Special Committee on Canada-China Relations (CACN) Appearance, Chief, CSE – March 11

Appearance details

Date: March 11, 2021

Location: Meeting to be held virtually

Time: 6:30 – 7:30 p.m.

Appearing:

  • Shelly Bruce | Chief, Communications Security Establishment (CSE)
  • Scott Jones | Head, Canadian Centre for Cyber Security
  • David Vigneault | Director, Canadian Security Intelligence Service (CSIS)
  • Rob Stewart | Deputy Minister, Public Safety
  • Brenda Lucki | Commisioner, Royal Canadian Mounted Police (RCMP)
  • John Ossowski | President, Canada Border Services Agency (CBSA)

Details: The Committee has invited officials from CSIS, CSE, RCMP, CBSA, Public Safety to appear as a continuation from the February 25 meeting with the Minister of Public Safety.

Committee information and potential questions

  • Committee membership and profiles

     

    Hon. John Mckay | Chair - LPC (Scarborough-Guildwood, ON)

    Portrait-Geoff-Regan
    • CACN since 2020
    • Former Speaker of the House (2015 to 2019)
    Key interests

    Natural resources, Chinese investment

    Election to the House of Commons

    First elected 1993 to 1997; re-elected in 2000

    Professional background
    • B.A. in Political Science, St. Francis Xavier University
    • Law degree, Dalhousie University
    • Commercial and real estate lawyer before entering politics
    Committee membership
    • Chair of the Special Committee on Canada-China Relations (CACN) (2020-)
      • Chair of Subcommittee on Agenda and Procedure of CACN
    • Former member of Standing Committee on Natural Resources (2009 to 2010, 2013 to 2015)
    • Former Vice-Chair of Standing Committee on Industry, Science, and Technology (2011 to 2013)
    • Former Vice-Chair of Standing Committee on Environment and Sustainable Development (2007 to 2008)
    • Former Member of Standing Committee on National Defence and Veterans Affairs, 2001 (during 9/11)
    Political and parliamentary roles
    • Former Speaker of the House (2015 to 2019)
    • Former Member of the Canada-China Legislation Association (2011 to 2012, 2013 to 2015)
    • Former Chair of the Board of Internal Economy (2015 to 2019)
    • Former Minister of Fisheries and Oceans (2003 to 2006)
    • Former Parliamentary Secretary to the Leader of the Government (2001 to 2003)
    • Former member of Canada-United States, Canada-France, Canada-Japan, Canada-United Kingdom, Canada-Ireland, and Canada-NATO Inter-Parliamentary Groups, and the Commonwealth Parliamentary Association
    Points of interest to CSE
    • Speaker during C-59 process; didn’t vote
    Other interests

    Chinese investment, natural resources

     

    Garnett Genuis  | Vice - Chair - CPC (Sherwood Park–Fort Saskatchewan, AB)

    Portrait - Garnett Genuis

    CACN since 2020

    Key interests

    5G and Huawei, human rights, Huawei

    Election to the House of Commons

    Elected in 2015

    Professional background
    • Bachelor of Public Affairs and Policy Management, Carleton University
    • Master’s in Public Policy, London School of Economics
    • Staffer in Prime Minister’s Office
    • Vice President of a national research firm
    Committee membership
    • Member of Special Committee on Canada-China Relations (CACN) (2020-)
    • Member of the Subcommittee on International Human Rights of the Standing Committee on Foreign Affairs and international Development, (2020-)
    • Former Member of the Standing Committee on Foreign Affairs and International Development (2017 to 2018)
    • Former member of the Standing Joint Committee for the Scrutiny of Regulations
    • Former member of the Special Joint Committee on Physician-Assisted Dying
    Political and parliamentary roles
    • Conservative Party shadow cabinet critic for Canada-China Relations and Multiculturalism
    Points of interest to CSE
    • Voted against C-59
    • CACN, July 2020: Questions on investment of Chinese state-affiliated companies
    • CACN, July 2020: “There are a number of companies, Nuctech, Dahua, Hikvision, … with close relationships with the Chinese state that we know play some role in supplying security technology.”
    • INDU, June 2020: questioned intelligence capacity of intelligence agency with the present funding levels
    Other interests

    China, human rights, infrastructure, international relations, foreign banks

     

    Jack Harris  | Vice - Chair - NDP (St. John’s East, NL)

    Portrait - Jack Harris
    • CACN since 2020
    • NDP Critic for Foreign Affairs, Public Safety
    Key interests

    National defence and security, policing, racial equality

    Election to the House of Commons

    First elected 1987 to 1990; re-elected 2008 to 2015 and 2019

    Professional background
    • Studied at Memorial University, University of Alberta, and London School of Economics
    • Newfoundland and Labrador MHA (1990 to 2006)
    • Provincial NDP Leader (1992 to 2006)
    • Lawyer
    Committee membership
    • Vice-Chair of the Special Committee on Canada-China Relations (CACN) (2020-)
      • Member of Subcommittee of CACN
    • Former Vice-Chair and member of Standing Committee on National Defence (2009 to 2015)
    • Former Member of Special Committee on the Canadian Mission in Afghanistan (2010 to 2011)
    • Former Vice-Chair of Standing Committee on Justice and Human Rights (2010 to 2011)
    • Former Vice-Chair and Member of Standing Committee on Public Safety and National Security (2009)
    Political and parliamentary roles
    • NDP Critic for Foreign Affairs, Public Safety, and the Atlantic Canada Opportunities Agency
    • NDP Deputy Critic for Defence
    • Vice-Chair and member of the Canadian NATO Parliamentary Association
    • Former member of the Canada-United States, Canada-Europe, Canada-United Kingdom, and Canada-Ireland Inter-parliamentary groups/associations
    Points of interest to CSE
    • CACN, August 2020: Interest in foreign influenced activities and coordination of RCMP and CSIS.
    Other interests

    Defence issues, racial equality, law enforcement, Indigenous peoples

     

    Stéphane Bergeron | Vice - Chair - BQ (Montarville, QC)

    Portrait - Stéphane Bergeron

    CACN since 2020

    Key interests

    International relations and trade, families and seniors issues

    Election to the House of Commons

    Elected 1993 to 2005, re-elected 2019

    Professional background
    • Political Science, Université du Québec and Université Laval
    • Cadet Instructor Cadre officer, Canadian Armed Forces (1984 to 1993)
    • Parti Québécois member of the Quebec National Assembly (2005 to 2018)
    Committee membership
    • Vice-Chair of Special Committee on Canada-China Relations (CACN) (2020-)
    • Member of Standing Committee on Foreign Affairs and International Trade (2002 to 2004)
    • Member of Standing Committee on Procedure and House Affairs (1997 to 2001)
    Political and parliamentary roles
    • Party Critic for Foreign Affairs
    • Member of Canada-China Legislative Association (2004 to 2006, 2019-)
    • Member of Canada-United States, Canada-Africa, Canada-Germany, Canada-Europe, Canada-Israel, Canada-France, Canada-Japan, Canada-Italy, and Canada-Ireland Inter-parliamentary groups/associations
    Points of interest to CSE
    • NIL
    Other interests

    Families and seniors, heatlh transfers, immigration, human rights, federal-provincial relations

     

    Peter Fragiskatos - LPC (London North Centre, ON)

    Portrait - Peter Fragiskatos

    CACN since 2020

    Key interests

    International relations

    Election to the House of Commons

    Elected in 2015

    Professional background
    • PhD in International Relations from Cambridge University, also studied at University of Western Ontario and Queens University
    • Political science professor and media commentator
    Committee membership
    • Member of the Special Committee on Canada-China Relations (CACN) (2020-)
    • Former member of the Standing Committee on Finance (2018 to 2019)
    • Former member of the Standing Committee on Public Safety and National Security, (2017 to 2018)
    • Former member of the Standing Committee on Foreign Affairs and International Development, 2016 to 2017
    Political and parliamentary roles
    • Member of Canada-China Legislation Association, 2016 to 2017
    • Former member of Canadian NATO and Canada-Africa Parliamentary Associations
    Points of interest to CSE
    • Voted in favour of C-59
    Other interests

    Supporting SMEs, international relations, public transit

     

    Robert Oliphant - LPC (Don Valley West, ON)

    Portrait - Robert Oliphant
    • CACN since 2020
    • Parl. Sec. for Foreign Affairs
    Key interests

    International relations, national security

    Election to the House of Commons

    Elected in 2008

    Professional background
    • B. Commerce, University of Toronto
    • Masters in Theology, University of British Colombia
    • Doctor of Ministry, Chicago Theological Seminary
    • United Church minister
    • Former Chief of staff to Ontario Provincial Minister of Women’s Issues and Minister of Culture and Communications, 1989 to 1990
    • President and CEO of Asthma Society of Canada, 2011 to 2015
    Committee membership
    • Member of Special Committee on Canada-China Relations (CACN) (2020-)
    • Former Chair of Standing Committee on Public Safety and National Security (2016 to 2019)
    • Former Chair of Standing Committee on Citizenship and Immigration (2017 to 2019)
    • Former non-voting member of Standing Committee on International Trade (2019)
    Political and parliamentary roles
    • Parliamentary Secretary to the Minister of Foreign Affairs
    • Member of the Canada-China Legislative Association (2015-)
    • Member of the Canada-United States, Canada-Africa, Canada-Germany, Canada-Israel, Canada-Japan, and Canada-France Inter-Parliamentary groups/associations
    • Member of the Canadian Delegation to the Organization for Security and Co-operation in Europe Parliamentary Assembly
    Points of interest to CSE
    • Voted in favour of C-59
    Other interests

    China, International relations

     

    Emmanuel Dubourg - LPC (Bourassa, QC)

    Portrait - Emmanuel Dubourg
    • CACN since 2020
    • Member of NSICOP (2017 to 2019)
    Key interests

    National security, international tax policy, Huawei, language rights

    Election to the House of Commons

    Elected in 2013

    Professional background
    • MBA, Université du Québec à Montréal
    • Chartered Accountant and Teacher
    • Manager and Advisor at the Canada Revenue Agency
    • Liberal member of the Quebec National Assembly (2007 to 2013)
    Committee membership
    • Member of the Special Committee on Canada-China Relations (CACN) (2020-)
    • Member of the Standing Committee on Official Langauges since 2020
    • Former member of the Standing Committee on Access to Information, Privacy and Ethics (2017 to 2018)
    Political and parliamentary roles
    • Member of the National Security and Intelligence Committee of Parliamentarians, 2017 to 2019)
    • Former Parliamentary Secretary to the Minister of National Revenue (2015 to 2017)
    • Former member of the Canadian NATO Parliamentary Association (2018 to 2019)
    • Former Member of the National Security and Intelligence Committee of Parliamentarians (2017 to 2019)
    Points of interest to CSE
    • Voted in favour of C-59
    • CACN, March 2020: question about the decision to be made on Huawei and concerns about national security
    Other interests

    Tax policy, international relations, official langauges, trade

     

    Jean Yip - LPC (Scarborough-Agincourt, ON)

    Portrait - Jean Yip

    CACN since 2020

    Key interests

    Asian diaspora communities, seniors issues

    Election to the House of Commons

    Elected in 2017 (by-election)

    Professional background
    • University of Toronto
    • Career in insurance and underwriting; holds her Fellow Chartered Insurance Professional Delegation
    Committee membership
    • Member of Special Committee on Canada-China Relations (CACN) (2020-)
    • Former member of Standing Committee on Government Operations and Estimates (2018 to 2019)
    • Former member of Standing Committee on Public Accounts (2018 to 2019)
    Political and parliamentary roles
    • Member of the Canada-China Legislative Association (2020-)
    • Member of the Canadian Branch of the Commonwealth Parliamentary Association
    • Former member of the NATO Parliamentary Association
    • Former member of the Canada-Israel, Canada-Germany, Canada-Philippines, and Canada-Armenian Inter-parliamentary groups
    Points of interest to CSE
    • Voted in favour of C-59
    • CACN, August 2020: “Do you feel that TikTok is a national security threat, and will the ban be effective in limiting China's interference?”
    Other interests
    • Made a statement highlighting the importance of Asian Heritage Month in May, 2018; riding has a large Asian population
    • Seniors issues, international relations, information collection
     

    Pierre Paul-Hus - CPC (Charlesbourg-Haute-Saint-Charles, QC)

    Portrait - Pierre Paul-Hus

    CACN since 2020

    Key interests

    Immigration, Quebec

    Election to the House of Commons

    Elected in 2015

    Professional background
    • Degree in Political Science from Laval University
    • Graduate of the Kingston Staff College in Ontario and Military School of Paris
    • Owned PRESTIGE Group Média
    • Shareholder of Sélections Mondial des Vins – Canada (the largest wine competition in North America)
    • Joined the Régiment de la Chaudière, a reserve unit in the Canadian Armed Forces (22 years of military service). He ended his military career in 2009.
    Committee membership
    • Member of the Standing Committee on Government Operations and Estimates (2020-)
    • Member of the Special Committee on Canada-China Relations (2020-)
    • Former Vice-Chair of the Standing Committee on Public Safety and National Security (2020) (member from 2016 to 2019)
    Political and parliamentary roles
    • Shadow Minister for Public Services and Procurement (2019-)
    • Counsellor on the Canadian NATO Parliamentary Association (2020)
    • Member of the Canada-Europe Parliamentary Association, Member of the Canada-Israel Interparliamentary Group, Member of the Canada-United States Interparliamentary Group (2020)
    • Former Vice-Chair of Canadian NATO Parliamentary Association (2018 to 2020)
    Points of interest to CSE
    • Raised Question Period: “Mr. Speaker, Canada is the only Five Eyes ally that has not yet made a decision about Huawei's participation in our 5G network…What is the Prime Minister waiting for to ban Huawei from our 5G network and to protect Canadian businesses and citizens?”, March 2020
    • Raised in the House: “[my constituents] are also concerned about the government's failure to make a decision about banning Huawei from the 5G network. They know that the communist Chinese regime spies on us and regularly steals Canadian intellectual property, but they do not see the government doing anything to protect them”, March 2020
    Other interests

    Veterans, border safety, immigration in Quebec

     

    Lenore Zann - LPC (Cumberland-Colchester, NS)

    Portrait - Lenore Zann

    CACN since 2020

    Key interests

    Environmental issues, human rights and racial issues

    Election to the House of Commons

    Elected in 2019

    Professional background
    • Drama, Fine Arts, and Political Science at York University
    • Career as a screen, stage, and voice actress before moving back to her hometown of to Truro, NS and entering public life
    • Former MLA for Provincial NDP in Nova Scotia (2009 to 2019)
    Committee membership
    • Member of the Special Committee on Canada-China Relations (CACN) (2020-)
    • Member of the Standing Committee on Indigenous and Northern Affairs (2020-)
    Political and parliamentary roles
    • Member of the Canadian NATO Parliamentary Association (2020-)
    Points of interest to CSE
    • NIL
    Other interests

    Culture and arts, environmental issues, human rights and racial issues

     

    John Williamson - CPC (New Brunswick Southwest, NB)

    Portrait - John Williamson

    CACN since 2020

    Key interests

    Foreign affairs, taxpayers rights, energy

    Election to the House of Commons

    First elected in 2011, defeated in 2015, re-elected in 2019

    Professional background
    • Economics and Political Science, McGill University
    • Economic history, London School of Economics
    • Former editorial writer for National Post
    • Former national director of the Canadian Taxpayers Federation (2004 to 2008)
    • Former Director of Communications in PMO under Stephen Harper (2009 to 2010)
    Committee membership
    • Member of Special Committee on Canada-China Relations (CACN) (2020-)
    • Former member of Standing Committee on National Defence (2013 to 2015)
    • Former member of Standing Committee on Foreign Affairs and International Development (2012 to 2013)
    • Also former member of Standing Committees on Official Languages, Public Accounts, Health, and Procedure and House Affairs
    Political and parliamentary roles
    • Former member of Canada-China Legislative Association, 2013 (for one month)
    • Former member of Canada-United States, Canadian NATO, Canada-France, Canada-Japan, Canada-Europe, and Canada-United Kingdom Inter-parliamentary groups/associations
    Points of interest to CSE
    • Publically critical of current government’s dealings with China
    Other interests
    • CFB Gagetown is in his riding
    • Taxpayer rights, energy issues
     

    Hon. Michael Chong - CPC (Wellington-Halton Hills, ON)

    Portrait - Michael Chong

    CACN since 2020

    Key interests

    China, immigration, langauge rights, data

    Election to the House of Commons

    Elected in 2004

    Professional background
    • Former acting Chief Information Officer for the National Hockey League Players’ Association
    • Worked as a senior technology consultatnt to the Greater Toronto Airports Authority
    • Co-founded the Dominion Institute, now known as Historica Canada. Currently sits on Board of Governors
    • Degree in Philosophy from Trinity College at the Universtiy of Toronto
    Committee membership
    • Member of Special Committee on Canada-China Relations (CACN) (2020)
    • Member of the Standing Committee on Foreign Affairs and International Development (2020-)
    • Former Member of the Standing Committee on Official Languages (2020)
    • Former Member of the Standing Committee on Industry, Science and Technoloogy (2018 to 2019)
    • Former Member of the Standing Committee on Transport, Infrastructure and Communities (2017 to 2018)
    Political and parliamentary roles
    • Critic for Foreign Affairs (2020-)
    • Former President of the Queen’s Privy Council (2006)
    • Former Minister of Intergovernmental Affairs and Minister for Sport (2006)
    • Former Member of the Canadian NATO Parliamentary Association (2018 to 2019)
    • Former Member of the Canada-China Legislative Association (2016 to 2017)
    Points of interest to CSE
    • Publically critical of current government’s dealings with China; advocates for stronger diplomatic action on Hong Kong
    • Question Period, May 2020 on the Stats Canada leak: “This leak speaks to the integrity of the government. Intelligence at the Five Eyes.... Our four allies have been telling us for years that one of the top two or three threats that democracies are facing is declining public confidence in our key institutions. Democracies have been blindsided by misinformation, disinformation and cyber-attacks...”
    Other interests

    Passed The Reform Act in 2015, language rights, immigration, international relations

     

    Todd Doherty - CPC (Cariboo-Prince George, BC)

    Portrait - Todd Doherty
    Key interests

    Veterans and CAF issues

     

    Rachel Blaney - NPD (North Island – Powell River, BC)

    Portrait - Rachel Blaney

    CFB Comox in riding

    Key interests

    Search and rescue, reserves, closure of government operations and facilities

     
  • Committee backgrounder

    43rd Parliament, 2nd session

    Mandate

    CACN is a Special Committee appointed to conduct hearings to examine and review all aspects of the Canada-China relationship. This includes, but is not limited to, consular, economic, legal, security and diplomatic relations.

    Appearances
    • February 25, 2021: CSE was invited to appear alongside the Minister of Public Safety and other government officials to discuss the cyber security dimensions of the Canada-China relationship.
    Key studies
    • Current session (42nd Parliament, 2nd session)
      • Canada-China Relations
      • Hong Kong
      • National Security
    • Report 1: Canada-China Relations presented to the House on October 19, 2020
    Previous meetings (current session)
    • Friday October 9, 2020: Election of Chair
      Geoff Regan (LPC) was elected Chair. Garnett Genuis (CPC), Stéphane Bergeron (BQ) and Jack Harris (NDP) were elected Vice-Chairs of the Committee.
    • Monday October 26, 2020: Committee Business
      The Committee adopted a motion to resume its study on the situation in Hong Kong. Upon the completion of the Hong Kong study, the committee will study issues related to national security, including cyber security and foreign influence.
    • Monday November 2, 2020: Canada-China Relations
      Appearance from Jeff Nankivell, Consul General of Canada in Hong Kong and Macao, Global Affairs Canada.
    • Monday November 9, 2020: Canada-China Relations
      Appearances from the National Democratic Institute, Vancouver Society in Support of Democratic Movement and several individuals from academia and media organizations.
    • Monday November 16, 2020: Canada-China Relations
      Appearance from the Hon. Marco Mendicino, Minister of Immigration, Refugees and Citizenship, alongside officials from the Department of Citizenship and Immigration.
    • Tuesday November 17, 2020: Canada-China Relations
      Appearance from Shawn Steil, Executive Director of Greater China Policy from the Department of Foreign Affairs, Trade and Development.
    • Monday November 23, 2020: Canada-China Relations
      Appearance from the Hon. François-Philippe Champagne, Minister of Foreign Affairs, alongside officials from the Department of Foreign Affairs, Trade and Development.
    • Tuesday November 24, 2020: Canada-China Relations
      Appearances from former Ambassadors of Canada to the People’s Republic of China.
    • Monday November 30, 2020: Canada-China Relations
      The committee commenced consideration of a draft report.
    • Tuesday December 1, 2020: Canada-China Relations
      The committee resumed consideration of a draft report.
    • Monday December 7, 2020: Canada-China Relations
      The committee resumed consideration of a draft report.
    • Tuesday December 8, 2020: Canada-China Relations
      Appearances from Dominic Barton, Ambassador Extraordinary and Plenipotentiary of Canada to the People's Republic of China, and Shawn Steil, Executive Director of Greater China Policy from the Department of Foreign Affairs, Trade and Development.
    • Thursday January 28, 2021: Canada-China Relations
      The committee agreed that officials from CSE, CSIS, and the RCMP provide a briefing on the topic of the national security dimensions of the Canada-China relationship. It was then agreed that the Minister of Public Safety, along with departmental officials, be invited to appear regarding this topic.
    • Monday February 1, 2021; Thursday February 4, 2021; Thursday February 18, 2021: Canada-China Relations and Monday February 22, 2021: Canada-China Relations
      The committee resumed consideration of a draft report.
    • Thursday February 25, 2021: Canada-China Relations
      Appearance from the Hon. Bill Blair, Minister of Public Safety and Emergency Preparedness alongside officials from Public Safety, RCMP, CBSA, CSIS and CSE.
  • Potential questions

    National Cyber Threat Assessment report

    • What is the National Cyber Threat Assessment report? What information does it include?
      • On November 18, The Cyber Centre released the National Cyber Threat Assessment report 2020, an update to its 2018 report.
      • The NCTA 2020 provides an update to the 2018 National Cyber Threat Assessment with an analysis of the interim years and forecasts looking ahead to 2022.
      • The key judgements in this report are based on reporting from multiple sources, including classified and unclassified information. The judgements are based on the Cyber Centre’s knowledge and expertise in cyber security and informed by CSE’s foreign intelligence mandate, which provides us with valuable insights on cyber threat activity around the world.
    • What are the primary concerns and observations made in the report?

      The National Cyber Threat Assessment 2020 highlights 4 key observations:

      • First, cyber-crime is the most likely threat to impact Canadians now and in the years ahead;
      • Second, cybercriminals often succeed in their work because they exploit human and social behaviours;
      • Third, ransomware directed against Canada will almost certainly continue to target large enterprises and critical infrastructure providers.
      • Finally, while cybercrime is the main threat, state-sponsored cyber programs of China, Russia, North Korea and Iran pose a strategic threat to Canada.

    Procurement

    • Was CSE asked to review the Visa Application Centre contract?
      • As part of CSE’s risk-mitigation programs, CSE provides advice and guidance to help GC departments with their own risk-informed decisions.
      • CSE’s Cyber Centre is not a regulatory agency and as such, we do not endorse or comment on specific companies.
      • CSE offers technical advice and guidance to help GC network owners and operators to make their best-informed choices, such as in consideration of cyber security risks.
    • Will there be changes to the contracting process?

      We are being engaged earlier as part of the contracting process on identified procurements. As noted in the NCTA more and more equipment is being internet enabled and connected which will inevitably increase demands on CSE for these reviews. At this time the program is strained for capacity but looking at ways to find efficiencies. One of these is including more advanced security requirements into contracts.

    • How does the CSE assess risk for specific vendors or companies?
      • The Cyber Centre does not make assessments about companies, nor dictate procurement decisions.
      • As part of CSE’s risk-mitigation programs, CSE provides advice and guidance to help GC departments with their own risk-informed decisions.
      • Ultimately, adoption of specific technical solutions and products is still the specific responsibility of GC network owners and operators. CSE offers technical advice and guidance to help GC network owners and operators to make their best-informed choices, such as in consideration of cyber security risks.
    • Has the Cyber Centre ever assessed companies for any other department?

      Upon request, CSE may provide advice and guidance to other government departments so they can make their own risk-informed decisions. This happens upon request and the decision, ultimately, is up to them.

    • What are the steps in the risk mitigation process?

      A supply chain cyber security risk assessment involves three main components:

      • An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
      • A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
      • A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.

    Huawei and 5G

    • Our Five Eyes partners have made decisions on Huawei and their 5G networks, with the UK recently banning them. Has/Will Canada make a decision on Huawei?

      The Government of Canada is working to ensure that robust protections are in place. CSE continues to collaborate with Innovation, Science and Economic Development; National Defence; Public Safety; CSIS; Global Affairs and other partners on reviewing the approach to emerging 5G technology.

    • Does CSE have any concerns about the social media app Tik Tok or WeChat?

      CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or ban social media applications. It is important for Canadians to adopt good cyber security practices – which we share on the cyber.gc.ca website. This includes knowing and activating an app’s security measures, knowing where their data is stored and managing it properly, and assessing other possible risks of using social media platforms and apps.

    State-sponsored activities

    • Has there been any observable change of cyber intrusions or attempts of intrusions due to the COVID-19 pandemic from foreign state-sponsored actors?
      • CSE continues to advise the government on foreign related attacks before and during the COVID-19 Pandemic.
      • The bulk of malicious threat activity we have observed during the COVID-19 pandemic continues to be criminal in nature, and we are working with the appropriate partners to address such activity. For example, CSE has issued alerts and cyber security advice about COVID-related phishing campaigns.
      • We assess that foreign intelligence agencies will almost certainly continue to use their cyber capabilities to pursue intelligence related to COVID-19 medical research and intellectual property. Intellectual property, especially related to vaccine development, treatments, COVID-19 testing, and medical devices such as ventilators or personal protective equipment (PPE), would offer public health, economic, and national security benefits.
      • Adopting cybersecurity best practices goes a long way to offsetting risks of exploitation by any cyber threat actor.
    • Are Chinese state-sponsored actors attempting to disrupt Canadian critical infrastructure?
      • The Cyber Centre has assessed that state-sponsored programs of China, Russia, Iran and North Korea all pose threats to Canada.
      • We’ve also assessed that it’s very likely that state-sponsored actors are attempting to develop capabilities that could disrupt critical infrastructure, such as the supply of electricity.
      • These actors may also continue to target our critical infrastructure to collect information, position for future activity or intimidate.
      • But we assess it is unlikely that actors will use cyber activities to disrupt or harm critical infrastructure outside conflict scenarios.
      • Adopting cybersecurity best practices goes a long way to offsetting risks of exploitation by any cyber threat actor.
    • Has there been an increase in commercial espionage against Canadian organizations from state-sponsored actors?
      • As mentioned in the NCTA 2020 Report, state-sponsored actors will certainly continue to conduct espionage against Canadian businesses, academic or governments to steal intellectual property or proprietary information. State-sponsored cyber threat actors will continue to target intellectual property related to combatting COVID-19 in order to support their own domestic health responses or to profit from its illegal reproduction by their own firms.
      • Adopting cybersecurity best practices goes a long way to offsetting risks of exploitation by any cyber threat actor.
    • The recent NCTA points to state-sponsored activities of China, as well as a few other countries, specifically. Going forward, what needs to be done to protect the Government of Canada’s assets and data from state-sponsored aggression?
      • CSE’s foreign intelligence mandate provides us with a unique insight into the cyber threat environment. We regularly share threat information with our domestic and international partners, and we are able to see firsthand what the evolving cyber threat landscape looks like, including the tactics, techniques and procedures within the cyber threat intelligence world.
      • Within the Government of Canada, the Cyber Centre is responsible for the protection of our assets and data. The Host-Based Sensor (HBS) program is a unique and innovative Canadian technology that is part of a layered approach to defending Canadian federal government systems. HBS is applied in combination with the Cyber Centre’s capabilities at the network perimeter. This “dynamic defence” program uses advanced analytics to help protect government systems from cyber exploitation.
      • These integrated capabilities are part of a complex program, and we are proud of the leading-edge nature of the HBS component and how it has evolved over the past decade. In recent years, we have worked with our UK counterparts to help them implement the host-based capability within their own systems.
      • The Government of Canada, through its quantum innovation strategy "Quantum Canada", has also been taking steps to protect its communications against future attacks by quantum computing. For example, CSE has undertaken the Interim Quantum Safe Capability in collaboration with other government departments to ensure the Government of Canada’s classified cryptographic devices are appropriately updated.
      • CSE has also established the Quantum Security Technology Access Centre, a joint effort between CSE, the National Research Council of Canada and other government departments. CSE and Shared Services Canada continue to work together to defend the Government of Canada’s information networks and systems through internet gateways and leading-edge cyber defence.

    CSE activities and COVID-19

    • What is CSE doing to support GC departments and agencies during this time?
      • CSE has been working to protect the Government of Canada through a number of different measures during the COVID-19 pandemic.
      • This work included monitoring of important Government of Canada programs such as the Canada Emergency Response Benefit (CERB) and evaluating cloud applications for organizations like the Public Health Agency of Canada. CSE has worked to enable cyber security monitoring and defence for cloud usage across the Government of Canada.
      • To help clients and Canadians make informed cyber-safe decisions, CSE’s Cyber Centre shared cyber security tips on video-teleconferencing and telework tools and published a non-product specific advice document to help clients make informed decisions.
    • How have cyber criminals taken advantage of the COVID-19 pandemic?
      • Cybercriminals have been using COVID-19 to exploit the fears of Canadians. With these feelings heightened, citizens can be less attentive to cyber risks and cybercriminals are aware of this.
      • Cybercriminals have shaped traditional methods of attacks, such as phishing and cyber attacks, to fit the coronavirus theme. Individuals may be more inclined to click on a link in an email promising free personal protective equipment or warning of virus exposure than they would be for a more familiar fishing theme.
      • Threat actors are also taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. As one of 10 critical infrastructure sectors in Canada, the health sector is involved in activities critical to the health and life of many Canadians, especially during the pandemic. Because the healthcare sector is under extreme pressure to respond to COVID-19, it is a high value target for cyber actors.
      • Threat actors are also taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. As one of 10 critical infrastructure sectors in Canada, the health sector is involved in activities critical to the health and life of many Canadians, especially during the pandemic. Because the healthcare sector is under extreme pressure to respond to COVID-19, it is a high value target for cyber actors.
    • What is the Government doing to counter misinformation about COVID-19?
      • CSE and its Cyber Centre are working in coordination with industry partners, including commercial and international Cyber Incident Response Teams.
      • This work is resulting in the removal of a number of malicious sites, including fake sites that have spoofed the Public Health Agency of Canada, Canada Revenue Agency, and Canada Border Services Agency, which have been related to cyber-crime and fraud.
    • There are reports that Canadians have lost more than $1.2 million to COVID-19 scams. What is CSE doing to protect Canadians?
      • CSE and the Cyber Centre has been actively sharing examples of these fraudulent messages with Canadians via our public twitter account. We have worked closely with industry and commercial partners to facilitate the removal of malicious websites, including those that have spoofed Canadian Government departments and agencies.
      • These efforts have resulted in the removal of a significant number of Canadian themed fraudulent sites that were designed specifically for malicious cyber activity, such as phishing and malware delivery.
    • Has CSE dealt with any compromises of our own research organizations?
      • CSE is aware of incidents of malicious threat activities directed at Canadian health research organizations and continues to offer support and cyber security mitigations services to limit any potential impacts to targeted organizations.
      • CSE recommends that all Canadian health and research organizations remain vigilant and apply best practices in cyber security. Such practices include monitoring network logs, remaining alert to suspicious emails and calls, and keeping servers and critical systems patched for all known security vulnerabilities.
      • While we cannot speak on any specific incidents, know that we are working with Canadian health care and research sectors, and other partners and industries, as appropriate.
    • What has CSE done specifically to reduce the risks that Canadian research and development efforts could be compromised, specific points about what we are doing with Canadian universities, GC science departments, and the private sector?
      • CSE, in collaboration with CSIS continues to engage with all of these entities to provide threat briefings. CSE, through our cyber centre, has published practical steps organizations can proactively do to protect themselves. These are all available online. This is in addition to alerts and advisories published regularly to draw attention to security vulnerabilities or issues.
      • Further, when we see foreign state actors performing these activities we have both alerted the victims and assisted with recovery but also, with our colleagues around government and our allies, publicly attributed this activity as seen this past year.
      • More recently we have been working with ISED to assess the cyber security posture for recipients of strategic innovation funds but, it is important to note that all of the advice and guidance is publicly available for ALL Canadian organizations.
    • What are the main cyber security safeguarding initiatives that we collaborate on with PS?
      • Public Safety is the Policy Lead for cyber security and would have responsibility for things like the broad National Cyber Security Strategy. CSE is the technical and operational authority for Cyber Security. In practical terms this means that, as a national centre it is our role to try to raise the cyber security bar across Canada with the goal of building a secure digital Canada, as the national authority we are also response for managing the national response to cyber incidents, in addition we have been, for 75 years, the nation's cryptographer with a deep expertise in that fundamental science needed to protect us online.
      • In the event of a severe national incident PS also leads the Government Operations Centre and we would be part of that team.
      • Further to that, PS leads the all-hazards approach to critical infrastructure and, as noted in the NCTA, cyber security and critical infrastructure are tightly coupled. More recently CSE and PS collaborated on a Cyber Security Survey Tool which is a practical way for organizations in critical infrastructure to assess their cyber maturity and find ways to increase their resilience.
    • What support did CSE provide to the development of a Virtual Parliament?
      • CSE and the Cyber Centre’s partnership with the House of Commons is extremely important and includes supporting virtual sittings and committee meetings.
      • CSE and the Cyber Centre, working together with House of Commons teams, are comfortable that the platform currently in use aligns with security recommendations. Additional security measures may be waiting rooms or passwords to protect unintended interruptions.
      • CSE, including the Cyber Centre, is always monitoring for cyber threats that may be directed against Canada and Canadians, and regularly sharing threat information with our Government of Canada partners.
    • What is the Canadian Internet Registration Authority (CIRA) Canadian Shield? Are there any privacy implications?
      • Launched on April 23, 2020, the CIRA Canadian Shield is a free DNS firewall service that will provide online privacy and security to Canadians.
      • The Canadian Shield provides enterprise-grade privacy and cyber security protection to Canadians by leveraging CIRA’s national DNS infrastructure and a global partnership with Akamai Technologies.
      • CIRA has also partnered with the Cyber Centre to integrate its Canadian threat feed into Canadian Shield. This partnership provides Canadian Shield users with enhanced protections through Cyber Centre derived threat intelligence.
      • In terms of privacy, no personally identifiable information (PII) of any kind is transmitted to the Canadian Centre for Cyber Security. CIRA has committed to a full annual privacy audit, conducted by a third-party auditor, to ensure the highest standards of data privacy.
      • The Cyber Centre has a mandate to raise the cyber security bar across the whole of Canada and ensure Canadians stay protected online. A recent initiative from the Canadian Internet Registration Authority (CIRA) demonstrates how we are delivering on that mandate.
      • In the first six months, 100,000 Canadians have downloaded the tool. We recommend all Canadians check out this free service to see if it is right for them.
    • On the development of tracking applications during the COVID-19 pandemic: how will the Federal Government of Canada ensure the rights and privacy of Canadians?
      • The security and intelligence community will continue to play a crucial role by providing timely and relevant information in support of our Government’s extraordinary efforts to manage this current crisis.
      • Regarding the COVID Alert, the Government of Canada’s exposure notification application, CSE’s Cyber Centre has been asked to provide cyber security advice and guidance, and we have agreed to provide the support that we can, within our mandate.
      • We are engaged with our federal government partners, including Health Canada, Treasury Board Secretariat (TBS) and Canadian Digital Services (CDS) and will be sharing our cyber expertise to ensure that the official application has been designed and built securely. It is important to note, however, that CSE and the Cyber Centre have no mandate to collect or analyze data in connection with the Government’s COVID-19 exposure notification initiative.

    CSE general questions

    • How did the Communications Security Establishment Act change CSE’s authorities?
      • The Communications Security Establishment Act gave CSE new authorities which are needed to keep up with rapid advancements in technology. These new authorities enable CSE to work more effectively and proactively to protect Canada and Canadians.
      • CSE is now able, upon request, to deploy its cyber defence services to protect Canada’s critical infrastructure and other important systems designated by the Minister of National Defence as being of importance to the Government of Canada.
      • CSE is now authorized to undertake both defensive and active foreign cyber operations to help protect Canadians and Canada’s interests. At the same time, CSE is also now subject to a new oversight and accountability regime to ensure the privacy of Canadians.
    • What are the Cyber Centre’s responsibilities?
      • Created in 2018 as part of CSE, the Canadian Centre for Cyber Security consolidates the key cyber security operational units of the Government of Canada under a single roof. As a unified source of expert advice and guidance, the Cyber Centre leads the Government’s response to cyber incidents.
      • The Cyber Centre also collaborates with the rest of government, the private sector and academia to strengthen Canada’s cyber resilience.
      • With the Cyber Centre, Canadians have a clear and trusted place to turn for cyber security.
  • Recent appearances summary

    Recent Appearances on COVID-19 (May – November 2020)

    The COVID-19 pandemic has required government departments, Parliament and industry to make quick and innovative changes to the way they communicate and work. To commentate on some of the work that the Communications Security Establishment and the Canadian Centre for Cyber Security (CCCS) has done to aid both government and industry partners, Scott Jones, Head of the CCCS, has made several appearances in front of House Standing Committees. This document provides a brief summary of some of the key topics and questions that have been directed at Scott in rounds of questions, most notably at INDU, OGGO and HESA appearances.

    Cyber threats

    The COVID-19 pandemic has added a new layer of risk regarding our communication networks. Malicious actors continue to take advantage of this heightened level of fear and confusion. Members are keenly interested in how CSE/CCCS have worked to protect not just Government networks, but the networks of the health care sector and Canadians.

    Notable questions:
    • Has there been any observable decline/increase of cyber intrusions due to the lockdown from certain countries? If so, from what countries?
    • Have any of your public or private sector partners come to you asking for your help with a COVID-related incident? If so, is there any determination of the sources?
    • How is cybersecurity addressed in the Government of Canada, including cyber threats that may pose a risk to government infrastructure?

    Canada-China relations

    Top of mind for many Members is Canada-China relations; this includes topics such as Huawei, 5G technology, procurement, and state-owned enterprises. While Canada-China relations may not be directly correlated with CSE’s response to the COVID-19 pandemic, the issues of Huawei and 5G arise in most discussions, as our Five Eyes partners have banned Huawei from their networks. Scott Jones has emphasized the importance of the ongoing security assessment being led by the Minister of Public Safety, but also the importance of assessing all companies and technologies with the same rigour. More recently, CSE appeared to discuss their role in the procurement of security equipment in Canadian embassies abroad.

    Notable questions:
    • If Huawei is a part of Canada's 5G network, will it pose a security risk to Canadians?
    • Other Five Eyes partners have already made a decision on Huawei and 5G networks. Is there something different about Canada that dictates why we have not made a decision?
    • Is Huawei considered a higher risk vendor when it comes to a 5G network?
    • Do we risk being excluded from information sharing if we move ahead with Huawei?
    • Do you have any concerns about Huawei technology in home internet networks?
    • CSE just came out with the Cyber Threat Assessment Report and highlighted issues with state-owned actors, naming China and Russia for the first time. What kind of information could state-sponsored actors gain from security equipment in our embassies abroad?
    • Going forward, what do we need to do to protect our assets, our people, our data both overseas in embassies and within Canada, to protect from state-sponsored aggression?

    Support to health sector

    Members have often oriented their questions in regard to the cybersecurity of the health sector and Canadian health institutions due to the COVID-19 pandemic. Most questions directed at CSE focus on cyberattacks on health workers and health organizations, although it’s worth noting that members also have a strong interest in the safety of health data.

    Notable questions:
    • Has CSE been called into deal with intrusions against frontline health workers?
    • We know cyber-attacks on health and research organizations can come from many sources around the globe, what plan is in place at Public Safety Canada or the RCMP or both to put an end to an attack, to find the guilty party and then prevent future attacks?
    • Can you confirm if there have been any successful breaches on Canadian health research organizations working on COVID-19?

    Teleworking, virtual parliament and sensitive information

    COVID-19 has led MPs, staff, the public service, and many other Canadians to working from home. Teleworking adds another challenge and level of risk in cyber-security. Members asked several questions regarding the transferring and handling of sensitive information, as well as ways the CCCS/CSE are safeguarding Parliamentary activities over teleconference.

    Notable questions:
    • Are there any public servants working from home that have been targets of cyberattacks?
    • Has any cyber security assessment been done before using Zoom? Since when do you think any Zoom application has been used by the government in any capacity?
    • I wanted to follow up on security measures at high level. What are some of the factors and principles that are important when it comes to remote or virtual voting?
    • Industry and gov’t went home to work and adopted things like Zoom overnight. There is much talk about government employees working from home in the future too. Many have access to state secrets, military info and personal information; how do we balance the risks of personal safety and security, and national safety and security?

    Fraud and scams

    Fraud has been an important topic before and during the COVID-19 pandemic. Members continue to question what is being done to protect Canadians and businesses from cyber-related fraud and fraud calls, but particularly when COVID-19 is the lure.

    Notable questions:
    • In your speech, you spoke about fraudulent websites that were copying the Government of Canada website? How many were detected? Were they all eliminated?
    • We’re hearing a lot about phishing scams, such as a senior getting calls about the ‘top up’ on COVID assistance and asking for information to access bank accounts to deposit money; how does your organization work with the RCMP and local police forces to investigate something like this? How do you work to ensure the public is aware of these scams?
    • During this pandemic, have we invoked our proactive measures to stop or mitigate cyber fraud?

    Collaboration and intelligence sharing

    Members have shown interest in how the CCCS works with partners such as the RCMP, the Canadian Anti-Fraud Centre (CAFC), and the Five Eyes. While these questions surface outside of a COVID-19 setting, Members continue to ask about whether the rise in COVID-related fraud and cyber-attacks on the health care and research sector has changed these relationships.

    Notable questions:
    • Was there any exchange of intelligence with other partners such as the Five Eyes, for example, on incidents happening to us and happening elsewhere within our allies?
    • According to a media report, the CSE is working in coordination with its partners to ensure COVID-19-related phishing sites mimicking the Government of Canada are removed. Who are those partners?

    Research and development

    Many questions about academic institutions, R&D organizations and COVID-19-related research have emerged in Committee appearances. There is special concern of foreign actors attempting to attack government efforts to develop a vaccine, and research institutions assisting in that.

    Notable questions:
    • Has CSE been brought in to deal with any attacks against our own government in the efforts to develop a vaccine?
    • What is the intent of attacks against R&D institutions and academia, do you think?
    • The health sector has been highlighted here; however, a month ago, the authorities in the US and UK warned that universities are incredibly vulnerable. Have you seen an uptake in cyberattacks on universities? Do you agree with their assessment?

Issue notes

  • COVID-19 and the Cyber Security environment

    • The Communications Security Establishment (CSE) has seen an increase in reports of malicious actors using COVID-19 in phishing campaigns and malware scams.
    • In response, CSE continues to leverage all aspects of its mandate to help ensure that Canada is protected against cyber threats.
    • For example, in coordination with industry partners, CSE has contributed to the removal of over 5,500 fraudulent sites or email addresses designed for malicious cyber activity, including those impersonating the Government of Canada.
    • The Cyber Centre has also been working to protect the Government of Canada through a number of measures including continued monitoring of important Government of Canada programs such as the Canada Emergency Response Benefit (CERB) against cyber threats.
    • CSE has also partnered with the Canadian Internet Registration Authority (CIRA) to launch the CIRA Canadian Shield - a free DNS firewall service that will provide online privacy and security to Canadians.

    Details

    • COVID-19 has presented cybercriminals and fraudsters with an effective lure to encourage victims to visit fake web sites, open e-mail attachments, and click on text message links. These e-mails typically impersonate health organizations, and can pretend to be from the Government of Canada.
    • CSE's Canadian Centre for Cyber Security, in coordination with industry partners, is taking action that is contributing to the removal of over 5,500 fraudulent sites that have spoofed the Public Health Agency of Canada, Canada Revenue Agency, and the Canada Border Services Agency.
    • The Cyber Centre has also been working to protect the Government of Canada through continued monitoring of important GC programs against cyber threats (including CERB), enabling cyber security monitoring/defence for cloud usage across the GC and evaluating cloud applications, including for the Public Health Agency of Canada.
    • The Canadian Centre for Cyber Security has also shared advice and guidance to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.
    • Cyber security tips for remote work were also issued to help inform and educate Canadians about how to stay safe online, particularly while many Canadians are working from home.
    The Canadian Internet Registration Authority (CIRA) Canadian Shield
    • On April 23, 2020, the Canadian Internet Registration Authority (CIRA) announced the official launch of the CIRA Canadian Shield.
    • The CIRA Canadian Shield is a free DNS firewall service that provides online privacy and security to individuals and families across Canada, based on defensive measures that have already been in place to protect the Government's own systems.
    • In December, CIRA announced their 100,000 Canadian-user milestone after only seven months. CIRA Canadian Shield has surpassed its first-year goal of 100,000 users in a little over half a year.
    • CIRA partnered with the Canadian Centre for Cyber Security (Cyber Centre) to integrate its Canadian threat feed into Canadian Shield. No personally identifiable information (PII) of any kind is transmitted to the Cyber Centre as part of this process.
  • The National Cyber Threat Assessment 2020

    • With more Canadians than ever before connected online for work, school and leisure, the safety and security of Canada’s digital environment has become a critical component of our collective prosperity and competitiveness.
    • As part of the Communications Security Establishment (CSE), the Canadian Centre for Cyber Security has over 70 years’ experience protecting Canada’s information and networks.
    • The Cyber Centre released the National Cyber Threat Assessment 2020 highlighting that:
      • cyber-crime is the most likely threat to impact Canadians now and in the years ahead
      • cybercriminals often succeed in their work because they exploit human and social behaviours
      • while cybercrime is the main threat, state-sponsored cyber programs of China, Russia, North Korea and Iran also pose a strategic threat to Canada
    • The report will help “raise the bar” in terms of awareness of today’s cyber threats. Our public awareness campaign “GetCyberSafe.ca” also provides information for Canadians to protect themselves.

    Details

    The National Cyber Threat Assessment 2020
    • The NCTA 2020 provides an update to the 2018 National Cyber Threat Assessment with an analysis of the interim years and forecasts ahead to 2022.
    • The key judgements in this report are based on reporting from multiple sources, including classified and unclassified information. The judgements are based on the Cyber Centre’s knowledge and expertise in cyber security and informed by CSE’s foreign intelligence mandate, which provides us with valuable insights on cyber threat activity around the world.
    • The information and analysis in the NCTA are based on information available up to October 20, 2020.
    Key findings
    • Cyber-crime is the cyber threat most likely to affect Canadians and Canadian organizations in 2020 and in the years ahead.
    • While cybercrime is the most likely threat to impact the average Canadian, the state-sponsored cyber programs of China, Russia, North Korea and Iran post the greatest strategic threat to Canada.
    • Many of the threats identified in the report involve both technological and human elements.
    • Cybercriminals often succeed in their work because they exploit human and social behaviours.
    New Internet Protocol
    • China and Russia are notably leading efforts in international forums to change the accepted approach to Internet governance from the multi-stakeholder approach to one of state sovereignty. They view ideas and information primarily through the lenses of domestic stability and national security and want an Internet that will allow them to track their citizens and censor information.
    • These states are pushing technical standards proposals, like the New Internet Protocol (NIP) proposal made by China and Chinese telecommunications companies, that would fundamentally transform the way the Internet works.
    • The NIP would provide certain cyber security advantages, but it would enable powerful censorship, surveillance, and state control.
    The Canadian Centre for Cyber Security
    • As part of the Communications Security Establishment (CSE), the Canadian Centre for Cyber Security (Cyber Centre) brings over 70 years of experience protecting Canada’s most sensitive information and networks. Bringing together operational security experts from across the Government of Canada, the Cyber Centre is the Government of Canada’s authority on cyber security.
    • Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe and analyze trends in the cyber threat environment.
    • The Cyber Centre works closely with other government agencies, industry partners, and with the public to share knowledge and experience to improve cyber security for Canadians and to make Canada more resilient against cyber threats.
  • Foreign interference and elections

    Foreign interference and democratic process

    • CSE is Canada’s national lead for foreign signals intelligence and cyber operations, and the technical authority for cyber security. The Canadian Centre for Cyber Security (Cyber Centre) operates within CSE, and protects the systems and information that Canadians rely on every day.
    • CSE and its Cyber Centre continue to monitor for cyber threats through our foreign intelligence. We also work with allied and domestic partners to improve Canada’s cyber security and resilience.
    • In the lead up to and during the 2019 Federal Election, CSE worked with partners at the Canadian Security Intelligence Service (CSIS), Global Affairs Canada (GAC), and the RCMP as the Security and Intelligence Threats to Elections Task Force (SITE).
    • CSE’s role in SITE was to monitor for foreign threats and interference with electoral processes in Canada.
    • If CSE were to become aware of a cyber threat, including those directed at a provincial electoral process, we would take appropriate action to address the threat.

    Details

    Potential election during COVID-19 pandemic
    • On December 11, 2020, the Standing Committee on Procedure and House Affairs (PROC) presented Report 7 – An Interim Report on Protecting Public Health and Democracy during a Possible Pandemic Election.
    • The Committee heard from officials that ran elections in four provinces during the pandemic and assessed three temporary legislative changes that would supersede the Canada Elections Act: extending the voting period, flexibility for administering the vote in long-term care facilities and provide Canada’s Chief Electoral Officer the power to adapt the Act to respond to the challenges created by the pandemic.
    • SITE Task Force partners will continue to work within their respective mandates to detect and counter possible foreign threats to Canada and its democratic institutions on an ongoing basis.
    2019 election
    • In 2019, the Government of Canada announced a plan to safeguard the 2019 federal election.
    • As part of its plan, the Government of Canada established the Critical Election Incident Public Protocol (the Protocol Panel) to ensure coherence and consistency in Canada’s approach to publicly informing Canadians during the writ period about incidents that threaten Canada’s ability to have a free and fair election.
    • The Security and Intelligence Threats to Election (SITE) Task Force, comprised of officials from the Communications Security Establishment, the Canadian Security and Intelligence Service, the Royal Canadian Mounted Police, and Global Affairs Canada was established as a fully integrated team to help the Government assess and respond to foreign threats.
    • Before and throughout the election, the SITE Task Force provided security briefings to Elections Canada and Canadian political parties to promote situational awareness and help them strengthen their security practices.
    • The Protocol Panel did not observe any activities that met the threshold for a public announcement or affected Canada’s ability to have a free and fair election.
    • CSE and its Canadian Centre for Cyber Security (Cyber Centre) have worked directly with Elections Canada for several years providing cyber security advice and guidance. This partnership continues today, and we continue to support their efforts in ensuring a secure election.
    • CSE and its Cyber Centre published a detailed cyber security guide for campaign teams in advance of the 2019 Election. Cyber Centre senior officials offered unclassified briefings to all 16 federal registered political parties and held follow-on meetings at the request of individual parties. The Cyber Centre also held regular stakeholder calls with political parties to raise awareness of cyber security threats and provide advice and guidance.
    • In advance of the 2019 General Election, CSE and the Cyber Centre made the decision to offer cabinet ministers a 24/7 cyber hotline service, providing centralized support in the event they suspected their ministerial, parliamentary, or personal communications, e-mail or social media accounts were compromised. The hotline provided a 24/7 priority service in the case of a cyber incident and is still operational today.
    • In addition to this service, CSE and the Cyber Centre provided a point of contact to all 16 federal registered political parties for further discussion on the cyber security challenges related to Canada’s democratic process. If any political parties and/or candidates encountered any suspicious cyber activity, we had also designated a quick response point of contact for them, which was coordinated through each political party’s headquarters. This cyber security technical support service to political parties, while also available on a 24/7 basis, was only in operation throughout the 2019 General Election, and was similar to the Cyber Hotline for Ministers.
    Cyber Threats to Canada’s Democratic Process reports
    • In June 2017, CSE published an unclassified assessment of cyber threats to Canada’s democratic process, which found that Canada is not immune from cyber threat activity against its elections. While the threat in Canada is generally of low sophistication, political parties, politicians and the media are vulnerable to cyber threats and influence operations.
    • In 2019, CSE provided an update to the 2017 report. The updated report found that overall, cyber threat continues to target three main aspects of the democratic process: voters, political parties, candidates and their staff; and elections. The report concluded that it was very likely that Canadian voters would encounter cyber interference ahead of and during the 2019 election.
  • Misinformation and COVID-19

    Countering misinformation on COVID-19

    • Cyber threat actors are using fake websites, imitating health agencies or government departments, to spread disinformation or to scam people.
    • In response, the Communications Security Establishment is helping to identify and take down these kinds of malicious websites.
    • In coordination with industry partners, CSE has contributed to the removal of thousands of fraudulent sites or email addresses.
    • For example, CSE has helped identify and take down malicious websites pretending to be the Public Health Agency and the Canada Revenue Agency.
    • CSE also continues to provide critical foreign intelligence to inform decisions on Canada’s approach to COVID-19.

    Details

    • COVID-19 has presented cybercriminals and fraudsters with an effective lure to encourage victims to visit fake web sites, open e-mail attachments, and click on text message links. These e-mails typically impersonate health organizations, and can pretend to be from the Government of Canada.
    • CSE, through its Canadian Centre for Cyber Security, has been working with partners, including the Canadian Internet Registration Authority (CIRA), to better identify malicious versus legitimate COVID-19 domains.
    • In this effort, CSE shares information about fake sites and other threat indicators with partners so they can act quickly to remove platforms involved in fraudulent activity.
    • This activity is conducted under CSE’s cyber security mandate pursuant to the Communications Security Establishment Act.
    • The Canadian Centre for Cyber Security has also shared advice and guidance to help inform and educate Canadians about how to stay safe online.
  • COVID-19 vaccine data

    Cyber threats and the COVID-19 vaccine

    • CSE and the Cyber Centre are always monitoring for cyber threats that may be directed against Canada, including those in the health and research sector.
    • The sensitive nature of health data, including personal information, has made the health sector a more attractive target since the start of the COVID-19 pandemic. CSE has assessed that it is near certain that state sponsored actors have shifted their focus during the pandemic, and that Canadian intellectual property represents a valuable target.
    • The threats to Canadian health organizations, and related research and development entities, and academia, remain persistent.
    • In July 2020, CSE and its U.K. and U.S. partners issued a joint statement on threat activity targeting COVID-19 vaccine development.
    • In addition to increased COVID-related vigilance, CSE continues to work with our Canadian security and intelligence partners, including the Department of National Defence and the Canadian Armed Forces, to address foreign and cyber threats facing Canada.
    • CSE and its Cyber Centre will continue to work within our foreign intelligence mandate to help address foreign and cyber threats facing Canada.

    Details

    Monitoring threats
    • CSE and its Cyber Centre have assessed that the COVID-19 pandemic presents an elevated risk to the cyber security of Canadian health organizations involved in the national response to the pandemic.
    • Cyber Centre’s National Cyber Threat Assessment 2020 report noted that state-sponsored actors would almost certainly continue to conduct commercial espionage against Canadian businesses, academia, and governments.
    • Over the duration of the COVID-19 pandemic, threat actors have continued to attempt to steal intellectual property and proprietary information related to combatting COVID-19 to support their own domestic health responses, or to profit from its illegal reproduction by their own firms.
    • CSE continues to monitor for cyber threats through our foreign intelligence mandate, working with Canadian security and intelligence partners, including the Department of National Defence and Canadian Armed Forces.
    Coordinated efforts
    • In July 2020, CSE, along with its U.K. and U.S. partners issued a joint statement about cyber threat activity directed at Canadian, U.K. and U.S. organizations, including vaccines research entities.
    • Malicious cyber activities were jointly assessed as likely to be targeting information and intellectual property relating to the development and testing of COVID-19 vaccines.
    • These malicious activities also serve to hinder response efforts at a time when healthcare experts and medical researches need every available resource to help fight the COVID-19 pandemic.
    • CSE continues to work closely with both domestic and international partners to support the Government of Canada’s response to the COVID-19 pandemic.
    Support to Canadian organizations
    • Throughout the pandemic, CSE and its Cyber Centre have issued regular alerts and cyber security advice and guidance related to COVID-related threat activity. This includes an important and still active Cyber Threat Bulletin on the Impact of COVID-19 on Cyber Threats to the Health Sector, which mentions the targeting of Canadian biopharmaceutical companies.
    • Threat Bulletins provide more tailored advice and guidance for Canadian sectors that are particularly likely to be targeted by threat actors and include the most up-to-date information on how to best secure their organizations.
    • In addition, Cyber Centre experts have regular calls with the health care sector to share relevant and timely cyber threat information and guidance for mitigating threats.
    • If any Canadian businesses or organizations suspect they have been targeted by cyber threat activity, CSE encourages them to contact local law enforcement of the Cyber Centre.
  • 5G and Huawei

    5G (Huawei)

    • CSE takes the security of our country’s critical infrastructure very seriously.
    • 5G networks will be a key driver of innovation and enable new technologies such as cleaner energy, smart cities, and autonomous vehicles.
    • While we cannot comment on specific companies, an examination of emerging 5G technology and the associated security and economic considerations is underway.
    • Canada’s review will consider technical and security factors, and include advice from our security agencies, and consider decisions from our Allies and partners.

    Details

    • As part of its cyber security mandate, CSE works with telecommunications service providers representing over 99% of Canadian subscribers. In this role, CSE provides advice and guidance to mitigate supply chain risks in telecommunications infrastructures upon which Canadians rely, including, since 2013, a program that has been in place to test and evaluate designated equipment considered for use in Canadian 3G and 4G/LTE networks, including Huawei.
    • CSE’s role includes accrediting the third party labs that perform this assurance testing, and defining the testing requirements. CSE reviews the testing results and provides tailored advice and guidance to Canada’s telecommunications sector.
  • Procurement and Nuctech

    Nuctech assesment

    • CSE and its Cyber Centre are always monitoring for cyber threats that may be directed against Canada and Canadians, and regularly sharing threat information with our Government of Canada partners.
    • I would like to note that CSE is here as the cyber technical authority. CSE is not a regulatory agency and as such, we do not endorse or ban specific technologies.
    • As part of CSE’s risk mitigation programs, CSE provides advice and guidance to help GC departments with their own risk-informed decisions.
    • Ultimately, adoption of specific technical solutions and products is the responsibility of network owners and operators. CSE offers its best technical advice and guidance to help those network owners and operators to make their best-informed choices and in consideration of cyber security risks.
    • CSE does not have a veto or decision-making abilities in procurement for federal departments and agencies. After procurement, CSE is only able to recommend ways to mitigate risks.
    • CSE and the Cyber Centre were not asked to assess Nuctech as part of the Global Affairs Canada standing offer. However, CSE has previously assessed Nuctech products, once for the RCMP and once for the Canada Border Services Agency (CBSA).
    • CSE continues to support the Government of Canada and ensure that its cyber security is robust and protects all federal departments and agencies from threats.

    Details

    Nuctech “Standing offer”
    • On July 20th The National Post reported that Beijing-based company Nuctech was made a “standing offer” to supply X-ray equipment for 170 embassies and consulates around the world.
    Risk Mitigation Program
    • Threat actors use supply chain weaknesses for malicious activity. Organizations with valuable information or services should include supply chain risks in their decision making when they buy products and services. The Cyber Centre recommends incorporating supply chain risk management as part of an overall IT security risk management framework, such as the Cyber Centre’s IT Security Risk Management: A Lifecycle Approach (ITSG-33).
    • The Cyber Centre offers Government of Canada (GC) departments a supply chain cyber security risk assessment program to understand the supply chain risks of ICT products under procurement. These assessments provide advice, guidance, best practices, and mitigations that GC departments can consider when making decisions relating to IT procurements.
    • As the SCI process is comprised of research and analysis involving classified intelligence reporting, only the final risk assessment and recommendations are provided as advice and guidance back to the requesting GC Department. This is done to protect classified intelligence information and sources and ensure that CSE remains compliant Canadian SIGNT Security Standards.
    • The Cyber Centre does not provide general assessments about companies, nor make statements to GC Departments dictating procurement decisions. Additionally, further disclosure of a SCI risk assessment to vendor(s) is strictly forbidden, as such action may damage the ability of the GC Departments to mitigate supply chain risks from the same service(s) or product(s).
    • The Cyber Centre’s risk assessment process can include a supply chain integrity (SCI) assessment. However, this would only be performed where there are plans for a specific deployment of IT equipment. At the standing offer stage, where a contract has yet to be awarded, there is no deployment-specific information that can be evaluated as part of a supply chain integrity assessment.
    • Supply chain integrity risk assessments are typically performed early in the procurement process and are usually for information and communications technology, such as network security devices, computing equipment or data storage.
    • A supply chain cyber security risk assessment involves three main components:
      • an ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
      • a technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
      • a sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.
    RCMP and CBSA
    • To be more specific: CSE provided security advice on Nuctech products, once for the RCMP and once for the Canada Border Services Agency (CBSA). In both cases products had been bought, and in one case (RCMP) installed, and CSE provided mitigation advice in those situations.
    • Security screening equipment is not traditionally deemed IT equipment, so an IT security review is not necessarily triggered in the procurement process. Technological advances however mean that today’s screening equipment is often connected to the internet and that introduces a new level of risk.
  • National Security and Intelligence Review Agency (NSIRA)

    NSIRA Report

    • The Government of Canada takes the privacy of Canadians very seriously. The Communications Security Establishment (CSE) conducts all of its activities within a robust system of accountability.
    • The review process is essential in ensuring that as CSE provides the Government with critical foreign intelligence and cyber defences, it remains open, transparent, and accountable to Canadians.
    • CSE has accepted all five recommendations from the National Security and Intelligence Review Agency.
    • It has implemented, or is in the process of implementing, a wide range of policy, procedural, and technical solutions, in order to further mitigate any privacy incidents.
    • CSE is committed to continuing its support to the National Security and Intelligence Review Agency by providing information, records, and expert briefings on its activities and programs, and will maintain ongoing communication to ensure that reviews progress efficiently.
    • Canadians can have confidence in the work of CSE and Canada’s security and intelligence community.

    Details

    National Security and Intelligence Review Agency report
    • CSE is subject to after-the-fact review by the National Security and Intelligence Review Agency (NSIRA). NSIRA has assumed responsibility for reviewing all national security activities across the Government of Canada, including all of CSE’s activities.
    • NSIRA reviews CSE’s activities for lawfulness and to ensure that the activities are reasonable, necessary, and compliant with ministerial direction. NSIRA also serves as the body for any complaints against CSE.
    • A redacted report from NSIRA made public the first week of March 2021, looked into reported breaches of Canadians' privacy by the Communications Security Establishment.
    • NSIRA recognized that privacy incidents are unavoidable due to the nature of CSE’s activities, and found that CSE employed compliance measures in a timely manner in accordance with policy. NSIRA also included five recommendations intended to improve our documentation, assessment, and mitigation of privacy incidents.
    • CSE’s robust and layered approach to privacy protection contributes to an operational environment resulting in a relatively small number of inadvertent privacy incidents. Some of these incidents are unfortunately a result of simple errors, which requires information to be updated and/or corrected.
    Accountability and oversight
    • CSE conducts all its activities, including protections for the privacy of Canadians and persons in Canada, within a robust system of accountability. This review process is essential in ensuring that, as CSE provides the Government of Canada with critical foreign intelligence and cyber defences, we remain open, transparent, and accountable to Canadians.
    • CSE ensures that incidents are not only documented within the respective mission and operational teams, but also reviewed by a team independent of operations in order to ensure a CSE-wide consistent approach is taken on mitigating and assessing privacy incidents. This layered approach further demonstrates CSE’s commitment to ensuring that it protects the privacy of Canadians when an incident arises.
    • CSE has a culture of compliance, which is based on employees understanding the legal and policy framework, their accountability to operate within it, and evidenced by their strong record of reporting and addressing incidents that may occur during the course of their activities. CSE’s operational policies establish specific measures to protect the privacy of Canadians and persons in Canada in the acquisition, use and retention of information.
  • Potential strike at CSE

    • The Communications Security Establishment is one of Canada’s key intelligence agencies and the lead federal technical authority for cyber security.
    • It would be inappropriate to comment on the status of the ongoing negotiations.
    • However, I can tell you that essential service agreements are in place to ensure that, in the event of a strike, all areas of CSE have the people at work necessary to continue to provide for the safety and security of the public.
    • CSE continues to support employees with a healthy and positive working environment focused on innovation, collaboration and well-being. It will continue to work towards a negotiated resolution with the Public Service Alliance of Canada for a mutually beneficial collective agreement.

    Details

    • CSE is one of Canada’s key security and intelligence agencies, responsible for foreign intelligence and cybersecurity.
    • Its employees are part of the Public Service, but are employed by CSE, as a separate agency of the Government of Canada.
    • CSE has more than 2,900 employees, among whom are some of Canada’s brightest mathematicians, computer scientists, engineers, and intelligence analysts.
    • CSE management supports employees with a healthy and positive working environment focused on innovation, collaboration and well-being. During the pandemic, CSE has ensured that its employees working on-site have a safe working environment, and those working from home have the necessary tools and technology to do meaningful and important work.
    • Our approach has ensured that CSE’s efforts to protect Canada and Canadians has continued unabated during the pandemic, and that our employees have had the flexible work arrangements they need.
    • In the annual Public Service Employee Survey, CSE routinely ranks near the top of best places to work in the Government of Canada, with employees rating innovation, diversity and management support at rates far higher than the rest of the Public Service.
    • When employees do raise concerns through the survey or other means, CSE takes action to improve. For example, when employees raised concerns about the timeliness of pay, CSE took action to address urgent backlogs, and we continue to pursue other means to address issues around the processing of pay.
    • CSE’s executive management team continues to work towards a negotiated resolution with the Public Service Alliance of Canada (PSAC) for a mutually beneficial collective agreement. CSE takes an interest-based bargaining approach in good faith to create the best working environment, and a fair and competitive total compensation package for all employees.
    • This includes ensuring ongoing benefits such as market allowance for CSE employees who are eligible to receive it. The interest-based bargaining approach is closely coordinated with TBS, the GC lead for collective bargaining to ensure that negotiations are in the best and balanced interests of CSE’s union members and the Canadian public.

Background documents

  • OGGO (Nuctech summary from appearance with CSE)

    House Committee on Government Operations and Estimates (OGGO)

    Study on the Nuctech security equipment contract | November 18, 2020
    Witnesses
    • Michèle Mullen, Director General, Partnerships and Risk Mitigation, Communications Security Establishment
    • Lorenzo Leraci, Acting Assistant Deputy Minister, Procurement Branch, Public Services and Procurement Canada
    • Claude Kateb, Acting Director General, Industrial Security Sector, Public Services and Procurement Canada
    • Catherine Poulin, Director General, Integrity and Forensic Accounting Services, Public Services and Procurement Canada
    • Dan Danagher, Assistant Deputy Minister, International Platform, Department of Foregin Affairs, Trade and Development

    The Nuctech security contract

    • MP Pierre Paul-Hus (CPC): I’m still concerned that the Government of Canada accepted to go forward with the request for a standing offer with Nuctech. What is your current assessment of Nuctech?

      Michèle Mullen: As the Director General or Partnerships and Risk Mitigation at the Communications Security Establishment I’m responsible for 3 main functions:

      1. Building trust-based partnerships with all levels of government, critical infrastructure and the private industry
      2. Providing cyber security architecture guidance based on the threat landscape
      3. Implementing risk mitigation programs in reducing the risks identified
    • MP Pierre Paul-Hus (CPC): Can you confirm that Nuctech is really related to the Chinese Communist Party and under its direct control?

      Michèle Mullen: CSE was not asked to assess Nuctech as part of the Global Affairs Canada standing offer.

    • MP Kelly McCauley (CPC): If the media hadn’t highlighted this issue, would CSE have even been concerned?

      Michèle Mullen: We, again, only perform these assessments when we are approached by a department actually making the decision on the acquisition. acquisition.

    • MP Pierre Paul-Hus (CPC): In terms of CSE, were any notices provided with regards to Nuctech?

      Michèle Mullen: Again, we were not approached by Global Affairs in support of the Nuctech standing offer.

    • MP Pierre Paul-Hus (CPC): Did CSIS contact you?

      Michèle Mullen: Not with regards to this file.

    Security risks of technology

    • MP Kelly McCauley (CPC): CSE just came out with the Cyber Threat Assessment Report and highlighted a lot of issues with state-owned actors, naming China and Russia for the first time. Regarding the information gained from this equipment, how could it be gathered from our embassies? Does CSE have a concern about this?

      Michèle Mullen: Normally a supply-chain integrity assessment, which is something CSE would perform, is done to support another department in making a risk-based decision on the procurement of a technology.

    • MP Kelly McCauley (CPC): Your threat assessment came out today naming China for the first time and identifying state-sponsored actors attempting cyber threats. What kind of information could state-sponsored actors gain from this equipment? Do you share the lack of concern coming from GAC and PSPC? This is about the exact machines.

      Michèle Mullen: This is why we working together now to identify this and other equipment that should be flagged in the future, and in procurement activities, because the nature of this technology has evolved such that it could gather information of risk to Canada.

    • MP Julie Vignola (BQ): There’s a business in Montreal that tried to apply for the same process and was unsuccessful. Is it correct that “it would be possible to access the hard drive and download data when the devices are serviced”?

      Michèle Mullen: Normally, we have to take all the surrounding details of a particular deployment into account, but typically speaking, in the more recent versions of equipment like this, they are starting to emerge with embedded hard drives and USB ports that can be used for maintenance purposes, for uploading and downloading data, and software updates. So, in the truest sense, those would indeed give vectors opportunities for malicious intent.

    • MP Julie Vignola (BQ): So, it is possible for the hard drive to be accessed in embassies during servicing?

      Michèle Mullen: As Global Affairs said, their practice is to have anyone servicing equipment be escorted by embassy staff, in which case that would be observable behaviour.

    • MP Julie Vignola (BQ): Earlier I talked about the various entry ways that could provide a lot of information. What are the risks if they could access data? What are the risks for Canada if this company had access to embassy data and telecommunications data?

      Michèle Mullen: It depends on the sensitivity of the information that is flowing through that machine and where it’s deployed. When we do our assessments it has to be in the context of an actual deployment as opposed to a very general contract like this one where it’s a potential for future acquisition. That’s at the crux of the matter is: where its deployed, what the surrounding circumstances are, and what kind of information will transverse the product; that determines the degree of risk.

    • MP Julie Vignola (BQ): So, if it’s in an embassy for example?

      Michèle Mullen: What they’re putting these pieces of equipment in place for at embassies is to screen people entering the embassy and ensure they aren’t bringing in anything they shouldn’t. This type of information isn’t going to be the problem – the problem would be if there were any additional capabilities in the machinery that is of concern. That is where a supple-chain integrity assessment would come into play.

    The procurement process going forward

    • MP Kelly McCauley (CPC): How do we ensure this doesn’t happen again? Does it start with Global Affairs?

      Michèle Mullen: The way this all changes in the future is for them to come to us and ask whether the types of equipment they’re looking at should be assessed for supply-chain integrity. In which cases, we would look at ownership as one of three prongs of the assessment.

    • MP Kelly McCauley (CPC): It sounds like some of these security issues are going ahead without CSE’s knowledge. How do we change this, so CSE has input in this? Should we allowing Russia and China tech to be in any Government of Canada operations?

      Michèle Mullen: CSE is not a regulatory agency, so we do not endorse or ban specific technologies or companies; however, I think the first part gets to the heart of the matter: to ensure departments know when to come to CSE to do our assessment, which includes ownership and business practices of the entity. And I think that’s what I was getting at earlier because the technology is evolving where things we didn’t used to look at, we now should look at. Capabilities, like embedded operating systems and USB ports, didn’t used to exist in X-ray machines and now do. We are now working together to add into the procurement process: to ensure flags come up when equipment falls into these categories and is being acquired, so that the departments making the acquisition knows to reach out to CSE.

    • MP Kelly McCauley (CPC): Going forward, what do we need to do to protect our assets, our people, our data, both overseas in embassies and within Canada, to protect from state-sponsored aggression?

      Michèle Mullen: The technical aspects that CSE is seized with in an assessment is one of the inputs. As you’re aware, there are geopolitical and economic considerations that layer onto the technical assessment in terms of supporting departments and agencies in making acquisition decisions and who they partner with in the international realm.

    • MP Julie Vignola (BQ): Should the government review its policy to ensure that Chinese tech companies no longer have access to Canadian infrastructure?

      Michèle Mullen: In my opinion, the work we’re doing to identify additional types of equipment that should be flagged within the procurement policy for will get us to where we need to be, to be more aware about what things should come to CSE for evaluation.

    • MP Matthew Green (NDP): In 2014 there was a presentation about IP Profiling that tracked cellphones of travellers moving through Toronto Pearson Airport. Is there any learning that we might be able to apply of the potential risks that could have come through malicious technology in our own missions?

      Michèle Mullen: Although I’m not familiar with that study, I can say that the Cyber Centre does issue a lot of advice and guidance for specific mitigation measures that Canadian travellers should take to protect themselves in terms of the types of risk that communications equipment (cellphones, etc.) inherently have. This is informed by that report and others like it.

    • MP Matthew Green (NDP): Are there any learnings from work you’re doing in CSE to better check the profiles of our future procurement to ensure no malicious technology isn’t hidden in our equipment procurement?

      Michèle Mullen: Yes and no. Yes, we are using the things we know using the techniques we employ in our lines of business to better design protections to those types of techniques. But no, we are not being asked to weigh in on specific changes to procurement activities other than urging departments making technical procurements to come to us.

    • MP Kelly McCauley (CPC): You mentioned urging departments to come to you. Should this committee then ask PSPC to change the policy so that all tech purchases have to go through a process such as that?

      Michèle Mullen: All tech purchases, I wouldn’t even begin to know how my team could keep up with that level of demand, so I think it’s about choosing the right technology in the right deployment scenarios that warrant our attention.

    • MP Kelly McCauley (CPC): For security reasons then, should we have an outright ban on buying tech equipment controlled by state-owned operators in an adversarial position?

      Michèle Mullen: CSE is not a regulatory agency, but we definitely need to consider who they are, the sensitivity of information, and the specific technology in question.

    Potential questions and answers prepared for Michèle Mullen

    Nuctech
    • Does CSE have any concerns over the NucTech contract?

      CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or comment on specific companies. CSE continues to support the Government of Canada and ensure that its cyber security is robust and protects all GoC networks from threats.

    • How does CSE assess risk for specific venders or companies?
      • The Cyber Centre does not provide general assessments about companies, nor make statements to GC Departments dictating procurement decisions.
      • As part of CSE’s risk mitigation programs, CSE provides advice and guidance to help GC departments with their own risk-informed decisions.
      • Ultimately, adoption of specific technical solutions and products is the responsibility of network owners and operators. CSE offers its best technical advice and guidance to help those network owners and operators to make their best-informed choices and in consideration of cyber security risks.
    • Has the Cyber Centre ever assessed NucTech for any other department?
      • As I mentioned, CSE provides advice and guidance to other government departments so they can make their own risk-informed decisions. This happens upon request and the decision, ultimately, is up to them.
      • CSE has done an assessment of Nuctech for a couple of different departments including for the RCMP at the G7 in Huntsville.
    • What were the results of the assessment for the Royal Canadian Mounted Police (RCMP)?
      • To be more specific: CSE provided security advice on Nuctech products, once for the RCMP and once for the Canada Border Services Agency (CBSA). In both cases products had been bought, and in one case (RCMP) installed, and CSE provided mitigation advice in those situations.   
      • Security screening equipment is not traditionally deemed IT equipment, so an IT security review is not necessarily triggered in the procurement process. Technological advances however mean that today’s screening equipment is often connected to the internet and that introduces a new level of risk.
    • Was CSE asked to review Nuctech by Global Affairs Canada (GAC)/ Have you seen the risk assessment by GAC?
      • No we were not. We only conduct Supply Chain Integrity Assessments for specific deployment. A standing offer does not have specific deployment.
      • I have not seen the risk assessment by GAC.
    • Why didn’t CSE have any documents to disclose in the production of papers request?
      • CSE did not have any documents that met the scope of this request.
      • As the committee is studying the standing offer awarded by Global Affairs Canada, we looked for documents related to that issue.
    • What are the steps in the risk mitigation process?
      • A supply chain cyber security risk assessment involves three main components:
      • An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
      • A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
      • A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.
    • What did you mean by “supply chain process”?
      • The chief’s shorthand ‘supply chain process’ speaks to a supply chain cyber security risk assessment that involves three main components:
      • An ownership assessment considering underlying controlling interests, geolocation of operations, and evidence of non-likeminded business practices informs part of the overall supply chain risk; and
      • A technical assessment seeks to understand the resilience of the products against exploitation as well as whether there are known threat actor tactics, techniques, and procedures (TTPs) against products; and
      • A sensitivity assessment to better understand the data that will be processed by the product, and the potential impact of a product compromise.
    Tik tok
    • Does CSE have any concerns about the social media app Tik Tok?
      • CSE, and its Canadian Centre for Cyber Security (Cyber Centre), defends the Government of Canada's networks from threats; provides cyber security advice and guidance to other levels of government and critical infrastructure; and offers simple but effective tips that all Canadians can use to keep themselves safer online.
      • CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or ban social media applications. It is important for Canadians to adopt good cyber security practices, including assessing possible risks of using social media platforms and apps.
      • The Cyber Centre previously issued advice and guidance to help Canadians protect how they connect to social media and instant messaging services.
    • On August 8, President Trump stated that he plans to ban Tik Tok from the US, will Canada follow suit?
      • As stated, CSE's Cyber Centre is not a regulatory agency and as such, we do not endorse or ban social media applications.
      • It is important for Canadians to adopt good cyber security practices, including assessing possible risks of using social media platforms and apps.
      Canada Revenue Agency (CRA)
      • Is the Canadian Centre for Cyber Security exploring the possibility that these cyber threats were by foreign hackers? Are you exploring if these cyber attacks were by a foreign state, or state-sponsored actors?
        • We work with our partners at the Treasury Board Secretariat of Canada (TBS) Chief Information Office (CIO), and Shared Services Canada to ensure the Government of Canada has robust systems and tools in place to monitor, detect, and investigate potential threats, and to neutralize threats when they occur.
        • We also provide advice and guidance about cyber security so that Canadians are armed with basic measures that they can take to significantly offset the risks of compromise.
        • Given the investigation into this incident is ongoing, I am unable to comment on a threat actor.
        • We remind Canadians with compromised passwords—whether implicated in this or any other incident—to update them immediately and avoid reuse, particularly for important accounts that may contain personal or financial information.
      Huawei and 5G
      • Our Five Eyes partners have made decisions on Huawei and their 5G networks, with the UK recently banning them. Has/Will Canada make a decision on Huawei?
        • CSE, Public Safety, the Department of National Defence, the Canadian Security Intelligence Service, Global Affairs Canada, and Innovation, Science, and Economic Development are continuing to work together on this issue. 
        • While we cannot comment on specific companies, an examination of emerging 5G technology and the associated security and economic considerations is underway. Canada’s review will consider technical and security factors, and include advice from our security agencies, and decisions from our Allies.
        • Canadians can be assured that the Government is working to make sure that robust protections are in place to safeguard the communications systems that Canadians rely on.
      CSE activities and COVID-19
      • What is CSE’s Cyber Centre doing to support GC departments and agencies during this time?
        • The Cyber Centre has been working to protect the Government of Canada through a number of different measures, including the continued monitoring of important Government of Canada programs such as the Canada Emergency Response Benefit (CERB).
        • This critical work has also included an evaluation of cloud applications for organizations such as the Public Health Agency of Canada and enabling cyber security monitoring and defence for cloud usage across the Government of Canada.
        • To help clients and Canadians make informed cyber-safe decisions, the Cyber Centre shared cyber security tips on video-teleconferencing tools and telework and published a non-product specific advice and guidance document to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.
      • What is the Government doing to counter misinformation about COVID-19?
        • CSE and its Cyber Centre are working in coordination with industry partners, including commercial and international Cyber Incident Response Teams.
        • This work is resulting in the removal of a number of malicious sites, including fake sites that have spoofed the Public Health Agency of Canada, Canada Revenue Agency, and Canada Border Services Agency, which have been related to cyber-crime and fraud.
      • There are reports that Canadians have lost more than $1.2 million to COVID-19 scams. What is CSE doing to protect Canadians?
        • The Cyber Centre has been actively sharing examples of these fraudulent messages with Canadians via our public twitter account. The Cyber Centre has worked closely with industry and commercial partners to facilitate the removal of malicious websites, including those that have spoofed Canadian Government departments and agencies.
        • These efforts have resulted in the removal of a significant number of Canadian themed fraudulent sites that were designed specifically for malicious cyber activity, such as phishing and malware delivery.
      • Has the government directed CSE to assist the U.S. investigation into COVID-19’s origins and early steps taken by Beijing?
        • CSE has a strong and valuable relationship with its Five Eyes alliance partners. We regularly share information with our partners, including the U.S., which has a significant impact on protecting our respective countries’ safety and security.
        • Although we do not comment on our foreign intelligence operations, we can tell you that CSE continues to exercise our authorities to help ensure that Canada is protected against threats, and that the Government of Canada has foreign intelligence and cyber security insights to help inform decisions on national priorities, including COVID-19.
        • In both our national lead roles, we apply our expertise and we engage with both our domestic and international security and intelligence partners, and other Government of Canada departments.
      • Has there been any observable change of cyber intrusions or attempts of intrusions due to the COVID-19 pandemic from foreign state-sponsored actors?
        • CSE continues to advise the government on foreign related attacks before and during the COVID-19 Pandemic.
        • The bulk of malicious threat activity we have observed during the COVID-19 pandemic continues to be criminal in nature, and we are working with the appropriate partners to address such activity. For example, CSE has issued alerts and cyber security advice about COVID-related phishing campaigns.
        • We assess that foreign intelligence agencies will almost certainly continue to use their cyber capabilities to pursue intelligence related to COVID-19 medical research and intellectual property. Intellectual property, especially related to vaccine development, treatments, COVID-19 testing, and medical devices such as ventilators or personal protective equipment (PPE), would offer public health, economic, and national security benefits.
      • Has the Cyber Centre dealt with any compromises of our own research organizations?
        • The Cyber Centre is aware of incidents of malicious threat activities directed at Canadian health research organizations.
        • With regards to these incidents, the Cyber Centre continues to offer support and cyber security mitigations services to limit any potential impacts to targeted organizations.
        • The Cyber Centre continues to recommend all Canadian health and research organizations remain vigilant and apply best practices in cyber security, especially during COVID-19. Such practices include monitoring network logs, remaining alert to suspicious emails and calls, and keeping servers and critical systems patched for all known security vulnerabilities.
        • While we cannot speak on any specific incidents, know that we are working with Canadian health care and research sectors, and other partners and industries, as appropriate.
      Teleworking
      • With more people working from home, what advice has the Cyber Centre given to Canadians about which platforms are safe to use?
        • The Canadian Centre for Cyber Security has shared advice and guidance to help clients make informed decisions when selecting, installing and using video-teleconferencing tools.
        • Cyber security tips for remote work were also issued by the Cyber Centre to help inform and educate Canadians about how to stay safe online.
        • The Cyber Centre continues to actively share cyber security tips and helpful information on its social media channels, as well as the Get Cyber Safe public awareness campaign.
      Privacy
      • On the development of tracking applications during the COVID-19 pandemic: how will the Federal Government of Canada ensure the rights and privacy of Canadians?
        • The security and intelligence community will continue to play a crucial role by providing timely and relevant information in support of our Government’s extraordinary efforts to manage this current crisis.
        • Regarding the official Government of Canada COVID-19 Exposure Notification application, CSE’s Cyber Centre has been asked to provide cyber security advice and guidance, and we have agreed to provide the support that we can, within our mandate.
        • We are engaged with our federal government partners, including Health Canada, Treasury Board Secretariat (TBS) and Canadian Digital Services (CDS) and will be sharing our cyber expertise to ensure that the official application has been designed and built securely. It is important to note, however, that CSE and the Cyber Centre have no mandate to collect or analyze data in connection with the Government’s COVID-19 exposure notification initiative.
      • What is the Canadian Internet Registration Authority (CIRA) Canadian Shield?
        • Launched on April 23, 2020, the CIRA Canadian Shield is a free DNS firewall service that will provide online privacy and security to Canadians.
        • The Canadian Shield provides enterprise-grade privacy and cyber security protection to Canadians by leveraging CIRA’s national DNS infrastructure and a global partnership with Akamai Technologies.
        • CIRA has also partnered with the Cyber Centre to integrate its Canadian threat feed into Canadian Shield. This partnership provides Canadian Shield users with enhanced protections through Cyber Centre derived threat intelligence.
      • What are the privacy implications of the Canadian Shield?
        • No personally identifiable information (PII) of any kind is transmitted to the Canadian Centre for Cyber Security.
        • CIRA has committed to a full annual privacy audit, conducted by a third-party auditor, to ensure adherence to the highest standards of data privacy.
      • How can we better protect privacy while health data is actively targeted?
        • Cyber security is a baseline condition for the protection of data. Confidentiality is one of the main goals of the protection of cyber systems and is as important as making sure that data is available. The Office of the Privacy Commissioner has published excellent guidance related to ensuring data is protected adequately from a privacy perspective.
        • CSE has assessed that it is near certain that state sponsored actors have shifted their focus during the pandemic, and that Canadian intellectual property represents a valuable target.
        • We continue to recommend that Canadian health organizations remain vigilant and take the time to ensure that they are applying cyber defence best practices, including increased monitoring of network logs, reminding employees to be alert to suspicious emails, use secure teleworking practices, ensuring that servers and critical systems are patched for all known security vulnerabilities.
      Cyber security in the health sector
      • How have cyber criminals been taking advantage of the COVID-19 pandemic?
        • Cybercriminals have been using the COVID-19 pandemic to exploit the fears and anxieties of Canadians across the country. With these feelings heightened, citizens can be less attentive to cyber risks, and cybercriminals are aware of this.
        • Cybercriminals have shaped traditional methods of attacks, such as phishing and smishing attacks, to fit the coronavirus theme. Individuals may be more inclined to click on a link in an email promising free personal protective equipment or warning of virus exposure than they would be for a more familiar fishing theme.
        • Threat actors are also taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. As one of 10 critical infrastructure sectors in Canada, the health sector is involved in activities critical to the health and life of many Canadians, especially during the current pandemic. Because the healthcare sector is under extreme pressure to respond to COVID-19, it is a high value target and a target of cyber-attacks.
      • What are the major threats to cyber security and the main vulnerabilities for the health sector?
        • The sensitive nature of health data, including personal information, has made the health sector a more attractive target before and during the COVID-19 pandemic. CSE has assessed that it is near certain that state sponsored actors have shifted their focus during the pandemic, and that Canadian intellectual property represents a valuable target.
        • Canada is a leader in health research, including efforts to find treatments and a vaccine for COVID-19. Data related to this research can be extremely valuable to individuals, industry and state actors, and this intellectual property is targeted by cyber criminals for financial gain and for the purpose of strategic advantage.
        • The Cyber Centre assesses that ransomware will continue to target healthcare and medical research facilities, potentially jeopardizing patient outcomes and wider public health efforts.
      • How can stakeholders in the health sector protect their cyber systems and secure the data of Canadians?
        • We continue to recommend that Canadian health organizations remain extra vigilant and ensure that they are applying cyber defence best practices, including increased monitoring of network logs, reminding employees to be alert to suspicious emails, use secure teleworking practices, ensuring that servers and critical systems are patched for all known security vulnerabilities.
        • The pandemic has people doing more activities online; but generally, it does not significantly alter the cyber ecosystem or the best practices necessary to protect ourselves and our data.
      • Has the pandemic demonstrated an increased vulnerability in the cyber security of health data?

        Threat actors are taking advantage of the pandemic environment to conduct attacks against vulnerable sectors. Because the healthcare sector is under extreme pressure to mitigate the threat of COVID-19, they have been targets of cyber-attacks.

      CSE’s cyber centre general questions
      • What is your role at the Cyber Centre?

        As the acting Director General of Partnerships and Risk Mitigation, I run the directorate responsible for providing IT security advice, guidance and services to the government at all levels, Canadian critical infrastructure organizations as well as advancing relationships with private industry. Our overall goal is to strengthen cyber security practices in Canada.

      • How did the Communications Security Establishment Act change CSE’s authorities?
        • The Communications Security Establishment Act gave CSE new authorities which are needed to keep up with rapid advancements in technology. These new authorities enable CSE to work more effectively and proactively to protect Canada and Canadians.
        • CSE is now able, upon request, to deploy its cyber defence services to protect Canada’s critical infrastructure and other important systems designated by the Minister of National Defence as being of importance to the Government of Canada.
        • CSE is now authorized to undertake both defensive and active foreign cyber operations to help protect Canadians and Canada’s interests. At the same time, CSE is also now subject to a new oversight and accountability regime to ensure the privacy of Canadians.
      • What are the Cyber Centre’s responsibilities?
        • The Cyber Centre consolidates the key cyber security operational units of the Government of Canada under a single roof. As a unified source of expert advice and guidance, the Cyber Centre leads the Government’s response to cyber incidents.
        • The Cyber Centre also collaborates with the rest of government, the private sector and academia to strengthen Canada’s cyber resilience.
        • With the Cyber Centre, Canadians have a clear and trusted place to turn for cyber security.
  • Attribution summary

    Attribution summary
      Date State and actor Type of activity How we Attributed International partners
    Russia – CAN/UK/USA

    Attribution:
    October 19, 2020

    Activity:
    2020 Olympic and Paralympic Games

    Russia   Russian military intelligence, GRU   Canada is concerned over reports of a series of global malicious cyber activities, as detailed in today’s statements by the United States and the United Kingdom. These activities are examples of the willingness of Russian military intelligence, GRU, to target critical infrastructure and international organizations   Supporting Statement: Canada expresses concern over pattern of malicious cyber activity by Russian Military Intelligence UK, US
    Russia – CAN/UK/USA statement on activities targeting Vaccine development – July 2020

    Attribution:
    July 16, 2020

    Russia   APT29, also named “the Dukes” or “Cozy Bear” Cyber threat activity directed at Canadian, United Kingdom and United States organizations, including vaccine research entities, involved in COVID-19 response and recovery efforts   Joint technical advisory : Advisory: APT29 targets COVID-19 vaccine development UK, US
    Russia – Activities targeting Georgia and democratic processes – February 2020

    Attribution:
    February 21, 2020

    Activity:
    October 28, 2019

    Russia   Cyber units of Russia’s military intelligence agency: the GRU.   The GRU cyber unit responsible for these disruptions is known in open source as the Sandworm Team/BlackEnergy Group. A large scale disruptive cyber attack against a range of Georgian web hosting providers and media companies that resulted in widespread defacements and the failure of thousands of websites, including sites belonging to the Georgian government, courts, NGOs, media, and businesses. Statement US, UK, AUS
    China – MSPs    

    Attribution:
    December 20, 2018

    Activity:
    2016

    People’s Republic of China (PRC) Ministry of State Security (MSS) Actors associated with the People’s Republic of China (PRC) Ministry of State Security (MSS) are responsible for the compromise of several Managed Service Providers (MSP), beginning as early as 2016.   Statement Five Eyes
    Russia – Activities targeting international organizations

    Attribution:
    October 4, 2018

    Activity:
    2016 and 2018

    Russian military, GRU   Fancy Bear/APT28     A series of malicious cyber-operations by the Russian military against the World Anti-Doping Agency, the Canadian Centre for Ethics in Sport, and the Organisation for the Prohibition of Chemical Weapons   Statement : Canada identifies malicious cyber-activity by Russia Five Eyes
    Iran – Mabna Institute – May 2018

    Attribution:
    March, 2018

    Activity:
    2013

    Iran   Nine Iranian nationals allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 American companies, five American government agencies, and also more than 176 universities in 21 foreign countries     US
    Russia – NotPetya malware  

    Attribution:
    February 15, 2018

    Activity:
    June 2017

    Actors in Russia Canada condemns the use of the NotPetya malware to indiscriminately attack critical financial, energy, government, and infrastructure sectors around the world in June 2017.   Statement Five Eyes
    North Korea – WannaCry – December 2017

    Attribution:
    December 19, 2017

    Activity:
    May 2017

    North Korea The development of the malware known as WannaCry for destructive criminal activities, such as extort ransoms and disrupted services. Statement US, UK
    China - NRC cyberattack – July 2014

    Attribution:
    July 29, 2014

    People’s Republic of China (PRC) The National Research Council of Canada (NRC) was the target of a cyberattack from a “highly sophisticated Chinese state-sponsored actor" Statement by Canada's chief information officer, Corinne Charette  
  • Special committee on Canada-China relations (CACN) Blues

    The transcript is available on the House of commons website - Special Committee on Canada-China Relations - meeting transcript - February 25,2021

  • Special committee on Canada-China relations (CACN): key figures/witnesses

    Officials/figures that may be invited to appear, but have not yet appeared at committee:

    • Minister of National Defence
    • Minister of Public Safety
    • Officials from CSIS
    • Officials from RCMP
    • Officials from Public Safety
    • Officials from Department of National Defence
    • PCO National Security Advisor

    Former Minister of Foreign Affairs, François Philippe-Champagne

    Appeared: November 23, 2020

    Transcript for the CACN committee meeting 7

    Opening remarks: The Minister spoke to Canada’s important relationship with China in terms of trade and economic growth as well as China’s growing influence globally. He remarked that 2020 marked 50 years of diplomatic relations between Canada and China and the particular challenges of the relationship, including the arbitrary detainment of Michael Kovrig and Michael Spavor. The Minister concluded with concerns regarding threats to human rights, coercive diplomacy and the Uighurs.

    CSE was mentioned once during the meeting:

    • Jack Harris (NDP): The NSICOP Report talks about a lack of coordination between departments on foreign interference. We are late in the game and there seems to be a lack of commitment. Is there a specific program in the next 30 days?

      Hon. François-Philippe Champagne: We have a number of measures in place. The agencies of Canada are all seized with this matter whether its CSIS or CSE. This is not unique to Canada. We have seen this with our five-eyes partners. We are making sure that we coordinate and will take all the appropriate measures. We will make sure that we put all the resources in place to protect the safety and security of Canadians.

    • Michael Chong (CPC): What assurances can you give this committee that the government will deliver both a decision on Huawei and a robust plan to counter China’s influence operations by Friday, December 18?

      Hon. François-Philippe Champagne: We proposed an amendement. National Security should guide our decision when it comes to 5G and like I said when it comes to foreign interference, we take that very seriously and I am working with the Minister of Public Safety and we have measures in place.

    • Stephane Bergeron (BQ): The major telecommunications companies have stated that they no longer really need Huawei for the 5G network in Canada. How does this play into the decision in the next 30 days and Huawei and the Canadian network?

      Hon. François-Philippe Champagne: There were a lot of consultations. I rely on the Canadian agencies. National Security is the most important. What counts is to do this work well, using all the intelligence we have. We know that 5G will be very important. When the time comes, we will make a decision.

    • Jack Harris (NDP): Does the government have a plan to fix those problems focus on the problem of foreign interference [harassment of Chinese Canadians/foreign nationals]?

      Hon. François-Philippe Champagne: We take any allegations of foreign interference by state or non-state actors very seriously. This is something like you’ve heard from the Minister of Public Safety that is a dynamic situation; we are always looking. I will be looking into the recommendations from the NSICOP Report. Any Canadians who feel threatened by any form of intimidation should report this to their local police force to ensure that it is properly recorded.

    • MP Pierre Paul-Hus (CPC): Nuctech is a Chinese company. An agreement was made with them on border services, your department participated in the procurement process. How did things get to that point?

      Hon. François-Philippe Champagne: For the Nuctech file, all we had was an offer. There was no purchase made by Global Affairs Canada. When I found out about that I had asked for a review. Deloitte was appointed to do that work and they gave suggestions on how to improve that procurement process. Security is very important for contracts. No purchase was made by GAC, it was an offer not a contract.

    • MP Pierre Paul-Hus (CPC): If the opposition had not done their work, we probably would have had their equipment in our embassies. Last week I was at OGGO and departments were passing around the hot potato and saying it wasn’t their fault. How is it that the government of Canada is still doing business with China (computer equipment, etc.) knowing we can’t trust China?

      Hon. François-Philippe Champagne: I share your concern on national security and that’s why as soon as I found out about that situation I requested a review. The study done by Deloitte will help us improve our procurement processes. I also talked to the Minister in charge of Public Procurement. Thanks to the study done by Deloitte we will have even stronger systems and security will be at the heart of our decisions around suppliers.

    Marta Morgan, Deputy Minister, Foreign Affairs

    Appeared: January 30, 2020 (also appeared 23 November 2020, but all questions went to the Minister)

    Opening Remarks: outlined the governments concern with the outbreak of the Coronavirus, and the detainment of Canadians. She categorized Canada’s relationship with China as being complex, and that December 10th (the date two Canadians were detained) changed Canada’s relationship dramatically. Other questions revolved around the detention of the Uighurs and other Turkic Muslims in China.

    Transcript for the CACN committee meeting 3

    • Leona Alleslev (CPC): What direction have you been given by the government and what actions you have taken over the last 14 months to prevent the further decline of Canada's relationship with China?

      Marta Morgan: Over the past 14 months our priority has been to resolve a number of the challenging issues that have arisen in our relationship with the People's Republic of China. The Government of Canada is deeply concerned by the arbitrary detention and arrest by Chinese authorities of Michael Kovrig and Michael Spavor and we continue to call for their immediate release. We have worked very closely at all levels to convey these messages to the Government of China, most recently in a meeting in Japan between Minister Champagne and his counterpart, Foreign Minister Wang Yi, shortly after Minister Champagne became foreign minister. We have engaged many other countries to assist us in making these representations. Fourteen other countries have supported us publicly, and even more privately.

    • Peter Fragiskatos (LPC): Can you go into detail on the challenges of Canada's navigating what is a difficult time in the relations between the U.S. and China?

      Marta Morgan: There's been a lot written about the strategic rivalry between a status quo power and an emerging power. This might make a great future study for the committee. As a middle power, Canada has relied strongly on international rules and norms in institutions, and to protect businesses and our economic interests, as well as to promote peace and stability. We believe that is the strongest framework within which we can operate as a middle power.

    • Stéphane Bergeron (BQ): Given the hold that the Communist Party has on China as a state, are Canada’s relations limited to China as a state or are we also trying to develop relations with the Communist Party?

      Marta Morgan: I agree that our relations with China have been excellent for a number of years, and we have always had good face-to-face relationships. In the field of trade, we have many very complex relationships that require contacts. We are developing the relationships at all levels of Chinese society and government. China is a major country in the world and the relationships that we have with them are very important for us all.

    • Stéphane Bergeron (BQ): Given that Meng Wanzhou is accused of breaking United States sanctions against Iran, sanctions that Canada does not even apply, what justified that arrest? How do you explain the impact of having no Canadian ambassador in Beijing for those months?

      Marta Morgan: Canada is abiding by its international legal obligations in this case. We are working in accordance with the Extradition Act and our bilateral extradition treaty with the United States. I believe the committee will be receiving briefings by Department of Justice officials on these matters as early as next week. This proceeding is currently before the Supreme Court of B.C. and it will be up to an independent judge to resolve.

    Barton, Ambassador Extraordinary and Plenipotentiary of Canada to the People's Republic of China

    Appeared: December 8, 2020 (Also appeared 5 February 2020 where questions revolved around Barton’s role at McKinsey and their dealings with state-owned enterprises in China)

    Opening remarks: Ambassador Barton provided an overview of Canada’s relationship with China. He stated that the Government’s goal is to restore the relationship through three key priorities: (1) securing the release of the two Canadians detained in China; (2) promoting and protecting human rights; and (3) deepening and broadening people to people ties.

    Transcript for the CACN committee meeting 12

    • MP J Williamson (CPC): Could I start by getting your thoughts on today’s Washington Post story, “Huawei tested face scanning cameras that could send police a Uyghur alert”? This was an internal report that vanished after reporters asked about it. What do you make of this story?

      Dominic Barton: One of the concerns we do have are the cameras that are everywhere. I did not see any more cameras in Lhassa than I did in Beijing. But they’re everywhere. That is something we should be concerned about; while no one was following me, I didn’t think there weren’t people watching me. It’s a concern. I am not familiar with the particular Huawei technology or case.

      Washington Post story

    • MP J Williamson (CPC): I mean,it’s a police state. This is an example of using facial recognition technologies to classify human beings based on their ethnicity. Something that I certainly would think would violate human rights and has a racist component as well. Is this a company that the government of Canada would want to associate itself with?

      Dominic Barton: On the point of facial recognition and the ethic or bias differentiation, I would also worry and would concur with your concerns. I think as it relates to Huawei, I don’t know enough background in terms of what they have done on that and I am not involved in my role here in anything to do with the Huawei decision. So, I rather not comment on that.

    • MP J Williamson (CPC): The last time you were with us you said in regard to Canada’s 5G network “whichever way it goes there will be consequences”. What would be some of the consequences for Canada?

      Dominic Barton: I think the decision that the government is going to make on Huawei 5G obviously it’s a very important decision. Other countries have been affected by that, I look at commentary in Sweden and Australia. I think a lot of Canadian telecommunications companies have made some decisions on what they are going to do already. It’s a sensitive area and I honestly don’t know; people will be upset or mad about it but I think we need to do what’s right for our Canadian interests and be prepared to deal with the consequences in whatever way this decision goes.

    • MP J Harris (NDP): We talked in this committee about Chinese influence in Canada, but also the actions in Canada in buying energy and interest in minerals and other activities. Can you tell us whether or not the FIPA is important to China? Has it ever been raised to you as a concern of theirs that that might not be followed? Is it something you think they rely on in terms of their relationship with China and their interest in developing in Canada?

      Dominic Barton: The issue of investment in countries is a critical one. What they look at in particular is the Investment Canada Act, that is the core element. What is the process by which investment will be screened and allowed. And I think there’s a concern because what they’re seeing in other parts of their world in their point of view; the Investment Canada Act provides a lot of provision to check on the security side and ensure we aren’t putting ourselves in a vulnerabilities on that front.

  • CSE Response to committee

    Written Response to Special Committee on Canada-China Relations

    With respect to Canada’s 3G, 4G, and LTE networks, CSE has worked together with government partners and telecoms providers to mitigate cyber security risks through a collaborative risk mitigation framework (CSE’s Security review program). Since 2010, we have worked with the Canadian Security Telecommunications Advisory Committee (CSTAC) to exchange information and develop industry best practices that contribute to the security and resilience of the Canadian telecommunications systems. Since 2013, the Program has helped mitigate risks stemming from designated equipment and services, including Huawei, under consideration for use in Canadian 3G/4G/LTE telecommunications networks. To date, this program has led to:

    • excluding designated equipment in sensitive areas of Canadian networks;
    • mandatory assurance testing in independent third-party laboratories for designated equipment before use in less sensitive areas of Canadian networks; and
    • restricting outsourced managed services across government networks and other Canadian critical networks.

    With respect to 5G networks, CSE has been part of an interdepartmental government   review that is considering technical, economic and security factors associated with this emerging technology. This review includes advice from CSE and other security agencies, and takes into account relevant information and decisions from our allies and partners.  Each department taking part in the 5G security review has shared information and insights based on their subject matter expertise to ensure that the government has as a complete understanding of the issues in order to make informed decisions on the way forward.

  • OGGO – Transcript – Nuctech contract

    The transcript is available on the House of commons website Special Committee on Canada-China Relations - meeting transcript - November 18, 2020

  • Protect how you connect infographic

    The document is available on the Cyber Centre website Protect how you connect infographic

Report a problem on this page

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, please contact us.

Date modified: