Information & Ethics Committee on June 7th, 2018

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Could this software be provided to the committee so that we can understand what was on the hard drive?

[Chris Vickery]

Yes, they are free, open-source software. I can give you a list of them. If you have a tech team at all set up, I'm sure they will be able to dive right in.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Did this software end up in the hands of several companies or was it limited to only a few of them?

[Chris Vickery]

I think we're getting into a bit of a dual answer here. There is software that are frameworks, that are open source and available to everyone in the world, and then there are projects that are made from that open-source software that AIQ tailored.

Are you talking about the AIQ-tailored ones, built from the frameworks, or the ones that are open source and available to the world?

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Actually, I wasn't talking about the software, but rather the information that was on the hard drive and that you provided to us. Was that information in the hands of several companies or was it in the hands of one particular company that at least tried to keep the information confidential?

[Chris Vickery]

The hard drive that you have is pulled directly from the GitLab instance at gitlab.aggregateiq.com. That would have been data held by AggregateIQ. However, they did incorporate a lot of scripting and software that is available on the open Internet.

I think the answer to your question is that this is internal AggregateIQ data. The overall philosophical answer is that anybody in the world could have accessed it, both because it was open and exposed on AIQ's side, and because they built it using software, primarily frameworks, that are available to the public. It's a bifurcated answer.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Was the level of security this company assigned to the personal data on the hard drive high, medium or low?

[Chris Vickery]

As far as what I gave to you guys, the amount of security that was present was nothing. There was no security whatsoever guarding it. I wouldn't assign any level of security. There are user names, passwords, and network locations present, which could have been seen by anybody in the entire world.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Unbelievable. So all the information on these hard drives could have ended up in the hands of anyone who was interested in using it for other purposes, quite simply.

[Chris Vickery]

Exactly. Yes, that is the very disturbing truth.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you. I'm done.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Gourde.

We'll go next to Mr. Boulerice. You have seven minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you very much, Mr. Chair.

Mr. Vickery, thank you very much for appearing before our committee again, only a few months after your last appearance.

Much has been said about Cambridge Analytica, AIQ and SCL. In your opinion, what is the extent of this underground world of data exchange that can be used for political purposes? Are we talking about these entities simply because we stumbled upon them or because there were a few whistleblowers? Are there only these entities or is this the tip of the iceberg of a phenomenon much larger and broader than we could imagine?

[Chris Vickery]

It is my belief that what you just said there is most likely the truth, that this is a beginning to something much larger. Even though it's a very big beginning, I believe there is a fairly good chance that before this is over, we will find ties to additional countries that have not really been recognized in the media, as well as various special interest groups in the United States—perhaps in Canada, but definitely within the United States—that have been taking advantage of this set of data, maybe not knowing exactly where it comes from. I believe there is a very large machine at work here, and we have not seen all sides of it.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

In your opinion, how could we, as a state and a government, search and find other organizations or companies that exchange or use data in this way, for political purposes, to interfere in election campaigns? Should we start a big manhunt?

[Chris Vickery]

I believe that perhaps the best way to go at this is much the same way that classically the United States has worked to rout out mob families. You put pressure on the people that you have strong evidence against, get them to turn on their co-conspirators and get the inside information, and keep flipping the dominoes down the chain until all the truth comes out. This is being done in such a way that it's hard, unless you have inside information or there's a huge mistake like what I discovered. It's hard to get inside information into investigators' hands.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

But depending on what you say, once a breach has been made, it can be used to dig and find all the ramifications.

[Chris Vickery]

I believe we have a beachhead, if that's what you're talking about, to begin a foothold, in another way to phrase it, to start really digging in. Yes, I believe we have established a foothold.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you.

My next question is from the perspective of the Canadian Parliament, or perhaps Elections Canada. We value the integrity of our electoral system. We wouldn't want to see foreign powers interfere in our election campaigns and use our citizens' personal data to influence electoral behaviour, people's perceptions or even election results.

However, I have the impression that states are very heavy and very slow institutions. Here, for example, until very recently, MPs had to send authorisations by fax. It's a bit like running on roller skates behind a Ferrari and being constantly late.

What advice would you give us to ensure that our legislation to protect our citizens is up to date and appropriate?

Here, the whole process is a bit archaic. It's not very modern, and it's generally quite slow.

[Chris Vickery]

One angle that I believe, specific to the Canadian side of things, you have an advantage on really is that AggregateIQ is under Canadian jurisdiction. If you can get to the bottom of the AggregateIQ involvement in this whole situation, you can have some very good inside insight into, “Okay, they did this. How could we have seen this coming? How could we have seen some red flags? What did they do, and how did they get to this level of involvement without our knowing?” and put in place some stopgaps to prevent that sort of thing from happening in the future.

I believe you actually are in a power position, as far as that goes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

That's good to know. Thank you.

Do you think the solutions lie more with investigations or more with legal or legislative protections?

[Chris Vickery]

I believe regulation, such as [Technical difficulty—Editor] is going to be very useful in protecting the public from abuses happening. If Canada wants to look into the GDPR model and you subscribe to it and pass something of your own, I'm very much in favour of regulation that has teeth behind it, so that it can be enforced. When there is an egregious violation of whatever law gets put in place, make an example of the companies that are the egregious violators and make others afraid to do it.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

It's a bit like what you were saying earlier about how to take on mafia families.

Mr. Chair, how much time do I have left?

[The Chair, Conservative, Bob Zimmer]

You have about 30 seconds.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

You are in the United States and we are in Canada. How would you rate our level of security in terms of the integrity of our electoral system? Are things going well or are we obviously threatened?