Procedure and House Affairs Committee on June 4th, 2024

[The Chair, Liberal, Ben Carr]

Good morning, everybody.

I hope all of you had a good weekend in your ridings.

Colleagues, welcome to meeting number 118 of the Standing Committee on Procedure and House Affairs.

The committee is meeting today to discuss the question of privilege related to cyber-attacks targeting members of Parliament.

Colleagues, we are all very well aware of the new regulations for audio devices. Please take good care to make sure that when they are not in use, you are placing them on the stickers provided in front of you on the table, either to your left or to your right.

I notice that we have a number of non-permanent members at the committee. Welcome to those who are here as substitutes today.

Colleagues, we have had a couple of very productive meetings. We have been dealing with some sensitive and difficult issues. Despite that, the conversation has been respectful. We've been able to maintain a good dialogue between those asking questions and the witnesses we've had. I hope we can continue in that spirit today.

We have a lot of witnesses this morning.

They are no strangers to us. They were with us not too long ago.

I would like to welcome back Eric Janse, Clerk of the House of Commons; Stéphan Aubé, chief executive administrator; Michel Bédard, law clerk and parliamentary counsel; Patrick McDonell, Sergeant-at-Arms and corporate security officer; Jeffrey LeBlanc, deputy clerk of procedure; and Benoit Dicaire, acting chief information officer, digital services and real property.

Mr. Janse, you and your colleagues will have 10 minutes collectively to begin the meeting. Following the conclusion of those remarks, we will go into our first round of questions.

Mr. Janse, the floor is yours.

[Eric Janse, Clerk of the House of Commons]

Thank you very much, Mr. Chair. It's a pleasure to be back before the committee, this time on a different topic than last week's and with a slightly different cast of characters before you.

We are appearing today regarding the prima facie contempt arising from the cyber-attacks by a foreign-backed entity called Advanced Persistent Threat 31, allegedly supported by the People's Republic of China and targeting members of Parliament. We trust that our testimony today will assist the committee in its consideration of this important question.

In his May 8, 2024, ruling, the Speaker broke down the question of privilege into two distinctive parts. The first was the issue of the lack of notification of members regarding the cyber-attack, and the second was the attack itself.

In his ruling, the Speaker noted that, since the attack, processes and protocols regarding the notification of members had evolved. The Speaker, notably, referred to the May 2023 direction from the former minister of public safety respecting threats to the security of Canada directed at Parliament and parliamentarians. He also mentioned this committee's recommendation, contained in its 63rd report, that members of Parliament be notified by CSIS of the foreign interference threats targeting them.

In the second part of his ruling—that is, the cyber-attack itself—the Speaker found the matter to be an attempt to interfere with the work of parliamentarians, and he ruled that the matter was a prima facie question of privilege.

In reaching his conclusion, the Speaker referred to the prima facie question of privilege raised by the member for Wellington—Halton Hills, which was the subject of a ruling from the Speaker’s predecessor on May 8, 2023. In that case, the member was the subject of threats of reprisal by foreign actors for positions he had taken during debates.

In his ruling finding a prima facie case of privilege, the Speaker stated that the matter raised by the member squarely touches upon the privileges and immunities that underpin the collective ability to carry out parliamentary duties unimpeded.

At the culmination of its study on this prima facie question of privilege, this committee presented its 63rd report to the House on April 10, 2024. While the report is not yet concurred in, it contains many recommendations. As the committee considers this latest question of privilege, it may seek to build upon the conclusions of that report and provide further recommendations to the House.

Three of the recommendations in the 63rd report were directed at the House administration.

The first suggested that training on foreign interference be developed and offered as part of the members' orientation program and on a continual basis. This had been in development for some time, and I am pleased to say it is currently being offered to caucuses and will be part of the next orientation program.

The second sought a contact person to be assigned by the House administration to liaise with members on all matters related to foreign interference threats. The third, related recommendation suggested that a protocol be developed to inform the whips about foreign interference threats.

I note that agreements with our security partners relevant to these recommendations are already in place. We will be happy to provide further information about these later on during the meeting.

This new question of privilege provides the committee with the opportunity to consider some additional elements that were brought to light regarding cyber-attacks toward members individually and to the House as a whole.

Cyber-attacks have several objectives, one of the most obvious being to disturb our technical systems, and as such impacting the ability of members to do their work. They can attempt to steal confidential information, impacting members’ ability to work on sensitive files. These attacks might also be seen as attempts to intimidate members, therefore also interfering with the business of the House. When individual members are the subject of various forms of obstruction, the House as a whole can be impeded.

As indicated by the Speaker in his ruling, these types of attacks are more and more common. The issue raised by the member for Sherwood Park—Fort Saskatchewan related to cyber-attacks by a foreign entity targeting emails, but other modern technology may be used to disturb parliamentary proceedings. In some cases, the entities behind the attacks can be identified, and in other cases they cannot.

Another element to consider is the difficulty for the House to assert its rights when a foreign entity is the sponsor of reprehensible actions. Furthermore, if the House can, to a certain extent, mitigate the impact and risks when attacks target its own systems, when other systems, such as personal emails, are used by members to fulfill their duties, the House's ability is limited. Members can currently use various tools to fulfill their parliamentary functions, some supported by the House's IT services and others not.

When examining a question of privilege, the committee typically avails itself of the usual powers as it would when conducting any study. In terms of privilege, it will seek to establish the facts. It can propose remedies and proposals by way of recommendations in a report presented to the House.

I will now ask my colleague, Benoit Dicaire, acting chief information officer, to provide further information on cybersecurity at the House of Commons.

[Benoit Dicaire, Acting Chief Information Officer, Digital Services and Real Property, House of Commons]

Thank you, Mr. Clerk.

Thank you, Mr. Chair.

I’m here today to talk to you about cybersecurity in the House of Commons, specifically to give you information on our evolving cybersecurity posture and the House administration’s commitment to protecting the institution and its users from cyber-threats.

The cyber-threat landscape is constantly evolving and becoming increasingly complex and challenging. The proliferation of technologies in this new digital reality is introducing significant growth in new threat vectors. In addition, the sophistication of threat actors is driving the House of Commons administration to continuously evolve and adapt our cybersecurity program to reduce emerging risks.

The House administration IT security team has a specific mandate to strengthen Parliament's cyber-resilience against a continuously evolving digital threat environment. Its role is specifically to protect the availability of IT resources, to ensure the continuity of parliamentary operations and to protect the confidentiality and integrity of the infrastructure system and its users, including members of Parliament and their data, whether in Ottawa, in constituencies or while travelling or working remotely. The House administration IT security team's mandate is for parliamentary information and devices only. Our role does not extend outside of members' legislative functions.

Parliament’s cyber-resilience relies on an integrated approach based on proactive measures such as ongoing monitoring, intelligence, threat hunting, vulnerability management, the development of incident response guides and regular exercises.

It is equally important to take reactive measures to ensure our ability to effectively detect incidents, threats and security breaches, to respond quickly when they are detected and to rely on them as they occur.

This approach is inspired by internationally recognized standards and best practices, such as the ISO 27000 series, the NIST cybersecurity framework, ITSG-22 and ITSG-33. It ensures that security controls and processes are in place to mitigate cyber-risk and to respond adequately to cyber-incidents.

In addition, this integrated approach is supported by various critical partnerships to effectively collaborate, share information and strengthen our cybersecurity posture. I will share more information about these partnerships in the in camera portion of this meeting.

That concludes the public portion of our introduction. We would be happy to take questions or answer any concerns.

Thank you.

[The Chair, Liberal, Ben Carr]

Thank you very much, Mr. Janse and Mr. Dicaire.

Colleagues, I have just a quick reminder. I briefly suggested last meeting that it would be helpful to the chair if, when you ask your questions, you have a timer in front of you or if the colleague next to you has a timer. It's certainly not required, but it means I don't have to speak over you to interrupt and keep you focused. I know sometimes that can be a distraction, but it's helpful for the efficiency of the meeting.

Mr. Genuis, the first six minutes are yours. I turn the floor to you.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Thank you, Mr. Chair.

We're here to discuss the fact that 18 parliamentarians were targeted by APT31, a Chinese state-affiliated hacking outfit. I was one of the 18. The attack targeted parliamentarians involved in the Inter-Parliamentary Alliance on China, which is, I should note, a great and important legislative network that brings together legislators from various countries and continents across different political traditions to work on issues related to the CCP.

I should have been informed about this attack but wasn't. My questions will focus on the notification of members. The government's public statements have suggested that they were aware of this attack. They chose not to inform members. They shared some information with the House administration.

Can you confirm whether and when the government shared information about this attack with the House administration?

[Eric Janse]

Thank you for the question, Mr. Genuis.

Indeed there were exchanges between security partners and the House administration at that time. We can perhaps provide some more details during the in camera portion, Mr. Genuis.

I think what was pointed out during the report—and certainly we can confirm from our end, and our security partners can on their end—was that if a similar situation were to occur today, things would be done differently from how they were when this incident occurred.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

The government could have informed members directly. From my perspective, there's no reason why they shouldn't have. Saying that they told somebody else looks like an excuse.

In the context of informing the House administration, was whether or not members were informed discussed? Did they express an expectation that members would be informed? Did they express an expectation that members would not be informed? Was that an issue in the conversation?

[Eric Janse]

I hate to do this, Mr. Genuis, but I'd like to suggest that perhaps this can be addressed in the in camera portion.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

I won't press the point more than to say that it's a question of political accountability for the government whether or not they sought to get this information to members. If they had asked you not to share the information with members, I think that would be germane to the public conversation around this issue. If they had made other comments.... You know what you know, and I don't know it, so I'm not going to press you beyond your comfort level. However, I think whatever advice the government gave around whether members should be informed is a matter of legitimate public interest.

[Eric Janse]

It's a fair point. Again, in order to provide a truly fulsome response to your question, we would prefer to do so during the in camera portion.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Maybe we'll follow up, and at that time the committee can decide what information should be shared publicly.

One thing has really bothered me about it. I think most members were attacked through their parliamentary accounts. I was not. I was attacked through my personal account. It was related to my parliamentary work, of course, but my personal email account, which is not published, was nonetheless targeted.

The response we heard early on in a media comment by the Speaker's office was that there was nothing to worry too much about because the attack had been thwarted. My understanding—and perhaps you could clarify this—is that House of Commons security is not involved in monitoring or protecting the personal non-parliamentary accounts of members in any way. The Speaker's office and the House of Commons administration would not in any way be able to say whether the attack on a personal account had been successful.

Could you comment on that?

[Eric Janse]

I can confirm that the House administration does not in any way monitor personal emails.

[The Chair, Liberal, Ben Carr]

You have about 90 seconds, Mr. Genuis.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Okay.

In terms of the protocols that were in place and that are in place now, there have been multiple cases in which there were threats and members were not informed. Those protocols have changed, if I understand right, such that if this event were to happen today, members would be informed immediately. Can you confirm that? Also, does the directive mean that members would be informed of threats to them that took place prior to the introduction of the new directive and that might still be relevant to them today?

[Eric Janse]

I'll give a high-level answer, but I can get into a bit more detail in the in camera portion.

Indeed, there would be quicker communication with members than in the past, but there is still an issue of threshold. As my notes and the Speaker's decision alluded to, there are an awful lot of attacks, unfortunately, on the House. We wouldn't want CSIS to have a satellite office at the House, because giving constant representations to members would be required.

If this were the case today, as opposed to two or three years ago, it would be handled differently.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

I have 15 seconds left.

That still seems fairly unclear. I understand there are a lot of threats. However, if an individual member, because of work they're doing on a foreign policy issue, is specifically targeted by a foreign government—not a generalized threat—it would seem reasonable to me that the member has a right to know, especially when they can take remedial action to protect themselves in both their parliamentary and non-parliamentary accounts.

You're saying it's still not a certainty they would be told.

[Eric Janse]

I hate to do this, but we can get into that during the in camera portion. I can give you a more fulsome response.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

I think it's a matter of significant public—

[The Chair, Liberal, Ben Carr]

Mr. Genuis, I've been courteous with the time.

Colleagues, in the event that you find you're getting to your final 20 or 30 seconds at the beginning of a round, feel free to give the time back to the chair. I'll simply add it to your time later on so you can have more efficiency in the lines of questioning. I certainly don't want to cut off any type of productivity.

Mr. Genuis, thank you very much.

Mrs. Romanado, the floor is yours for six minutes.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Thank you very much, Mr. Chair.

I'd like to thank the witnesses for being back at PROC.

I have questions that I anticipate you will only be able to answer in the in camera portion, so I will save some of those for then. Once we do a full round, if it's the will of the committee, we might want to start that in camera session a little sooner, rather than asking questions that unfortunately can't be answered in public.

The CSE has provided PROC with a timeline of events that walks us through this situation and provides us with dates for when this came about.

Mr. Dicaire, we understand a parliamentary email account is being monitored, obviously, but what is the protocol right now in the event the House of Commons receives a call from CSIS or CSE saying they have reason to believe a parliamentarian's private email has been targeted? Walk us through what would happen, because there seems to be some information in this chronology that shows, despite multiple contact points with the House of Commons administration, that things were not done, or it took a couple of days before action was taken. If you could walk us through this, it would be helpful.

[Benoit Dicaire]

Thank you for the question, Mrs. Romanado.

It doesn't happen often with partners on the cyber front because they understand our mandate when it comes to specific threats regarding the personal identity of members. It's not coming from a lot of instances because usually our interactions with partners are through our mandate specifically. As you know, some of these agencies have specific mandates, and they only interact with us when it matters to Parliament specifically.

We take information from various partnerships. When we speak in the in camera portion, I can allude to this more. Any information coming to the parliamentary cybersecurity team would be triaged and handled. We would look at the level of risk tied to the threat specifically. If it is a physical threat, we would liaise with my colleague the Sergeant-at-Arms. If it is foreign interference or that type of scenario, we would go to our Sergeant-at-Arms specifically.

Most of our relationships, from my perspective, are on the technology side. When it comes to technology elements, we very rarely get an interaction specifically targeting someone. It's mostly targeting infrastructure—these types of scenarios.

In general, that's probably the best answer I can give in public. Maybe Stéphan can add something.

[Stéphan Aubé, Chief Executive Administrator, House of Commons]

Through the board in 2014, we modified the acceptable use policy to clearly articulate the process if ever a member's personal information was targeted. With the cybersecurity group, in all cases when a member's information is put at risk, the discussion first happens with the member's office and directly with the member. This is the process that is documented and was approved by the Board of Internal Economy for specific threats to members.

If ever we need to access content—and the content would not be shared from the members to the House administration because we need your authorization to do so—then after that we can escalate this to the House officers. If we feel that the House infrastructure is at risk and we need to protect the institution, we will then get into that discussion.

The document we follow for incidents pertaining to members is the acceptable use policy of 2014.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

Monsieur Aubé, there was an acceptable use policy in 2014, but these events happened in 2021. If there was already a policy in place that clearly articulated the protocol to follow in the event of a possible non-House of Commons IT cyber-attack, as in the case of MP Genuis, why wasn't he contacted? You just mentioned that you need the approval of an MP in order to access that information. How come he was not made aware?

[Stéphan Aubé]

Our mandate from an IT security perspective focuses on Parliament and the legislative role of the member. We are not engaged currently in the personal protection of a member's information. In the case of such an event, if I don't have access to the information, I can't follow the protocol. Members whose House infrastructure was affected would have been notified.

[Sherry Romanado, Liberal, Longueuil—Charles-LeMoyne, QC]

You just mentioned that you currently are not engaged with IT systems that are outside of the House of Commons. Is that correct?