Information & Ethics Committee on April 29th, 2014

[Dr. José Manuel Fernandez]

Yes, I will very briefly.

The world of cybercrime has become more complex in the last few years. There are at least four different kinds of groups. There are those who attract you to a website where you are going to get infected. There are those who operate those websites to infect you when actually they are sending in the viruses, but they don't hold your machine. Then they sell your machine to somebody who's going to be operating that machine for several weeks or months. Then those button operators as we call them will rent those machines out to the people making the money and making the fraud. They will use those infected machines to send spam. They might mine your machine for financial data. That's one of the ways of doing identity theft. They might use that machine to conduct a denial of service attack on some country.

There are many ways in which these infected machines can be monetized. That's why when I say it's all the same problem it's because that same arsenal of infected machines can be used for cyber-espionage, cybersabotage, identity theft, and mass market cybercrime. All of these groups are collaborating. They used to be doing it just for fun, then they were doing it for money, but what we have seen is that they are also using it for political gain and for propaganda as well.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

I have another question as a follow up to that.

You talked about the one company that had to replace 30,000 computers. Is that a correct amount?

[Dr. José Manuel Fernandez]

That was Aramco. Yes. They had about 30,000 desktops that were—

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

It was always my understanding that a virus would only have done so much hard damage to a computer, but it sounds like this particular virus or whatever happened there had much more of a direct effect on the actual hardware. Can you explain that?

[Dr. José Manuel Fernandez]

Yes. Typically viruses do not harm the hardware, but in this case it was a management decision of Aramco. Of course they are rich. They said the best way to deal with the problem is to throw away all those computers, buy new ones, and reinstall them.

Probably that was a very good decision because it's probably cheaper to do that than to have to reinstall them from scratch. Do the math, $1,000 a machine. That's a big number.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Again just to get back, we talked about different levels of where this is at, and you talked about espionage.

Is the sound not working on a particular computer evidence of something worse, or is it a kid hacking from a high school computer just to tick people off?

[Dr. José Manuel Fernandez]

As I said, high school kids hacking with respect to the Heartbleed incident, students from the University of Western Ontario, they used to be the bigger problem. Now they are just a nuisance. They are not the problem.

From a social-political point of view, however, in countries where there hasn't been much of an IT economy developing, you have all of those whiz kids who instead of finding jobs in Kanata or Silicon Valley go into cybercrime. They have become professional, and they have people with big guns and big muscle who are making sure they do what they need to do.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thanks. That's all I had.

Thank you.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Zimmer.

We will move on to five-minute rounds for questions and answers.

Mathieu Ravignat, go ahead for five minutes, please.

[Mathieu Ravignat, NDP, Pontiac, QC]

Mr. Fernandez, to come on the tail of what my colleague there said about Heartbleed, at the beginning of your presentation you said that the government infrastructure is—I think “pitiful” was the term you used or it may have been something rather colourful, which gets me worried.

What decisions have we been making in the last few years that has led to the current situation we find ourselves in?

Secondly, what needs to be done?

[Dr. José Manuel Fernandez]

It's not only the government. It's Canadian industry. It's foreign governments worldwide. It's a worldwide problem. I don't think the Canadian government is less diligent than all the governments worldwide or even all the big organizations. It's not only in the last few years. It's in the last 30 years. In the sixties, seventies, and eighties, the IT industry was a well-dominated, organized market. It used to be IBM and a few other people. It was well understood how it worked, and whose throat you had to choke if there was a problem.

But with the arrival of the web, then it became a free-for-all. Anybody who had some kind of coding knowledge could develop a web app. Anybody who could contribute to the development of open-source software could, and the standards we were used to were dropped because it was new, it was shiny, and we wanted to have the cool stuff and we wanted to make a buck as quickly as we could with it. The banks are a good example of that, right? The fabulous profits they made in 2000 were due to that.

The government just followed suit. They did what everybody else did in adopting technology, but they abandoned the standards they had in the previous world. In the mainframe world, there were standards about development and so forth, but when we went to the new paradigm of client, server, and web, we just forgot it. We just abandoned it completely. We need to go back.

[Dr. Susan Sproule]

When we talk about technology, we talk about security, and data security is the weakest-link problem. There are technological aspects to it. We can have good technology. We have encryption technology, but it's just not being used. People don't use it. When we get into new types of information like health information and electronic health records and the way that this is now being transferred among all these different networks and systems, the fact that we have data breaches of health information that's not encrypted is criminal. That shouldn't happen. But that's a people-problem not a technology-problem. The technology is there.

[Mathieu Ravignat, NDP, Pontiac, QC]

The technology is there but the public policy isn't.

[Dr. Susan Sproule]

Yes, with encryption, the policies may even be there, but you have to have people to actually do it.

[Mathieu Ravignat, NDP, Pontiac, QC]

Right.

[The Chair, NDP, Pat Martin]

Mr. Ravignat, we could invite some of our remote witnesses to see if they want to take part as well.

[Mathieu Ravignat, NDP, Pontiac, QC]

Certainly.

[The Chair, NDP, Pat Martin]

Do either of you have a comment on Mr. Ravignat's last comments?

No. Fair enough. Okay. I wanted to make sure you were included. Thank you.

[Mathieu Ravignat, NDP, Pontiac, QC]

My next question is on the recent development of payWave technology. These are cards that you can just tap to pay, and it seems like there are a number of security issues surrounding that technology, particularly credit cards, banks, and so forth.

Mr. Fernandez, you were part of a research project that looked at this. Do you have any results from that research, anything helpful to show us?

[Dr. José Manuel Fernandez]

If you don't mind, I can borrow your credit card, I'll shut off my phone and I'll be able to read your credit card number over the air, and your name, and your expiry date. There's an app for that.

[Mathieu Ravignat, NDP, Pontiac, QC]

Given that this is a public session, I'd rather not go through that exercise.

[Voices]

Oh, oh.

[Dr. José Manuel Fernandez]

Yes, unfortunately the banks were mostly motivated by profit in developing this technology. They wanted to get their filthy 3.5% of profit on the market of the small pocket change.

That's at the cost of Canadians’ privacy because that technology is not protecting their privacy. If I steal your credit card from your wallet, you'll probably notice because I have to put my hand in your pocket at some point, but with this new technology I don't even have to do that. I only have to get close to you in the metro, on the subway, or within 10 centimetres, and that's it; I've stolen your credit card credentials and I can make transactions on it. The technology that they themselves have created could prevent that, but they've deployed it in a mode that is less secure, for the time being, because they don't want to have to invest the money required to change the infrastructure for the payment terminals.

[Mathieu Ravignat, NDP, Pontiac, QC]

Regulation hasn't caught up, I imagine.

[Dr. José Manuel Fernandez]

What regulation...?