Government should have cyber security czar, senators hear

OTTAWA — Canada should have a federal “cyber czar” focused on the issue of cyber security, Peter Sloly, the former deputy chief of the Toronto Police Service and an executive director at Deloitte Touche Tohmatsu Ltd., told senators Wednesday. The cyber czar would “overarch ministries and other divisions of government in order to co-ordinate and develop a level of cyber capacity and update the strategy on a continual basis,” he said. Sloly, who works in the cyber section of Deloitte Canada’s risk advisory services, was speaking at a meeting held as part of an “Open Caucus” initiative organized by the Senate Liberals. Public Safety Canada is currently in the middle of a consultation process for a cyber-security review, due to wrap up by the end of the year. Cyber czar posts should also exist at the provincial and municipal levels, Sloly added. There should also be a cyber “ambassador,” who would work at international bodies like trade associations and the United Nations, he said, noting international agreements are needed to access data stored on servers stored in other countries. Sloly suggested the cyber czar post “be set up somewhat similar to a direct security advisor to the PMO or something out of the Privy Council, potentially.” David Murakami Wood, associate professor at Queen’s University and Canada research chair in surveillance studies, said “one issue is how those kinds of special advisors, czars and so on, are held accountable for what they do.” Wood agreed with Sloly that “we should be creating different structures.” He said that “one of the problems with creating ministries, of course, is they create their own bureaucratic institutional norms, and it’s very difficult to get them to change later,” though he noted that “the only good thing about ministries is that they have formal accountability.” He also pointed to the international dimension of the cyber-security problem. Wood said the increased move towards storing data in the cloud, including by the federal government, “will inevitably at some point bring Canadian information and privacy law into conflict with those of other jurisdictions.” Senator Paul Massicotte asked whether big telecoms or banks are doing enough to address cyber security. Claude Sarrazin, president of Montreal-based investigation company Sirco, responded that “they’re investing massively. The big organizations are in there. The banks are in there,” though there’s “always” the possibility that they could do more. He noted that one problem is that spending on security, including cyber security, doesn’t turn a profit. “We’re not going to show a profit at the end of the line, and you can’t show ‘this is the money we saved because we put in a new law or we spent $100 million more on this type of security. We prevented something from happening.’ It doesn’t show up that way.” In response to a question about whether enough has been done at the regulatory and legislative levels, Sloly said that significant strides have been made “in a relatively short period of time,” such as new rules requiring notification when a data breach occurs. “I think our privacy legislation is very, very strong, and I would suggest that’s actually a better place to start from than a Bill C-51,” he said in reference to the previous government’s anti-terror bill that’s currently under review. Having privacy “as a priority” at various levels of governments will help to drive a lot of “good bylaws, provincial legislation and federal legislation so that when we get to it we’ll have more resilient and sustainable legislation around which to build.” Sloly noted that jurisdictions like Australia and the United Kingdom are “leading” on strengthening existing and building new legislation. The Wire Report reported earlier this year that Innovation Canada is watching how Australia is reforming its telecommunications security policies. Any cyber security strategy needs to be evergreen, Sloly said. “There is no point in … having one in 2016 and then updating it four years later around an election cycle,” he said, adding a cyber strategy has to keep pace with how fast technology is evolving. “There is a great saying out of the U.K. cyber strategy—‘you must run fast in order to even stand still’ in the new changing environment.” Sloly said various entities — police, the private and public sectors, privacy commissions and the public education sector — need to work together to develop and implement a plan. “These need to now integrate at the strategy level, operation level, and tactical level for both prevention and response operations,” he said. Sloly also compared Canada’s spending on cyber security to the U.K., which spent 10 times more on its cyber security in 2011 than the $90 million Canada allotted, and now has plans to double its investment. Wood said one way to lower risk is to re-think the idea that everything has to be connected to the Internet, “at a time when there’s a mania for connecting everything, not just what one would formally call computers or information systems, but all kinds of things via the so-called Internet of Things.” He noted that “connection always means more openness and vulnerability, and every security action taken after connection is mitigation of risk. It should not be forgotten that if it serves no necessary democratic or public purpose to connect an information system, don’t.” — With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Charelle Evelyn at cevelyn@thewirereport.ca

Government should have cyber security czar, senators hear

News | October 19, 2016

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Government should have cyber security czar, senators hear

News | October 19, 2016

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us