Evidence of meeting #121 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cse.
A video is available from Parliament.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
To put it a different way, do you think it would be better for the protection of our information or for the security of our elections if your advice became a rule?
Assistant Deputy Minister, Operations, Canadian Centre for Cyber Security, Communications Security Establishment
If I may jump in, based on years of practice, I'll share with you my position on rules.
We work in collaboration, as I mentioned, with all participants. People want to secure themselves. All entities and political parties genuinely want to do that.
When I work on a model of collaboration and best practices, I reach a certain threshold of delivery and outcome. The minute I establish a standard—and there are many standards in production of equipment, tables, chairs and what have you—there's a race to the bottom. People try to meet the minimum standard because there's competition at play. Best practices are done through collaboration.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Thanks very much.
Mr. Durocher, in your report, the white paper, it indicates that the purpose of the act and the review, when you look at big data, the goal really is to ensure an innovative, efficient and prosperous economy. There's a conversation about substitutability. It's not just the price; you could talk about quality.
We had some folks here talking about the worries about antitrust. It was on this point, quite apart from pricing. People are put in a position—Ms. Vandenbeld got at this—where you're forced to deal with a monopoly.
We have the Bank of Canada suggesting that the five biggest global tech companies have a market cap of $3.5 trillion U.S. There are certain companies we have to deal with in our day-to-day lives. There's no choice to be made. We have to give up what we give up to access the service. It's not necessarily a price consideration, but there's a quality consideration. Part of that quality of service is the data and the privacy that I potentially give up.
That was not a big part of the conversation when you were looking at big data in the paper. I wonder if you could speak to that.
Deputy Commissioner, Monopolistic Practices Directorate, Competition Bureau
Sure. That's a great question, great observations, and I can tell you that when Professor Maurice Stucke appeared before this committee, we reviewed the transcript with great interest, because we are following what thought leaders such as him have to say on the matter.
I completely agree that in the digital economy, we've moved from what we call static competition to dynamic competition. Static competition is this old-world competition on price and output which is still prominent in a lot of industries across Canada. In the digital space, what we're seeing is that companies largely compete for users on the basis of how they're innovating in the offer of their products to consumers. We call this non-price effects. When I talk about modernizing the tools we use for the Competition Act, it's exactly with a view to addressing these issues of non-price effect.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Great.
Another thing talked about in your white paper was a barrier to switching services. It's not so easy for me to print out everything from Facebook and move it over to another network. It occurs to me that another barrier is network effects, but as your paper indicates, there are great positive benefits that come from network effects.
I don't know what the positive benefit is from the barrier to switching. I know that when you look at the GDPR and you see a rule about the right to portability, and others have talked about not just a right to portability but a right to interoperability as well, wouldn't that increase competition?
Deputy Commissioner, Monopolistic Practices Directorate, Competition Bureau
Yes. That's an excellent question as well.
Data portability of the regulations that we're seeing through the GDPR is the most noteworthy, I think, from a competition perspective. In theory, it can be pro-competitive. It can empower consumers to take their data from one platform to another. Obviously the devil is in the details as to how that's operationalized, but certainly it's something we're taking note of.
We're seeing it in the Canadian banking industry. For instance, the underlying premise of the open banking initiative is enabling people to move their data from one service provider to another. From a competitive perspective it's certainly very interesting. It's something we're monitoring very closely.
By the same token, we have to watch how it's operationalized. From a competitive perspective, when we look at regulations relating to privacy, another competition consideration involves the cost of compliance. It must not be so high as to effectively entrench large players and make it more difficult for smaller players to compete.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Don't you think that when you look at those other factors beyond price and privacy, which is something that this committee has obviously been concerned with, the notion of privacy by default would level the playing field? Wouldn't it take away that unequal bargaining power between the monopolies, as it were, and the individual consumer? An individual wouldn't have to immediately give away all of his or her privacy rights right from the get-go. We'd get at some of those other factors related to substitutability beyond price.
Do you think that would be a useful conversation for us to have?
Deputy Commissioner, Monopolistic Practices Directorate, Competition Bureau
It certainly could be. We would advocate that market forces should drive improvements in all dimensions, including privacy.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
That's fair.
Mr. Santor, this is my last question.
Ms. Wilkins, senior deputy governor, remarked in February of this year that data has become another source of monopoly power. She indicated two concerns. One, it might impact innovation in a negative way, and two, it may well return to monopoly pricing in the long run.
There may be some other concerns. We've certainly heard some other potential antitrust concerns from other witnesses here.
She threw out some potential solutions that other people have been talking about regarding how we regulate ownership and the sharing of information, and maybe treating tech platforms as utilities.
When we had the CRTC here on net neutrality, they talked about a section that says companies can't unjustly discriminate or give undue reasonable preference towards themselves—or any person, but including towards themselves—or subject any person to unreasonable disadvantage. That's to get at equal treatment.
Should we regulate Facebook, Google, Apple, Amazon and Microsoft? Shouldn't we treat them the same as Rogers and Bell?
Managing Director, Canadian Economic Analysis, Bank of Canada
That's a question beyond the mandate of—
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
She suggested treating them as similar to utilities, though.
Managing Director, Canadian Economic Analysis, Bank of Canada
That question is best discussed by those who have the expertise to decide whether or not the competition.... To fully realize the benefits of digitalization, we need to ensure that competition is effective.
We need to be asking these questions, but it's an open question as to how best to do that. I would defer to my colleagues on that.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Thanks very much.
The only thing I would say is that I'm very glad Ms. Wilkins raised the concerns and identified the problem. If she happens to have any solutions she wants to offer, she's welcome to propose them.
Does anyone else have any questions?
We have Mr. Picard with a question, Mr. Baylis with a question, and then Ms. Mathyssen.
Liberal
Michel Picard Liberal Montarville, QC
Ms. Gendron-O'Donnell, you clearly indicated, in response to a question, that you should be able to ensure that what's stated in contracts is transparent.
To improve your investigations, are there any changes or things you would like to recommend to the committee? We talked about misuse and misleading information. Is omission part of that? Are there aspects of your regulations that should be amended to improve your ability to investigate?
October 18th, 2018 / 12:40 p.m.
Associate Deputy Commissioner, Economic Analysis Directorate, Competition Promotion Branch, Competition Bureau
Thank you for your question.
As my colleague told you, political issues or matters concerning the Competition Act do not come under the Competition Bureau's mandate. We are satisfied with the current provisions of the Competition Act, and the department handles those aspects. We do as much as we can with the resources at our disposal. We focus our efforts on areas where we can have the biggest possible impact, and we target investigations that will have the most positive impact on Canadians.
Liberal
Michel Picard Liberal Montarville, QC
My next question is for the CSE representatives.
In your understanding of a threat, do you draw a distinction between the enormous quantity of information that's dumped onto social media and that confuses people and direct attacks or piracy? Most readers no longer know what to think, how to think or what to look at. In fact, it's all outright propaganda.
Is there another aspect that would be similar to piracy but that falls under your responsibility and constitutes a threat? You have to draw distinctions among things. The government has to be able to take action on the right thing. It can't interfere with someone's right to say what he wants, even if it's nonsense. On the other hand, if people post things in places where they shouldn't, the government's entitled to act.
Do you distinguish between the two at your level?
Deputy Chief, SIGINT, Communications Security Establishment
I can speak to the foreign intelligence side of that question, and that is to say that regardless of the method, whether it's hacking or sending disinformation, whatever the technique of a foreign government is, for instance, or of an organization that would seek to do Canada harm, we would be interested in that so long as it is a government intelligence priority. From the foreign intelligence side, both of these things may be distinct, but we would be interested in either.
From a response point of view, André, did you want to comment on that?
Assistant Deputy Minister, Operations, Canadian Centre for Cyber Security, Communications Security Establishment
Yes.
Mr. Picard, as you mentioned, we examine the threat and the method normally used. We focus on the confidentiality, integrity and availability of systems and networks. Information conveyed over those networks does not come under the CSE's responsibility. We ensure that information, whatever it may be, is safely saved, protected and transmitted.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Thanks very much.
Mr. Baylis, you have a few minutes. We want to finish up by 12:50 p.m., so we can go in camera and discuss some committee business.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Mr. Rogers, in your presentation, you're looking at cyber-threats to Canada's democratic process. We just had Aggregate IQ, a Canadian-based company, busily interfering with the U.K. Brexit vote and, we believe, also the American presidential vote which President Trump won.
They were using stolen data. It was Facebook's stolen data. Are they captured in what you investigate? Or are you only outward-looking? If they're sitting here in Canada and they're interfering with other people, we'd be foolish to believe that tomorrow they're not going to turn around and interfere with their own. Are there limits on what you can investigate? I'm quite bothered that we have a Canadian entity actively interfering and thumbing their nose at our committee as they do it.
Deputy Chief, SIGINT, Communications Security Establishment
It is part of our lawful mandate to look only at foreign threats outside of Canada. A Canadian company engaging in any type of behaviour would not be within our mandate in the foreign intelligence side to investigate, but there may be other entities in Canada where that would be within the mandate. I can't speak to that, but CSIS, RCMP and others have more of a domestic focus than we do.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
If I understand it, you're the chief of foreign signals intelligence. Is that the catchword for cybersecurity?
Deputy Chief, SIGINT, Communications Security Establishment
That's our foreign intelligence collection apparatus within CSE. André is the assistant deputy minister for operations on the cyber side. That's the centre that will respond to cyber-threats and advise. We do the intelligence collection that might inform their activities and other activities in government.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Do you interface with other foreign entities that are also looking at getting hacked themselves? Did the Americans or the British people contact you to coordinate specifically with respect to what AIQ is up to?