Information & Ethics Committee on May 6th, 2014

[Chantal Bernier]

Absolutely. I'll give you an example of how we leverage national partnerships.

There are three provinces that have their own private sector legislation, and they are Quebec, Alberta, and British Columbia. When a big organization, for example, LinkedIn, suffered a breach, we reached out to the three provinces. Rather than the four of us going to LinkedIn independently, we went to LinkedIn together.

LinkedIn proved to be a very responsible organization. It's an example not just of leveraging our national counterparts' expertise, but also of engaging with an organization in a less expensive way to reach compliance.

We did not do an investigation of LinkedIn. We engaged with them in an informal investigation. In fact, we asked them what happened, what the management failings were, and what they were doing about it. So we got resolution with a much lower expenditure of effort and money.

In relation to the international partners, let's take the investigation of WhatsApp, an American company about which we had concerns. We had concerns about lack of encryption of messages, for example. We had concerns about the transparency, because the location of an individual was almost broadcasted. The Dutch Data Protection Authority had the same concerns. So we decided to join forces.

Doing the investigation together allowed us to divide the work. They took on mainly the technological analysis. We took on the negotiation with the American company. Together we did coordinated investigations that fed into each other and were, therefore, much more efficient. In less than a year we managed to conclude that investigation. That's another example of how we leveraged international counterparts' efforts for greater efficiency with fewer resources.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

That's great news. Thank you.

Do I still have some time, Mr. Chair?

[The Chair, NDP, Pat Martin]

You're exactly finished.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

I am? Okay.

[The Chair, NDP, Pat Martin]

Nice timing, yes; thank you very much.

We have to remember that the seven minutes is for questions and answers, and the time goes very quickly.

Next, for the Liberal Party, is Scott Andrews.

[Scott Andrews, Liberal, Avalon, NL]

Thank you very much, Mr. Chair.

Commissioners, welcome. It's a pleasure to have you back here again.

Ms. Bernier, I'm going to start with you. Your office never knows the next thing that's going to be thrown at it. The world is changing. You may have three or four different files thrown at you at one time.

I have a question about a recent file that's been thrown at you and about how you're managing it. It's the Heartbleed privacy breach. Obviously we're just starting to learn a little bit about this. Is this something that's going to consume a lot of the resources in your office right now? If we were to have another case similar to that, how much of your office's resources would be taken up to deal with this one particular issue?

[Chantal Bernier]

Your premise is quite right. I believe it characterizes our office. Because technology and society are moving so fast in relation to privacy and personal information, indeed we never know what's going to come at us.

Turning to Heartbleed, immediately when we heard about it, our technological analysis unit examined the issue, briefed me on it, and explained to me that in fact it was an Internet-wide issue that was probably not malicious, and that it was probably an honest mistake that created a vulnerability that data holders did not know about because no one knew about it. As well, as we now know, it was unfortunately exploited by some hackers.

What we see in front of us now is a situation in which the vulnerability of the Internet was exposed. More than the deficiencies of any data holder, it was the vulnerability of the Internet that was exposed.

We also saw that these vulnerabilities can be exploited with malicious intent either for personal gain or perhaps just for fun. Sadly, we see a lot of hacking just for fun.

At this point, we have no investigation related to Heartbleed, probably due to the fact that the only instance has been very quickly contained. I am speaking based only on the facts I know so far. I reserve my position on it in case I should get more information. But on the basis of what we know so far, there has been no management failing. It was a vulnerability in the Internet and what had to be done to contain it has been done.

[Scott Andrews, Liberal, Avalon, NL]

So it's limited to just CRA? That was my next question. How many different government organizations or businesses have contacted you about a potential breach in Heartbleed?

[Chantal Bernier]

It's only CRA. I was informed of all the measures they were taking, including notification of the individuals concerned, and all the measures they had taken technologically. As you know, we have posted a statement on that on our website.

[Scott Andrews, Liberal, Avalon, NL]

Ms. Bernier, another file that may or not consume some of your time is the accountability gap when government agencies are accessing privacy information. You just released some information in 2011, the 1.2 million requests, and you are sort of throwing your hands up, saying that we don't know what's going on; we have government organizations on one side saying, yes, we're complying and everything is okay; we have the telecoms and the social media on the other side saying, yes, we're complying. But nobody as a watchdog, Parliament or yourself, is....

How do you see that as a major problem?

[Chantal Bernier]

You're referring to our January 28, 2014, special report to Parliament on checks and controls where we make a specific recommendation precisely to address the accountability gap, which would be for the private entities to annually report on how many requests they answer, with some specificity as to whether it is with a warrant or without a warrant.

I have, in front of me, the answer that we received from the telcos, and it allows me to make a few clarifications. The 1.2 million that we received as the figure was in answer to a question that refers to government authorities in general. It could be municipal, provincial, or federal. It is very, very broad. It does not give any specificity of detail as to the circumstances, which is why in May 2013 we made first the recommendation in relation to reform of PIPEDA, the private sector legislation, to create an obligation for private entities to disclose the statistics as to how often they answer requests and under what circumstances, and we picked up that recommendation again in our January 28 report. We believe that it would give a sense of the scope of the phenomenon.

[Scott Andrews, Liberal, Avalon, NL]

I have one quick question on that. A lot of people will say about basic subscriber information that's being provided...that's it's okay without a warrant; we're talking address, phone number, e-mail, IP address. Does it go any further than those? There's a lot of discussion around the metadata and the envelope and communications. When you say basic, where do you see basic subscriber information?

[Chantal Bernier]

We have done research precisely on that. We have “What an IP address can reveal about you” posted on our website. It sought precisely to address this question. When an IP address and the customer information behind it is revealed, is it really sensitive or is it innocuous information? You will see in that technical analysis that in fact it is not innocuous, because it reveals Internet searches. Internet searches will reveal a person's interests, preoccupations, opinions, allegiances. So that in itself should be protected.

[Scott Andrews, Liberal, Avalon, NL]

Is it anything above those things? When people talk about the envelope, where you've sent, who you've sent to and from, is that part of basic subscriber information?

[Chantal Bernier]

That is precisely what we looked at. We found—it is well described in that technical analysis—that the envelope is in itself revealing.

[Scott Andrews, Liberal, Avalon, NL]

That's basic subscriber information?

[Chantal Bernier]

That is basic subscriber information linked to the Internet activity.

[The Chair, NDP, Pat Martin]

Mr. Andrews, I'm afraid you're well over your time allowed. As interesting as this is, I have to cut you off, I'm afraid.

Next, for the Conservative Party, is Mr. Zimmer.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thank you, Mr. Chair.

Thank you for appearing before the committee today.

My questions are predominantly for Ms. Bernier. We certainly appreciate what you do in your office. Many Canadians, although it goes unnoticed, definitely appreciate the results.

I just have a couple of questions for you. First, “Reduced resources” is one of your titles here, and you say this: “Beginning with our financial situation, looking at the numbers, you see a decrease in our resources of nearly $5 million.”

What is your overall budget, just to put that into context?

[Chantal Bernier]

The overall budget is $24 million.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

That's per year?

[Chantal Bernier]

Yes. Last year it was $29 million. The reason for the discrepancy is what I've explained.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Can you give us a breakdown of that figure, of where the money is spent?

[Chantal Bernier]

Certainly.

Or perhaps I can ask Daniel—

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

If Daniel would like to do it, that would be fine.