Procedure and House Affairs Committee on June 6th, 2024

[Caroline Xavier]

From January 2021 all the way until.... I forget the exact date, because I don't have the chronology in front of me, but it was almost a year in advance of the time in 2022 when we got the FBI report. We were aware that APT31 was of concern for us from January 2021. As part of the conversations we had with the House of Commons, the presentations we made to them and the reports we shared, we identified APT31 as, potentially, the actor at that time.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Okay. You're telling us now, at the end of this round, that you did inform the House that it was APT31. It's just yes or no.

[The Chair, Liberal, Ben Carr]

Please answer in about five seconds.

[Caroline Xavier]

I think, Mr. Chair, that I've answered the question.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

It's a yes, then, or is it a no?

[The Chair, Liberal, Ben Carr]

Unfortunately, Mr. Genuis, that is time.

Ms. Fortier, you have the floor for six minutes.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you very much, Mr. Chair.

Ms. Xavier and Mr. Gupta, thank you for being here and helping us shed light on this issue.

I will continue along the same lines. I’d like to know when you discovered ATP 31, or advanced persistent threat, was an issue.

[Caroline Xavier]

Thank you very much for the question.

As I said before, since the start of January 2021, we observed anomalies, troubling cyber-activities. We then contacted the House of Commons cybersecurity analysts to advise them of our concerns on a technical level. As we gained understanding of what was happening, we submitted 12 reports to them, met with them and also met with our colleagues from the Canadian Security Intelligence Service, or CSIS. We participated in conversations and advised the House of Commons that a nation-state actor was involved, and that it was in fact ATP 31.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Did it happen at that time or later? That’s what I’m trying to understand.

[Caroline Xavier]

It happened between January 22, 2021, and—

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

It was done with the House of Commons, correct?

[Caroline Xavier]

Yes, that’s right.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

You talked about the fact that you had meetings and shared information. Is that what you do when you notice something, a specific situation, activity from a group? What type of information do you send to the House of Commons when you detect a threat?

[Caroline Xavier]

We send a great deal of information, as much as we can, especially when it is not classified. Sometimes, we declassify information if sending it is useful.

I will ask Mr. Gupta, who was present during some of those conversations, to shed a bit more light on the type of information we send.

[Rajiv Gupta, Associate Head, Canadian Centre for Cyber Security, Communications Security Establishment]

Thank you, Mr. Chair.

When you have classified intelligence reporting, there's a lot of context and information, and then there's often a tear line, so there is another set of information that you can provide to an incident responder or to another organization to enable it to take immediate action in resolving an incident. In the lead-up to the incident, we would be sharing tear-line information: “Here is a sophisticated threat actor,” which, in cybersecurity terms, typically means a nation-state and is super important. It definitely reinforces the seriousness and the importance of the event.

However, all we're allowed to share, because of the intelligence, are the technical indicators. We didn't have the email addresses, so we would share the things that would be needed to find the email addresses. That's what we shared with the House of Commons, and we worked with the House of Commons collaboratively to figure out exactly what was going on, because typically you have a thread you need to pull.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

If it's through working with the House of Commons that you're trying to find out what's happening, then whose role is it? Does the House of Commons need to come back to you and say, “Here's what we found?”, or do you have to tell them, “Let's find something?” How is that relationship?

[Rajiv Gupta]

We started the thread-pulling by saying, “Hey, this is what we know. You can go find your emails.” We didn't have the emails. We had the thing to look for the emails with. They would go and look for that. That's what they did, and then they came back with that information. Every time we found something new, they understood the scope of the incident. That's how we work collaboratively with the House of Commons, and we've worked collaboratively with the House of Commons for a decade or more.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

During this incident’s time frame, you had regular contact. The chronology of events you provided to committee members shows that, on February 18, 2021, a decision was made for CSIS to work with the House. The Canadian Centre for Cyber Security’s cyber security events management team provided CSIS with a list of technical questions to help it analyze suspicious activity.

Why was it decided that CSIS would act as an intermediary between the Communications Security Establishment and the House of Commons?

[Caroline Xavier]

Thank you very much for the question.

We take our role very seriously. For us, it’s important not to keep Canadians’ private information with CSE data, because our role plays out on the international stage. When we understand that the origin of the threat to Canada is coming from abroad, it’s very natural for us to pass the torch to CSIS, because it has the mandate to act within Canada. We therefore take very seriously the fact that we do not intervene, and we are careful not to manage personal information. The reason why we passed the torch to CSIS in that situation was because the incident had to be managed here, in Canada.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Does the Communications Security Establishment know whether a follow-up was done with parliamentarians to make sure they had been warned, that they understood the measures to take and that their questions regarding the threat itself were answered?

[Caroline Xavier]

As my colleague Mr. Gupta said, when we manage an incident involving an institution, we maintain a continuous relationship in order to better understand the threat. It also provides us with information.

With the exception of the House of Commons, an institution could manage everything internally and inform us of the incident only after it is resolved. It’s also possible that it will not inform us at all.

[The Chair, Liberal, Ben Carr]

Thank you, Ms. Fortier.

Ms. Gaudreau, you have the floor for six minutes.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I did not hear your opening remarks correctly, so I may ask some questions.

If we come back to the beginning, the Communications Security Establishment’s mandate involves protecting digital infrastructure. Your clients include the government, public administration, National Defence and some of the companies you mentioned. Is that right?

[Caroline Xavier]

Thank you for your question.

Yes, our mandate involves protecting Canada’s government systems and critical infrastructure, but we also have an international mandate. Even if our mandate does not involve protecting individuals directly, you will find information on our website about ways to improve individual cyber-hygiene.

Our first mandate is to protect Canada and Canadians, especially government systems, industry, critical infrastructure and government communication sectors, among others.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I see. Given that we are going through a rather significant shift, MPs are becoming key players. Are they on the list of people to whom you offer services?