Canada, United States & Cyber-Security: With National Efforts Faltering, Will Cross-Border Cooperation Propel Both Nations Cyber-Security Strategies?

By Keith Edmund White

Editor-in-Chief

Has the Beyond the Border Initiative become the best hope for the United States and Canada to craft effective cyber-security strategies?

On Friday the U.S. Department of Homeland Security (DHS) and Public Safety Canada (PS) announced a Cyber Security Action Plan, a 4-page document that fleshes out the security-cyber objectives of the Beyond the Border Initiative, a bi-national effort to cooperate on security and border management.

Cyber-Security:  An Important, Cross-Border Issue

First, before delving into the Action Plan and cyber-security in Canada and the United States, it’s important to emphasize the importance of cyber-security to both Canada and the United States.  Whether it’s food supply systems, financial institutions, or energy distribution facilities, all these vital pieces of critical infrastructure are vulnerable to cyber attacks. And, whether through shared fiber optic cable networks or America's extensive use of Canadian-generated electricity, Canada and the United States can’t tackle cyber-security alone.

Cooperation Without Substance?

The Action Plan represents a still early, light-on-details step in DHS and PS coordination—but does show that the two agencies have, at least, identified the goals they wish to accomplish.  Perhaps the two most challenging goals can be found on page 3 of the Action Plan:

1.4 Align and standardize cyber incident management processes and escalation procedures; and

1.5 Enhance technical and operational information sharing in the area of industrial control systems security.

 Why are these goals unlikely to be met anytime soon?  Well, Canada and America seem MIA on even having a national approach to cyber-security.  As pointed out at CUSLI’s 2012 March Conference, the United States really doesn’t have a cyber-security strategy on the national level—with comprehensive cyber-security legislation unlikely to pass Congress this year.  And Canada’s Auditor General, while noting improvement, still hit the nation’s cyber security nerve centre for only running during daytime hours and not being kept in the loop with the most pressing cyber-security threats. 

Just to illustrate how much work still needs to be done, DHS’s National Cyber Security Division—which offers a link to a 2003 National Strategy Report—still, as of today, lists “build[ing] and maintain[ing] an effective national cyber response system” as one of its two objectives.  And, when it comes to Canada, a 2012 article by cyber-security expert Ron Deibert, published by Queen’s University Centre for International and Defence Policy, states “the Canadian government is late to the cyber-security arena…and only barely nods at the importance of a foreign policy for cyberspace.” 

Will Beyond the Border Propel Comprehensive Cyber-Security Strategies in Canada and the United States? 

So, how do two nations do cyber-security coordination when both have lackluster national cyber-security strategies?  Though, a fair counter-argument could be made—taking up a theme pushed in today’s Globe and Mail—that exactly because both nations are only beginning to hammer out their cyber-security strategies, there's greater likelihood that both nations will work together to tackle this pressing issue, unimpeded by entrenched institutional practices and regulations.

Perhaps Canada and America’s individual difficulties on cyber-security will make the Beyond the Border framework the main hub for both nations emerging cyber-security strategies.  Not only is this good news for protecting both nations critical infrastructure, it could also show the value of bilateral approaches to more effectively--and efficiently--solve pressing public policy issues in Canada and the United States.

CUSLI 2012 Conference: Afternoon Panel 2 -- Cyber Security and Infrastructure

by Keith Edmund White


This panel discussed Canada and the United States’ plans to reform cybersecurity and critical infrastructure and some of the secondary impacts that will have on privacy rights and trade.  Critical discussion resolved around (1) what role the government should play in these areas (and can it keep up with breakneck changes in cybersecurity) and (2) the risk that even if like-minded countries come together for critical infrastructure and cyber-security, will this just push the leading industries to put them serves in non-member countries?  In any case, one thing is clear:  while nations have seen first hand, re: the 2003 power grid failure that rocked both nations, little--if anything--has happened when it comes to Canada and the United States to adopting a joint risk assessment approach and response plan.

Chaired by Eric Miller, Canadian Embassy

Paul Rosenzweig, Private Practitioner focusing in Cyber Security Law

Michael McDaniel, Professor of Law at Cooley

William de Laat, de Laat Global

Paul Rosenzweig:  What Cyber-Security Law Applied When Servers Are All World?  Short Answer—No One Knows.

Paul Rosenzweig opened his remarks pointing out that viruses can do physical damage—just look at the Stutnet virus that set back the Iranian program back.  So, this means America has to make sure other Stutnet’s don’t disable our transportation grids, agricultural grids, and manufacturing grids are run on a cyber-infrastructure on both sides of the border.  And what does this mean?  No matter what America does, Rosenzweig continued, that Canada has to work en tandem.

What’s next?  We need to get the basic level of risk.  But in discussing this, we need to have a joint services approach to cyber security.  But are we moving forward the right way?  Rosenzweig pointed out two bills moving through Congress now that are now written “with a complete U.S.-centric viewpoint because no one has looked at and said” that a vulnerability in Niagara power facility will want to know what’s happening on the other side.  If we don’t do this, the U.S. efforts will be “substantially diminished.”

And the Canadian side?  Just like with day-light saving time, Canada has raised its hand and said “hey, what about us?”  And this is particularly important since it involved important civil liberalities, and Canada shouldn’t just avoid this discussion by following wherever America may lead it regarding cyber security.

But Rosenzweig is “deeply skeptical” of the government leading the way on cyber-security.  The National Energy Regulatory Commission) to set standards for standards for energy grids.  But the average time for the production of rules like those is about 24 months, Rosenzweig.  But in that time, Rosenzweig, the mutation in threats is vast and the processing power doubled every 18 months.  So, Rosenzweig concluded, government can’t keep up with this in terms of specific rules.  But government can create a web to enable private industry to address these concerns in the private sector.

The U.S. and Canadian government cannot respond to these cyber security threats comes at our own peril.  In short, it “can’t be the be all and end all.”  He need “as close to a joint operating model as we can come given the limits of legal and policy models.”  One such example is that the NSA has a wide swath of cyber security information that only select individuals are aware of, but it is “essential” that it is shared with CSIS and the Five Eyes Organization, and from that those groups share that as much as possible with U.S. and Canadian private actors who may be subject to the attack, Paul Rosenzweig stated.  Also, we have Lockheed Martin plants in Canada and the United States, there’s no reason to make it harder for one of them to get information.

And countering against McDaniel’s push for greater government involvement, while there are areas that the government must take the lead, this can’t be the model.  In one study, the NSA only identified 5% of the risk that the private industry did regarding cyber-security.  Also, 82% of government alerts on cyber-security come after the private sector alerts occurred.  So the government needs to play a role and bring players together, “the structure is moving too fast” when it comes to cyber-security.  Thus, what is right for a Ford factory will not be a cure-all for cyber security.

“This is a problem of diplomacy, not technology,” Rosenzweig stated.  Like-minded countries have to come together and set standards and then grade ourselves.  And once we do that, those countries can then call out other countries, whether its China or Russia, for failing these standards that liberal, western anti-criminality norms regarding cyber-security and critical infrastructure can then call-out those nations who are failing to meet the board.

And when it comes to dealing with choice of law disputes when it comes to cyber-security standards:  no one knows what the answer to choice of law disputes yet.  And what about privacy standards?  When it comes to Canada’s efforts for privacy in cyberspace, the efforts are based on out-dated 1970s notions of privacy.  The answer?  We need a new conception of privacy.

Michael McDaniel:  We need to have a joint approach to responding to threats to critical infrastructure, and we get there by building on regional agreements.

While an optimist, McDaniel cast a critical eye on the one recommendation relating to critical infrastructure that says cyber security will be brought together and working through RRAP (Regional Resilience Assessment Program).  But, he cautioned, RWRAP is just a pilot program,  that may or may not actually happen.

“The plan doesn’t even talk about planning for a response at all.”

 When recommending what to do over the next year, McDaniel stated that we need something like the Emergency Management Assessment Compact (EMAC) —which involved Ontario and the Great Lakes States.  Second, we have to have that down at the county level as well for dealing with the effects of a damage to America’s critical infrastructure.  Third, we need to “define our taxonomy” when it comes to how we assess risk to our critical infrastructure.  And this requires information sharing among governments, different sizes businesses, and within agencies that connect the regulators to the operators to the first-responders. 

Is it underwhelming because of lack of internet or its just “too big to get our arms around at this point.”  But there are other agreements that show that we can move forward on this topic. 

When you look at Michigan, with the just in time automobile system, businesses and States are ready to take on the problem themselves. 

McDaniel pointed out that USNORTHCOM should have authority over the countries responses to cybersecurity and critical infrastructure challenges.  But we don’t have agreement on that.  And the chief hold-out, McDaniel argued, is at the state-level.  He stressed that this shows the value of taking an EMAC approach to coordinating Canada and America’s critical infrastructure.

William de Laat:  “..the specifics aren’t there.”

DE Laat focused on the link on physical infrastructure, trade, and cyber security in the Action Plan.  He emphasized that the BTB Action Plan’s comprehensive view of these matters is critical, whether its power, stock trading, or transportation.  But what the plan doesn’t do, and this is not different from past efforts, is “to link cyber security and critical infrastructure.”  Both Canada and America divide critical infrastructure and cyber-security, and while de Laat admitted these groups say they talk to each other all the time, but we need formal ties to protect critical infrastructure.  But “I’m underwhelmed” by the results we have so far…the specifics aren’t there.”  We need a comprehensive plan that “combines the really good, high value information sharing that really…allows us to come up with a clear protocol…and joint operational capacity that says in a crisis or non-crisis this is how we [Canada and the United States] will work together.

And why is this important?  Because, de Laat pointed out, one prominent Canadian expert has stated that “the interconnection of CI [critical infrastructure] systems is developing an overlay of what might be called the meta-CI system…”  If we don’t protect this emerging meta-system, it appears from this author’s quick read on the topic, it seems that America and Canada are leaving themselves open to natural disasters or computer attacks reaping havoc on their economic and trading relationship.

 A number of regional groups are “working really effectively.”  But these are treaty level agreements if taken on the bilateral level, and getting these through the national level are much more difficult.

De Laat sees the the path forward on critical infrastructure is working with a few countries who share the same values.  But this brings up a difference between Canada and the United States:  Canada tends to push more for multinational engagement.

Addressing if industry can take care of itself, he pointed out that industries may not take a strategic view.  “Governments will not save the day, but if governments do not make this a priority we will have problems on our hands…they have to work with the private sector.  Unfortunately, “we’re all sitting on our hands right now.”