Information & Ethics Committee on April 24th, 2018

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you very much, Mr. Chair.

Thank you for being here, gentlemen.

My next question is for you, Mr. Massingham. You have been oddly silent; I would like to hear more from you.

In your testimony, you said that you comply with the legal and regulatory framework as well as possible. On your website, you clearly and unequivocally state that you comply with it.

Would I be correct in saying that you have received legal advice and that you may have violated certain Canadian or foreign laws in this regard?

[Zackary Massingham]

No.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Have you received legal advice?

[Zackary Massingham]

No, I don't. I'm not a lawyer.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

You have not received legal advice in this regard?

[Zackary Massingham]

Yes, we have. Jeff can probably speak to that better than I can.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Mr. Silvester, if you have more information than your chief executive officer, please go ahead.

[Jeff Silvester]

As a Chief Operating Officer, I'm the one who's responsible for our compliance with privacy and information laws wherever we work. If we encounter a situation that's different from what we're used to in Canada or the United States, then there are times when we will seek a legal opinion. Certainly, when working with regulators to make sure that we're giving them all the information we want, we make sure that we speak to a lawyer to make sure we're giving them all the information that they've asked for.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Do you think you have violated certain Canadian or foreign laws?

[Jeff Silvester]

No, I don't believe we've violated any Canadian or foreign laws.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you.

Now for my next question. Have you ever used the data or databases in your possession for political organizations, third parties, or non-profit organizations in municipal, provincial or federal elections in Canada?

[Jeff Silvester]

We have.

If an organization that we're working with would like our help in organizing their information in something like a political CRM, then yes, of course they will provide us with that information for the purposes of doing that work. Then, at the end of that work, we delete that information. They may ask us to return it to them and then delete it or just to delete it. We'll comply with whichever they prefer.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

So you have no framework or concrete measures. You and the client decide what to do with that data subsequently, whether to keep it or delete it.

[Jeff Silvester]

No, we always delete the data after we're done working with a client.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Okay.

Mr. Silvester, in your testimony you said there are measures in place to protect the data in your possession. Can you give me some specific examples of those measures in your company?

[Jeff Silvester]

Yes. When we're using any information that's provided by a client, we make sure that we follow standard industry practice with respect to security certificates, encryption, and all of the technologies companies use to protect their information. We ensure that meets all of our standards here and, of course, their standards in the places where they're operating.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

In the various activities you have conducted using that data, has there ever been a breach of privacy or has any data ever been at risk?

[Jeff Silvester]

As I mentioned at the beginning, an incident was reported to us on March 25, and we acted right away to secure the information that was there at those servers, and indeed all of our servers. Once we discovered that there was some personal contact information that had inadvertently been left, we contacted the Office of the Information and Privacy Commissioner for B.C. to let them know about that.

That information should not have been there. As I mentioned, it happened when someone was backing up code and accidentally also backed up some data that went with that code, so when we deleted it off the customer's server, it wasn't deleted off the code repository, unfortunately.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

In light of this unfortunate situation, do you need to adopt new measures or do you think you have everything you need to truly protect that data in future activities?

[Jeff Silvester]

Yes. We have put measures in place already to protect the information on that code repository. We have also put into place some new measures with respect to auditing all of our servers more frequently.

I imagine there will be additional recommendations that come out as our investigation continues, and we may also get some recommendations from the federal or provincial privacy commissioners, which of course we welcome and will follow.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

That is all, thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you.

Next up, for our three-minute round, is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Chair.

Mr. Massingham, I'm very interested in the work of SCL, Cambridge, and AIQ in Nigeria. Let's talk about the murder video. This video was sent around with horrific pictures of people being burned alive; the message was very clearly to incite anti-Muslim hatred in Nigeria. Who gave that video to you to release?

[Zackary Massingham]

I do not recall who the individual was at SCL who provided that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Was it someone at SCL who provided that?