New cybersecurity centre will lead response to major cyber attacks, says Sajjan The head of the cybersecurity centre is expected to be announced this spring, but industry advocates say funding enough cybersecurity experts to staff it will be a major hurdle. (By Jolson Lim (The Hill Times)
The Canadian Centre for Cyber Security, the centrepiece of the Liberal government’s efforts to protect the country from cyberattacks, will act as the “operational leader” in the event of a cyber security incident, Defence Minister Harjit Sajjan says.
Public details on the new cybersecurity centre have been sparse since its formation was promised in the 2018 budget, but Mr. Sajjan told The Hill Times in an email interview that the centre would “act as the operational leader during cyber security events and will provide leadership on national cyber security issues.”
The cybersecurity centre was pitched in last February’s budget as a one-stop centre to provide trustworthy guidance for the federal government, businesses, and ordinary Canadians on how to protect themselves from hacking and other cyberthreats.
The newly-announced centre will be the agency assigned to respond to threats on top of its prevention role, and will be housed within the Communications Security Establishment (CSE), the country’s intelligence agency.
Mr. Sajjan (Vancouver South, B.C.) said he expected to announce who will head the cyber centre “this spring,” and that it will be fully operational by fall 2019. It will bring existing cybersecurity operations scattered across multiple federal departments under a single roof.
He said the Canadian centre will be based on equivalent agencies in the United Kingdom and Australia, two countries that form part of the “Five Eyes” intelligence alliance, which also includes Canada, New Zealand, and the United States. The Canadian centre will perform “additional functions,” compared with its international counterparts, related to cyber defence operations for federal government networks under a single centre of expertise.
He said the centre will end confusion and internal government overlap while boosting the country’s ability to detect and respond to new and increasingly-complex cyber threats. The U.K.’s National Cyber Security Centre (NCSC), housed within the CSE-equivalent called the Government Communications Headquarters—better known by its acronym GCHQ—provides Britons with advice and support on how to fend off cyberattacks.
The U.K. announced a new cyberattack classification network last month, and the NCSC takes charge in responding to threats except in the cases of a national emergency, where the British cabinet takes control with support of the NCSC and law enforcement.
The current Canadian Cyber Incident Response Centre, housed in Public Safety Canada, is tasked with responding to national cybersecurity incidents, on top of monitoring risks for critical infrastructure, but will soon be folded into the new centre. If required, the general federal crisis response team, the Government Operations Centre, may also step in.
The centre will have its own dedicated website, launch a public awareness campaign, and host a forum for technical cyber information. Mr. Sajjan said “quicker, more effective information flow will occur between the centre and private sector partners.“
The move is an early step in the federal government’s plans to improve the country’s ability to protect itself from hacking and other cyberthreats, something experts have said Canada lags behind in compared to countries such as the U.K.
While all countries are victims to cyber attacks, a study by consulting fi rm MNP LLP conducted by Ipsos in January found three in five businesses “either suspect or know for certain” they were victims of hacking attempts. The survey asked 100 Canadian executives of large companies as well as 1,000 small business owners.
Since that month, major data breaches affecting Canadians have been reported at Loblaws, Canadian Tire, Bell Canada, and Uber. Businesses and government computer infrastructure are often targets of attacks, either done by individuals or foreign entities.
But small- and medium-sized companies are mostly ill-equipped and lack the know-how needed to fend off increasingly-complex threats.
Katherine Thompson, chair of the Canadian Advanced Technology Alliance’s (CATA) cyber council, said the challenge is also “that they still don’t believe they’re at risk.” She said the cybersecurity centre presents an opportunity to provide businesses with cybersecurity information more easily, noting that content is often spread over different government websites.
“A lot of them aren’t making major investments in time or technology to address it,” she said.
That poses big challenges to their bottom line if they’re victims of an attack, which can hurt them even more if they aren’t aware of or fail to meet new data breach disclosure regulations, she said. They may have to pay fines in the hundreds of thousands of dollars that they’ll struggle to afford
Meanwhile, The Globe and Mail reported last year that a Chinese state-sponsored cyberattack on the National Research Council’s computer infrastructure in 2014 cost the federal government hundreds of millions of dollars. Increasingly, cyberattacks have been directed at democratic processes around the world, and the CSE recently noted in a report that Canada isn’t immune.
Public Safety Canada is set to unveil the $507-million National Cyber Security Strategy, which will rejig an old cybersecurity plan put forward by the Conservative government in 2010.
Details are scarce but the 2018 budget states the strategy focuses on fortifying Canadian systems from attack, building an innovation and adaptive cyber ecosystem, and supporting better leadership and co-operation internationally and between different levels of government.
Public Safety Minister Ralph Goodale’s (Regina-Wascana, Sask.) press secretary, Scott Bardsley, told The Hill Times there will be a formal announcement with ministers this spring, but did not confirm a date.
Feds will face cybersecurity expert crunch
A total of $155.2-million over five years is being spent to prop up the CSE cybersecurity centre.
The Liberal government has promised to provide the centre a stable budget of $44.5-million annually after 2022. A total of 750 employees will work at the centre, some migrating from Public Safety Canada and Shared Services Canada.
While the cybersecurity centre merges in-house government expertise, Ms. Thompson told The Hill Times that it probably won’t address a “growing labour and skills shortage in Canada when it comes to cybersecurity expertise.”
Ms. Thompson, who said she is frequently in talks with federal officials on cyber security issues, said there are more than 500 unfilled cybersecurity jobs just within the federal government.
“In Canada, we haven’t quanti- fi ed it. We just know there’s a gap and it’s growing,” she said, contrasting it to the U.S. Department of Commerce’s countrywide heat map showing where the unfilled cybersecurity jobs are in the country, which is located in the capital. She said Canadian firms such as Scotiabank and TD are seeking Israeli expertise to protect their online infrastructure.
The government is going to be confronted by that shortage of expertise “right away,” said Kevin Wennekes, chief business officer of CATA, the largest high-tech association in Canada.
Mr. Wennekes said with the RCMP plans to staff its new National Cybercrime Coordination Unit with 100 people within the next year but already recognizes problems facing finding experts with extremely specialized skill sets. The unit will acts as a hub for law enforcement to co-ordinate investigating cyber crimes.
He said he’s working on an advocacy campaign to get the federal government to set up a cybercrime training institute in order to increase the number of Canadian cybercrime experts.
Meanwhile, if Bill C-59 passes, it could mean the centre will be the base for pro-actively launching cyber attacks abroad and engaging in covert operations, two powers set forth in the legislation, which has been criticized by academics as being too broad.
Conservative MP James Bezan (Selkirk-Interlake-Eastman, Man.), his party’s defence critic, told The Hill Times that “as Conservatives, we are supportive of having these centres of excellence.”
“We do support increasing the capabilities of the Canadian armed forces, CSE and CSIS to have not only the ability to protect us from cyberattacks but also pre-emptively remove those threats, and so it’s cyber warfare on both the offensive side and the defensive side,” he said. Mr. Bezan, who was parliamentary secretary to the defence minister from 2013-15, said “for the most part, we’re pretty supportive” of the bill.
Mr. Bezan is vice-chair of the House Defence Committee, which is currently studying the bill.
A major concern is how to protect Canada’s financial institutions and energy sector from attacks that “could cripple our nations,” he said.
Nevertheless, he said he was concerned about the proposed oversight powers for the foreign affairs minister, who he says would be able to veto cybersecurity decisions made by the defence minister.
Interact with your Innovation Peer Group Now
The Canadian Advanced Technology Alliance (CATAAlliance), Canada’s One Voice for Innovation Lobby Group, crowdsources ideas and guidance from thousands of opt in members in moderated social networks in Canada and key global markets. (No Tech Firm Left Behind)