approach to one of state sovereignty. They view ideas and information primarily through the lenses of domestic stability and national security and want an Internet that will allow them to track their citizens and censor information.
• These states are pushing technical standards proposals, like the New Internet Protocol (NIP) proposal made by China and Chinese telecommunications companies, that would fundamentally transform the way the Internet works.
• The NIP would provide certain cyber security advantages, but it would enable powerful censorship, surveillance, and state control.

The Canadian Centre for Cyber Security

• As part of the Communications Security Establishment (CSE), the Canadian Centre for Cyber Security (Cyber Centre) brings over 70 years of experience protecting Canada’s most sensitive information and networks. Bringing together operational security experts from across the Government of Canada, the Cyber Centre is the Government of Canada’s authority on cyber security.
• Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe and analyze trends in the cyber threat environment.
• The Cyber Centre works closely with other government agencies, industry partners, and with the public to share knowledge and experience to improve cyber security for Canadians and to make Canada more resilient against cyber threats.

Foreign interference and democratic process

Details

Potential election during COVID-19 pandemic

• On December 11, 2020, the Standing Committee on Procedure and House Affairs (PROC) presented Report 7 – An Interim Report on Protecting Public Health and Democracy during a Possible Pandemic Election.
• The Committee heard from officials that ran elections in four provinces during the pandemic and assessed three temporary legislative changes that would supersede the Canada Elections Act: extending the voting period, flexibility for administering the vote in long-term care facilities and provide Canada’s Chief Electoral Officer the power to adapt the Act to respond to the challenges created by the pandemic.
• SITE Task Force partners will continue to work within their respective mandates to detect and counter possible foreign threats to Canada and its democratic institutions on an ongoing basis.

2019 election

• In 2019, the Government of Canada announced a plan to safeguard the 2019 federal election.
• As part of its plan, the Government of Canada established the Critical Election Incident Public Protocol (the Protocol Panel) to ensure coherence and consistency in Canada’s approach to publicly informing Canadians during the writ period about incidents that threaten Canada’s ability to have a free and fair election.
• The Security and Intelligence Threats to Election (SITE) Task Force, comprised of officials from the Communications Security Establishment, the Canadian Security and Intelligence Service, the Royal Canadian Mounted Police, and Global Affairs Canada was established as a fully integrated team to help the Government assess and respond to foreign threats.
• Before and throughout the election, the SITE Task Force provided security briefings to Elections Canada and Canadian political parties to promote situational awareness and help them strengthen their security practices.
• The Protocol Panel did not observe any activities that met the threshold for a public announcement or affected Canada’s ability to have a free and fair election.
• CSE and its Canadian Centre for Cyber Security (Cyber Centre) have worked directly with Elections Canada for several years providing cyber security advice and guidance. This partnership continues today, and we continue to support their efforts in ensuring a secure election.
• CSE and its Cyber Centre published a detailed cyber security guide for campaign teams in advance of the 2019 Election. Cyber Centre senior officials offered unclassified briefings to all 16 federal registered political parties and held follow-on meetings at the request of individual parties. The Cyber Centre also held regular stakeholder calls with political parties to raise awareness of cyber security threats and provide advice and guidance.
• In advance of the 2019 General Election, CSE and the Cyber Centre made the decision to offer cabinet ministers a 24/7 cyber hotline service, providing centralized support in the event they suspected their ministerial, parliamentary, or personal communications, e-mail or social media accounts were compromised. The hotline provided a 24/7 priority service in the case of a cyber incident and is still operational today.
• In addition to this service, CSE and the Cyber Centre provided a point of contact to all 16 federal registered political parties for further discussion on the cyber security challenges related to Canada’s democratic process. If any political parties and/or candidates encountered any suspicious cyber activity, we had also designated a quick response point of contact for them, which was coordinated through each political party’s headquarters. This cyber security technical support service to political parties, while also available on a 24/7 basis, was only in operation throughout the 2019 General Election, and was similar to the Cyber Hotline for Ministers.

Cyber threats to Canada’s democratic process reports

• In June 2017, CSE published an unclassified assessment of cyber threats to Canada’s democratic process, which found that Canada is not immune from cyber threat activity against its elections. While the threat in Canada is generally of low sophistication, political parties, politicians and the media are vulnerable to cyber threats and influence operations.
• In 2019, CSE provided an update to the 2017 report. The updated report found that overall, cyber threat continues to target three main aspects of the democratic process: voters, political parties, candidates and their staff; and elections. The report concluded that it was very likely that Canadian voters would encounter cyber interference ahead of and during the 2019 election.

Countering misinformation on COVID-19

Details

• COVID-19 has presented cybercriminals and fraudsters with an effective lure to encourage victims to visit fake web sites, open e-mail attachments, and click on text message links. These e-mails typically impersonate health organizations, and can pretend to be from the Government of Canada.
• CSE, through its Canadian Centre for Cyber Security, has been working with partners, including the Canadian Internet Registration Authority (CIRA), to better identify malicious versus legitimate COVID-19 domains.
• In this effort, CSE shares information about fake sites and other threat indicators with partners so they can act quickly to remove platforms involved in fraudulent activity.
• This activity is conducted under CSE’s cyber security mandate pursuant to the Communications Security Establishment Act.
• The Canadian Centre for Cyber Security has also shared advice and guidance to help inform and educate Canadians about how to stay safe online. Visit the Canadian Centre for Cyber Security website for more information.

Cyber threats and the COVID-19 vaccine

Details

Monitoring threats

• CSE and its Cyber Centre have assessed that the COVID-19 pandemic presents an elevated risk to the cyber security of Canadian health organizations involved in the national response to the pandemic.
• Cyber Centre’s National Cyber Threat Assessment 2020 report noted that state-sponsored actors would almost certainly continue to conduct commercial espionage against Canadian businesses, academia, and governments.
• Over the duration of the COVID-19 pandemic, threat actors have continued to attempt to steal intellectual property and proprietary information related to combatting COVID-19 to support their own domestic health responses, or to profit from its illegal reproduction by their own firms.
• CSE continues to monitor for cyber threats through our foreign intelligence mandate, working with Canadian security and intelligence partners, including the Department of National Defence and Canadian Armed Forces.

Coordinated efforts

• In July 2020, CSE, along with its U.K. and U.S. partners issued a joint statement about cyber threat activity directed at Canadian, U.K. and U.S. organizations, including vaccines research entities.
• Malicious cyber activities were jointly assessed as likely to be targeting information and intellectual property relating to the development and testing of COVID-19 vaccines.
• These malicious activities also serve to hinder response efforts at a time when healthcare experts and medical researches need every available resource to help fight the COVID-19 pandemic.
• CSE continues to work closely with both domestic and international partners to support the Government of Canada’s response to the COVID-19 pandemic.

Support to Canadian organizations

• Throughout the pandemic, CSE and its Cyber Centre have issued regular alerts and cyber security advice and guidance related to COVID-related threat activity. This includes an important and still active Cyber Threat Bulletin on the Impact of COVID-19 on Cyber Threats to the Health Sector, which mentions the targeting of Canadian biopharmaceutical companies.
• Threat Bulletins provide more tailored advice and guidance for Canadian sectors that are particularly likely to be targeted by threat actors and include the most up-to-date information on how to best secure their organizations.
• In addition, Cyber Centre experts have regular calls with the health care sector to share relevant and timely cyber threat information and guidance for mitigating threats.
• If any Canadian businesses or organizations suspect they have been targeted by cyber threat activity, CSE encourages them to contact local law enforcement of the Cyber Centre.

5G (Huawei)

Details

• As part of its cyber security mandate, CSE works with telecommunications service providers representing over 99% of Canadian subscribers. In this role, CSE provides advice and guidance to mitigate supply chain risks in telecommunications infrastructures upon which Canadians rely, including, since 2013, a program that has been in place to test and evaluate designated equipment considered for use in Canadian 3G and 4G/LTE networks, including Huawei.
• CSE’s role includes accrediting the third party labs that perform this assurance testing, and defining the testing requirements. CSE reviews the testing results and provides tailored advice and guidance to Canada’s telecommunications sector.

Nuctech assessment

Details

Nuctech “standing offer”

• On July 20th The National Post reported that Beijing-based company Nuctech was made a “standing offer” to supply X-ray equipment for 170 embassies and consulates around the world.

Risk mitigation program

• Threat actors use supply chain weaknesses for malicious activity. Organizations with valuable information or services should include supply chain risks in their decision making when they buy products and services. The Cyber Centre recommends incorporating supply chain risk management as part of an overall IT security risk management framework, such as the Cyber Centre’s IT Security Risk Management: A Lifecycle Approach (ITSG-33).
• The Cyber Centre offers Government of Canada (GC) departments a supply chain cyber security risk assessment program to understand the supply chain risks of ICT products under procurement. These assessments provide advice, guidance, best practices, and mitigations that GC departments can consider when making decisions relating to IT procurements.
• As the SCI process is comprised of research and analysis involving classified intelligence reporting, only the final risk assessment and recommendations are provided as advice and guidance back to the requesting GC Department. This is done to protect classified intelligence information and sources and ensure that CSE remains compliant Canadian SIGNT Security Standards.
• The Cyber Centre does not provide general assessments about companies, nor make statements to GC Departments dictating procurement decisions. Additionally, further disclosure of a SCI risk assessment to vendor(s) is strictly forbidden, as such action may damage the ability of the GC Departments to mitigate supply chain risks from the same service(s) or product(s).
• The Cyber Centre’s risk assessment process can include a supply chain integrity (SCI) assessment. However, this would only be performed where there are plans for a specific deployment of IT equipment. At the standing offer stage, where a contract has yet to be awarded, there is no deployment-specific information that can be evaluated as part of a supply chain integrity assessment.
• Supply chain integrity risk assessments are typically performed early in the procurement process and are usually for information and communications technology, such as network security devices, computing equipment or data storage.
• A supply chain cyber security risk assessment involves three main components:
  • An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
  • A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
  • A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.

RCMP and CBSA

• To be more specific: CSE provided security advice on Nuctech products, once for the RCMP and once for the Canada Border Services Agency (CBSA). In both cases products had been bought, and in one case (RCMP) installed, and CSE provided mitigation advice in those situations.
• Security screening equipment is not traditionally deemed IT equipment, so an IT security review is not necessarily triggered in the procurement process. Technological advances however mean that today’s screening equipment is often connected to the internet and that introduces a new level of risk.

National Security and Intelligence Review Agency (NSIRA)

Details

National Security and Intelligence Review Agency report

• CSE is subject to after-the-fact review by the National Security and Intelligence Review Agency (NSIRA). NSIRA has assumed responsibility for reviewing all national security activities across the Government of Canada, including all of CSE’s activities.
• NSIRA reviews CSE’s activities for lawfulness and to ensure that the activities are reasonable, necessary, and compliant with ministerial direction. NSIRA also serves as the body for any complaints against CSE.
• A redacted report from NSIRA made public the first week of March 2021, looked into reported breaches of Canadians' privacy by the Communications Security Establishment.
• NSIRA recognized that privacy incidents are unavoidable due to the nature of CSE’s activities, and found that CSE employed compliance measures in a timely manner in accordance with policy. NSIRA also included five recommendations intended to improve our documentation, assessment, and mitigation of privacy incidents.
• CSE’s robust and layered approach to privacy protection contributes to an operational environment resulting in a relatively small number of inadvertent privacy incidents. Some of these incidents are unfortunately a result of simple errors, which requires information to be updated and/or corrected.

Accountability and oversight

• CSE conducts all its activities, including protections for the privacy of Canadians and persons in Canada, within a robust system of accountability. This review process is essential in ensuring that, as CSE provides the Government of Canada with critical foreign intelligence and cyber defences, we remain open, transparent, and accountable to Canadians.
• CSE ensures that incidents are not only documented within the respective mission and operational teams, but also reviewed by a team independent of operations in order to ensure a CSE-wide consistent approach is taken on mitigating and assessing privacy incidents. This layered approach further demonstrates CSE’s commitment to ensuring that it protects the privacy of Canadians when an incident arises.
• CSE has a culture of compliance, which is based on employees understanding the legal and policy framework, their accountability to operate within it, and evidenced by their strong record of reporting and addressing incidents that may occur during the course of their activities. CSE’s operational policies establish specific measures to protect the privacy of Canadians and persons in Canada in the acquisition, use and retention of information.

Potential CSE strike

Details

• CSE is one of Canada’s key security and intelligence agencies, responsible for foreign intelligence and cybersecurity.
• Its employees are part of the Public Service, but are employed by CSE, as a separate agency of the Government of Canada.
• CSE has more than 2,900 employees, among whom are some of Canada’s brightest mathematicians, computer scientists, engineers, and intelligence analysts.
• CSE management supports employees with a healthy and positive working environment focused on innovation, collaboration and well-being. During the pandemic, CSE has ensured that its employees working on-site have a safe working environment, and those working from home have the necessary tools and technology to do meaningful and important work.
• Our approach has ensured that CSE’s efforts to protect Canada and Canadians has continued unabated during the pandemic, and that our employees have had the flexible work arrangements they need.
• In the annual Public Service Employee Survey, CSE routinely ranks near the top of best places to work in the Government of Canada, with employees rating innovation, diversity and management support at rates far higher than the rest of the Public Service.
• When employees do raise concerns through the survey or other means, CSE takes action to improve. For example, when employees raised concerns about the timeliness of pay, CSE took action to address urgent backlogs, and we continue to pursue other means to address issues around the processing of pay.
• CSE’s executive management team continues to work towards a negotiated resolution with the Public Service Alliance of Canada (PSAC) for a mutually beneficial collective agreement. CSE takes an interest-based bargaining approach in good faith to create the best working environment, and a fair and competitive total compensation package for all employees.
• This includes ensuring ongoing benefits such as market allowance for CSE employees who are eligible to receive it. The interest-based bargaining approach is closely coordinated with TBS, the GC lead for collective bargaining to ensure that negotiations are in the best and balanced interests of CSE’s union members and the Canadian public.

OGGO (Nuctech summary from appearance with CSE)

House Committee on Government Operations and Estimates (OGGO)

Study on the Nuctech security equipment contract | November 18, 2020

Potential questions and answers prepared for Michèle Mullen

Nuctech

Does CSE have any concerns over the NucTech contract?

CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or comment on specific companies. CSE continues to support the Government of Canada and ensure that its cyber security is robust and protects all GoC networks from threats.

How does CSE assess risk for specific venders or companies?

• The Cyber Centre does not provide general assessments about companies, nor make statements to GC Departments dictating procurement decisions.
• As part of CSE’s risk mitigation programs, CSE provides advice and guidance to help GC departments with their own risk-informed decisions.
• Ultimately, adoption of specific technical solutions and products is the responsibility of network owners and operators. CSE offers its best technical advice and guidance to help those network owners and operators to make their best-informed choices and in consideration of cyber security risks.

Has the Cyber Centre ever assessed NucTech for any other department?

• As I mentioned, CSE provides advice and guidance to other government departments so they can make their own risk-informed decisions. This happens upon request and the decision, ultimately, is up to them.
• CSE has done an assessment of Nuctech for a couple of different departments including for the RCMP at the G7 in Huntsville.

What were the results of the assessment for the Royal Canadian Mounted Police (RCMP)?

• To be more specific: CSE provided security advice on Nuctech products, once for the RCMP and once for the Canada Border Services Agency (CBSA). In both cases products had been bought, and in one case (RCMP) installed, and CSE provided mitigation advice in those situations.
• Security screening equipment is not traditionally deemed IT equipment, so an IT security review is not necessarily triggered in the procurement process. Technological advances however mean that today’s screening equipment is often connected to the internet and that introduces a new level of risk.

Was CSE asked to review Nuctech by Global Affairs Canada (GAC)/ Have you seen the risk assessment by GAC?

• No we were not. We only conduct Supply Chain Integrity Assessments for specific deployment. A standing offer does not have specific deployment.
• I have not seen the risk assessment by GAC.

Why didn’t CSE have any documents to disclose in the production of papers request?

• CSE did not have any documents that met the scope of this request.
• As the committee is studying the standing offer awarded by Global Affairs Canada, we looked for documents related to that issue.

What are the steps in the risk mitigation process?

• A supply chain cyber security risk assessment involves three main components:
• An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
• A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
• A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.

What did you mean by “supply chain process”?

• The chief’s shorthand ‘supply chain process’ speaks to a supply chain cyber security risk assessment that involves three main components:
• An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
• A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
• A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.

Tik tok

Does CSE have any concerns about the social media app Tik Tok?

• CSE, and its Canadian Centre for Cyber Security (Cyber Centre), defends the Government of Canada's networks from threats; provides cyber security advice and guidance to other levels of government and critical infrastructure; and offers simple but effective tips that all Canadians can use to keep themselves safer online.
• CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or ban social media applications. It is important for Canadians to adopt good cyber security practices, including assessing possible risks of using social media platforms and apps.
• The Cyber Centre previously issued advice and guidance to help Canadians protect how they connect to social media and instant messaging services.

On August 8, President Trump stated that he plans to ban Tik Tok from the US, will Canada follow suit?

• As stated, CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or ban social media applications.
• It is important for Canadians to adopt good cyber security practices, including assessing possible risks of using social media platforms and apps.

Canada Revenue Agency (CRA)

Is the Canadian Centre for Cyber Security exploring the possibility that these cyber threats were by foreign hackers? Are you exploring if these cyber attacks were by a foreign state, or state-sponsored actors?

• We work with our partners at the Treasury Board Secretariat of Canada (TBS) Chief Information Office (CIO), and Shared Services Canada to ensure the Government of Canada has robust systems and tools in place to monitor, detect, and investigate potential threats, and to neutralize threats when they occur.
• We also provide advice and guidance about cyber security so that Canadians are armed with basic measures that they can take to significantly offset the risks of compromise.
• Given the investigation into this incident is ongoing, I am unable to comment on a threat actor.
• We remind Canadians with compromised passwords—whether implicated in this or any other incident—to update them immediately and avoid reuse, particularly for important accounts that may contain personal or financial information.

Huawei and 5G

Our Five Eyes partners have made decisions on Huawei and their 5G networks, with the UK recently banning them. Has/Will Canada make a decision on Huawei?

• CSE, Public Safety, the Department of National Defence, the Canadian Security Intelligence Service, Global Affairs Canada, and Innovation, Science, and Economic Development are continuing to work together on this issue.
• While we cannot comment on specific companies, an examination of emerging 5G technology and the associated security and economic considerations is underway. Canada’s review will consider technical and security factors, and include advice from our security agencies, and decisions from our Allies.
• Canadians can be assured that the Government is working to make sure that robust protections are in place to safeguard the communications systems that Canadians rely on.

CSE activities and COVID-19

What is CSE’s Cyber Centre doing to support GC departments and agencies during this time?

• The Cyber Centre has been working to protect the Government of Canada through a number of different measures, including the continued monitoring of important Government of Canada programs such as the Canada Emergency Response Benefit (CERB).
• This critical work has also included an evaluation of cloud applications for organizations such as the Public Health Agency of Canada and enabling cyber security monitoring and defence for cloud usage across the Government of Canada.
• To help clients and Canadians make informed cyber-safe decisions, the Cyber Centre shared cyber security tips on video-teleconferencing tools and telework and published a non-product specific advice and guidance document to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.

What is the Government doing to counter misinformation about COVID-19?

• CSE and its Cyber Centre are working in coordination with industry partners, including commercial and international Cyber Incident Response Teams.
• This work is resulting in the removal of a number of malicious sites, including fake sites that have spoofed the Public Health Agency of Canada, Canada Revenue Agency, and Canada Border Services Agency, which have been related to cyber-crime and fraud.

There are reports that Canadians have lost more than $1.2 million to COVID-19 scams. What is CSE doing to protect Canadians?

• The Cyber Centre has been actively sharing examples of these fraudulent messages with Canadians via our public twitter account. The Cyber Centre has worked closely with industry and commercial partners to facilitate the removal of malicious websites, including those that have spoofed Canadian Government departments and agencies.
• These efforts have resulted in the removal of a significant number of Canadian themed fraudulent sites that were designed specifically for malicious cyber activity, such as phishing and malware delivery.

Has the government directed CSE to assist the U.S. investigation into COVID-19’s origins and early steps taken by Beijing?

• CSE has a strong and valuable relationship with its Five Eyes alliance partners. We regularly share information with our partners, including the U.S., which has a significant impact on protecting our respective countries’ safety and security.
• Although we do not comment on our foreign intelligence operations, we can tell you that CSE continues to exercise our authorities to help ensure that Canada is protected against threats, and that the Government of Canada has foreign intelligence and cyber security insights to help inform decisions on national priorities, including COVID-19.
• In both our national lead roles, we apply our expertise and we engage with both our domestic and international security and intelligence partners, and other Government of Canada departments.

Has there been any observable change of cyber intrusions or attempts of intrusions due to the COVID-19 pandemic from foreign state-sponsored actors?

• CSE continues to advise the government on foreign related attacks before and during the COVID-19 Pandemic.
• The bulk of malicious threat activity we have observed during the COVID-19 pandemic continues to be criminal in nature, and we are working with the appropriate partners to address such activity. For example, CSE has issued alerts and cyber security advice about COVID-related phishing campaigns.
• We assess that foreign intelligence agencies will almost certainly continue to use their cyber capabilities to pursue intelligence related to COVID-19 medical research and intellectual property. Intellectual property, especially related to vaccine development, treatments, COVID-19 testing, and medical devices such as ventilators or personal protective equipment (PPE), would offer public health, economic, and national security benefits.

Has the Cyber Centre dealt with any compromises of our own research organizations?

• The Cyber Centre is aware of incidents of malicious threat activities directed at Canadian health research organizations.
• With regards to these incidents, the Cyber Centre continues to offer support and cyber security mitigations services to limit any potential impacts to targeted organizations.
• The Cyber Centre continues to recommend all Canadian health and research organizations remain vigilant and apply best practices in cyber security, especially during COVID-19. Such practices include monitoring network logs, remaining alert to suspicious emails and calls, and keeping servers and critical systems patched for all known security vulnerabilities.
• While we cannot speak on any specific incidents, know that we are working with Canadian health care and research sectors, and other partners and industries, as appropriate.

Teleworking

With more people working from home, what advice has the Cyber Centre given to Canadians about which platforms are safe to use?

• The Canadian Centre for Cyber Security has shared advice and guidance to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.
• Cyber security tips for remote work were also issued by the Cyber Centre to help inform and educate Canadians about how to stay safe online.
• The Cyber Centre continues to actively share cyber security tips and helpful information on its social media channels, as well as the Get Cyber Safe public awareness campaign.

Privacy

On the development of tracking applications during the COVID-19 pandemic: how will the Federal Government of Canada ensure the rights and privacy of Canadians?

• The security and intelligence community will continue to play a crucial role by providing timely and relevant information in support of our Government’s extraordinary efforts to manage this current crisis.
• Regarding the official Government of Canada COVID-19 Exposure Notification application, CSE’s Cyber Centre has been asked to provide cyber security advice and guidance, and we have agreed to provide the support that we can, within our mandate.
• We are engaged with our federal government partners, including Health Canada, Treasury Board Secretariat (TBS) and Canadian Digital Services (CDS) and will be sharing our cyber expertise to ensure that the official application has been designed and built securely. It is important to note, however, that CSE and the Cyber Centre have no mandate to collect or analyze data in connection with the Government’s COVID-19 exposure notification initiative.

What is the Canadian Internet Registration Authority (CIRA) Canadian Shield?

• Launched on April 23, 2020, the CIRA Canadian Shield is a free DNS firewall service that will provide online privacy and security to Canadians.
• The Canadian Shield provides enterprise-grade privacy and cyber security protection to Canadians by leveraging CIRA’s national DNS infrastructure and a global partnership with Akamai Technologies.
• CIRA has also partnered with the Cyber Centre to integrate its Canadian threat feed into Canadian Shield. This partnership provides Canadian Shield users with enhanced protections through Cyber Centre derived threat intelligence.

What are the privacy implications of the Canadian Shield?

• No personally identifiable information (PII) of any kind is transmitted to the Canadian Centre for Cyber Security.
• CIRA has committed to a full annual privacy audit, conducted by a third-party auditor, to ensure adherence to the highest standards of data privacy.

How can we better protect privacy while health data is actively targeted?

• Cyber security is a baseline condition for the protection of data. Confidentiality is one of the main goals of the protection of cyber systems and is as important as making sure that data is available. The Office of the Privacy Commissioner has published excellent guidance related to ensuring data is protected adequately from a privacy perspective.
• CSE has assessed that it is near certain that state sponsored actors have shifted their focus during the pandemic, and that Canadian intellectual property represents a valuable target.
• We continue to recommend that Canadian health organizations remain vigilant and take the time to ensure that they are applying cyber defence best practices, including increased monitoring of network logs, reminding employees to be alert to suspicious emails, use secure teleworking practices, ensuring that servers and critical systems are patched for all known security vulnerabilities.

Cyber security in the health sector

How have cyber criminals been taking advantage of the COVID-19 pandemic?

• Cybercriminals have been using the COVID-19 pandemic to exploit the fears and anxieties of Canadians across the country. With these feelings heightened, citizens can be less attentive to cyber risks, and cybercriminals are aware of this.
• Cybercriminals have shaped traditional methods of attacks, such as phishing and smishing attacks, to fit the coronavirus theme. Individuals may be more inclined to click on a link in an email promising free personal protective equipment or warning of virus exposure than they would be for a more familiar fishing theme.
• Threat actors are also taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. As one of 10 critical infrastructure sectors in Canada, the health sector is involved in activities critical to the health and life of many Canadians, especially during the current pandemic. Because the healthcare sector is under extreme pressure to respond to COVID-19, it is a high value target and a target of cyber-attacks.

What are the major threats to cyber security and the main vulnerabilities for the health sector?

• The sensitive nature of health data, including personal information, has made the health sector a more attractive target before and during the COVID-19 pandemic. CSE has assessed that it is near certain that state sponsored actors have shifted their focus during the pandemic, and that Canadian intellectual property represents a valuable target.
• Canada is a leader in health research, including efforts to find treatments and a vaccine for COVID-19. Data related to this research can be extremely valuable to individuals, industry and state actors, and this intellectual property is targeted by cyber criminals for financial gain and for the purpose of strategic advantage.
• The Cyber Centre assesses that ransomware will continue to target healthcare and medical research facilities, potentially jeopardizing patient outcomes and wider public health efforts.

How can stakeholders in the health sector protect their cyber systems and secure the data of Canadians?

• We continue to recommend that Canadian health organizations remain extra vigilant and ensure that they are applying cyber defence best practices, including increased monitoring of network logs, reminding employees to be alert to suspicious emails, use secure teleworking practices, ensuring that servers and critical systems are patched for all known security vulnerabilities.
• The pandemic has people doing more activities online; but generally, it does not significantly alter the cyber ecosystem or the best practices necessary to protect ourselves and our data.

Has the pandemic demonstrated an increased vulnerability in the cyber security of health data?

Threat actors are taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. Because the healthcare sector is under extreme pressure to mitigate the threat of COVID-19, they have been targets of cyber-attacks.

CSE’s cyber centre general questions

What is your role at the Cyber Centre?

As the acting Director General of Partnerships and Risk Mitigation, I run the directorate responsible for providing IT security advice, guidance and services to the government at all levels, Canadian critical infrastructure organizations as well as advancing relationships with private industry. Our overall goal is to strengthen cyber security practices in Canada.

How did the Communications Security Establishment Act change CSE’s authorities?

• The Communications Security Establishment Act gave CSE new authorities which are needed to keep up with rapid advancements in technology. These new authorities enable CSE to work more effectively and proactively to protect Canada and Canadians.
• CSE is now able, upon request, to deploy its cyber defence services to protect Canada’s critical infrastructure and other important systems designated by the Minister of National Defence as being of importance to the Government of Canada.
• CSE is now authorized to undertake both defensive and active foreign cyber operations to help protect Canadians and Canada’s interests. At the same time, CSE is also now subject to a new oversight and accountability regime to ensure the privacy of Canadians.

What are the Cyber Centre’s responsibilities?

• The Cyber Centre consolidates the key cyber security operational units of the Government of Canada under a single roof. As a unified source of expert advice and guidance, the Cyber Centre leads the Government’s response to cyber incidents.
• The Cyber Centre also collaborates with the rest of government, the private sector and academia to strengthen Canada’s cyber resilience.
• With the Cyber Centre, Canadians have a clear and trusted place to turn for cyber security.

Attribution summary

Special committee on Canada-China relations (CACN) Blues - February 25, 2023

The transcript is available on the House of commons website - Special Committee on Canada-China Relations - meeting transcript - February 25,2021

Special committee on Canada-China relations (CACN) Blues - March 11, 2023

The transcript is available on the House of commons website - Special Committee on Canada-China Relations - meeting transcript - March 11,2021

Special committee on Canada-China relations (CACN): key figures/witnesses

Officials/figures that may be invited to appear, but have not yet appeared at committee:

• Minister of National Defence
• Minister of Public Safety
• Officials from CSIS
• Officials from RCMP
• Officials from Public Safety
• Officials from Department of National Defence
• PCO National Security Advisor

CSE Response to committee

Written Response to Special Committee on Canada-China Relations

With respect to Canada’s 3G, 4G, and LTE networks, CSE has worked together with government partners and telecoms providers to mitigate cyber security risks through a collaborative risk mitigation framework (CSE’s Security review program). Since 2010, we have worked with the Canadian Security Telecommunications Advisory Committee (CSTAC) to exchange information and develop industry best practices that contribute to the security and resilience of the Canadian telecommunications systems. Since 2013, the Program has helped mitigate risks stemming from designated equipment and services, including Huawei, under consideration for use in Canadian 3G/4G/LTE telecommunications networks. To date, this program has led to:

• excluding designated equipment in sensitive areas of Canadian networks;
• mandatory assurance testing in independent third-party laboratories for designated equipment before use in less sensitive areas of Canadian networks; and
• restricting outsourced managed services across government networks and other Canadian critical networks.

With respect to 5G networks, CSE has been part of an interdepartmental government review that is considering technical, economic and security factors associated with this emerging technology. This review includes advice from CSE and other security agencies, and takes into account relevant information and decisions from our allies and partners. Each department taking part in the 5G security review has shared information and insights based on their subject matter expertise to ensure that the government has as a complete understanding of the issues in order to make informed decisions on the way forward.