NDDN Committee Meeting

     Thank you very much, ladies and gentlemen, for being here on time. We're continuing our study into the defence of North America.

    We have with us today, Mr. Paul Stockton, managing director of Sonecon, LLC.

    Mr. Stockton, as per usual, we'll start with your 10 minutes of introduction.

    Let me begin, first of all, Mr. Chairman, and distinguished members of the committee, by thanking you for the opportunity to share perspectives with you today.

    I was the assistant secretary of defense for Homeland Defense and Americas' Security Affairs from 2009 through January of 2013. In that capacity, I was responsible for U.S. security relations and security policy with Canada and with the western hemisphere as a whole.

    I'm here as a private citizen today. Nothing that I say should be taken to reflect the views of the United States government. But I want to emphasize that as a private citizen, I remain enormously grateful for the collaboration that Canada and the United States have to meet our shared security challenges, and above all, I want to take a moment and honour the 158 men and women in the Canadian Armed Forces who made the ultimate sacrifice in Afghanistan. Americans will never forget what Canada accomplished in Kandahar and beyond, and we remain enormously grateful.

    I always like to start with my bottom line up front. What I'm going to argue with you today is that although Canadian-U.S. defence collaboration is extraordinary, and extraordinarily valuable, I believe that there are opportunities to deepen and broaden this collaboration into new security realms.

    Two forces drive us to consider this expanded collaboration: first of all, emerging threats that challenge the security of the United States and Canada together on a North American basis, and second, the budgetary pressures confronting both nations. I believe there are opportunities to have collaborative investment strategies, opportunities to partner together, so that we understand who is going to take the lead in international engagement in particular countries, in regions around the world, so that this kind of collaborative planning can provide for a much more efficient use and effective use of Canadian and U.S. defence resources than would otherwise be the case if we failed to have the strategic dialogue. I'm going to offer a couple of examples of how this dialogue can go forward, but I'm going to keep my remarks very brief because I'm looking forward to your questions, your insights, and to allow you to drive our sense of priorities today.

    Let me start with a prime opportunity for deeper collaboration, and that is the resilience of critical infrastructure. As all of you know, the United States and Canada share extensive interconnections in natural gas infrastructure, electricity infrastructure, and other forms of critical infrastructure. Hydro-Québec is really important to the United States. Equivalent sources of energy on the west coast flow down to California and make it possible in California for electricity generation to be possible based on natural gas that comes from Canada. This infrastructure, in many ways, is structured to run north to south, not east to west, and the interconnectedness of critical infrastructure, especially energy infrastructure, between the United States and Canada creates an important opportunity for collaboration.

    This is especially true given the rise of new threats to critical infrastructure. Mr. Chairman, members of the committee, as I speak right now, efforts are under way to penetrate the networks on which our energy infrastructure depends. The computer networks are under attack today, both to map those networks, to steal valuable data, and potentially to launch attacks on the industrial control systems, the other mechanisms that provide for the functioning of this critical infrastructure.

    The Canadian Department of National Defence is not responsible for critical infrastructure in the civilian sector; neither is the U.S. Department of Defense.

    Public Safety Canada and other non-DND departments play a critical role in overseeing the cyber-security of critical infrastructure. It's the same in the United States. The Department of Homeland Security, not the Department of Defense, has primary responsibility for the cyber-security of the electric power grid and other critical infrastructure.

    I'd like to suggest today that the resilience of critical infrastructure is increasingly important to the United States Department of Defense, and provides opportunities for defence collaboration between Canada and the United States. Let me give you some prime examples.

    First of all, although we continue to collaborate on building protections against cyber-attack, better defending the networks against cyber-attack, I believe that eventually it is inevitable that a successful cyber-attack will occur on the electric, natural gas, or other energy infrastructure on which both our nations depend. The offence is developing weapons much more quickly than we can defend against them.

     I believe that former Secretary Panetta had it exactly right when he said that we in the United States are at risk of a cyber Pearl Harbor that will create an electric power outage of a length and a duration that could dwarf the outage caused by superstorm Sandy or any previous event.

    Although thus far I've been talking about cyber-threats, other potential hazards, both natural and man-made, pose the threat of these severe power outages in the United States. Certainly on our side of the border, this would land in the lap of the Department of Defense.

    As part of my responsibilities as assistant secretary of defense, I led the Department of Defense's operations to help restore power and help reduce the threats to public health and safety in superstorm Sandy.

    The Department of Defense flew hundreds of utility trucks and power restoration crews from the west coast to New York and New Jersey in order to accelerate power restoration. The Department of Defense provided millions of gallons of fuel and many, many hundreds of emergency generators in order to keep hospitals, nursing homes, and other facilities critical to saving and sustaining lives up and running when the power grid went down for two weeks.

    But again, an outage of two weeks from a U.S. perspective is not nearly as severe as some of the outages that we could be facing in the future. The demand for the Department of Defense to help save and sustain lives, to provide defence support to civil authorities would be much, much greater.

    At the same time that the Department of Defense would be called on to assist civil authorities, above all the Department of Homeland Security and FEMA in our system, providing that assistance will be much more difficult because the environment in which we'll be trying to provide disaster assistance will be so severely disrupted.

    It would be great if big trucks full of assistance could flow on highways into the stricken area, but as you know, every gas pump runs on electricity. When electricity goes down, as we found in superstorm Sandy, emergency vehicles, police cars, everything else that you need in order to provide for life-saving and rescue operations, couldn't get the fuel they needed unless the Department of Defense brought it forward.

    Guess what? We found that in critical cell communications towers, which fortunately had backup generators, there was only enough fuel stored at those critical communication nodes for them to run for two or three days. When that fuel ran out, the delivery of backup fuel had been disrupted.

    My point is that if there is a long duration of wide-area loss of electric power or the natural gas that fuels electric generation, not only is there going to be an immense demand for our armed forces to save and sustain lives, but our ability to deliver that assistance is going to be disrupted, because the infrastructure on which we depend to provide the assistance is itself going to be severely degraded.

    That's the puzzle we're facing in the United States, where the leaders of our emergency management community and the leadership of the Department of Defense have agreed that we're not going to plan just to do better the next time a superstorm Sandy strikes. We're going to assume that a much worse catastrophe, from either natural or man-made hazards, is right around the corner and could strike at any day. Therefore, from a Department of Defense perspective, being ready to support civil authorities and conduct disaster response operations is a prime defence mission.

    There's a second way in which thinking is evolving in the United States, and that is support for power restoration. In the kind of catastrophe that I've been discussing, nothing is more important for saving lives than getting the power grid and natural gas systems back up and running. Emergency power can only do so much to save and sustain lives. Restoring the functionality of the grid and the natural gas system is absolutely essential.

    I mentioned that in superstorm Sandy the Department of Defense conducted unprecedented operations to help the private utilities that own and operate our grid and yours move their assets and support the mutual assistance agreements that work so effectively in Canada and in the United States. Now the effort is under way in our country to think about what it would take to provide for mutual support in a nationwide event worse than Sandy. Here's where the opportunity for binational collaboration comes in.

    Today in Halifax, the regulators of energy infrastructure in both the United States and Canada are meeting to discuss how, on a binational basis, we can support each other if a disaster occurs in Canada or if a disaster occurs in the United States: how utilities can move more effectively across the border. There are opportunities for defence collaboration to support this movement as well.

    But there's an even more interesting opportunity for defence collaboration. In the United States, we have a mission assurance strategy in the Department of Defense. Let me give you the argument.

    The Department of Defense depends on the electric power industry for 99% of the electricity that DOD uses. If the electric power grid goes down for an extended period in the United States, very quickly the ability of U.S. military facilities to execute their responsibilities to the nation could be in jeopardy. The Department of Defense doesn't own much generating capacity and doesn't regulate electric utilities, nor should it. Instead, there needs to be a partnership between DOD and industry to strengthen the resilience of the power grid.

    Inside the Department of Defense, DOD leaders have been taking a hard look at the vulnerability of the U.S. armed forces to an asymmetric attack, that is, not an attack on our forces when they're deployed abroad but an attack on the critical infrastructure in the United States on which we depend.

    Those are examples of opportunities for deeper collaboration, which I welcome the chance to talk about further, in the western hemisphere, in the Arctic, and beyond.

    Thank you very much.

    Thank you very much, sir.

    We'll start with a seven-minute round with Mr. Leung.

    Thank you, Mr. Chair.

    Mr. Stockton, in the area of defence, you mentioned electricity and energy. What about threats from other people to our water system and supply? I was in UNTAC, the United Nations Transitional Authority in Cambodia, and there were attacks contaminating the water source at the nuclear, biological, and chemical level. I would think if energy is a critical part of survival, so is water. A corollary to that would be, how do we do adequate disaster mitigation as in the case of preventing the second occurrence of a Katrina, or in Banda Aceh, Sri Lanka, or the situation in Fukushima? A lot of our infrastructure was put in more than 50 years ago before we had these insights into the changing threats, both natural or man-made, or by a potential person or country that could be a threat to us.

    I would like you to share your comments with us.

    Thank you especially for emphasizing the importance of water infrastructure.

    People get thirsty fast if water infrastructure is attacked. Scholars in the United States last year, in order to assess the threat to water and waste water infrastructure in the cyber realm, built an imaginary website, loaded it up on the Web, and provided a website and an entry into an imaginary municipal water system just to see whether it would attract cyber-attacks on the industrial control systems that govern the municipal water system here in Ottawa, back in Washington, and across our two nations. That website attracted hundreds of attacks immediately.

    Water infrastructure, and waste water infrastructure, are absolutely vital to strengthen in terms of resilience because of our dependence on water. This goes not only to direct attacks on the infrastructure, but the indirect effects, because certainly in Washington, D.C., perhaps also here in Ottawa, that water system is utterly dependent on electricity in order to function and in order to pump the water. With no electricity, no water for drinking, no water for firefighting, everything else is in jeopardy.

    In regard to your second point in terms of aging infrastructure and how we can build resilience against non-traditional threats, this is why it's so important at the federal level and at the provincial level to have a dialogue on how investments should go forward against these non-traditional hazards. Ratepayers and customers are ultimately going to get stuck with the bill. What kinds of investments are prudent? What kinds of investments are important from a national security perspective for Canada and the United States? Who ought to pay and where should those investments be targeted going forward? That is a critical opportunity for progress in Canada and in the United States.

    You mentioned budgetary pressure and budgetary constraints. As you know, as politicians we're always determining where to spend the money. If we do this on the national defence side, it is for disaster mitigation, it is for emergency purposes. But if we look at it from, say, the overall national public security side, then it really is very long-term strategic thinking.

    Perhaps you can share with us how that allocation is best performed to look at making sure that long-term infrastructure has its survivability and sustainability and then the emergency.... In the United States you have Homeland Security. Should that not all come under the national defence strategy?

    In this realm I believe defence will always be in support. That's one of the lessons learned from the revitalization of the Permanent Joint Board on Defence over the past few years. The PJBD took on, as a core area for work, the question of how the Department of National Defence could be in support of Public Safety Canada, the Department of Homeland Security, and other agencies in order to strengthen the resilience of infrastructure on which national defence and national security depends.

    There are very few dollars in the Canadian defence budget, or the U.S. defence budget, to strengthen resilience of infrastructure, even though it's absolutely vital to national defence. So the question is this: how can government and industry partner together to make sure the investments go forward in the way they need to? And how, in the Canadian system, can provincial governments that have so much of the regulatory authority over infrastructure be brought into this dialogue?

    In our country we need much deeper federalist approaches that bring federal, state, and local dialogue together with the private sector above and beyond anything we've ever had before. This is an opportunity to do it not only within the United States but in close partnership with industry and the Government of Canada.

    Mr. Leung, you have about 30 seconds.

    Let me just add a comment, if time permits. I'd also like to hear later on how in the United States the Department of Defense coordinates all the activities of the federal government and the state reserves in the military.

    We welcome the chance.

    That response will have to come later.

    Mr. Harris, you have seven minutes.

    Thank you, Mr. Stockton, for your presentation.

    I understand the thrust of what you're saying, but are you suggesting that the military budget or the military itself have some responsibility for making the pipelines or the Hydro-Québec facilities more resilient? Really, that is something that in your country Homeland Security takes extremely seriously, has a budget for, works on, etc., and Public Safety in Canada has responsibility for cyber-security. They presumably work hand in glove with the keepers and operators of critical infrastructure to assist them in achieving some cyber defence security.

    What I don't understand is how...other than the planning role, which is pretty clear on both sides. Both the military and the civil society sides would be very important, and yes, it would be great to know exactly how many generators might be available so those pumps that are pumping gas can actually pump at the critical points to make sure the police cars are able to run, etc.

    But I'm not sure...and I'm looking here too at an agreement between Canada and the U.S. on civil assistance, which you're probably familiar with. It's the Canada-U.S. civil assistance plan, the 2013 version of it. Is there some inadequacy in that plan that needs to be fixed or expanded on?

    I hear you saying that, yes, we can find opportunities to cooperate, but I gather we've found them, and at least we put them down on paper, and we have agreements about them, and who's going to do what, and all of that.

    Could you tell us what the inadequacies of that plan might be, or are you looking at some expanded role for interjurisdictional cooperation?

    The civil assistance plan provides a strong foundation on which to build, and it's in the planning realm that I think the greatest progress can go forward. What we discovered with superstorm Sandy is that we did not have the agreements in place to allow for Canadian utility crews to easily come across the border to assist the United States. There were too many impediments, too many delays.

    They offered and they were available. Were they not able to deliver?

    They weren't able to get through the customs system as quickly as we would want, to be able to have that go forward in the future.

    More generally, we are not prepared in the United States yet for worse events than Sandy where the Department of Defense would be called on to provide support to civil authorities in order to respond to the disaster, save lives, and provide support to utilities for power restoration. We have agreements in place that provide a terrific basis for moving forward, but the concrete work to get to the level of detail where we have plans that we can actually fall in on and implement when lives are at stake, when every hour matters, is very much a work in progress.

    There's a second dimension, too, that I'll mention, and that is in the Department of Defense. Until very recently, DOD was not where it needed to be to understand its own vulnerability, the vulnerability of U.S. armed forces to the long-term loss of electric power. That requires internal investment inside the Department of Defense.

    Could you give us an idea of what has been different in terms of the American overall disaster assistance response in Katrina versus Sandy, for example? I'm sure we all remember the awful pictures of people in New Orleans struggling to survive, but did not survive in many cases. Sandy was a little different. It was in New York, and floods, and all of these.... It was a different type of event, obviously. But in terms of the U.S., Homeland Security, government response, FEMA, etc., what was the difference? Was there any improvement in the U.S. approach to handling disaster relief in those circumstances?

    There was a great improvement in Sandy over Katrina, in part because of the lessons learned. Let me give you a prime example. We were able to use state national guard forces much more effectively, in a much more coordinated fashion, with federal military forces, than was possible in Hurricane Katrina.

    Why?

    This was because we reached an agreement between the Department of Defense and the governors of each state in the United States for how these military forces would operate more effectively together and give governors a say over the disaster response priorities that these military forces would be carrying out. That was a breakthrough in governance in the United States and allowed for much more efficient targeting of defence resources to support civil authorities than was possible in hurricane Katrina.

    You talked about hydro or electrical energy resources as a critical infrastructure. Would there be the same difficulty of, say, expertise resources, like the utility workers? Supposedly during the ice storm in Quebec we needed American assistance because they didn't have enough riggers—I forget the exact name now—people who do that transmission tower work. Would there be the same difficulty for them to get into Canada? Is that something that needs to be worked out as a protocol?

    It's something that's being worked on today. We need a binational approach to these severe threats, natural hazards and man-made, in order to provide for infrastructure restoration. There's important progress under way right now with industry, and between industry and government. That progress needs to be sustained, it needs to be deepened, and it needs to be built out in greater detail.

    Can you tell us—

    Thank you very much. Sorry, Mr. Harris.

    Mr. Williamson, for seven minutes.

    Mr. Stockton, it's nice of you to be up in our country today sharing some of your views.

     I think this is a really interesting line of questioning. I have a couple questions.

    You talked about the threat to the electrical system, and you've touched on both infrastructure and the cyber-threat, but I'm a little unclear. Is it a cyber-threat that you see as being the bigger concern or is it a natural physical attack on the infrastructure? Put aside a natural disaster; I'm just curious to kind of get the threat level, and where it's coming from.

    We recently had an exercise, a government-industry exercise, in the United States with strong Canadian participation from the electric industry. The scenario on which that exercise was based had a simultaneous cyber and physical attack on the electric grid. I don't believe our adversaries are going to do us a favour in the future and only attack with cyber. The risk of having a combined cyber and kinetic attack—attacks on high-voltage transformers, other components of critical infrastructure that are vulnerable to physical attack—that kind of combined attack would put extraordinary stress on the infrastructure systems being attacked and could make restoration much more complicated.

     I agree.

    When it comes to cyber-threat or cyber-attack, I'm not clear on the remedy or the response to that. Putting aside prevention, where, obviously, you want to be focusing your efforts, once it's actually occurred, is it a question of rebooting the system? How do you recover from something like that? I'm sure it's very complicated, but I—

    No, it's an excellent question and one on which I think much further work needs to be done.

    Scrubbing malware from an operating system is utterly unlike re-rigging power lines. There are many fewer people capable of conducting these response operations. Sharing them between utilities could pose additional challenges. Let's remember, at the same time that restoration activities are going to be under way—efforts will be under way to clean up the malware that's been inserted—the infrastructure is also a crime scene. So, in our nation the FBI would want to preserve evidence and would be conducting law enforcement operations at the same time that industry needs to be getting the systems back up and running.

    What would be the role of the Canadian government in this, the Department of Public Safety or potentially the Department of National Defence?

    I understand how the Department of Defense supported power restoration in hurricane Sandy. We delivered fuel and utility trucks. What is the equivalent role in a cyber-attack in restoring the functionality of the grid when malware has been deposited in our networks?

    These are big important opportunities for dialogue between the United States and Canada, with the defence establishments in our two nations playing an important role.

    When we talk about some of these natural disasters, do you think maybe that's actually the wrong comparison?

     I come from a small province of 800,000 people, New Brunswick, which is right next to the state of Maine. Over the holidays there was a power outage because of bad weather. At one point 20% of the population was without power. Also, over several weeks, lines were strung up again and the power was slowly restored. It was a combination. We had assistance from New England and from as far away as Ontario, actually, Hydro Ottawa. You saw the resources that came together in terms of assistance, with industry working with various power companies. As well, there was civilian oversight.

    Perhaps the better example is the power outage we saw in 2003. A natural disaster brings in a whole different component which causes all kinds of chaos. In 2003, in Ontario and eight states the power went out, and 50 million people were affected. Where are we 10 years later? To me that's a better example, I think, in terms of a quick blow. I think under your scenario you'd want to incorporate some sort of cyber component to it, as well. 'm curious to know your thoughts on that scenario, and where we are 10 years later, in terms of that kind of quick shock to the system.

    The loss of power in 2003 was very wide in geographic scope, but the key is that it was very brief. Power was restored to the vast majority of customers within 48 hours.

    If there were either a natural disaster or a man-made attack that caused outages of much longer duration, then we would be in a different world in terms of defence support to civil authorities. Then the requirements for the nation to have assistance would be much greater, and the difficulty of delivering that assistance for our military and civilian authorities would be enormously more severe. That's why the puzzle we're facing now is so much more challenging, and why the need for additional planning and building on the current foundations for collaboration are so important.

    It sounds like when you present your scenario, you're talking about defence. This is where maybe I get a little concerned. A natural disaster is very serious, but there's no military threat to that. There is no foreign threat. A natural disaster impacts hundreds of thousands, potentially millions, of people and is very serious, as we've seen several times in your country.

    Is there not a risk that the military is overstepping its boundary, and that a natural disaster should be dealt with by domestic authorities with a joint partnership between the two countries, of course, and that it is not really a role for the defence establishment? That would be a scenario where there is an attack either within or from abroad. What are your thoughts on that?

    The witness will have to get back to us in writing or through a follow-up question.

    Ms. Murray, for seven minutes.

    Thank you, Mr. Stockton, for being here to help us understand the possibilities of better collaboration between our two countries for continental defence and defence of Canada. I'd like to ask you a broader line of questioning. Based on your prior role as the assistant secretary for defense for Homeland Defense and Americas' Security Affairs, you must have been privy to many areas of overlapping interest between our country and the United States of America, and various ways in which our countries have collaborated to be more effective with defence and security measures.

    Could you think back to not just these kinds of domestic challenges of the critical infrastructure and responding to natural disasters that you've been discussing, but more broadly, whether it's cooperating in the Arctic, in the maritime sphere? Talk to us about some specific collaborations that were examples of what works that we may want to build on as two nations.

    Let me give you an example of concrete collaboration that's very important now and could be built upon going forward, and that is collaboration in building partner capacity in the western hemisphere and beyond for defence and for disaster response.

    One of the very first meetings that we had when I came into office in the Permanent Joint Board of Defence included a discussion of how Canada and the United States, with full participation and leadership of DFAIT and our Department of State, could build on each other's comparative advantages in strengthening partner capacity in the western hemisphere, because Canada has some terrific programs under way—for example, in Jamaica, in order to train up Guatemalan helicopter pilots. It would be wasteful for the United States to replicate what Canada is already doing in building partner capacity. By having a dialogue about which country is going to invest where, we can together make sure that those investments are more efficient and more effective.

    This dialogue about how we can have a collaborative approach in the western hemisphere has been going forward with great effectiveness, and now it has been expanded to the Asia-Pacific, where our Secretary of Defense and your Minister of National Defence recently agreed to a dialogue on Asia-Pacific engagement, including the ASEAN nations, in order to determine how best to have a coordinated approach to work together with nations of the Asia-Pacific region, in order to not step on each other's toes, in order to spend our scarce engagement resources most effectively, and to be of mutual support in ways that serve the interests of both Canada and the United States. We've gone far down this path in the western hemisphere. Now we're applying it more broadly.

    Thanks for those two examples.

    Even two departments within the same ministry sometimes have a hard time working together on collaborative projects. Across ministries, it's more complicated still. Across countries, it's very complicated. Can you tell us what mechanisms have you seen function that make that collaboration flow more smoothly rather than adding a whole lot of bureaucracy and time delays to the mutual objective?

    The Permanent Joint Board of Defence provides the institution and the framework in order to advance these opportunities for collaboration. Our Department of Defense will always be in support of FEMA or the Department of Homeland Security for disaster response. Our Department of Defense will always be in support of the Department of State in international engagements. The Permanent Joint Board of Defence now incorporates Public Safety Canada, DHS, DFAIT, and the Department of State in the dialogue so that the departments that are in the lead for these issues can help shape the kinds of defence collaboration that go forward.

    The future of our defence collaboration is not only military NORAD-type issues but defence support to civil authorities, where DND and DOD will always play a subordinate role and should always play a subordinate role in critical infrastructure protection, in disaster response, in all of these issues that we've been discussing today.

    Can you give me some examples of attempts to work together that have failed or that have created more problems than they have solved, just so we understand the kind of things that don't work as well as the kind of things that do work? This is in collaboration between Canada and the United States, raising issues of sovereignty, cost-sharing, a different vision of how to move forward.

    In the defence realm, I did not encounter any problems in terms of building a collaborative approach. Clearly on some issues, sovereign nations are going to make their own policy and they won't always agree. That's certainly the case with ballistic missile defence. That's fine. The important thing is to sustain the dialogue and, where each sovereign nation shares an interest in defence collaboration, to advance those opportunities. I think there are many more opportunities to build on the foundation that exists today, which need to be advanced.

    You have about eight seconds.

    Ms. Joyce Murray: Oh, okay.

    The Chair: Thank you. We'll move on to Ms. Gallant, for five minutes.

    I was highly pleased to see that you were on the witness list today, especially given your subject, security in the electric grid system, and given that here in Ontario there's public upheaval over mismanagement of our electrical generation and distribution systems at the time.

    When the military and heads of state were drafting the NATO strategic concept, the principle of energy security had been proposed by some of the eastern European nations that were dependent and had suffered the valve turn-off by Russia. The alliance decided not to adopt power security as part of its new strategic concept. My question is this: should the principle of energy security be included as central components of our national defence policies, either separately or collectively in North America?

    This, of course, is a sovereign decision for the Government of Canada to make regarding its own energy policy. But in the United States we recently, in fact just two weeks ago, took a very important step in the Department of Defense. I brought with me the first ever Department of Defense policy on energy, which tackles many of these issues in terms of the importance of energy to the Department of Defense and how to build resilience.

    The Department of Defense is never going to be investing in public utilities in order to build the resilience of the electric power grid. That's within the private sector. That's a challenge for regulators who provide for cost recovery, to ensure that investments are prudent and that rate payers ought to be paying for them. But in the Department of Defense, ensuring the flow of power so that our armed forces can accomplish their missions no matter what is the key focus of this new policy.

     If you would like, I'd be happy to provide a copy for the record, for your committee to review.

    Thank you.

    Is it in both official languages?

    Bien sûr.

    Recently, we had announced in Canada the sale of one of our province's transmission lines, AltaLink, which was Canadian owned by SNC-Lavalin and it's selling to Berkshire Hathaway energy. We're allies, but in the future, part or all of those transmission lines could be sold to an entity outside North America.

    Should there be consideration given from a security standpoint into the ownership of power generation and transmission lines in North America?

    I'd like to provide an answer for the record to that question. That is a very thoughtful question. Let me have an opportunity to come back to you after the hearing with an answer.

    Okay.

    We are recently hearing more and more about the Internet of things. That's where our smart appliances talk to one another; baby monitors transmit to work what's going on in the nursery. All these are interconnected—the rationale being that we will be able to use our power more wisely—and they send the information in turn to our smart meter. From your standpoint and knowing that we've just had a breach—apparently 750,000 households in North America were hacked by a commercial entity to spam them—but from a security entity, do you see this Internet of things as a vulnerable point from which unfriendly entities could attack our energy system?

    Yes, absolutely. The smart grid and the Internet of things is going to provide for a more efficient operation of infrastructure and everything else that's now web-enabled to provide for more effective management of these systems, but the connectivity of these things to the web provides a potential means of attack to adversaries. Security needs to be baked into these investments in efficiency and effectiveness, baked into this development of connectivity to the web rather than tacked on after a successful attack occurs.

    Thank you very much.

    Mr. Larose, for cinq minutes.

    Thank you to our witness for being here.

    I have three questions, and I would appreciate it if you could answer quickly because I don't have much time.

    There was the ice storm in Quebec.

    Can you hear me?

    I'm not hearing it.

     It's okay, I can ask it in English.

    We had the ice storm in Quebec. I wonder as an outside observer—

    I'm sorry. Yes, thank you.

    I was saying that there was the ice storm in Quebec.

    Can you hear me?

    I can hear, thank you. I apologize.

    There was the ice storm in Quebec. As an outside observer, do you have any suggestions for improving our equipment? A lot of equipment came back from Afghanistan, and it was not necessarily adapted. You said earlier that an agreement between the U.S. government and the governors had improved the response time and collaboration.

    My other question has to do with the network. Has the possibility of separating the network been investigated? The Internet was originally created by the army. Has the possibility of completely physically separating the Internet network been investigated in order to increase its effectiveness and reduce threats?

    I have a third question. Have civilian agencies been considered in the strategic planning, as is done in other countries? Those agencies also have worthwhile resources. What is their role in military planning?

    Thank you.

    I don't know enough about the ice storms in order to make a judgment of whether or not there could have been opportunities to respond more effectively. Let me say that in Halifax today that is one of the scenarios that's being addressed, the rise of severe weather hazards and what can be done to invest against them to strengthen good resilience. That's a prime focus now of regulators and industry both in Canada and in the United States.

    With regard to separating the network and building firewalls more effectively, this is an extremely important opportunity for progress. Let me say again, my personal view is that even if we invest in the protections that we should be making, eventually the offence has such an advantage in the cyber realm. Eventually there will be opportunities to penetrate software using zero day exploits or other openings by the attacker so that in addition to building protections, we must invest, we must plan for restoring the grid, restoring the flow of natural gas after an effective attack occurs.

    For the civil sector, as I mentioned before, that participation in the planning, are they there? You mentioned the private sector but....

    Yes, thank you. They're increasingly there. It's absolutely essential that the civil sector be brought into this dialogue.

    Let me give you an example. Every utility has in its back pocket a plan for which facilities get their power restored first. Sometimes this is done on an engineering basis in your ridings—which substation to energize first and what order to go. But sometimes it's done on a basis of what's most important to public safety in your riding. Should the hospital get power first? How about nursing homes? This is a prime example for bringing civil society into this dialogue with utilities so that the public is represented, thanks to your participation.

    What exactly would be the role of national defence—of the military, physically—within that realm, in that collaboration? That question was asked earlier by my colleague. What is your take on it?

    The Department of National Defence and the Department of Defense are not going to be investing in utility resilience at all.

    As you mentioned earlier....

    But clearly, in the United States the Department of Defense is paying much more serious attention to what kinds of emergency power assets should be in our critical military facilities. Should we begin to develop micro-grids that allow for generation on a base in a way that makes the base still able to operate even if the surrounding power grid goes down.

    This is a big focus of the new energy policy that has just been announced, and there may be opportunities for dialogue between DND and the Department of Defense on this question of energy assurance.

    Is there a difference? The mission in Afghanistan is over and there was Iraq. There was equipment that came back and it is not necessarily adequate.

    Are discussions being held with the United States to buy new equipment just in the context of that planning?

    I do not know and I would like to answer that for the record.

    Increasingly in the United States we are providing Department of Defense equipment to law enforcement. That program is going forward very effectively. But for power restoration and infrastructure resilience, I do not know.

    Thank you very much.

    Mr. Chisu, you have five minutes.

    Thank you very much, Mr. Stockton, for your presentation and your expertise in cyber-attacks and so on.

    First of all, thank you very much for mentioning our sacrifices in Afghanistan. We will have a day of honour on May 9, this Friday, to honour our men and women in uniform who participated in Afghanistan.

    I participated in Afghanistan. You mentioned Kandahar. I was working with the U.S. forces. Also, previously I was working in Bosnia with U.S. forces. So I'm going back a bit on the military side of the issues here.

    As you know, most of the casualties that we had and also that the United States had.... The 9/11 attack was low-tech; it was an airplane full of fuel that hit the World Trade Center. With roadside bombs, even though we had the electronic bubbles around the military bases against remote detonation, two wires connected created a lot of casualties in Afghanistan. So we have also this low-tech side, normal military activity that we cannot distinguish or detach from the cyber-attacks.

    I will go back to the military operations and will look mostly to the Arctic. I would like you, if you can, to define who you see today as a threat to the United States and Canada, and mostly in the Arctic. It is an interest in the Arctic. What is your opinion about this? Of course, from there we will see how we can cooperate in the Arctic and in other areas.

    Also, I mentioned that the United States made a change of strategy, the pivot towards the Pacific.

    Threats in the Arctic are not primarily military. Maintaining the Arctic as a zone of peace is very important and an opportunity for collaboration between the United States and Canada. There are threats in the Arctic, but they're not military.

    My personal view is that the most severe, the most imminent threat is that a ship loaded with petroleum products is going to hit an unmarked shoal off the coast of Canada or Alaska and that we are going to very quickly discover that our nations are not fully prepared to conduct the kinds of disaster response operations or conduct the environmental cleanup operations that will be absolutely essential to limit damage in such a scenario.

    Our coast guards have been focusing a great deal of attention on this challenge, but you know better than I do that the problem in the Arctic is lack of infrastructure to support these kinds of disaster response operations. Where is the communications infrastructure? Where are the port facilities? Where are the landing strips necessary to clean up a devastating oil spill? That is the challenge.

    I had the honour of leading the Department of Defense's response to our Deepwater Horizon disaster in the Gulf of Mexico. We were able to bring in many hundreds of thousands of yards of booms, provide a great number of ships to skim the oil—all kinds of capabilities. To bring that to the Arctic would be enormously difficult.

    It gets me back to my initial point, and that is to ask how the United States and Canada can collaborate from the perspective of investing in capabilities in the Arctic so that we are not duplicating capabilities but we rely on each other, so that we have a sensible approach such that both nations together can invest, in a collaborative approach that makes sense for both of our nations.

    You have 15 seconds.

    Does the United States have a policy in the Arctic?

    You can respond to that question perhaps in writing or near the end.

    Mr. Harris, you have five minutes.

    Thank you very much.

    We talked about collaboration and working together and not stepping on each other's toes.

    Were you involved with the Department of Defense during the Haiti mission following the earthquake? Canada's experience there in trying to get our assets to ground zero caused a little bit of frustration. Nobody could land at the airports because they were filled with American planes, I'm told. I don't have the details of that.

    Is there a missing piece in something like this that we could fix or work on?

    There is a missing piece wherein Canadian leadership is going to be very important.

    Based on the harsh lessons learned from disaster response in Haiti, the Conference of Defense Ministers of the Americas launched an initiative, with Canada playing a vital role, to apply the lessons learned, so that the next time a catastrophe strikes in the western hemisphere we have arrangements in place to already know which nations can provide specific kinds of capabilities; so that instead of making things up under duress, instead of all rushing to the site in an uncoordinated fashion, we can know in advance which nation can provide the most important capabilities.

    So that is essentially fixed, with that collaboration.

    It's not fixed yet.

    In November, the next meeting of the Conference of Defense Ministers of the Americas will occur in Peru. Canada has played an extremely valuable role in the CDMA discussions, and it is going to be absolutely vital for Canada to continue to provide this kind of leadership going forward.

    Is there a standard, Mr. Stockton, for military response to disasters? Is there an expectation that the military will be ready in a matter of so many hours—48 hours, or 24 hours? In the United States, for example, what we saw with hurricane Katrina obviously was not acceptable—and was not acceptable to the American people. Do you have one now?

    The Department of Defense is building much more detailed plans for catastrophes than it has had in the past.

    One of the lessons from Sandy is that planning for specific scenarios, catastrophic natural or man-made hazards, hasn't been adequate in the past. We were good in Sandy, but we need to scale that kind of planning up, always with the Department of Defense being in support of civil authorities.

    That's part of the challenge, isn't it? To build this national approach to disaster preparedness, to bring in the private sector, to bring in non-governmental organizations like the Red Cross in this planning, that is a challenge that we're working on now, where a partnership with Canada could provide such enormous benefits.

    Can you tell us a little bit about the role of the U.S. Army Corps of Engineers in either prevention and/or response? I know in our province we had a hurricane, and the army actually put bridges up in the short-term, temporary relief, and things like that.

    Tell us a little about the U.S. Army Corps of Engineers in that.

    The Army Corps of Engineers is especially valuable for supporting civil authorities for emergency construction operations, but especially in our system in providing those backup power generators that proved so important, and in dewatering tunnels—a whole range of challenging operations that we saw in hurricane Sandy. The Army Corps of Engineers played a vital vote. Determining how best to use those resources and how much should be invested in building that capability, those are part of the puzzle in times of extraordinary budgetary pressures on the Department of Defense.

    I go back to the other question about response time. Is there a standard in terms of days, hours? What was the expectation?

    The expectation now is that every U.S. defence installation commander has immediate response authority. That is the ability to immediately deploy forces at the request of civilian authorities right out of the gate to immediately save lives.

    Thank you.

    Thank you very much, sir.

    Mr. Bezan, for five minutes.

    Thank you, Dr. Stockton, for sharing your expertise with us today and your experiences and really providing us some context, especially on the energy security standpoint.

    I want to move the conversation a little bit, because in your role as assistant secretary, you also had a very close working relationship and oversight on both northern command and southern command within the U.S. As you know, the general responsible for U.S. NORTHCOM is also the general for NORAD—he's double-hatted—General Jacoby.

     NORAD's looking at NORAD Next. Where does this go in the future? What role is Canada and the United States expected to play as we continue on with this great relationship that has been around for over 60 years?

    To me a NORAD after Next and the strategic review that's going to go forward needs to address what deeper collaboration is possible in the maritime realm, building on the maritime warning mission. What kind of collaboration is going to be possible to build on the foundations that now exist already in the civil assistance plan?

    What kinds of opportunities exist, not only for military to military collaboration, but knowing that in many cases militaries are going to be in support of law enforcement against terrorist threats that our two nations face? How can we glue together the information flow in a way that works not only military to military but with the RCMP and law enforcement in the United States? We're making enormous progress, but that is still progress that remains to be completed.

    We noticed when we were at NORAD headquarters in Colorado Springs that a lot of U.S. Coast Guard officers were walking around. Something that we don't see from a Canadian standpoint is Canadian Coast Guard. Do you see that relationship evolving, that Canadian Coast Guard plays a more aggressive role from the standpoint of homeland security?

     Canadian Coast Guard can make very important contributions. There is the shiprider program, with which you may be familiar, where U.S. personnel are stationed on Canadian Coast Guard ships and Canadian Coast Guard personnel are stationed on U.S. Coast Guard ships. We can have a binational law enforcement effort on the high seas, on the maritime approaches to the United States. That's incredibly valuable.

    In your relationship with Mexico through U.S. southern command, one thing that isn't really slowly evolving is Mexico becoming more of a partner in the defence of North America, not to the same degree we have, of course, between Canada and the United States, or that type of history. But we do have an upcoming meeting of NAFTA defence ministers taking place in Mexico in a couple of weeks.

    Do you see that role becoming more important? This is especially as Mexico in itself is struggling with a growing proliferation of drug lords and their own narcotic threats, which have turned into almost a paramilitary battle, as we've seen historically in Colombia.

    Yes, absolutely. Defence collaboration with Mexico is already improving and needs to be sustained.

    Let me be clear: the U.S. defence relationship with Canada is unique in the world and uniquely valuable to the United States. Bringing Mexico into North American security, beginning to develop a perimeter approach to North American security, is going to be a work in progress, but very much labour that's worthwhile.

    One of the witnesses we had a few weeks back, Stéphane Roussel, was critical of the relationship Canada has with the United States, that we're taking for granted our relationship with the U.S., and we're taking for granted our contribution through the Afghanistan mission.

    You have had very glowing words today on the value of the relationship with Canada, but do you foresee any difficulties? And how can we overcome those difficulties, if there are any?

    I'll be candid. I do believe there is a risk that we'll take for granted the extraordinary defence collaboration between the United States and Canada. I believe that we need to continue to highlight the value to both nations of this collaboration. Each nation is sovereign. Each nation is going to make its own decisions in terms of what it needs in order to secure its own nation. But the value going forward now is going to grow of this collaboration in the Arctic, in the other examples I've provided today that we've discussed. We need more collaboration, not less, and more attention to these opportunities for defence support to civil authorities going forward.

    You have half a minute.

    The only comment I had is you mentioned that the whole issue of cyber-security and protecting our energy supply are some of the threats from within, not from a national disaster standpoint but from probably you mean a terrorist element.

    I want you to comment about how high that risk is at the current stage.

    The risk is significant. Let me add that the risk of insider threats is growing.

    I had the honour of co-chairing the Independent Review of the Washington Navy Yard Shooting. Both for kinetic attack and cyber-attack, there's a risk that as we build our perimeter security more effectively, as we defend our networks on the outside, adversaries are going to have stronger incentives to attack from within. The insider threat is a major challenge.

    Mr. Blanchette, you have five minutes.

    Thank you, Mr. Chair.

    I would like to thank the witness for being here.

    I found your perspective and your presentation very interesting. What you are basically talking about is resupplying from within. In other words, defence capabilities still rest on the ability to supply the forces at the front. You are talking here about what North America does, but basically we are talking about resupply. That is what you told us.

    You spoke about resilience. I worked as a computer scientist and, in my head, that sounds like the word “redundance”.

    I would like to know one thing. With respect to the United States, you gave the example of diesel generators that run out of fuel after two or three days and where it isn't possible to provide backup. Have the United States started to look at using various types of energy for power?

    For example, when the generators break down, could solar energy be used as an alternative for a while until conventional forms of energy could be resupplied?

    Have the Americans started looking at diversifying energy sources in order to react during incidents that, because of climate change, may occur more often and be more severe?

    The opportunities to diversify sources of energy and do so in a way that strengthens national security are very important. The challenge, as you know, with some forms of renewable energy—solar, for example—is that it's difficult to store electricity. It's very inefficient, very expensive to do so on a large scale.

    From a perspective of the Canadian Armed Forces or U.S. military facilities, renewables are likely to be an important part of the energy puzzle, but not the whole answer.

    Innovative approaches to fuel cells, other kinds of generating capacity—it is imperative to pursue those opportunities.

    At the same time, you spoke at length about cyber attacks, which originate internally and externally. My colleague, Jean-François, spoke about the capacity of splitting up the networks. That question has already been considered.

    We know that one day, an attack will take place—it might originate internally or externally. We also know that one day, the defences will be penetrated. The true question is not whether it will happen, but rather how we will recover from that with respect to information.

    Is the United States considering this capacity to recover, but especially recovering quickly? There are classic recovery plans, but if a number of incidents occur simultaneously—a natural disaster and a cyber attack, for example—we would be a clay-footed giant. We would be extremely weakened.

    How is the capacity to recover from these kinds of incidents being considered on the cyber side?

    Public Safety Canada and the Department of Homeland Security have very strong collaboration under way on this issue. Bringing in industry, understanding what kinds of requests for assistance might come from industry to government, these kinds of issues now are the focus of intense dialogue today.

    The dialogue needs to be sustained, and I would suggest that the Department of National Defence and the members of this committee also need to think about how the defence establishments both are vulnerable to these kinds of cyber disruptions but also could provide part of the support needed for response and recovery.

    This is a dialogue that's just under way in the United States now in the infrastructure realm and needs to be sustained going forward. It should be done in a binational fashion.

    Thank you.

    Thank you very much, Mr. Blanchette.

    Ms. Gallant, for five minutes.

    I will continue on from where we left off with smart meters. The different smart appliances send the messages to the smart meter for reading or for adding up the kilowatt hours used. Now, it's my understanding that in order to read what the smart meters are accruing, the cellphone infrastructure is used and transmits the data to an entity that eventually does the billing. Where cellphone connectivity does not exist, there are remote readers used.

    From those two lines of connection, between the smart meter and the building that collects all the information, and the remote reader where cellphone is not available, are there areas of vulnerability there?

    There are areas of vulnerability, but also enormous advantages. Let me speak about the advantages first.

    We saw in hurricane Sandy very strong evidence that the kind of connectivity that you're describing between meters and the grid operators can help speed the restoration of power in very important ways, because all of a sudden the grid operators have a map of which households are missing power and which are up and running. So when you think about where to send your power restoration crews, having this automated flow of information rather than having utility trucks drive around and eyeball where the lights are out, it's enormously efficient and very helpful in speeding power restoration. So the smart grid is helpful for grid resilience.

    But as you point out, this kind of connectivity, wireless connectivity, cell connectivity, could provide means of inserting bad data, malware, that electric companies are very mindful of today, and they are building security against those kinds of intrusions. What we need to do is continue dialogue with industry to make sure that best practices are being applied across utilities, that there's a sharing of information between government and industry about the threat signatures that they need to be monitoring, and that we do whatever we can to build protection against these kinds of intrusions.

    What sort of trouble could an incursion cause, besides obviously billing errors? How could it wreak havoc on both society and individuals?

    The ultimate threat is that the industrial control systems that help operate the electric power system will be physically damaged. We saw examples of how this can happen in the Aurora test conducted at the Idaho National Laboratory. It is possible that physical effects can be created by computer attacks. The risk of physical damage on a widespread basis, that's frightening because of the difficulty of replacing some of these grid components. That's important.

    Let me emphasize also that corrupting the data on which grid operators depend in order to restore power after an outage provides an additional emerging threat vector. As you know, grid operators need to carefully balance the amount of power that's being generated against the load, that is, the amount of electricity that's being used. This needs to be carefully calibrated. If grid operators can't believe the data they're seeing because the data itself has been attacked, that's just as devastating as a bank or another financial institution not being able to prove that your bank account is what it is.

    On the topic of cyber-security as well, and specifically collaboration, we have Canada, the U.S., the Five Eyes. We also have the NATO alliance. Should there be more collaboration and sharing of notice of incursions across that entity as opposed to just the Five Eyes, more than there is right now?

    I think that sharing needs to increase. And let me say also that an important step occurred a couple of weeks ago when the Minister of National Defence of Canada, Secretary Hagel, the minister of defence of Mexico, and the head of the Mexican navy got together and agreed to collaborate on cyber-security.

    Important opportunities exist on a North American basis as well as a bilateral and NATO basis to increase the sharing, to not only increase the understanding of the threats that are emerging but build collaborative approaches to protect against and build resilience for cyber-attacks.

    Thank you very much, sir.

    Mr. Harris, for five minutes.

    Dr. Stockton, I'd like to follow up a little bit on your discussion about the response of the American military to the Deepwater Horizon incident. I presume we're talking about the navy here and the coast guard, and I guess the exact opposite of the capability in the north. What does that say to the readiness to even have oil tankers travel through the north, for one? Could you describe a little bit more how the DOD and the U.S. military were involved in coordinating activity in the Gulf of Mexico with the Deepwater Horizon?

     Yes, it would be a pleasure.

    Again, the Department of Defense was in support of the Department of Homeland Security, which had primary responsibility for the Deepwater Horizon response, and the Department of Energy, and other federal departments. But only the Department of the Navy had the large-scale assets for the skimmer boats, for example, to suck up the water off the surface of the ocean. Only the Department of Defense had those assets. The coast guard was also very important. The Department of Defense provided helicopters, transportation, all of these assets that were readily available in the Gulf of Mexico.

    Now imagine what it would be like trying to conduct those operations in the Beaufort, how much more difficult it would be to support those assets and to get them where they were needed in a timely fashion. I believe that this is a challenge going forward, where partnering with industry, understanding which ships of potential concern are going to be transiting, now that more and more transits are occurring, especially carrying petroleum products.... This is an opportunity for dialogue in the Arctic Council, led now by Canada—the United States is soon to follow in a chair role—to discuss with all of the Arctic Council members how we can have a better understanding of ships that are transiting that may require special attention.

    In the absence of a response capability, are we not looking at a disaster waiting to happen? We can't wait until the disaster happens to find a solution. Doesn't that speak to putting off use of that passage for transit of environmentally dangerous fuels, for example? We can't just wait.

    The governments of Canada and the United States are not waiting. They're engaging in intensive dialogue about how to meet these challenges today. I wanted to feature them with you also because it's such an important opportunity for this collaborative approach to investment that we were discussing before. That is, if Canada and the United States can figure out who should invest in what kinds of disaster response infrastructure, we'll both be better off.

    I think there has been a start within the Arctic Council on search and rescue—at least a framework, but not a lot of detail.

    Precisely.

    There should also be something with respect to what role the nations and their militaries might play in responding to an environmental disaster or environmental spill at best.

    Yes, and there is now an agreement in the Arctic Council on how to respond to a disaster of the sort we've been discussing. But building the actual response capabilities so we can remediate the spill when it happens, that's the challenge that remains.

    We note on the other side of the Arctic Circle the Russians have invested fairly heavily in infrastructure along their coastal route in terms of facilities, landing ports, supply ports, and capabilities. Would that speak to the kind of cooperation you're talking about and what facilities might exist in Alaska, say, versus in other parts of the eastern Arctic in which Canada participates? Is that what you're talking about?

    Yes.

    Let's talk about what you would build and what we would build, and what that would do for the needs of both countries.

    Exactly. That would be a very sensible approach. Let's agree on the nature of the challenge and what it's really going to take to build preparedness for the risk that an oil spill will occur.

    That's all I have.

    Thank you very much, Mr. Harris.

    Mr. Bezan, for five minutes.

    Dr. Stockton, you're talking quite a bit about infrastructure, mainly from the standpoint of energy and having more of a collaborative approach.

    Are you suggesting to do this through new mechanisms, or are you thinking of doing it through the PJBD or through NORAD? Exactly what approach are you recommending?

    I think the institutional framework that we need is exactly what we have today. I'm not advocating for the creation of new organizations, but the repurposing of the Permanent Joint Board on Defence towards these emerging challenges has been enormously helpful. I would say that's also true of the mutual assistance agreements that already exist between utilities in Canada and the United States. State by state, province by province, there are strong collaborative relationships that already exist, but what we need to do now is scale these relationships up in a binational framework and really figure out which kinds of capabilities are going to be most necessary for investment, given the rise of non-traditional hazards.

    When the committee was in D.C. meeting with our counterparts in Congress, it was brought to our attention that the House of Representatives defence committee is concerned about the lack of infrastructure for protection from ballistic missiles on the eastern seaboard. I want to get your take on whether or not this is an area that needs to be beefed up, from a U.S. standpoint.

    Also, we haven't talked at all with you about the Canadian relationship concerning BMD.

    As General Jacoby may have told you when you went to NORTHCOM, the United States has plans in place to strengthen our own ballistic missile defence against the emerging threat from North Korea and potentially from other nations as well. So the United States has a plan in place that it's executing.

    In terms of U.S.-Canada collaboration on this issue, Canada is going to make its own sovereign decision as to whether it wants to engage in a ballistic missile defence cooperation with the United States. I believe that when the decision is made by Canada to revisit its current position, if a decision is made to engage in this dialogue, there could be fruitful opportunities for collaboration, but this is purely a decision for Canada to make.

    Just on Sunday we commemorated in Canada the Battle of the Atlantic, the longest battle that Canada faced during World War II. Ultimately we had command of the Atlantic fleet, and there were German U-boats that came within the shores of Canada and the United States and sank both navy ships and merchant marine vessels that were trying to deliver goods and services for the war effort. They were going after everything. Newfoundland was part of Britain at that time. Of course, they made a huge contribution as well.

    To get to my point, things are changing in the world today. We see what's happening in Ukraine in the context of Russia. In considering threats to North American security, knowing what happened in the past, during World War II, do you have concerns—not only from the standpoint of the Arctic, which you say you see as involving more an environmental than a defence issue—that the aggression that Russia is demonstrating today in eastern Europe could spill over to other regions? I'm wondering what your thoughts are on that.

    I have two quick answers.

    First, with regard to Canadian military history, I wish I could march every American citizen through the Canadian War Museum here in Ottawa. The contributions of Canada for centuries now are really astounding.

    With regard to the aggressive behaviour of Russia, I believe it exemplifies why Canada and the United States need to continue to press for NATO transformation and the revitalization of NATO, because the thought that Europe was going to be a zone of peace and that the risk of conflict in Europe was over, those days are long gone. I'm looking forward now to opportunities to collaborate within the NATO framework with all of our partners. It makes it essential to sustain the dialogue.

    Thank you very much, Mr. Stockton.

    Ms. Murray.

    I'd like to extend the conversation around maritime security.

     I come from the west coast of British Columbia, and we share waters—the Strait of Juan de Fuca, Georgia Strait. We are very interconnected. At the northern part of British Columbia, southern Alaska of course has a lot of overlap in terms of maritime activity.

    One question I have is whether you see the fact that our coast guard is a non-armed service in the Department of Fisheries and Oceans, whereas the American coast guard is an armed service, as being a constraint on collaboration and cooperation in maritime defence.

    I do not. I think maritime collaboration is very strong. The recent exercise of the marine event response protocol—we had a big binational exercise, a potential terrorist threat coming from the maritime realm—shows how deep this collaboration already is.

    Clearly, Canada and the United States are going to make their respective decisions on rules for the use of force, the degree to which armaments and other capabilities are going to be provided to their coast guard, but as each nation makes its own sovereign decision, a terrific foundation for collaboration exists, and it's getting stronger every day. That needs to be sustained.

     In terms of equipment capacity, at this point Canada does not have a resupply ship available on the west coast, because we only have one, and it had a big engine fire. It might not be put back into service. Essentially, with procurement failures over the last years, there may not be another supply ship until 2022.

    Do you see the current kind of cooperation and collaboration as adequate, or does there need to be something more formal in terms of the utilization of supply capacity by the United States for Canadian purposes over the coming years, wherever there may be a big gap?

    The United States is a little short of icebreakers; we have our own capability gaps. This is precisely why, on both a formal and an informal basis, I recommend that dialogue continue on how we can be in mutual support. In areas in which one nation lacks capabilities and another has strengths in that regard, let's figure out who can support whom and build a system that works better for both of us.

    You mentioned earlier, in response to a similar question around oil spill response, that it should be discussed at the Arctic Council. Is there something more tangible by way of a process that you would recommend? When you say “dialogue”, is this informal dialogue, maybe between commanders? Is it a particular framework for collaboration around sharing of equipment? Or is it something else?

    I always start with NORAD, that being the crown jewel of U.S.-Canadian defence collaboration and indeed the gold standard for defence collaboration around the world.

    There are opportunities in the maritime awareness and warning realm to tackle this question of understanding which ships of interest are transiting the Arctic in order to better share information and to sustain dialogue again on how we're going to invest at a time of terrific pressures on our respective defence budgets in building capability where it is short today.

    What do you see as major threats, aside from the ones that have already been discussed, such as oil spills from pipeline tanker projects or from ships transiting the Arctic? What do you see as the major threats that the maritime strategy needs to address in the collaboration between the United States and Canada?

    I think of the Sun Sea incident. I think of risks that the maritime approaches to Canada and the United States would be exploited by adversaries, state and especially non-state; this needs to remain a focus of collaboration. I think of the law enforcement challenges posed by human trafficking and drug smuggling.

    Again, these are shared challenges. We need a binational, collaborative approach to meet them.

    Thank you very much, Mr. Stockton.

    Mr. Chisu, you have five minutes.

    Thank you very much, Mr. Stockton.

    We have spoken extensively about cyber-security and the necessity to pay attention to cyber-defence. In your opinion, where is the threat coming from? Actually, who is the enemy, or the perceived enemy? You are not building a defence without knowing who potentially will attack your systems, basically.

    I am excluding here absolutely North Korea, because they don't have the technical capability to do that. However, in the area we have seen, somebody has been flexing their muscles in Europe, and somebody else is flexing their muscles in Scarborough Shoal in the Pacific and is building up a great military capacity, which is not negligible. Two countries, which I haven't named yet, are building a great military cooperation. It is the height of their military cooperation.

    Does the United States perceive a threat from something? The Cold War ended 20 years ago, but now a new situation is evolving quite quickly.

    I didn't use to worry particularly about the cyber threat from al-Qaeda's affiliates or from rogue nations such as North Korea. But over the last few years a very important development has occurred in the cyber realm, and that is the growth in black market sales of zero day exploits and other kinds of cyber-weapons that enable potential adversaries who never would have had the resources on their own to develop sophisticated cyber-weapons to buy them, no questions asked.

    The proliferation of sophisticated cyber-weapons is a challenge and an opportunity again for U.S.-Canadian collaboration: what to do about this arms race, essentially, in cyber-weapons; whether there are opportunities through the Wassenaar Arrangement or other international cooperative arrangements that might begin to clamp down, knowing that doing so will be very difficult.

    When you are speaking about the technology of the arms race in the cyber war, who do you foresee will be the potential nations that can afford to have this technology? I don't think we cannot think about Russia or China in this area, because in most of the cyber-attacks you mentioned—you cited a water plant and so on—who was attacking it? I don't think it was North Korea or Iran.

    Attribution for these attacks is notoriously difficult. Hackers operating on behalf of states, grey areas in terms of difficulty in figuring out attribution as to who exactly has launched an attack, is a problem that characterizes the cyber realm.

     I'm all about understanding that the threat is going to become more severe and that we need to build protections against these threats. But at the end of the day, my working assumption is that an effective, large-scale attack will someday succeed, and so building resilience, building the ability to get the power grid, the natural gas system, or other critical infrastructure back up and running, is imperative.

    You were speaking about the infrastructure in the north. You cannot build a gas power plant, but what about nuclear mini-generators?

    This is being explored in the United States in both the private and the public sectors. I agree with President Obama on the all-of-the-above strategy: pursuing every promising development for generating capacity, knowing that the imperative to reduce carbon emissions is absolutely vital. That's why we need to explore all of these opportunities, including renewables, as we discussed a little earlier.

    You have 15 seconds.

    Okay.

    Thank you very much for your presentation. It was very good.

    We'll move on to our next questioner.

    Mr. Larose, you have five minutes.

    Thank you, Mr. Chair.

    I would like to thank the witness again for being here.

    Can you hear me, Mr. Stockton?

    Yes, thank you.

    Excellent.

    My first question has to do with the Arctic.

    We talked about the urgency of this. There is a dialogue right now about oil tankers. We are currently studying the possibility of building ships to meet our needs. Agreements have been made between Canada and the United States. In case of danger or imminent risk, would the United States be willing or able to mobilize equipment, personnel and ships while waiting for Canada to intervene, given that we are limited in terms of our capacity to intervene? Do the United States have this capacity or do they want to work with Canada just because they do not have an infinite capacity?

    We need Canada's collaboration, absolutely. Neither nation can meet these challenges on its own, in my view. An additional investment is going to be required going forward. We don't have the capability that we need to deal with the increase in ship traffic carrying petroleum products and other potential sources of environmental disaster—

    And 20 years is way too long.

    I completely agree. So let's figure out what we can do in both the immediate term and then over the longer term, for which sustained investment is going to be required.

    Is there not a danger in having interdependency on specific types of equipment? Let's say there's a list from A to Z, and we decide to take one-third of that list, which is my understanding of what you're mentioning. At a certain point.... We all hope there won't ever be another catastrophe, but what happens if there are two or three?

    That is an outstanding question. I'd say it reinforces the need to have a collaborative approach. Clearly the risk posed by a scenario such as the one that you have offered—to have multiple disasters—is of lower probability than to have one, but it can't be discounted and therefore ought to be part of the dialogue.

    You mentioned the agreement between the governors and the president. The measures were more effective in the case of Hurricane Sandy than Hurricane Katrina. Effectiveness has therefore been improved.

    Could you please give us some examples of changes that were made to accelerate the measures and that could help us change our current structure?

    As in so many cases, the differences in the structure of government between Canada and the United States make it difficult to apply lessons from one nation to the other. We have a system in which each governor has his or her own air force and army and the state national guard, and in state active duty those soldiers and airmen report to the governor, not to the President of the United States.

    I'll leave it to you to decide whether you'd like to adopt such a system in Canada.

    Some hon. members: Oh, oh!

    Mr. Paul Stockton: It makes for enormous political complexity inside the United States. Thanks to the leadership of our governors, we were able to forge an agreement that provides for unity of effort between our governors and the Commander in Chief.

    Let me ask the question differently. What were the points of friction that were eliminated?

    The points of friction were that in hurricane Katrina, federal forces came in to the disaster response under the command of the President without sufficient dialogue with the governors about which specific disaster response operations were most important for that governor. There needs always to be civilian leadership over defence operations, and in our system governors—not the President of the United States, but governors—have primary responsibility for the public safety of their citizens.

    What is this sharing of equipment? I imagine there is some between the governors and the President in the relationship. I imagine the states don't have a humongous amount of....

    The states are able to use their equipment for disaster response either funded by our disaster response agency, FEMA, or sometimes funded by the Department of Defense. It's an example of the extremely complicated system we have built, which reflects our unique form of government.

    Here is one last, quick question.

    You mentioned testing le réseau—the grid, the cyber-system—with false Internet pages to see whether there would be attacks or not.

    Are other measures of this type planned? Was it very effective? Could you give us some details on that?

    Perhaps that question could be responded to later. I allowed you about 20 extra seconds because I'm trying to balance back and forth.

    Mr. Williamson, you have five minutes.

    Thank you, Mr. Chair.

    I'd like to come back to the question of NORAD and maritime warning.

    I might just put on the record a clarification. Deepwater Horizon came up, as well as a pipeline. When we talk about the northern passage, we're talking primarily about ships going through. There is no drilling up there, and there's no pipeline. Now, if Keystone XL isn't approved, perhaps there will be: we'll go north instead of south. But for the moment, I think the threat level, the environmental danger level, is altogether different from what we've seen in the Gulf of Mexico, for example.

    Putting that aside, I'll touch on a question that Mr. Chisu asked some time ago. Given that Canada and the United States each have a different perspective on the Arctic, on the question of sovereignty, is it not very difficult for NORAD to take an institutional leadership role in maritime surveillance, when one-third of our territory in the north is perhaps in dispute from an international point of view? We have our position; the U.S. doesn't recognize it. We think we're right; they think they're right. How does NORAD get around that? That's a real stumbling block, I would think, if you can't even agree on what is being monitored.

    My standard response when I was in office was, “That's a problem for the Department of State and DFAIT to work out. In Defense, we don't have to tackle that one.” That remains my party line.

    Voices: Oh, oh!

    Mr. Paul Stockton: To give you a more serious answer, we can leave that issue still to be resolved and nevertheless look for opportunities for information sharing, under the purview of NORAD in its maritime warning, with full participation by coast guard and all of the other critical components of building the system that we need.

    Just to be clear, are you suggesting that positions could be nuanced to allow NORAD and some new maritime surveillance capacity to monitor what was happening on all coasts, including the Arctic?

    With the full participation of the coast guard and the other lead agencies.

    Sure enough. Thank you very much.

    I'd like to come back to a question I attempted to ask you earlier, which is about the influence of the military domestically, in addition to their participation in some instances, and their not being clear protocols such that they are not involved when they don't need to be.

    In Canada, it's the same thing. A municipal leader, a provincial premier, similar to a governor, is responsible for declaring states of emergency. At that point, they call in the federal government for assistance, if they need it. It's very similar, just using different terminology.

    Yet I worry, particularly given some of your comments in the first hour, about a dramatic increase or a dramatic military oversight of what I see as a civilian and local—by which I mean provincial—responsibility to repair downed infrastructure, for example. Again, going back to the case over the holidays when the power was out, you heard some opposition politicians talking about bringing in the military. I have the largest military land base in the country in my riding. The military doesn't have the capacity to string up lines. There is a function they can serve, but calling in the military is actually not always the best solution.

    Could I get your comments on that?

    Absolutely I agree with you. We always need to start with private industry and what industry believes would be appropriate government support.

    In our country, we find that our national guard, and to some extent other military forces, can provide for road clearance, can provide for security, can provide for other support functions that utilities actually find useful. But it always has to start with the utilities, since they are responsible for power restoration. What do they think the military can do that is genuinely useful? That is always the starting point for any such discussion.

    The role of the military will always be limited, but in these catastrophic events could prove to be very important.

    Thank you.

    Thank you very much.

    The chair will exercise some prerogative, because he has a question from the last witness that he would like to ask the current witness. It has to do with the defence of North America.

    Probably the threats to our continent will be of an air or a maritime nature; I doubt very much they will be of a land nature. Of course, interoperability and complementary equipment is absolutely necessary, especially if we're talking about one of the examples you used as the primary and best example, that being NORAD.

    With that, I'll open the question. I'll start by saying that I believe that one of the greatest reasons the United States is the power it is is due to to its military industrial complex and how it has contributed to the economy. That being the case, we are in a consortium with regard to air defence. I'm referring to the F-35 program. I wonder what your opinion is with regard to the kinds of assets we need to obtain in order to sustain that interoperability and complementary equipment, especially in communications.

    I wonder whether you would like to make a comment on that. Then we'll move to Ms. Murray, if we have time left.

    Interoperability is key to mission effectiveness in NORAD. The F-35, by providing for a common airframe, will not only allow us to sustain interoperability in those terms, but all of the ancillary equipment—communications, everything else for avionics that will be modernized over time as those airframes are updated because there is a common airframe, because these other projects will be able to go forward on a collaborative basis—provides for a foundation for interoperability that I believe is going to be extremely valuable.

    Knowing that program managers need to continue to drive down the cost of the F-35, knowing that each nation, including Canada, is going to make a sovereign decision ultimately on participation in the program, I believe that the interoperability value of this program is extremely important.

    On a point of order, Mr. Chairman, we have an outstanding invitation to the CDS, the CMP, and the JAG to come and talk about sexual assault. Do we have any news on when they might be before us?

    If I may, we do have the mains that we have to go to. That will occur....

    The only date that the minister is able to appear is May 29, and we have the department—

    The minister wasn't going to come to talk about sexual assault.

    No, it was on the mains.

    I said the mains, and I know you're interested in that.

    In terms of what you're referring to, the ombudsman for national defence will be here on May 15 for one hour.

    Okay.

    With regard to your question on sexual assault, we haven't heard from the Chief of the Defence Staff as to the date that he will be able to attend. We're anxiously awaiting the response to our invitation to attend committee.

    Thank you.

    Unfortunately, Ms. Murray, there's less than a minute left. If you have any questions, perhaps you could submit them.

    The meeting is adjourned.