Toronto - December 4, 2018 - Good afternoon, everyone. I very much appreciate the chance to speak with you today and I’m happy to see such a high turnout – even though I suspect most of you are here just to see what a spy looks like.
Well, as you can see, I look nothing like Daniel Craig, and I did not arrive here in an Aston Martin. I’m just as disappointed as you are – on both fronts!
Most of you remember the movie Fight Club. And you will know that the first rule of Fight Club is “Don’t talk about Fight Club.”
Well, the first rule of CSIS has always been: “Don’t talk.” Period.
It’s a pretty good guideline for an organization like ours. We watch what we say.
However, today, I want to provide you with an overview of the threat environment.
I will talk about terrorism and how it remains the number one national security-related danger to public safety in this country.
But I also want to talk to you – the key leaders in Canada’s business community – about what I consider to be the greatest threat to our prosperity and national interest, namely: foreign interference and espionage.
Before that, a bit about our organization. Because of our professional need for secrecy, you probably don’t know a lot about CSIS.
I’ll begin with the most important thing: the people of CSIS are highly committed and capable people who work day in and day out to keep Canadians safe and safeguard our rights and freedoms.
Just like the people of Canada, we are a diverse workforce.
Our diversity allows us to better understand the demographics of the Canadian communities we protect and gives us better tools to collect relevant and accurate intelligence.
As the Director of CSIS, I take the greatest pride in the exceptional quality of our workforce. They serve their country superbly well and I can assure you that they take their responsibility to protect Canada very much to heart.
At CSIS, we collect intelligence on threats to the security of Canada and foreign intelligence using a variety of investigative methods.
CSIS is not a law enforcement agency like a police force or the RCMP. We have no authority to arrest or detain people.
CSIS is not a secret organization. We are an organization that keeps secrets. And we take the social contract we have with Canadians in this regard very seriously.
At CSIS, accountability is at the centre of everything we do.
Since our creation in 1984, the way we manage our secrets has been subject to the scrutiny of the Security Intelligence Review Committee, who reviews all our activities.
We are also subject to judicial oversight. Contrary to what many people believe, CSIS cannot tap anyone’s phone or read anyone’s e-mails on a whim.
A warrant from the Federal Court is required for any intrusive investigative measure we use. Our compliance with the laws of Canada is paramount.
And the newly created National Security and Intelligence Committee of Parliamentarians offers us – for the first time – a classified setting to explain the complex threats we face and the responses we deploy to fight them.
Accountability is part of our core. As you can see, we are used to it – and we welcome it.
We’re also aiming to be more transparent about our work – to the extent that we can be, given our line of work. By engaging Canadians about the threats we’re facing, we hope to make them our partners in building protections against these threats.
CSIS may deal with a lot of secrets, but our mandate is quite public: we investigate threats to the security of Canada. And one of the threats most familiar to people is terrorism.
Canadians are not immune to terrorism. In the last five years alone, Canadian citizens lost their lives in terrorist attacks in places such as Burkina Faso, Indonesia, Jordan, Kenya, Spain, and the United Kingdom.
And sadly, terrorism has hit us here at home too.
You will likely be aware that the main terrorist organization in the world, Daesh, has lost significant amounts of territory due to the military actions of an international coalition which includes Canada.
Daesh has nearly collapsed as a fighting force. However, it has maintained its ability to inspire radicalized individuals to action all around the world.
These incidents have largely been low-tech attacks against crowds and police officers – with readily available weapons such as knives or cars and no requirement for prior training.
Due to their very nature, these kinds of attacks are difficult for intelligence services such as CSIS to detect and prevent. These investigations also require significant resources.
Low-tech incidents involving radicalized individuals should not lead us to discount the continued prospect of future complex, directed attacks by Daesh or other terrorist groups like Al Qaeda.
Some of the 37,000 extremists from over 100 countries who traveled to the Middle East to join the Syrian conflict may seek to return home or go elsewhere with intentions to commit attacks.
The numbers of foreign fighters with a Canadian nexus are small and stable. Despite the collapse of Daesh in Syria and Iraq, we have not seen a surge in foreign fighters attempting to return to Canada.
That said, the Government of Canada takes the threat posed by returning fighters very seriously. These people have not only shown the resolve to travel and join a terrorist group, they have often received training or gained operational experience while abroad.
CSIS and other Government of Canada departments and agencies are well organized as a community to manage the threat posed by returning fighters.
CSIS collects intelligence on these people to support our law enforcement partners, who collect evidence that can be used in Canadian courts.
We must also not lose sight of those extremists who may be compelled to act domestically should their plans to travel abroad be disrupted by authorities.
Recent events have also cast a spotlight on violent extremism.
There’s a complex spectrum of individuals, groups, and online communities that cultivate real or perceived grievances on issues as varied as gender, race, religion, sexual orientation, and immigration.
They often get together online, finding like-minded communities and sharing extremist ideas while using the anonymity of private chatrooms, forums, and online networks.
Let me be clear: the right to peaceful and lawful advocacy, protest, or dissent is one of the pillars of Canadian democracy. Activities involving or supporting the threat or use of violence are not.
As members of the business community, you know that digital media can be used to share ideas and bring people together. But it can also be used to coordinate attacks on our society and values.
Terrorists use social media, chatrooms, and file sharing sites to disseminate extremist content for recruitment, training, and fundraising.
Terrorists also exploit privacy settings, messaging apps, and crypto-currencies to support their operations and evade detection by intelligence and law enforcement agencies.
Intelligence and law enforcement is now often unable to access the content of some communications due to strong encryption. This greatly undermines the efforts of organizations like CSIS to investigate, disrupt, and prosecute the terrorist threat.
Terrorism has understandably occupied a significant portion of our collective attention for almost two decades.
Nevertheless, other national security threats – such as foreign interference, cyber threats, and espionage – pose greater strategic challenges and must also be addressed.
Activities by hostile states can have a corrosive effect on our democratic systems and institutions.
Traditional interference by foreign spies remains the greatest danger, but interference using cyber means is a growing concern.
The scales, speed, range, and impact of foreign interference has grown as a result of the Internet, social media platforms, and the availability of cheaper and more accessible cyber tools.
These include social media bot-nets, “fake news”, and advertising campaigns designed to confuse public opinion and influence our political system.
As we get closer to the 2019 Federal election, CSIS and other agencies like the Communications Security Establishment, the RCMP, and Global Affairs Canada are closely monitoring any attempt from hostile states to influence our democratic process.
We will take any measure necessary to safeguard our institutions.
I’d like to turn now to economic prosperity.
I don’t need to remind you of Canada’s economic strength.
We have an abundance of natural resources, advanced technology, human talent, and expertise.
We are world leaders in many sectors. We have powerful allies with whom we enjoy close economic, security, and defence relationships. We are a wealthy and highly-developed nation.
All of that makes us a target.
The bottom line is that a lot of people out there want what we have.
Every company represented here today has secrets: customer data, intellectual property, prototypes, financials…
Your secrets give your company its competitive advantages. They help you grow. They help you win. They help the Canadian economy prosper.
And they may also be at risk.
Plainly said: there is state-sponsored espionage in Canada.
We've seen it in our big cities and in our smallest communities.
We’ve seen it play out in the cyber realm. We’ve seen it play out in traditional human espionage. And we’ve seen combinations of both.
And we’ve seen it across many sectors of our economy.
Hostile foreign intelligence services or people who are working with the tacit or explicit support of foreign states gather political, economic, commercial, or military information through clandestine means here in Canada.
Some do it to tilt the playing field in their favour and undermine the principles of fair competition. Others just want to steal your ideas and use them to get rich.
What would happen if your corporate knowledge is accessed...
If your competitive advantage is undermined…
And if your company’s future – its share price, its ability to create and maintain jobs – is put at risk?
It’s difficult to put a dollar figure on how much advanced nations lose to state-sponsored economic espionage.
Some estimate that it could be $100 billion a year in the United States alone.
In Canada, businesses reported spending approximately $14 billion on cyber security measures to prevent, detect, and recover from cyber security incidents in 2017.
And over 20% of Canadian businesses have been impacted by a cyber security incident in 2017.
As difficult as it is to measure, this damage to our collective prosperity is very real and is the reason more and more governments are beginning to openly discuss the changing security landscape with their businesses, their universities, and the general public.
The national security community – of which I am part – and the business community – of which you are part – have a shared interest in raising public awareness of the scope and nature of state-sponsored espionage against Canada, and of its potential effect on our economic growth and ability to innovate.
But how are your secrets stolen?
The short answer is: in many ways.
I’ll give you a fictional example.
Imagine a promising Canadian company dealing in robotics.
It benefited from Canadian government funding. It developed cutting-edge intellectual property.
One day, the company decides to expand abroad.
The company opens an office or a lab, hires local employees, and starts dealing with local authorities.
At this point, the company has become vulnerable. Its new office or lab can be targeted by the foreign country’s intelligence services or can become victim of someone working on the inside.
In the blink of an eye, the company’s technology is accessed, its products are reverse engineered, and a foreign competitor starts selling the same technology worldwide at a much cheaper price.
Soon after that, the Canadian company goes bankrupt.
That’s one way hostile states can get what they want.
Or, they may do it more openly.
By investing in your company – or by outright buying it – foreign state actors can gain access to everything you know and everything you own.
Some of these investments may threaten Canada’s defence or sovereignty interests: by gaining access to Canadian companies, hostile foreign actors can use Canadian technology to build weapons that may be used against us or our allies.
Hostile actors can also gain access to sensitive data through their work in regulated industries, like telecommunications and banking.
The Government makes every effort to vet transactions that will give access to personal data and commercial information of Canadians to foreign companies. But we would be naïve to think that some of these firms don’t try to circumvent those safeguards.
There’s a third way for hostile actors to get what they want: they can simply steal it.
Using the Internet, states or people acting on their behalf can mount attacks on your servers from almost anywhere in the world – with no threat to personal safety and little risk of being caught.
If they don’t get what they want the first time around, they will just try again another day.
As if that were not enough, hostile states will often use old-school methods to compromise, influence, or manipulate people to wittingly or unwittingly give them what they want.
Even in our technology-driven age, extortion and bribery still work.
We have to be mindful that hostile states will use any means to recruit people, project their influence, and gain access to our proprietary information.
No matter how it’s done or who’s behind it, economic espionage represents a long-term threat to Canada’s economy and to our prosperity.
Now, I’m not trying to be a fear monger. I’m not suggesting that Canadian businesses should retreat from international partnerships and investments.
What I am saying is that this needs to be done with eyes wide open. The business community needs to be fully aware of the security threats to which it is exposed.
Unfortunately, everybody is at risk.
Large companies typically hold the most valuable information. But they also pay the most attention to security and have the most resources to build safeguards, including state-of-the-art cyber defences.
With their leading-edge research and development, universities and small start-ups are also attractive targets – but without the robust security.
Academics and entrepreneurs are often less aware of the threat posed by state-sponsored espionage, and they are less likely to have the resources to install the necessary protections. They are also often eager to attract investors and partners.
Hostile states typically target companies or universities that are active in emerging technology – the kind of potentially revolutionary discoveries that can bring massive profits.
Many of these advanced technologies are dual-use in nature in that they could advance a country’s economic, security or military interests.
In particular, CSIS has seen a trend of state-sponsored espionage in fields that are crucial to Canada’s ability to build and sustain a prosperous, knowledge-based economy.
I’m talking about areas such as A.I., quantum technology, 5G, biopharma, and clean tech. In other words, the foundation of Canada’s future economic growth.
Finding the people who target Canadian business can be difficult. And it can be even harder to stop them.
Just like terrorists do, many actors conducting economic espionage use advanced encryption to shield their activities, their intent, and their identity. Some use crypto-currencies to eliminate any potential paper trail. And their attacks can be surgical in nature.
So, what can your company do to ensure that it’s as secure as possible?
First, conduct a comprehensive assessment of your company’s competitive advantages. Pay special attention to your intellectual property. Know what you have. Understand what’s at stake – and what might be a target for others.
Second, assess your vulnerabilities. How secure are you against the kinds of dangers I’ve described here today – physical threats, cyber threats, insider threats? Be candid in your assessment.
Third, put in place a corporate security plan to actively address your vulnerabilities.
That means taking regular stock of your security measures to ensure they are up to date.
That means educating your employees to speak up if they see or hear something unusual.
And, if you detect suspicious activity, that means contacting the authorities – including CSIS. We have a Canada-wide presence – and we’re eager to help businesses protect themselves amid a challenging security landscape.
That also includes our colleagues at the Communications Security Establishment as well as at the new Canadian Centre for Cyber Security, which was stood up last month.
The Centre will be the main Government of Canada point of contact on cyber security operational matters, including incident response.
It will monitor the cyber security environment and share knowledge about threats, risks, and vulnerabilities. It will also be in a position to offer you expert advice and support to help you address your cyber security concerns.
You can also report suspicious cyber activities to the RCMP’s new National Cybercrime Coordination Unit. Part of the Unit’s mandate will be to establish a national public reporting mechanism for Canadian citizens and businesses to report cybercrime incidents to law enforcement.
The bottom line is this: the quicker the authorities know about a suspected cyber attack or espionage activity, the more likely we will be to be able to help you defend against it.
Today, I showed you a broad overview of the threats we face and the measures we can take to better protect our security and prosperity.
We saw that threats can come from many directions.
They can appear at any time.
They can appear quickly.
And they can have devastating effects on your companies and on our country.
Colleagues – I’m going to call you colleagues because we’re all in this together – Canada does best when it attracts foreign investment, engages in global trade, and collaborates to advance new technologies.
We should keep doing that.
But we should also be cautious and vigilant. Our eyes should be wide open.
There are signs we see at airports and elsewhere: “if you see something, say something.”
They serve as a reminder that keeping Canada safe is a shared responsibility.
I’ve said it before: we all have a role to play in protecting our national security.
The same goes for protecting our national prosperity.
As business leaders, you know the threats that your companies face.
And as an intelligence organization, CSIS knows how to address them.
You create Canada’s economic prosperity and we work to protect it.
A dialogue between the business and intelligence worlds should come naturally.
Colleagues, I’d like to leave you with this fundamental message:
It’s important that you see yourself as being a part of national security and that you see your colleagues at CSIS as part of the solution.
When you get back to your office, start this dialogue with your VPs, your board and with your employees.
And remember that together, we can better safeguard Canada’s businesses, we can bolster our economic strength, and we can better protect our country and its people.