Human Resources Committee on Feb. 14th, 2013

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Then it's appropriate to talk about the situation in general? I think it is.

[Joe Daniel, Conservative, Don Valley East, ON]

No, this is specific to the policy of the department. That's the question. It relates directly to what's being talked about.

[The Chair, Conservative, Ed Komarnicki]

Go ahead.

[Ian Shugart]

I think, Mr. Chair, we understood the question to be an elaboration of the measures that we have taken in response to these incidents which, as I understood it, was included in the order.

[The Chair, Conservative, Ed Komarnicki]

That's the idea, but answer it within those confines. If members still find that objectionable, raise your objection.

Go ahead.

[Ron Parker]

Only approved USB keys will be allowed, and the department is acquiring a large number of encrypted USB keys. As a result, portable hard drives are no longer allowed to be plugged into the network, nor are personal devices that use a USB connection. We are monitoring the network and accessing the network on a regular basis and moving to ensure that none of these devices are connected, which is a big step in preventing the movement of data off of the network, which is encrypted.

The other significant measure is the implementation of the data loss protection software. This will tell us exactly what sensitive information is on the network, where it is, and how it's stored, and it will allow us to take appropriate measures to make sure it's secure.

I repeat, the network is encrypted. It will also allow us to deal with the movement of the data. We can control or prevent the movement of data once this software is in place. These are very important measures that we're taking in response to the incident.

[Joe Daniel, Conservative, Don Valley East, ON]

Are there any measures you're taking to constrain how much data can be put on any one USB at a time, or anything like that?

[Ron Parker]

We have not looked at that particular issue at this time.

[Joe Daniel, Conservative, Don Valley East, ON]

Okay.

What guarantees can you offer my constituents that this data will not be used fraudulently as a result of this error?

[Ian Shugart]

Mr. Chair, I don't think we can ever offer guarantees. What we can offer is the assurance that, as Mr. Parker has said, we are monitoring things extremely closely, both through the Equifax arrangement and through the annotations in the social insurance register, to spot any suspicious activity that could give rise to suspicion. That suspicion alone would be the basis for the individual and for HRSDC to take appropriate action.

Again, quite obviously we are very pleased that we have absolutely no indication at this point of malfeasance or of misuse by any third party of any of this information.

[Joe Daniel, Conservative, Don Valley East, ON]

For my colleague across the way, we talked earlier about using TransUnion and Equifax, but you've chosen to use just Equifax. Can you help me understand again why you're just using one of the credit companies?

[Ron Parker]

I'm afraid the answer will be very similar. We're exploring the possibility of engaging with other credit bureaus and financial institutions to gain incremental services. At this moment, that's all that we can say about where we are.

[Joe Daniel, Conservative, Don Valley East, ON]

But pretty much all the clients will be serviced by Equifax.

[Ron Parker]

At the moment, yes, the contract is with Equifax.

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you very much.

[The Chair, Conservative, Ed Komarnicki]

Thank you for that.

With that, we've concluded the first round of questioning. We'll take a brief five-minute suspension of proceedings and then come back here so we can complete the second round.

[The Chair, Conservative, Ed Komarnicki]

If we could get the members back to their seats and get department officials, deputy ministers, and associate deputy ministers back to their tables, we'd like to start if we could. If we could get you back to the table there, that would be good. We'd like to complete a second round if that's possible.

We're going to start our second round of questioning. I believe we're going to lead off with Madame Boutin-Sweet.

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

Thank you, Mr. Chair.

Thank you, gentlemen.

We have not talked a great deal about the protection for those you call “clients”. I for one will use the term “former students”. We are also talking about 250 employees, but we often tend to forget them.

The minister said that you contacted the people whose information was up to date. We are talking about half a million students or former students. So they are people who move a lot.

How many of those people were you able to reach?

[Allen Sutherland]

We contacted approximately 320,000 people.

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

In other words, 200,000 people still don't know that they might have problems. If those people were victims of identity theft or some other issues, those problems might still come up, especially if this happened in December before the whole situation was released in the papers.

[Ron Parker]

That is why we put out announcements, posted documents on our website and made efforts to have this out in the media in order to be able to contact the students whose current information we didn't have.

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

You also said that there were 300,000 calls. So that means that 200,000 people perhaps didn't call or see those announcements and they don't know that their personal protection might be at risk.

[Ron Parker]

There have been 200,000 calls so far. As Al said, we sent 326,000 letters. Some of those people may still contact us.

[Marjolaine Boutin-Sweet, NDP, Hochelaga, QC]

Could you tell us more about Equifax? As Mr. Sutherland said, it is complicated. I would like you to be very clear about what is being offered to people. First, do the students need to make a request? What do they get? Who pays for what? What types of services are we talking about? Is it just a notation on their credit files, or do you have a surveillance and oversight system in place? Could you make this clear for me and everyone here today?

[Ron Parker]

The students have to call the call centre to have access to the program. They have to opt in for the protection of their private information. That is the only way to do so safely.

In terms of services, we have a customized package for our clients. There is a notation on the Equifax file that tells financial institutions that people's privacy may have been compromised. In those cases, the financial institution will ask clients to provide additional proof of identity if they want to increase their credit limit, to get a new credit card, or for any other transactions like that.

In addition, as mentioned, there is a call centre specifically for our Equifax clients. Those services will be provided for six years. After six years, we will have to review the situation closely.

Also, we have added notations to the social insurance numbers that might have been affected. For any changes to social insurance numbers, additional proof of identity will be requested.