Information & Ethics Committee on Oct. 28th, 2010

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Thank you very much.

I'm not usually on this committee, so if some of my questions are not that relevant, that may be why.

Ms. Kosseim, I find this very disturbing. You seem to be, as part of the Office of the Privacy Commissioner of Canada, pretty subtle about it all. I don't know the back history. This company, from what I'm reading, has 23,000 employees. Technology is not something that is primary information to them. I'm reading here--and help me if I'm wrong--that Google said Friday that it aims to make sure that workers are obeying the rules. The company is also introducing tougher privacy measures, and they're going to make sure that their employees now understand what privacy means. I find that appalling.

It was just a few days ago in October that they said this, and it has been going on now for a year. This is a company that delves into people's privacy. They go down the street and take pictures of your place, pictures of your vehicles, pictures of who's in your yard, and all this stuff, and they're saying “Oh, we're going to blur this all out”.

The complaint part from June 1 mentions that Google's collection and use of data was done without the individual's prior knowledge. They actually hadn't thought, “Gee, you know, if we're going to be delving into somebody's private life, do you think maybe we should have actually thought about letting them know we're going to do it?” They said they did it without prior identification, so they never even thought about identifying people and talking to them.

The worst of it is that they were collecting data for which they had not identified the purpose. I know you said earlier that they didn't understand that. When they would be going down the street, it would be blurred or whatever the terminology was, and they didn't think. I think the biggest part is actually that they just didn't think.

I don't want to be cruel, but it would lead me to believe that this really would lead people to think about corruption. It really leads me to think that we've now got this huge multinational company that is intent on making dollars in some way. One of my colleagues mentioned that they're getting into the movie business, and they're running around the communities taking pictures of people's property without their knowing. They've been doing it for a while.

I have a question. How long were they doing this before they actually got caught? I know you said they didn't get caught, but actually they did. How long had they been doing it before somebody realized that the company was actually taking pictures of people's private lives and that perhaps they'd better stop, because now it was out? How long was that happening before the stoppage of it actually came about?

[Patricia Kosseim]

I have a couple answers.

Just to be clear, the commissioner was extremely concerned, so let me not understate that. The commissioner was extremely concerned, which is why she initiated this complaint right off the mark.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

I didn't mean to take on the commissioner. I was just taking on the school board.

[Patricia Kosseim]

No, I just want to be clear and fair in my representation on her behalf.

She was first off the mark to initiate a complaint, has led a speedy investigation to get to the heart of the matter, and has in a precedent-setting way said, “I don't want just undertakings that you're going to do this. I want you to show me that this has been done before I will say and agree to say that it's been resolved.” I think that's also important, to indicate the seriousness of the situation.

The other thing I just want to clarify is that we're talking about two different technologies or two different deployments. One is the taking of the pictures, which is something that had been going on much longer, and about which the commissioner wrote to the organization in 2007 to indicate that she had problems. So there has been a long conversation to get them to adapt their practices to comply with Canadian privacy laws. That's one.

Then the more recent innovation is the collection of radio Wi-Fi signals or publicly broadcast Wi-Fi signals. That is something very recent. As I said, I know only that on April 27 we received knowledge that they were doing this and that in May there was a problem. She responded on May 30.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

I'm sorry, I missed that part of it. How long have they been doing the collection of the Wi-Fi signals? That's not just in Canada? Have they been doing it in the States?

[Patricia Kosseim]

My understanding is they've been collecting the Wi-Fi signals for about a year.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Do you know whether they knew they were picking up this personal information off these signals?

[Patricia Kosseim]

Our understanding is that they had no knowledge that they were picking up payload data, let alone personal data, which is what our investigation uncovered.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

And you actually believe that?

[Patricia Kosseim]

That was in the investigation report. Part of the investigator's job is to assess credibility, and that was the outcome.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Shipley.

I have just one question arising from that last question and answer.

You say they didn't know they were picking it up, but all the evidence is that they were not only picking it up but storing it. They have actively stored it all, and it's 600 gigabytes. So how can we say they didn't know they were picking it up when they actually stored it?

[Patricia Kosseim]

I will repeat my understanding, and then I will ask Dr. Patrick to say it in better terms than I can.

There are two things. There are the publicly broadcast Wi-Fi signals that they knew they were picking up, and they intended to pick up. What they did not know was that in that collection, they were also picking up meaningful payload data, which means not only the signals themselves but the communications, contents of messages, that were being transmitted through those signals. That's the best way I can explain it.

Dr. Patrick.

[Dr. Andrew Patrick]

I'll just expand on that a little bit.

When we viewed the data, there was 18 gigabytes of it. That's about four DVDs' worth of data. That would have been intermixed with hundreds, or perhaps thousands, of gigabytes' worth of photographs collected at the same time. Google cars use a proprietary storage mechanism to compress all of the information they can onto as few hard discs as possible while they're driving around. All of this information is being heavily compressed and written to the hard drives within the cars, so it is possible that they just did not see that data there in among all the other data that was there.

[The Chair, Liberal, Shawn Murphy]

Thank you for that explanation.

Thank you, Mr. Shipley.

We'll now go back to Mr. Siksay for five minutes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

I think there are three pieces, as I am seeing them now. There's the photography piece about which we've raised questions and the commissioner has raised questions, there's the payload data piece, which I think we're waiting to hear back from Google on, and then there's the Wi-Fi access piece.

When I was last questioning you, Dr. Patrick, you said there are some privacy implications of collecting at Wi-Fi access points. Is there any investigation continuing about that at the present time to determine if there has been a violation of Canadians' privacy because of the collection of that particular data?

[Dr. Andrew Patrick]

Thank you for the question. It's a very good question. We have not been asked to investigate that particular aspect of data collection, so we've not looked into it in detail.

It was not part of this investigation, because we were looking specifically at the issue of capturing content. So what we have stated is what we know so far.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Do you know if anybody elsewhere in the world is looking at that particular aspect of this process?

[Dr. Andrew Patrick]

The Europeans have expressed concerns about the collection of the Wi-Fi access point information.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay. But we don't know if they've drawn any conclusion about that at this point?

[Dr. Andrew Patrick]

I don't remember off the top of my head. I think they're at a stage similar to ours of trying to make sense of it and trying to figure out what's appropriate.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Ms. Kosseim said at one point that Google sort of expected when they were driving down the street that any payload information they got would be so hopelessly scrambled it would be useless, and it turns out that wasn't the case.

I don't know if this is really an important question or not, but it just occurred to me. Does it mean that if the Google camera car stopped at an intersection, the people who lived around that intersection would be more at risk of having a direct transfer of their data because the car was stationary? And would that be true if they were on their lunch break and left it running or stopped at a traffic light, for instance?

[Dr. Andrew Patrick]

Thank you for the question.

Yes, if a car was stationary, more data would have been collected. The software in the cars was set to change channels. There are about 11 Wi-Fi channels. It was changing channels five times a second, so it wasn't like it was getting a continuous stream from the house it was parked across from, but it would get more and more samples of that information if the car was parked there.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

And there'd be more likelihood of a complete sample of information being transferred in that kind of circumstance?

[Dr. Andrew Patrick]

Yes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay.

Ms. Kosseim, can you tell us which officials of Google the commissioner's office deals with?

I gather we have Mr. Glick coming next week. Is he the person you deal with, or are there other people who are privacy specialists at Google you would deal with to answer your questions?