Information & Ethics Committee on Oct. 18th, 2018

[Dan Rogers]

Certainly. Thank you for the question.

I'll answer from the foreign intelligence perspective, which is in my domain. Then I'll invite André to talk to some of the guidance we provide to Canadians to deal with that sort of issue.

As a foreign intelligence-mandated organization, we do track targets on the global information infrastructure, which includes social media. If we have intelligence priorities from the government, which would include things like looking at foreign nations that would have an interest in disrupting our electoral systems, we would look anywhere on the global information infrastructure to identify what those activities, capabilities and intentions of those foreign states are.

I can't in this setting speak to the details of how we do that, but I can definitely say that it is an active part of our role to observe that activity to the extent that we can. Then we roll that up into foreign intelligence products to provide to our partners in the government, and to André's team, which form the basis of some of their cybersecurity advice and work with those who may be affected by these activities.

André, do you wish to speak to that?

[André Boucher]

Absolutely.

Of course, we already provide advice and guidance on how to secure the devices, the utilization of devices, and so on and so forth. I'll leave that aside. Just to follow up on Dan's point, when the teams are informed that there's activity in a foreign space, I think it goes back to the previous question. There's the opportunity for us. We would tell the user to contact the company and let them know, but because we have these partnerships as well, we would also inform the company that we're seeing evidence that something is wrong with their service delivery and that perhaps they might want to turn their attention to it. What we try to do is get this information in the right way to those who can actually do something about it.

[Peter Kent, Conservative, Thornhill, ON]

The study we've conducted this year, since the Cambridge Analytica, Facebook, AggregateIQ scandal broke, involves a significant amount of testimony that says that the big data companies have been more preoccupied in developing their business plans and profits and competition rather than on the protection of privacy.

In your experience in dealing with the big data companies, have they been co-operative in terms of responding to your advice? You don't necessarily have to name the companies, but for our viewing audience, I'd suggest Facebook, Amazon, Google and so forth.

[André Boucher]

The very short answer is yes, but I'll nevertheless give you a little context.

You have to be pragmatic. I meet with corporate boards and presidents to discuss the idea of introducing security measures, whether it be to protect privacy or to ensure overall security, to preserve the confidentiality, integrity and availability of their networks.

Service providers must strike a balance between the profitability and the security of their product. Don't be naive. When I ask people from companies in all fields to ensure their product or service is secure, I have to give them convincing arguments for them to tighten up their security measures. Having relevant information on a given threat helps us convince them. In fact, we have a lot of success in this area.

[Peter Kent, Conservative, Thornhill, ON]

Thank you very much.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

The next seven minutes will go to MP Mathyssen.

[Irene Mathyssen, NDP, London—Fanshawe, ON]

Thank you very much, Mr. Chair.

Witnesses, thank you very much for being here.

This is a wealth of information, and I truly appreciate it. Some of it is a tad terrifying, but I'm sure that we'll sift through that and determine how best to tackle this very large question.

It's probably Mr. Durocher who could best answer this question. Yesterday there was a lawsuit filed against Facebook. The allegation is that they manipulated the numbers in regard to how many people were watching videos on their network. Of course, there are implications for those who work in media, the people who write for media outlets, and also advertisers.

I wonder if you would regard this as an abuse of market power. Does it have broader implications in regard to that question?

[Anthony Durocher]

Thank you very much for the question.

Canada's Competition Act, in terms of the abuse of market power provisions, is really aimed at dominant companies that engage in action that harms the competitive process and that is intended to keep competitors out of the market from competing on the merits with them. An instance of a firm that may be engaging in conduct that would be tantamount to exercising market power, such as raising prices, does not necessarily fall offside of the Competition Act. It's really geared towards protecting the competitive process. In the context of conversations around the large tech companies, really our role is to ensure that the competitive process is protected and that companies are afforded the opportunities to compete with Facebook on the merits of their products and services.

[Irene Mathyssen, NDP, London—Fanshawe, ON]

Obviously, Facebook benefits by the number of people watching and using it in terms of selling advertising. It seemed interesting in regard to this lawsuit, so thank you for that.

This question is for the Bank of Canada.

I wonder whether the bank has any concerns about concentration of superstar firms. You described that. Most of these are in the United States. Does this impact the ability of Canadians to build first-rate, domestic, digitalized business space? Apart from that, what's the impact on retailers?

[Eric Santor]

Thank you very much for the question. It's a good question.

What we're seeing right now in the Canadian economy is there's a lot of activity in the digital economy. While we don't have an explicit measure of the digital economy, the things that we do look at show there's very robust growth. Taking one measure, for example, if you look at GDP by industry, there's a category called computer systems design and related services. It's been growing more than 7% a year for the last five years. In value-added space, it's as big as autos and aerospace combined. So there's very rapid growth, a lot going on.

If you look more anecdotally in centres like Toronto, Montreal, the Waterloo corridor, Edmonton and other places, there's a lot of digital activity, a lot of investment going on in IP and research and development. Also, this has attracted the interest of large players to bring FDI into Canada, with them locating here, to benefit from the talent pool we have in terms of big data, AI and ML and a lot of artificial intelligence. By one metric, Canada has the third largest number of researchers in AI and ML, so we're well positioned to take advantage of this, and we see this as a really strong driver of the Canadian economy right now.

[Irene Mathyssen, NDP, London—Fanshawe, ON]

So the brain drain that we always seem to fear is not a reality. We are, indeed, attracting and keeping highly skilled professionals.

[Eric Santor]

Yes. It's a very competitive job market for data scientists and people who are conversant in AI and ML, but we're very well positioned. We produce a lot of talent ourselves, and we are attracting talent as well.

[Irene Mathyssen, NDP, London—Fanshawe, ON]

Okay. Thank you very much.

Mr. Durocher, the European Union has taken the proactive approach to antitrust enforcement against data-opolies such as Google. I wonder if you can explain the difference between the Canadian and the European approaches to that.

[Anthony Durocher]

Sure. That's an important thing, and I can tell you the Competition Bureau is very closely monitoring what is going on in Europe and elsewhere around the world. When we look at these large companies, this is a global issue and it's not Canada specific. An important thing is that we work together. We're aware of what is going on elsewhere, what tools they're using, to make sure that here in Canada we're using cutting-edge methods. It's no secret that the European Union has brought two cases against Google. There's also a recently announced investigation against Amazon. The German competition authority has an ongoing case against Facebook as well.

What I can tell you is the important thing to be mindful of is the difference not only in competitive dynamics between Europe and Canada, but also in the laws. Canada's abuse of dominance law is well established since 1986, with jurisprudence about what are the elements that need to be met to bring a case. All the work that we do is really principled, evidence-based enforcement. Our decisions in Canada are really informed by the evidence at hand and any harm to the Canadian market. With respect to Google in particular, in 2016 we closed a very lengthy three-year investigation against Google for some of its practices, and there was a commitment provided by Google for a competition issue that we had identified. But going forward, we are closely monitoring and working with our international counterparts to ensure that here in Canada we are staying on top of things.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thanks very much.

Our last seven minutes go to Mr. Picard.

[Michel Picard, Liberal, Montarville, QC]

Thank you, Mr. Chair.

My question is for the people from the Competition Bureau.

If Facebook handed over a significant amount of private data to a party for some kind of analysis and that party entered into an agreement with a third party over which we had no control, information would be scattered around without any control. Would the third party that got its hands on that metadata under a secret or even criminal agreement—it would have no right to sell the data but would nevertheless do so—be engaging in unfair competition?

[Alexa Gendron-O'Donnell, Associate Deputy Commissioner, Economic Analysis Directorate, Competition Promotion Branch, Competition Bureau]

Thank you very much for your question.

Allow me to continue in English.

The Competition Bureau, in addition to the sections that my colleague spoke about, also has what we call a section for false or misleading representation. When I talk about representation here, I mean marketing material, online advertisements, social media messages, even terms and conditions. The big thing under the Competition Act is that the general impression you are conveying has to be truthful. There has to be truth in advertising. When it comes to promoting your business interests or collecting consumer information, you must be truthful. That is the section of the act that would be engaged when any company is thinking about making some kind of representation to consumers, whether it's to sell them a product or to give them what I would call a free product in exchange for their information. You must abide by the act in those cases.

[Michel Picard, Liberal, Montarville, QC]

A social network that asks me for information for sign-up purposes is very transparent. It clearly states in its conditions that its partners and it are entitled to use my data. That's quite transparent, but I have no idea who its partners are.

[Alexa Gendron-O'Donnell]

That's correct. I'll continue my answer.

Really, it is about the misleading advertising provisions. We encourage companies to be clear, but the biggest thing is to not mislead. You cannot tell consumers that you are going to do one thing and then do another. Really, the competition provisions are about ensuring that there is truthful advertising to these customers, so that customers know, when they are about to purchase a product or give information, that there may be a possibility that it goes to a third party, or that it is used elsewhere.

[Michel Picard, Liberal, Montarville, QC]

They don't, however, take responsibility for the partner's business. They don't take responsibility for what the partner is going to do with the data they are exchanging. If I agree to exchange my social media with a partner, and the partner does something totally different, I'm going to address it to the CSE afterwards. But if it's all written in the contract and it's transparent and there's no misleading, then it's just omission. Is “omission” different from “misleading”, as you see it?

[Alexa Gendron-O'Donnell]

The big thing with the commission is just ensuring that the representation made to the customer is truthful. That is really the core of the law here. Certainly, if that secondary company at any point makes a representation to consumers, they absolutely have to ensure that it is truthful.

[Michel Picard, Liberal, Montarville, QC]

Regarding CSE, we have in mind that a third party in a scenario has millions and millions of data. You mentioned that the threat is increasing, especially for 2019. Can you identify the nature of the threat? Is it more individuals, institutions or associations, corporations or government, or is it all of the first three under a foreign government umbrella?

[Dan Rogers]

[Inaudible—Editor]

[André Boucher]

Don't overlook the fact that threats are categorized and that we examine them based on their type. That gives us information on the measures or methods that these businesses normally use. The measures we take are based on the threat type.

[Michel Picard, Liberal, Montarville, QC]

Here's the challenge we're currently facing.

The CSE normally focuses on foreign, not Canadian, sources. In signals intelligence, however, signals have no citizenship. We don't know who's sitting at the keyboard. It may be a Canadian or a non-Canadian.

How can we tell the difference? How can we identify the threat to ensure, on the one hand, that these are indeed foreign signals and, on the other, that we have authority to act, since action has to be taken at some point.