Budget’s cybersec plans invoke questions about transparency: professor

As the federal government announced schemes to bolster Canadian cybersecurity in Tuesday’s budget, with a new strategy and two centralized agencies, legal experts are asking how accountable and effective the organizations will be. According to Toronto-based lawyer Imran Ahmad, it makes sense to move towards a more centralized system to simplify responses to cyber threats, though Queen’s University associate professor David Murakami Wood said that the decision to have the Communications Security Establishment (CSE) take point on this effort brings up questions about openness and transparency. The 2018 federal budget included $507.7 million for a new cybersecurity strategy over the next five years, and within that funding, $155.2 million a year will be going to the Communications Security Establishment (CSE) to create the Canadian Centre for Cyber Security (CCCS). As well, the RCMP will receive $116 million over five years to build a National Cybercrime Coordination Unit (NCCU). After the five years, the agencies will continue to receive $44.5 million and $23.2 million a year, respectively. Both initiatives are still new and specific activities remain undefined, but according to the text of the budget, overall goals of the CCCS include bringing “together federal cyber expertise” and providing “Canadian citizens and businesses with a clear and trusted place to turn to for cyber security information.” The NCCU will be geared towards law enforcement and provide insights and advice to law enforcement organizations and let Canadians report “cybercrime incidents,” it said. Ahmad noted in a phone interview that if “you have too many different centers or agencies that are going to operate independently...there would be a scramble for budget, scramble for talent, and a lot of people in the public sector or private sector would be confused in terms of who to reach out to.” When taking into account the recent construction of a new campus for the agency, additional powers asked for in Bill C-59, and now this budget, the CSE’s role in government is in the midst of being redefined, said Murakami Wood in a telephone interview. “You get a picture of an agency that's, in some ways, cementing and securing its position quite centrally in the new debates and developments are going on this century,” he said. According to Murakami Wood, a habit which the CSE will find hard to break is secrecy, which doesn’t lend itself well to a public facing entity. Being consolidated under the CSE means the new agency ”will be outside of the ability of Parliament to scrutinise directly, for people to scrutinize directly, for better or worse. It basically all vanishes into that black hole. My view is that we have already too much secrecy in these kinds of areas, most of which is not actually necessary.” Less concerned is Ahmad, who pointed to the fact that the CSE could carry some of the load of Public Safety Canada’s (PSC) busy mandate. “ ranges from cybersecurity to physical security to other aspects… which are very demanding on one individual or one single ministry,” he said. Ahmad added he thinks it’s a good idea to “bifurcate the oversight responsibility away from Public Safety... to CSE, which has specific expertise.” He doesn’t believe the CCCS will be run like an intelligence agency, but will be providers of guidance and expertise in cybersecurity strategy. Highlighting that the word “resilient” was included in the budget documents, Ahmad said he defines it as an organization’s ability to recover after a cyber attack. “The term resilience, I think, underscores the fact that at some point, there's a recognition that our critical infrastructure will be attacked. It may even go down,” he said, but the key here is “going to be how quickly can we stand that back up.” Ahmad also expects that current national cybersecurity groups in which Canadian telecoms participate, the Canadian Cyber Threat Exchange (CCTX) and the Canadian Cyber Incident Response Centre (CCIRC), will be folded into the operation of the CCCS and NCCU. He says that telecoms will have a responsibility to continue their cooperation because of how critical their systems are. Taking home security today and connected vehicles in the future into consideration, Canada’s big three telecoms play an increasing role in more segments of everyday life of Canadians beyond mobile phones, said Ahmad. If even one of those three “go down or are significantly impaired for a prolonged period of time, that is a significant portion of the Canadian population which has no access to telecom.” Meanwhile, Murakami Wood was more hesitant to say that the CCCS would have contributed to stopping a cybersecurity incident like the Equifax Inc. breach last year if it was in place. Pointing to the fact that many cybersecurity problems end up being unpatched systems and internal causes rather than external threats, he thinks that there will still be gaps in Canada’s protective measures. “Companies have a very big role to play in contributing to cybersecurity in that sense, and they can't wait for some external government agency to come and save them,” he said. Calls for government involvement by private industry are “in some ways, a real abdication of their own responsibility to deal with what are a lot of the risks that they themselves create through their archaic systems.” — With reporting by Bryson Masse at bmasse@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Budget’s cybersec plans invoke questions about transparency: professor

News | February 28, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Budget’s cybersec plans invoke questions about transparency: professor

News | February 28, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us