National Security and Intelligence Committee of Parliamentarians Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack

Submitted to the Prime Minister on August 11, 2021 pursuant to subsection 21(1) of the National Security and Intelligence Committee of Parliamentarians Act (Revised version pursuant to subsection 21(5) of the NSICOP Act)

© Her Majesty the Queen in Right of Canada (2022)
All rights reserved.
Ottawa, ON

National Security and Intelligence Committee of Parliamentarians

Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack (Revised version pursuant to subsection21(5) of the NSICOP Act)

CP104-3/2022E (Print)
ISBN 978-0-660-41354-9 (Print)

CP104-3/2022E-PDF (Online)
ISBN 978-0-660-41353-2 (Online)

The Honourable David McGuinty, P.C., M.P.
Chair

Submitted to the Prime Minister on August 11, 2021
Revised version tabled in Parliament in February 2022

Revisions

Consistent with subsection 21 (2) of the National Security and Intelligence Committee of Parliamentarians Act (NSICOP Act), the Committee may submit a special report to the Prime Minister and the ministers concerned on any matter related to its mandate. Consistent with subsection 21 (5) of the NSICOP Act, the Prime Minister may, after consulting the Chair of the Committee, direct the Committee to submit to him or her a revised version of the report that does not contain information the Prime Minister believes the disclosure of which would be injurious to national security, national defence or international relations or is information that is protected by solicitor-client privilege.

This document is a revised version of the Special Report provided to the Prime Minister on 11 August 2021. At the time, the document was classified as 'Top Secret/Special Intelligence/Canadian Eyes Only.' Revisions were made to remove information the disclosure of which the Prime Minister believes would be injurious to national security, national defence or international relations or which constitutes solicitor-client privilege. Where information could simply be removed without affecting the readability of the document, the Committee noted the removal with three asterisks (***) in the text of this document. Where information could not simply be removed without affecting the readability of the document, the Committee revised the document to summarize the information that was removed. Those sections are marked with three asterisks at the beginning and the end of the summary, and the summary is enclosed by square brackets (see example below).

Example: [*** Revised sections are marked with three asterisks at the beginning and the end of the sentence, and the summary is enclosed by square brackets. ***]

The National Security and Intelligence Committee of Parliamentarians

• The Hon. David McGuinty, P.C., M.P. (Chair)
• Ms. Leona Alleslev, M.P.
• Mr. Stéphane Bergeron, M.P.
• Mr. Don Davies, M.P.
• The Hon. Dennis Dawson, P.C., Senator
• Mr. Ted Falk, M.P. (resigned June 15, 2021)
• Mr. Peter Fragiskatos, M.P.
• Ms. Iqra Khalid, M.P.
• The Hon. Frances Lankin, P.C., C.M., Senator
• Mr. Rob Morrison, M.P.
• Mr. Glen Motz, M.O.M., M.P. (resigned June 15, 2021)
• Ms. Jennifer O’Connell, M.P. (resigned March 19, 2021)
• Ms. Brenda Shanahan, M.P.
• The Hon. Vernon White, P.C., Senator

---

---

Table of Contents

• Introduction
• Overview of the Review
• Past Examinations of Cyber Defence Activities
  • External review
  • The CSE Commissioner
  • Internal review
• Part I: Cyber Threats  — what's at stake and who is involved?
  • What's at stake?
    • Threats to the personal information of Canadians
    • Threats to business information, intellectual property, research networks and academia
    • Threats to government policies and policy-making
    • Threats to security and intelligence information and operations
    • Threats to the integrity of government systems
  • What's happening? The cyber threat environment
    • Cyber threats to government networks, 2015 to 2020
    • Nation-state advanced persistent threats
    • Government networks and cyber crime
  • Summary
• Part II: Evolution of the Government's Framework for Cyber Defence
  • Early days (2001 to 2010)
    • Active network security testing and security posture assessments
    • The origin of computer network defence activities
    • Hard lessons learned along the way
  • Establishing the government enterprise (2010 to 2018)
    • Canada's Cyber Security Strategy, 2010
    • The evolution of Canada's Cyber Security Strategy
• Part III: Key Cyber Defence Players, Authorities and Activities
  • Treasury Board of Canada and the Treasury Board of Canada Secretariat
    • Defining government organizations
    • Foundational policies for cyber defence
    • Summary
  • Shared Services Canada
    • SSC mandate
    • SSC services and projects
    • Secure Internet connectivity: The evolution toward the Enterprise Internet Service
    • SSC partners and clients
    • Cyber security event management
    • Summary
  • The Communications Security Establishment
    • CSE cyber-related mandates and authorities
    • Governance of CSE cyber defence activities
    • CSE cyber defence activities
    • Summary
• Part IV: Governance of Cyber Defence
  • Strategic considerations
  • Operations, policy and programs
  • Incident response
    • Cyber Security Event Management Plan response levels
    • Cyber Security Event Management Plan governance bodies
    • Phases of the cyber security event management process
• Part V: The Committee's Assessment of the Cyber Defence Framework
  • The evolution of cyber defence in Canada: A virtuous cycle, but incomplete
  • Who is protected depends on who you ask
  • The success and the gap: Securing Internet access in government
    • Crown corporations and government interests
• Conclusion
• Findings
• Recommendations
• Government response to recommendations
• Annex A — List of Witnesses