Procedure and House Affairs Committee on June 6th, 2024

[Caroline Xavier]

Yes, they are. Since 2019, we’ve offered parliamentarians the opportunity to get support from the Canadian Centre for Cyber Security, especially if they’ve had problems after a cybersecurity incident. That is also part of the services we offer, but it is important for parliamentarians to contact us if they want our help.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Could you explain to me what these services include?

[Caroline Xavier]

As I said before, we are very careful not to collect Canadians’ information. That means when Canadians or parliamentarians contact the Canadian Centre for Cyber Security for support, it is very important for everything to go well, so that we can offer the support required for managing an incident without going into their private lives.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

When it comes to disclosed information, do you think the House of Commons administration has enough details to be able to engage directly with the members involved?

[Caroline Xavier]

I do not want to answer for the House of Commons administration, so it would be better to ask them the question directly.

That said, as Mr. Gupta noted, we have a very good relationship with the House of Commons administration. We’ve worked with them since 2012, and the relationship is constantly improving. In 2016, we implemented a memorandum of understanding to properly maintain this relationship.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

People from House Administration came to talk to us about advanced persistent threats, or ATPs. From what I gathered, the information disclosed was insufficient. I pictured a situation in which information was provided, but it’s like finding a needle in a haystack.

My understanding is that the protocol and information pertaining to ATP 31 had evolved significantly. Can you provide me with a more in-depth explanation of the matter?

[Caroline Xavier]

I will ask Mr. Gupta to answer you, because as I said, he was very involved at the time, in 2021. I think he may be able to give you a better answer.

[Rajiv Gupta]

I think, to be able to understand the implications, as I mentioned, we shared a series of reports over the first few weeks that would help us pull the thread and understand what was going on. This was in 2021. This was pre-vaccine COVID, so it was very difficult to get people into rooms. We were working, but not necessarily everyone was in the office, so we booked a classified meeting to make sure that the full implications were met. We can talk about that maybe in the in camera session, but that's how we go about it. We share the information we can, and then we try to book classified meetings to make sure that all the full context is well understood.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Very well.

Regarding the Federal Bureau of Investigation’s report in June 2022, I have a very simple question for you: Do you have enough human resources and technical capacity? Things are moving fast, and you described to what extent strategies and strategists can differ significantly. Do we have what we need?

[Caroline Xavier]

Thank you for the question.

I’m very proud of our organization. We have extraordinary people who work very hard for Canadians. The additional funds included in the 2022 budget helped us move our cybersecurity activities forward and fulfill our mandate. The additional funds proposed in the 2024 budget would give us additional resources to do our work for Canadians. For us, that’s a vote of confidence from the government regarding our ability, and we are very proud of it. We are committed to meeting the demand.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Thank you very much, Mr. Chair.

[The Chair, Liberal, Ben Carr]

Thank you, Ms. Gaudreau.

Ms. Mathyssen, it's over to you for six minutes.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Thank you, Mr. Chair.

Thank you to the witnesses. I appreciate your being here with us today.

This may be a bit of a repetition, but just so it's clear in my own mind too, you talked about the first communications with the House of Commons when you found out about the attacks in January 2021. Our concern, of course, is that there was a significant amount of time—and I certainly understand, in terms of the conversations that have been had, that you learned more as time went on, and you were reporting that. That's great. I think the key point here, though, is that at whatever point, none of this was reported to the individual MPs in question. This is what we have to investigate. We have to determine if this is the problem.

Could you go over again, for my own sake, why it's so important that there is almost that divide that occurs? There's this space where you're not directly communicating with the members once it's determined that there is this sophisticated actor, as you've labelled them. Why is that intermediary position so important? Why couldn't there have been maybe a joint communication with the members of Parliament who were impacted? Are you maybe looking at the advantages or disadvantages of that? This is constantly a learning process. I understand that as well. How will things maybe change in the future? Are you considering how we can move forward from this?

[Caroline Xavier]

Thank you very much for the question.

One thing that's worth mentioning here is that we work really hard to try to ensure we inform Canadians and businesses as much as possible with the various publications that we put out. As mentioned, since 2017 we've put out three updates on “Cyber Threats To Canada's Democratic Process” and, in addition to that, four editions of the “National Cyber Threat Assessment”. Those are documents that help highlight some of the threats we're seeing and observing based on a whole bunch of research as well as the observations that have occurred in Canadian systems as well.

With that, one thing we also do is that we actually hold quite a number of information sessions, and we've held some with parliamentarians, supported by others like the service and the RCMP. We're very happy to be able to do joint information sessions with whoever would like us to be present, to educate them on the cybersecurity domain in particular, because the more people are aware of what the threats are, the more resilient we become as a country and as individuals.

The issue, though, is that we really are respectful of the independence of the House of Commons and the Senate, and we're really respectful of the role that the House of Commons administration plays in supporting parliamentarians. This is why we go through them, as we do for many service providers and other institutions that we deal with. We go through them, and we're at their service if they would like to have more support from us. We would be more than happy to continue to hold sessions with parliamentarians should the House of Commons administration want our assistance to do a joint session. We're definitely available to do that.

As a matter of fact, the public safety department has been in touch with the Sergeant-at-Arms, and there are three sessions currently scheduled for caucus that we'll be part of, for example, with Public Safety as well as the RCMP and the service. This is to show you that these are services that we are prepared to do, but we are just trying to continue to be very respectful of the processes that are in place and, more importantly, the independence of the House of Commons in this role.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

I certainly appreciate that. Our caucus is getting a briefing, I think, next week. However, that's more of.... These info sessions are very general, and it's very different from when individual MPs themselves are targeted. Again, is there a shift in terms of...? I understand absolutely that the independence of Parliament is key, but that's actually what we're talking about here in terms of the threat or this potential breach of privilege that has been the concern of these studies and this meeting. That's what's at stake here as well.

To make it more specific, is there an idea that we've learned from this and said it was a problem? Clearly, the people involved were not told in the way that they needed to be. Are changes being made to ensure that breach of privilege potentially is not a future issue?

[Caroline Xavier]

Thank you very much for the question and the clarification.

We are an organization that considers itself very much a learning organization, so we continue to look for ways to improve. This is part of that learning, to be able to see where we can improve our processes, in addition to all the external review bodies and various reports that are going on with regard to other issues, like foreign interference.

We will continue to learn from this to improve those processes and work with the House of Commons to identify a better way forward.

In general, though, when it comes to identifying an individual who may be impacted by a cyber-incident because we learned of it from a foreign source, we pass on that information in general to the service, as I mentioned earlier, for the reason that then it becomes a domestic issue and is not within our wheelhouse. It is also not the way in which we function with respect to our act. Sometimes the RCMP will be engaged, especially if it's going to be something that requires a law enforcement lens. In this case, we did pass it on to the House of Commons as well as to CSIS, so that they could pass on the information to the necessary MPs.

[The Chair, Liberal, Ben Carr]

Thank you very much, Ms. Mathyssen.

Okay, folks. We are entering our second round.

Mr. Genuis, the floor is yours for five minutes.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Thank you, Chair.

I have to start by saying, in response to the round of questions with Ms. Mathyssen, that I find it laughably ridiculous to say that the government institution has so much respect for parliamentarians that they kept secrets from those parliamentarians about their own safety. That's not how you manifest respect in the relationships that I'm a part of—by keeping vital secrets from people.

Ma'am, when Parliament was briefed about aspects of this threat, did you expect the House of Commons IT department to inform members of Parliament about the specific threats?

[Caroline Xavier]

Our understanding, or, yes, I guess my expectation would be that if I'm passing on information to a partner, a partner will do what is necessary to address the content of the information that is provided—

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

I'm sorry, ma'am. You really prevaricated in my last round. I'm going to push you more, because prevaricating in response to questions is a matter that touches on the privileges of parliamentarians.

It was a very specific question. Did you expect them to brief members of Parliament who were threatened about these threats?

[Caroline Xavier]

When we pass information on, the expectation is that it will be of use to others. The expectation would be that, given that we shared a list of names, somebody will act on it, whether it's to CSIS or, in this case, the House of Commons.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

I'm sorry. That's not the question. That's not the question at all. It wasn't about whether you expected them to act on it. The House of Commons IT's job is to protect the IT systems.

[Chad Collins, Liberal, Hamilton East—Stoney Creek, ON]

I have a point of order, Mr. Chair. I'm interested in the answers. I don't think the witness has been given full opportunity to provide them—

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Then use your round. Come on. Learn the rules here, Mr. Collins.

I have five minutes. Then you have five minutes.

[Chad Collins, Liberal, Hamilton East—Stoney Creek, ON]

Maybe you could just have some level of decency here in terms of allowing the witness to fully answer a question.