Information & Ethics Committee on May 3rd, 2018

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Saini.

Next up, for five minutes, is Monsieur Gourde.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

Thank you, Mr. Collins, for taking part in this committee hearing. Your participation is really very important to us. In fact, in this new digital reality, there are many questions and beliefs to elucidate. We are currently experiencing a type of lawless and faithless digital far west.

The company names don't matter much to me. I am more interested in the ways they use our personal data for profiling. In fact I am especially interested in the tactic that involves third party companies in countries where the electoral laws are not the same. We have to deal with that.

Normally, a country's laws control elections well. However, the situation can become problematic if we are dealing with a company in a country where the laws are different. In the current situation, the data are in Facebook, but a company is using Facebook data to do advertising. So they are in two, three, or perhaps even four countries. Even if we legislate in our respective countries, that is Canada, the United Kingdom, the United States and others, those companies can settle in the Cayman Islands or any other tax haven. We have no control on the provenance of the funds or on the amounts spent.

We have to clean all of this up, but in your opinion, where should we start?

[Damian Collins]

Well, as you say, it's like the Hydra from Greek mythology, this sort of multi-headed beast. When you cut one head off, another one springs up.

I do think these systems, these companies, have been created to be as difficult to track and follow as possible. If you brought in money and finance there as well.... This is again something we discussed with Chris Vickery yesterday, about the interest these companies seem to have in cryptocurrency. That of course facilitates the movement of money from one place to another, for whatever reason, in a way that's very hard to trace.

I think what we have to try to do, and what we're trying to do with our work, is to strip this back to some basic principles where we know we have jurisdiction. There are laws about the way in which data can be gathered and used in elections. There are laws about the way that referendum campaigns can be funded and around the coordination of different aspects of those campaigns. In terms of data storage and the use of data belonging to the citizens of the country, there are national laws that apply, and national jurisdictions as well.

I think we can go after them. It got us to where that company is based. They are processing data by U.K. citizens. If they are doing so in the U.K. jurisdiction—any data processing—then we have clear jurisdiction there.

As I said at the beginning in response to Mr. Erskine-Smith's question, this is one of the reasons why I think co-operation between our committees and by authorities in different countries is so important. These companies and these investigations cross multiple boundaries. To be successful, I think we need to be as integrated as possible.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

If you discover after your investigation that those companies that did profiling did not declare certain funds that were spent during the pre-referendum Brexit campaign, and that those funds may have influenced the results of the vote by a few percentage points, you will probably have some recourse. However, does this call into question the very legitimacy of the referendum results?

[Damian Collins]

That's difficult to say. At this moment in time, we need to be able to identify what took place, both the actions of the companies involved and the work of companies such as AIQ in the campaign. The Electoral Commission will determine whether that was done within the rules. We've been seeking to ask questions as well about Russian interference and involvement in elections in the U.K. There has been work done that shows intent and activity from Russia to influence voters in both our last general election and the Brexit referendum. It has been harder to get information of that nature about Facebook, but there's clearly intent there as well.

Those are all really important issues in understanding what's in place. We can then lay it out for people to see. It should inform the way in which we seek to protect our democracy in the future from the interference of bad actors. It's then a debate for our country to say, if we feel and can demonstrate that the level of interference in the referendum was much greater than was previously suspected, does that change people's attitudes or not? The Electoral Commission, of course, can take action against people who committed offences, be it on spending or campaigning, or whatever.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Gourde.

Next up is Mr. Baylis for five minutes.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Thank you, Mr. Collins. I appreciate it very much.

Our concern, obviously, is that we don't want to be part of this international network and have Canadian companies interfering with other jurisdictions' elections. This is very concerning for us. It's also very concerning as we see a pattern flowing out and pointing to Russian interference in a number of elections. I'd like to draw the process as I see it and hear your comments as we go along.

If we start with the Russian government, their second largest oil company, Lukoil, which is presently under U.S. sanctions, has been operating as an arm of the Russian government. We know that Mr. Alekperovis is a former Soviet oil minister. This company somehow has money going to Mr. Aleksandr Kogan. He's the University of Cambridge researcher who has also, to my understanding, received money from the Russian government directly and had discussions with Lukoil.

I'd like to hear your thoughts on this. This person, Aleksandr Kogan, uses the cover of the University of Cambridge to do a little research project. If he were coming out saying, “I'm the Russian government doing a little research project,” I'm not so sure many people would have signed up. Do you see Mr. Kogan as a key player?

[Damian Collins]

When he gave evidence to our committee, we asked Dr. Kogan questions about his Russian connections. As you say, whilst he was at Cambridge, he also collaborated on a research project at Saint Petersburg University that was funded by the Russian government, and that was into cyberbullying techniques. It wasn't quite—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Yes, but he's being funnelled money from the Russian government. Now, somehow he connects with Mr. Alexander Nix. We've had a number of company names, but we know that Alexander Nix is both the CEO of SCL and Cambridge Analytica. Therefore, let's assume that they are one company.

I know that whenever you seem to ask some questions, he'll say that Cambridge Analytica had nothing to do with Lukoil. However, we know there were links between Lukoil and at least SCL. Is that correct?

[Damian Collins]

Yes, that seems to be the case from the information we received, particularly from Chris Wylie.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

We can assume, then, that Lukoil is both funding Aleksandr Kogan, with an objective to go and scrape a lot of information, and then discussing at the same time with Alexander Nix, the CEO of both SCL and Cambridge Analytica, how to use that to interfere with elections.

[Damian Collins]

Yes. Dr. Kogan's job seems to be data scraping, whether he's doing it for elections or for other commercial work. There is then a question that has been floated by people who gave it to the committee about the significance of Lukoil and the elections work. Is the purpose of the elections work just to get introductions and to develop a relationship with powerful people in certain countries in the hope that commercial work comes later or that big companies will fund other things?

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Yes, but it would seem that scraping data from 57 or however many millions of people would not be the business of Lukoil if they were truly just in the oil business. As we know, they are sanctioned for operating as part of the Russian government.

We also know or have proof that the Russians were interfering in the U.S. presidential election of November 8, because Robert Mueller has charged 13 Russians and three Russian entities with purposely interfering in that election. They've been charged in the United States. Before that, we look at Brexit, the same year, but on June 23. This Russian connection has got its hands everywhere and suddenly this little Canadian company called AIQ shows up, whose president or CEO has his cellphone number listed as SCL Canada, and yet has denied knowing anything about it before this committee. Does that make sense?

[Damian Collins]

No, it doesn't, and I share your concern. It's been difficult to get straight answers on what SCL Canada is. First it's AIQ, and are they the same thing? They certainly appear to be the same thing—

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

He had the nerve to tell us that. He found out about this when he read in the paper that his cellphone was listed as SCL.

[Damian Collins]

Yes, absolutely, and you'd have to ask, would AIQ have got the work that they did without their relationship with SCL?

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

Let's talk about that. That's another question, and it brings me to connect the dots of between how Russia, I truly believe, interfered in the U.S. election, as Robert Mueller has found out, and the Brexit vote. It did so purposely by funnelling money to Mr. Aleksandr Kogan in connection with Alexander Nix.

Now, you have a substantial sum of money from VoteLeave. Then you have BeLeave, and we learned that not only did BeLeave not get the money from VoteLeave, but they were contacted—theoretically—independently, and the CEO and COO could not tell us how BeLeave even found out about them. Suddenly they get a phone call and order over a million Canadian dollars' worth of services, and just say someone from VoteLeave will call you up and pay our invoice.

Then you have Veterans for Britain and the Democratic Unionist Party. You have four entities in the Brexit side contracting with this minute little company in Victoria, B.C., and they were unwilling or unable to give us any clarity as to how these people even knew about them, except for the fact that we could find out that the CEO was completely linked with SCL.

[Damian Collins]

Yes. That's right. You can see how a link through SCL and Cambridge Analytica can get to these parties in the U.K., and it's hard to see how the Democratic Unionist Party would have decided to pick up the phone to AggregateIQ. It's impossible to see how that could have been the case.

[Frank Baylis, Liberal, Pierrefonds—Dollard, QC]

If I could sum it up—

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Baylis. I'd love to let you keep going, but I would just like to clarify something. We do have the Chair of the U.K. committee for two hours. We're going to try to get to some committee business at the very end, so don't worry, we can get you in.

Thank you.

We'll go up next with Mr. Kent for five minutes.

[Peter Kent, Conservative, Thornhill, ON]

This is a slightly broader question, Mr. Collins. With the GDPR coming into effect now, do those regulations cover some of the matters that your committee is studying, or is it all going forward from today?

[Damian Collins]

The GDPR comes into effect on May 25. That's the deadline for the new [Technical difficulty--Editor] coming in place. The House of Commons has got the final stages of the bill to implement the GDPR, for instance, next week.

I think it enhances a lot of the data.... A lot of the existing data protection law is already quite helpful for the inquiries that we're pursuing because there are already quite tough restrictions on holding political data about people and who can do it.

I think one of the big questions posed to our inquiry, and why we supported the Information Commissioner's getting these additional powers to support her investigations, is how do we know that a company like Facebook is compliant with GDPR rules? If someone puts in a request to get their data back or to have their data destroyed, how do we know that the request has been complied with? If someone asks for their data back and they want data that's been acquired by Facebook developers, as well, who polices that? The best way we can do that, I think, is to make sure the authorities have got these “no notice” powers just to go in and take data and inspect data where they believe a breach may have occurred. One of the big questions for us when GDPR comes in is, how can we make sure that it's being enforced correctly and that companies are actually doing what they're being asked to do?

[Peter Kent, Conservative, Thornhill, ON]

Will monitoring and enforcement and penalty applications be a result of national parliaments, or will there be an EU super-department that would have that responsibility and would require those resources to monitor?

[Damian Collins]

It will be the national authorities who will have the responsibility. The U.K. government policy is to have equivalence in data regulation with the rest of the EU, so even after Brexit we'll be operating on the same rules, but it will be the national authority of the Information Commissioner to enforce those rules.

I think it's also worth mentioning that even though we have European standards for data management through GDPR, there are different requirements in different countries as well, and for different reasons. So Facebook in Germany runs to different rules than Facebook does in the U.K. because it has to comply with German legislation on hate speech, and therefore employs vast numbers of people to take down posts that would be in breach of Germany's data protection laws, and Facebook itself would be penalized if it failed to do that. So even within common European standards, you could still have quite different jurisdictional requirements in different member states.