Information & Ethics Committee on April 3rd, 2014

[Supt Jean Cormier]

Yes. As I stated in my opening remarks as well, there can be a long-term impact on the victim. Rebuilding and clarifying your credit history when you were a victim of fraud or identity theft is not an easy process. It is complex and can be difficult to complete. In some cases, yes, I've heard of victims waiting months before the situation was completely resolved.

[Scott Andrews, Liberal, Avalon, NL]

Is it mainly with their credit history? Is that the common one of trying to regain their correct credit history?

[Supt Jean Cormier]

I believe that is the one that is more complex and problematic for victims, yes. Depending on the type of fraud that the individual may have used the identity to commit, it may have an impact on them as well.

[Scott Andrews, Liberal, Avalon, NL]

I think at some point in the future we're going to have the credit agencies come in. Is there anything we should be asking them about trying to help victims get their files straightened out more quickly? Is there an angle there for us to ask them about?

[Supt Jean Cormier]

I don't know exactly what is involved in their process. I'm sure they have due diligence processes that they have to verify as well, because I'm sure that anybody with bad credit could go to them and say, “I was a victim of fraud. That's not my bad mark on my credit history.”

I'm sure they have a pretty stringent due diligence process that they have to go through. Sometimes the delay can be frustrating for victims, but it is necessary at the same time. For me to tell another agency what would be required would be difficult.

[The Vice-Chair, Conservative, Patricia Davidson]

Thanks very much, Mr. Andrews.

We'll now go to Mr. Zimmer for seven minutes.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thank you for appearing before committee today.

I have a couple of questions, and I'll start with the Competition Bureau. What officially is your mandate, in the simplest of terms?

[Morgan Currie]

Our mandate is to ensure that Canadian businesses and consumers prosper in a competitive and innovative marketplace. Our focus is very much on competition for Canadians and the health of the economy. Generally speaking, we have provisions that deal with criminal matters such as price fixing. We evaluate proposed mergers to see if they might limit competition for Canadians for products and services. We have a branch that looks specifically at abuse of dominant position, when large companies that dominate a marketplace might be engaging in acts to limit competition.

In our branch, the fair business practices branch, the core of our work is to investigate cases of false and misleading representation and deceptive marketing practices that cause consumers to have unclear information when they go to make purchasing decisions.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

I heard what you said earlier, and it goes along with what you had just suggested.

Can you give us an example of mass marketing fraud, and maybe some examples of other types of fraud? Can you give us an example that occurred in Canada? What was the fraud? How did the Competition Bureau nip it in the bud? How were the victims recognized in the whole process?

[Thomas Steen, Major Case Director and Strategic Policy Advisor, Competition Bureau, Fair Business Practices Branch , Department of Industry]

I can handle that one.

My colleague, Mr. Currie, stated four examples of the types of mass marketing fraud the bureau handles.

The first category covers scams targeted at generally small or medium-sized business, whether they're in or outside of Canada. If the perpetrators are in Canada but target people outside of Canada, the act applies to that, as well as to situations when the victims are in Canada.

Of those scams targeting businesses, a typical one is the directory scam. This is committed either by telemarketing or by fax. There's always an Internet aspect to these scams as well. Generally what they try to do is they use what we refer to as the assumed sales technique, where they call someone at a business—actually it could be an organization, a charity, a church, a government agency, anybody that runs an office, really—and they try to leave the impression with them that they've already bought this directory every year and they're just calling to renew their listing and update their information. They sometimes try to use names similar to the Yellow Pages group, or companies such as that. People don't realize that they're committing to a payment, whether it's over the phone, or sometimes they send facsimiles to companies saying to update their information, sign the form, and send it back. Buried in fine print, they're committing themselves to $1,500 a year to be listed in the directory.

There is a product, per se, usually a directory listing on the Internet, but it's not accessible. For instance, for any commercial purpose to be listed in a directory, if I have a towing company, I would want my consumers to maybe google towing companies in Ottawa, and my company name would come up. It probably does come up in the Yellow Pages directory or Canada411, but not on these scam ones, so they're of no commercial value to businesses.

How do we investigate those? We receive complaints. We have our own complaint centre, through the Canadian Anti-Fraud Centre, and through our partnerships. Then we evaluate those complaints. We have enforcement priorities, and at a certain point we decide to investigate. When we get to that stage, we have several investigative tools in our toolbox, including search warrants, sections under our act where we can apply for people to provide information, written returns, or records, or provide information under oath. We have to apply to courts for these powers and show that there are reasonable grounds that these offences have occurred. That's what really gets us started on our investigation, when we use those powers and we analyze that information. Eventually, we complete our investigation and refer it to the federal prosecution services with recommendations to charge, and it's their decision whether the individuals or companies should be prosecuted.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Following up on that last point, how often do you see those groups actually prosecuted, and what is the restitution for the victims? Have you seen victims compensated? What is the typical end of the road for that particular victim of this crime?

[Thomas Steen]

To the first part of your question, a very high percentage of the cases we refer to the federal prosecution services are prosecuted. We have a very close and good relationship with them. We work with them along the way, so there are very rarely any surprises in our investigative technique or what we've uncovered. For that reason, I would say well over 90% of the time, maybe 95% of the time, the cases we refer are prosecuted.

As far as what happens down the road, first of all, the provisions in the Competition Act dealing with this type of conduct are criminal in nature, so the accused can either be fined on summary conviction up to $200,000, or most likely, our cases go by way of indictment, not summary, and the fines can be very high at the discretion of the court, and jail terms to a maximum of 14 years can be imposed.

There is also means for restitution.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

What can happen and what actually happens are two different things completely.

What do you see typically happen to the victims of the crime at the end of the day? Are they being rewarded or are they not? We're talking about obviously the highest watermark, but what often happens? That's what I'm asking.

[Thomas Steen]

A few things happen.

Often what happens is that the targets are convicted. They are often fined significant amounts of money, hundreds of thousands, if not millions of dollars, and a time sentenced to jail terms. The highest jail term received so far is three and a half years, but it wasn't until 2009 that the penalty was increased to 14 years in jail, so we expect more severe jail terms.

In terms of victim restitution, there are provisions in the Criminal Code for that avenue for judges. There are also proceeds of crime that attaches to our offences, as well as Criminal Code offences. At times we do that.

It's really a question most of the time of what kind of evidence we're able to uncover at the time of our investigations. The criminals are smart, as has been said, and often they move and hide their money. When we find it, we do what we can. We're getting better and better at identifying those assets.

[The Vice-Chair, Conservative, Patricia Davidson]

We're going to have to stop there. The time is up.

Thanks, Mr. Zimmer.

That finishes our first round of questioning. We'll now go to the second round, which is five minutes, and we'll start with Mr. Angus, please.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I stopped at a bank machine at a bank in Ottawa one night and took money out. The very next morning, the caisse populaire in northern Ontario called my wife and said, “We think a fraud has occurred.” They had identified that my card had been compromised, and the very next day the passwords were changed.

That was extraordinary. That doesn't happen all the time. It made me realize that I could have gone a month without realizing that I had been compromised. My bank account could have been cleaned out because I'm on the road, and I'm not paying attention.

Mr. Cormier, how important is it when someone's information has been breached.... What is the timeline to inform them so that they can take preventive steps? How important is it to have a quick response time?

[Supt Jean Cormier]

It is very important, obviously, but it depends on how the information is compromised.

In the example when you were a victim of a compromise, you were advised the following day. That's a pretty quick response, which probably minimized.... The quicker it's identified and the quicker the response, the more chance we have, or that the organization will have, to minimize the impact on the victim as well. It's very important.

[Charlie Angus, NDP, Timmins—James Bay, ON]

We've talked many times to the Privacy Commissioner. She's expressed her frustration about the need to update Canada's privacy laws, because we see examples in the private sector where it's voluntary reporting of breaches. Certainly, if something has been breached in your company, you don't want to disturb your customers. We've seen 40 million and 50 million addresses, information taken out from companies. We've seen half a million students' information lost and over a month went by.

How important is it, do you think, that the Privacy Commissioner be informed of breaches in the private sector or in government to ensure that people can take steps in case it has been breached for criminal purposes?

[Supt Jean Cormier]

That the Privacy Commissioner be informed of the breach, or that the information be shared with law enforcement or other partners that could have an impact in minimizing the impact on the victim?

[Charlie Angus, NDP, Timmins—James Bay, ON]

The commissioner's role is to decide whether or not the breach is significant enough that individuals have to report it. You don't need to scare someone if the data has been put in the wrong closet, but then the commissioner gets to decide whether or not a breach has occurred and someone has been affected here.

[Supt Jean Cormier]

Then it would be very important, obviously, that they be engaged promptly and that the information be assessed as soon as possible. The privacy law, obviously, is necessary. I enjoy my privacy as much as anybody else in this room, but it needs to be balanced as well with the need to protect victims of crime.

[Charlie Angus, NDP, Timmins—James Bay, ON]

We're seeing now international gangs, international espionage. In 2011 the Treasury Board's and the Department of Finance's computers were hacked by someone who was trying to get passwords and sensitive information. It was traced to China. Was it for espionage reasons? Was it for criminal reasons?

Given the incredible power that's in the espionage and hacking world, the ability to use algorithms to gather all manner of data way beyond the ability of any individual to keep track, how realistic is it for present-day police enforcement to be able to stay on top of this? How much training is needed? Is it sufficient? It seems to me we're dealing with a level of scale of criminal activity that has dwarfed anything that ever happened back in the old 419 scam days when they had to actually run them through fax machines.

[Supt Jean Cormier]

Obviously, having a properly trained police officer to investigate those types of crimes is very important. Having the right partnerships in the public and private sectors to help us investigate those crimes can be very important as well. There are other parts of the Government of Canada that are also responsible for the electronic world or the cyberworld out there. It is very important to have the right training. In Canada, the RCMP have some very well-trained officers in that field. We have a good reputation in comparison with our partners around the globe in relation to our abilities in that area. Certainly because of the advance in technology and how quick technology develops or changes, there is that constant need for continued improvement in training.

[Charlie Angus, NDP, Timmins—James Bay, ON]

How important is it to have a transnational response? These gangs are setting up in some very sophisticated businesses now in domains where it's possible to carry on this activity and pretend that it's perfectly legal. Are they beyond the reach of Canadian law? Do we need to have a transnational response?

[The Vice-Chair, Conservative, Patricia Davidson]

Your time is up, Mr. Angus, but perhaps we could have a quick reply, please.