PUBLIC SAFETY CANADA – Statements on Cyber Strategy

QUESTIONS FROM CBC (Nov. 5, 2015):
1) What does Public Safety say to complaints from policing and industry leaders that Canada's
federal "cyber strategy" is failing and lags far behind actions taken by our allies?

2) What - if anything - is being done to document/measure/analyze the wide range of
cybercrimes being committed in Canada (from simple scam email solicitations, to more
sophisticated malware, hacks and full scale breaches of personal information and corpoate
intellectual property)?

3) What is the lead agency in Canada responsible for investigating cybercrime?

4) What is being done by the federal government to help industry, police and government
(CSE, public safety) to share intelligence about known cyber threats that pose a risk to
industry, small and medium sized business and individual citizens?

5) What new initiatives are in development to help address some of the shortcomings
identified above?

STATEMENT FROM PUBLIC SAFETY MEDIA RELATIONS ((Nov. 13, 2015)
Cybercrime refers to criminal offences where the Internet and information
technologies are used to carry out illegal activities. It covers a broad range of
offences that include familiar types of crime that are being conducted in new ways,
such as fraud, money laundering, and identity theft, as well as new kinds of crime
like denial of service attacks. The RCMP report on cybercrime, Cybercrime: an
overview of incidents and issues in Canada (http://www.rcmp-grc.gc.ca/pubs/ccreport-rapport-cc-eng.htm) provides more information about the types of
cybercrime, case studies, and some statistical tracking.
Criminal activity should be reported to local law enforcement, who have the
mandate to investigate or refer cases. The RCMP, as the national police force, has

 the mandate to investigate crimes that are national in scope. We would encourage
you to reach out to the RCMP for their perspective on cybercrime directly.
There are a number of Government of Canada initiatives to address different
aspects of cyber threats. We can provide more detail on two specific initiatives: The
Canadian Cyber Incident Response Centre and the Get Cyber Safe awareness
campaign.
The Canadian Cyber Incident Response Centre (CCIRC) is responsible for providing
authoritative advice and support, and coordinating the national response to cyber
security incidents. Its focus is the protection of vital systems outside of the federal
government, including provinces and territories as well as critical infrastructure
operators, against cyber incidents. CCIRC’s works directly with the security
specialists in many private sector organizations. Organizations can report any cyber
incident to Government through CCIRC, and they do so because of the value of
CCIRC’s expertise and services. Each partner organization benefits from CCIRC's
cross-sector cyber threat information sharing and regular updates, notices, bulletins
and technical advice on emerging cyber threats.
CCIRC works with the private sector on a voluntary basis and has become well
known and respected within Canada’s cyber security community. It notifies
Canadian organizations that are suspected of being infected with malicious
software. For more details on alerts and advisories published by the CCIRC, please
visit:http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/index-eng.aspx. Owners and
operators of vital cyber systems whose identities have been verified through an
authentication and reference process have access to the following CCIRC products
and services:
o Advice and support to prepare for and mitigate cyber events. CCIRC
disseminates various technical and IT manager-focused products that offer
guidance, early detection indicators, summary, trend, and operational analysis.
Additionally, CCIRC shares technical information on threats, vulnerabilities, risks and
incidents with its partners to enhance collective understanding of cyber threats and
incidents and help ensure organizations have the information required to make
informed decisions.
o Technical advice and support to respond to and recover from targeted
attacks. CCIRC provides its partners with technical assistance, and performs
malware analysis and forensics. In addition to its own expertise, CCIRC can draw on
broader Government expertise and resources to help develop targeted mitigation
and recovery advice.
o Access to trusted fora for information sharing and collaboration. CCIRC
provides partners access to fora where they can share information within their
communities of interest, or more broadly should they wish, and gain access
reciprocally to information, expertise and peer support. The CCIRC Community
Portal provides a common collaboration tool for organizations that are part
of Canada's critical infrastructure sectors. CCIRC uses this portal to share its most
recent documents and publications with its partners. In turn, partners have the

 option of posting documents of their own, and can also use this portal to report
cyber incidents to CCIRC.
“Get Cyber Safe” is the Government of Canada’s national public awareness
campaign created to educate Canadians about Internet security and the simple
steps they can take to protect themselves online. The messages and information in
the campaign are geared to be less technical to be immediately useful for the
majority of individual citizens and small and medium business owners. The
campaign has also released theGet Cyber Safe Guide for Small and Medium
Business as a resource, which has also been distributed in partnership with private
sector organizations and associations. To learn more about the campaign,
visit www.getcybersafe.ca.

CBC QUESTIONS FOLLOWING ATTACKS IN PARIS (Nov. 18, 2015)
Just this week the UK announced it is nearly doubling its funding for cyber security,
citing, among other cyber threat actors, ISIS developing capabilities and ambitions
to be able to launch cyber attacks on "enemy" critical infrastructure.

1) Is there anything you would add, given our adjusted focus on terrorism
threat actors, as opposed to cybercrime?
2) Are there any financial breakdowns you can provide us, on how much
Canada spends on "cyber security?"
3) How much are we spending on our "cyber strategy" ...and what does that
strategy encompass?
4) How much is spent specifically on the cyber security programs aimed at
defending "critical infrastructure?"
5) What can we say about where the "critical infrastructure" portion of the
"strategy" is at in terms of implementation and efficacy? (A few informed
commentators say there are still huge gaps, and that the federal strategy is
very much in progress, not quite yet fulfilled.)
STATEMENT FROM PUBLIC SAFETY CANADA (Nov. 20, 2015)

Canadians are embracing the many advantages that the Internet offers.
Along with this increased reliance on technologies comes the vulnerability
from those who would seek to attack and undermine digital infrastructure. By
taking action to protect the cyber systems that Canadians rely on daily, the

 Government is also protecting Canadians’ security, public safety, economic
prosperity and way of life.
In the midst of a rapidly evolving threat environment, we have made
significant progress, and we will continue to work to strengthen Canada’s
capacity to protect Canadians – individuals, industry and governments - from
cyber threats.
Launched in 2010, Canada’s Cyber Security Strategy is built on three pillars:
- securing government systems;
- partnering to secure vital cyber systems outside the Federal Government;
and
- helping Canadians to be secure online.
Since the launch of Canada’s Cyber Security Strategy, the federal
government invested $245 million. The Government of Canada committed a
further $142.6 million over five years to tackle cyber threats targeting
Canada’s private sector and, in particular, the critical infrastructure of our
country. Funding was allocated to Public Safety, RCMP, CSIS and CSE. Please
note that we cannot comment further on internal security measures, nor can
we disclose the breakdown of the funding for security reasons.
This funding will enable the creation of a dedicated cybercrime unit within
the RCMP and support the development of specialized law enforcement
capacity that’s required to combat the evolving cybercrime environment.
This investment will also significantly enhance the collaboration between the
Government of Canada and the private sector, including the owners and
operators of organizations in all ten of Canada’s critical infrastructure
sectors, as well as small and medium enterprises, by providing additional
information on cyber threats, and faster dissemination.
For example, the Canadian Cyber Incident Response Centre will use new
resources to analyze more threats and vulnerabilities to critical and emerging
technologies, such as industrial control systems and mobile devices,
enabling the sharing of timely and comprehensive mitigation advice to
reduce the risk faced by vital cyber systems in Canada. The Canadian Cyber
Incident Response Centre will also to broaden its outreach activities in order
to ensure cyber warning and mitigation advice reaches more Canadian
stakeholders, thereby increasing the safety, security and resilience of
Canada’s cyber ecosystem.

 Critical infrastructure owners and operators will also be able to draw on an
enhanced Regional Resilience Assessment Program (RRAP), which enables
organizations to assess how ready they are to deal with a range of risks and
will now incorporate cyber security into the site assessment process. This
measure will enable Public Safety Canada to assess the overall cyber
security of an organization and provide recommendations to improve
resilience in sectors such as finance, telecommunications, energy and
utilities.
Public Safety Canada continues to engage the owners and operators of
Canada's critical infrastructure on cyber security. For example, by providing
cyber security briefings to critical infrastructure sector networks and
organizing workshops across the country to improve awareness and
understanding of the threats to industrial control systems.

The Government of Canada recently released mandate information for each
Minister. As part of fulfilling its mandate, Public Safety Canada, with the
support of partner departments and agencies, will be undertaking a review of
the existing measures to protect Canadians and our critical infrastructure
from cyber threats. The outcomes from this review will guide and inform
policy and program decisions that will make our critical infrastructure more
resilient to cyber attacks and help keep Canadian citizens stay safe online.