Information & Ethics Committee on April 29th, 2014

[Laurie Hawn, Conservative, Edmonton Centre, AB]

You mentioned Nortel and who has taken over from Nortel, and that's no secret. That's on a commercial level. If you take that to a much higher national security level, the potential is frightening. To me, we're talking about the old—in nuclear terms—mutually assured destruction. They could basically turn us off whenever they want. They probably know we can turn them off whenever we want. It's a matter of staying one step ahead, and that goes back to data, I think.

Mr. Dupont, you talked about the problems with data. How do we get and keep better data?

[Dr. Benoît Dupont]

As I think has already been alluded to, one of the ways is to make the disclosure of some data held by the financial institutions...but also the retail institutions. We're talking a lot about the financial sector. The financial sector sees a lot of this identity theft happening, but the retail institutions are also responsible for the leakage of this data. They should be held responsible. They should be much more forthcoming about these types of events.

I think the government and some kind of authority within government should have the power to request that this data be made available, not necessarily...well, yes, maybe made available on a very broad basis. Someone mentioned the naming and shaming. That's what happened with the anti-theft devices on cars in the 1970s, when the insurance sectors and governments were tired of having so many cars stolen. Someone decided one day to publish the list of the 10 most stolen cars on the market. Twelve months after that, all these cars were equipped, for free for the taxpayers, with anti-theft devices.

So the automakers, who had been saying there was nothing they could do against it, suddenly found the resources and the technology to equip their cars, just because this data was made available to all the consumers to make their decisions based on the facts.

I think it's the role and the responsibility of the government to try to extract this information, not in a punitive way but in order to make this phenomenon more transparent and to make sure that consumers and citizens have all of the information. As my colleague Ms. Lawson said, there is very little that we can do as consumers, as individuals, but there is a lot that organizations can do to protect us as consumers.

[Laurie Hawn, Conservative, Edmonton Centre, AB]

I guess that's why I don't buy a Honda Civic.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Hawn. That concludes your time, on that note.

Perhaps I can remind committee members and witnesses that the seven minutes is for questions and answers. If we could keep them as brief as possible, more members would have an opportunity to question.

Next, for the Liberal Party, we have my colleague Mr. Scott Andrews.

You have seven minutes, please, Scott.

[Scott Andrews, Liberal, Avalon, NL]

Thank you, Mr. Chair.

I'd like to thank you folks for being here.

Susan, I'd like to dive into a little bit of what you mentioned near the end of your presentation, about the credit reporting agencies themselves. I think they probably can be an early warning system if someone's identity is being compromised. I think the role they play in helping consumers protect their identities is crucial. Most of us don't go looking for our credit scores or our credit history until after the fact, until after something happens.

How can we engage them? They will be witnesses here as well. What kind of questions...or how do we engage them? What kind of role do you think they could play here? Perhaps you could elaborate a little bit more on these credit reporting agencies and how they could help detect early on if someone's identity was potentially being compromised.

[Dr. Susan Sproule]

As Ms. Lawson said, the more serious type of identity theft financially is new accounts fraud. The only way you can find out if someone is opening up accounts in your name is through the credit reporting agencies.

As I said, I do a pretty good job of protecting my information as an individual. It's limited, what I can do, but I don't give out a whole lot of personal information, only what's required. I take all the advice that's given to consumers with regard to protecting my information.

One piece of advice that is often given to consumers is that you should be checking your credit report on a regular basis. I did that once about five years ago. It was such a chore to go through and collect all this information. I had to mail it off, which is very insecure. If anyone intercepts that envelope, they have everything they need to steal my identity. I sent it off to both credit reporting agencies. I got a credit report back from one. I never even received it back from the second one, which was sort of a source of concern. I ended up phoning them, and they said, “Oh, yes, we received it. Something must have happened.”

To really protect myself, I would like to go online once a quarter to get an instantaneous look at my credit report. That's something I would do to protect myself. At the moment, that costs me $24 each time I do it.

[Scott Andrews, Liberal, Avalon, NL]

It's $16 a month.

[Dr. Susan Sproule]

Or I can pay $16 a month and they'll send me that and some other sort of advice about how to protect myself. It really does bother me that they're making a profit out of the problem, because then where's the incentive for them to help get rid of threats? It bothers me when my bank offers to sell me identity theft insurance. Isn't that their job, to protect my information?

[Scott Andrews, Liberal, Avalon, NL]

Ms. Lawson, do you want to comment on the credit reporting agencies as an early warning system that someone's credit is being compromised?

[Philippa Lawson]

Yes, I would totally agree with your comments in that respect and I'm glad to hear they will be coming before you. I think you should be asking them a lot of questions, including why they're not offering credit freezes to Canadian consumers while they are in the United States.

There are a number of other things they could and should be doing. One has to do with credit monitoring and providing reports, as you just heard. It costs a lot of money and it's a huge effort for Canadians. We are entitled to one free report per year by mail, but the credit bureaus charge to get online access and they make it difficult and they don't always follow through.

In the United States, there's a requirement for one-stop shopping. There are three credit bureaus in the States. In Canada, there are two. It would be helpful if consumers—particularly for victims of identity theft—if you could go to one central source and get the reports from both agencies. That would be helpful.

I think you should be allowed to access your report online, at no fee or a very low fee, and get credit monitoring services for no or a low fee, particularly if you can show that you may have been a victim of fraud. It's interesting that in the United States there are laws under the Fair Credit Reporting Act that we don't have in Canada, other than very general principles in our data protection law. For example, in the United States credit bureaus have to block reporting of information where the consumer provides evidence of fraud. They have to notify furnishers of allegedly fraudulent information, once they've been notified by the victim that there appears to have been a fraud.

These kinds of very specific obligations on credit bureaus can really help to prevent, detect, and deal with the problems of identity theft.

[Scott Andrews, Liberal, Avalon, NL]

Back to you, Susan, you mentioned early on that those committing identity theft are not the ones committing the identity fraud. I wonder if you could elaborate on that a little bit. Is there a way that law enforcement and people could stop the in-between of when identity theft happens to when the fraud occurs?

[Dr. Susan Sproule]

I guess there are different kinds of identity theft. Some is very opportunistic and targeted, where someone has access to the information, gets the information, and then impersonates that person to commit a fraud. In that case the thief and the fraudster are the same.

When we're talking about data breaches, where hackers go in and get into databases and collect information, that information goes into black-market marketplaces and is sold. There are academic studies that have looked at the black market and what a credit card account identity is worth—what an identity, something that has your social insurance number and your mother's maiden name, is worth. So you can get data on that from these black markets, and that's the gap between the theft and the fraud. The fraudsters go and—

[Scott Andrews, Liberal, Avalon, NL]

Mr. Fernandez, do you want to jump in on that as well?

[Dr. José Manuel Fernandez]

Yes. The problem is that, unfortunately, a lot of these identity thieves are not in Canada. They're not within our jurisdiction. It's organized crime in eastern Europe, in Indonesia, in Brazil, and they're simply outside our jurisdiction. A lot of these countries are not collaborating with law enforcement in Canada. That's why the Convention on Cybercrime that we still need to ratify is important.

[Scott Andrews, Liberal, Avalon, NL]

How about the issue of the black market? Is there a way that law enforcement can zoom in on that, or is it something that's out there and they can't—

[Dr. José Manuel Fernandez]

I'm going to forward that question to my colleague, Benoît Dupont, who has some interesting ideas about what we could do about disrupting the black market.

[The Chair, NDP, Pat Martin]

If we could have a very brief answer please, Mr. Dupont. We're almost out of time.

[Dr. Benoît Dupont]

A very brief answer.... I think so far the only country that has really made some investigative investments in trying to disrupt the black market is the United States with the U.S. Secret Service. There is no reason why the RCMP, which is able to leverage large sums of money to conduct large investigations on the mafia.... You know, the Colisée investigation in Quebec cost about $30 million. So there is no reason why the RCMP couldn't invest this type, or maybe smaller amounts of money, to try to disrupt black markets. It has a network of liaison attachés all across the world who try to cooperate. But so far, only the U.S. government has invested this type of money to investigate these types of crimes outside its borders.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Dupont.

Thank you, Mr. Andrews.

Next for the Conservatives is Mr. Zimmer.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thank you all for coming to committee today. I think a lot of us who spend a lot of time on the web are concerned about how secure our information is.

I have a few questions on some basic information. How is the $3 billion quantified? I think somebody used that number as the amount that is affecting Canadians and how much the loss is. How do you quantify that amount?

[Dr. José Manuel Fernandez]

That figure comes from Symantec, which is an anti-virus company. The 2013 report for Canada reports that figure.

I'm not an expert on how to quantify these things. Some people might say they suspect that figure comes from a party that is interested in maybe growing the size of the problem, but that's probably better answered by some of my colleagues here who actually are specialized in those numbers.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Does anybody else want to respond to that quickly? I have more questions, but if somebody could answer that....

[The Chair, NDP, Pat Martin]

Dr. Sproule, would you like to go first?

[Dr. Susan Sproule]

Just as an example, and it's old data, but when we did our survey of consumers in 2008, we found 1.7 million people or 6.5% of Canadian adults were the victim of some kind of identity fraud in the last year. They spent over 20 million hours and more than $150 million to resolve problems associated with those frauds. That's just the consumers' out-of-pocket costs, which is a small part of the big problem.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

That's significant. Thanks for that.

I would ask you another one. I have a couple more simple ones.

We have all had a typical virus on a computer. I'm assuming everybody has where the sound stops working for instance, or something stops working. I guess I need to get a better understanding of who the people are. Are we dealing with the high schooler who wants to just turn my sound off on a computer? Are they getting other information off my computer that's more important than that, and that's just a residual effect?

We always think about the big guys, and the Chinese, or whoever it is that has a full frontage attack on our information, but maybe take us through the different levels of how this is done.