Information & Ethics Committee on Oct. 18th, 2018

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

I apologize for the late start.

We're joined by the Bank of Canada, the Competition Bureau and CSE today. I thank all of you for attending.

We'll start with a presentation from the Competition Bureau.

[Anthony Durocher, Deputy Commissioner, Monopolistic Practices Directorate, Competition Bureau]

Mr. Chair, Thank you for the opportunity to appear today.

I am Anthony Durocher, Deputy Commissioner of Monopolistic Practices at the Competition Bureau and I am joined by my colleague Alexa Gendron-O'Donnell, Associate Deputy Commissioner of the Bureau's Economic Analysis Directorate.

The Bureau is an independent law enforcement agency that ensures Canadian businesses and consumers prosper in a competitive and innovative marketplace.

The Bureau administers and enforces Canada's Competition Act, which involves investigating and addressing abuses of market power, anti-competitive mergers, price-fixing and deceptive marketing practices.

Competition law enforcement requires more than theory. Evidence-based enforcement is at the heart of what the Bureau does and this requires that our decisions be based on credible evidence that can withstand judicial scrutiny.

It is also important to recognize that we are enforcers, not adjudicators. The Competition Act requires us to meet several thresholds and standards, such as proving there has been a significant harm to competition.

Regardless of if we want to bring a case forward, we are guided by the decisions of the Competition Tribunal and courts.

It is difficult to turn on the television or read the news without seeing the increasing role of data in our economy. The power that data now represents, and the control that digital platforms have over it, deserves careful consideration. The bureau recognizes its important role in this area and strives to be a leader through both its enforcement work and its policy work, both of which we plan to discuss today.

We understand that this committee is particularly focused on privacy. It is important for me to say from the outset that safeguarding privacy is not an explicit goal under the Competition Act, so our role is limited in this regard. However, there are two ways privacy can be relevant to our work. First, if companies compete to attract users by offering privacy protection, then this dimension of competition can be a relevant factor in reviewing anti-competitive activity. Second, if companies mislead consumers about whether and how their data will be used, this may also raise concerns under the Competition Act.

There are many obvious benefits associated with the collection and analysis of data, particularly for driving innovation, but there are also risks. The bureau has a mandate to safeguard competition in the digital economy, and we continue to prioritize this work. However, it is important to acknowledge that competition law has its limits. It is not a cure-all for the broader threats that data and data-driven platforms may pose for society, such as breaches of privacy, election tampering or manipulation of public opinion. These risks go beyond our legal mandate. Nevertheless, we are happy to bring our competition expertise to bear on this important discussion, as these issues are cross-cutting and will benefit from collaboration across government to protect Canadians.

A little over a year ago, the bureau published a comprehensive white paper entitled, “Big data and Innovation: Implications for Competition Policy in Canada". The purpose of this paper was to engage with stakeholders by prompting a discussion on how the emergence of big data should affect competition law enforcement.

Following an extensive consultation, the bureau found that there's no need for hasty moves in this area. The current framework is up to the task, but our tools must evolve to deal with the complex issues arising from digital platforms, such as those that monetize user data through advertising by offering free services to consumers.

A recurring concern we hear about is the large and growing size of some tech firms, but big doesn't necessarily mean bad. Becoming big is the reward a firm could get for successfully introducing an innovative product. We should not punish this success. Only when we find evidence that a big firm is engaging in harmful anti-competitive conduct should we intervene.

It is important to find the right balance between preventing any competitive behaviour that harms Canadian consumers and avoiding undue over-enforcment and the inadvertent harm this may cause to innovation and the economy. Some of the issues that we have heard about relating to the digital economy and our monitoring include firms buying emerging competitors or excluding disruptive ones; firms that may use artificial intelligence or algorithms to collude and fix prices; and firms misleading consumers about whether and how their data will be used. If we find evidence that any of these practices violate the Competition Act, the bureau will act to protect Canadians.

We have already conducted several notable investigations in the digital economy, including against Google over an alleged abuse of market power related to its search engine, and the Toronto Real Estate Board, or TREB, over its real estate data.

Our case against TREB is a great example. We were able to stop TREB from withholding its real estate data from agents who wanted to offer innovative online services to homebuyers and home sellers. This case exemplifies how we are ensuring that Canadian consumers benefit from the innovation happening in the digital economy.

We welcome the opportunity to discuss the bureau's white paper, as well as these recent cases, in greater detail during the question and answer period.

The digital economy is a top priority for the Bureau. We will continue to monitor the online marketplace, including the conduct of large tech firms.

We will also continue to work closely with our domestic and international partners and carefully review the actions taken by our international counterparts. However, laws and competitive dynamics may differ significantly between countries, and we must remain mindful of that.

The Bureau also encourages all Canadians to reach out to us if they have any evidence of violations of the Competition Act.

Before fielding your questions, I would note that the law requires the Bureau to conduct investigations in private and keep confidential the information we have. This obligation may prevent us from discussing some past or current investigations.

We appreciate the opportunity to appear before you to discuss our work and look forward to your questions.

Thank you.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thanks very much. That's much appreciated.

Our next presentation will come from the Communications Security Establishment.

You have 10 minutes.

[Dan Rogers, Deputy Chief, SIGINT, Communications Security Establishment]

Thank you, and good morning, Mr. Chair and members of the committee.

My name is Dan Rogers, and I'm the deputy chief of foreign signals intelligence at the Communications Security Establishment. I am responsible for CSE's foreign signals intelligence program. I'm joined today by my colleague André Boucher, the assistant deputy minister of operations at the Canadian Centre for Cybersecurity.

The Canadian Centre for Cybersecurity, which is a part of CSE, is Canada's national authority on cybersecurity and cyber-threat response. It's a pleasure to appear before you as you continue your study.

With regard to the incident involving Cambridge Analytica and Facebook, CSE does not have a mandate to regulate social media, nor is it a law enforcement agency. We have no oversight role with respect to these companies. We do, however, have a role in identifying and helping protect against cyber-threats to Canada's democratic process. Therefore, I would like to focus my remarks on these threats and how they can be mitigated through good cyber and physical security.

I also hope to leave you with a better sense of what CSE does and how we have changed as an organization since CSE officials last appeared before this committee in 2017.

CSE is Canada's national signals intelligence agency for foreign intelligence and the technical authority for cybersecurity and information assurance. I would like to emphasize that CSE only directs its signals intelligence activities at foreign communications. CSE is prohibited by law from directing its activities at Canadians anywhere or at anyone in Canada.

CSE operates at the cutting edge of today's threat environment. Whether providing intelligence on foreign-based terrorism or threats to Canadians abroad, or defending against cyber-attacks, CSE helps to ensure Canada's prosperity, security and stability.

More recently, CSE was asked to assist the Minister of Democratic Institutions with her mandate to lead the Government of Canada's efforts to defend the Canadian electoral process. Specifically, the mandate letter for the Minister of Democratic Institutions directed that she ask CSE to analyze risks to Canada's political and electoral activities from hackers and release this assessment publicly, and to offer advice to Canada's political parties and Elections Canada on best practices when it comes to cybersecurity.

In response, we released a report on cyber-threats to Canada's democratic process in June 2017. While the report is unclassified, key judgments in the assessment rely on multiple sources including classified information from CSE's unique cybersecurity and foreign intelligence expertise. CSE examined cyber-threat activity against democratic processes across Canada at the federal, provincial and territorial, and municipal levels and around the world. The report examined the types of threat actors involved, the targets they are likely to select and the methods they may use to target their victims.

CSE assessed that in the 2015 Canadian federal election, Canada's democratic process was targeted by low-sophistication cyber-threats likely perpetrated by hacktivists and cyber criminals. These activities had no effect on the results of the election and no impact on the privacy of Canadians. CSE has assessed that, at the federal level, political parties and politicians and traditional and social media are more vulnerable to cyber-threats than election activities themselves.

Consistent with the increasing cyber-threat activity against democratic processes worldwide, we expect to see multiple hacktivist groups deploying cyber capabilities in an attempt to influence the democratic process during the 2019 federal election. These will likely be low-sophistication activities, but will be well planned and will target more than one aspect of the democratic process.

CSE has been asked to continue this analysis and expects to release an update to the 2017 report.

While offering mitigation advice was outside the scope of the threat report, to respond to Minister Gould's second request of CSE, we have held briefings with political parties, provincial and territorial clerks, and Elections Canada to offer best practices when it comes to cybersecurity.

Our key message in all of these briefings is that, while system safeguards are expected to curtail most suspected malicious activity, we cannot rely solely on technical safeguards. Users must also be diligent and have good cybersecurity habits in order to stop the threats of today and to stay ahead of the threats of tomorrow.

CSE has made available on its website several documents, the "Top 10 IT Security Actions", "Cyber Hygiene", "Mobile Security" for IT enterprise, and other resources with user best practices. We'd be happy to speak to any of these in greater detail during the questions and answers.

Cybersecurity is a team sport. We'll continue to work with Elections Canada to ensure that the electoral process is secure and remains a trusted aspect of our democratic process.

CSE will work with Minister Gould and other stakeholders, if requested, to advance the goal of protecting Canada's democratic institutions and electoral processes from cyber-threats.

On October 1, the Minister of National Defence announced the launch of the cyber centre, Canada's national authority on cybersecurity and on cyber-threat response. The cyber centre, housed at CSE, brings together cyber expertise from Public Safety Canada, Shared Services Canada and CSE all under one roof. A unified government source of expert advice and guidance for the private sector, critical infrastructure owners and operators and all Canadians, the cyber centre will help ensure a safe and secure cyberspace.

This newly established centre will also enable better coordination of efforts in the protection of Canada's democratic institutions from cyber-threats. This includes the period preceding the 2019 federal election.

Again, thank you for inviting us here today. We look forward to answering your questions.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thank you very much.

Our last presentation will come from Eric Santor from the Bank of Canada.

Thanks very much for joining us today. You have 10 minutes.

[Eric Santor, Managing Director, Canadian Economic Analysis, Bank of Canada]

Good day, Mr. Chairman and committee members, and thank you very much for the invitation to be here.

As the managing director of the Canadian economic analysis department of the Bank of Canada, I'm happy to present our views and observations regarding the declining competition in advanced economies. I'll also address the implications for both competition and the longer-term dynamism of the economy related to the emergence of large tech firms as well as the growing importance of big data.

Understanding the impact of digitalization on the Canadian economy is crucial as we seek to achieve our objective of low, stable and predictable inflation. The Bank of Canada does not have a regulatory role with respect to the privacy of citizens' data so I trust you will understand that I will not be able to address the privacy implications of these issues.

The Canadian economy is digitalizing rapidly. Digital disruption is expected to be positive for economic progress overall. New firms are being created and existing ones are being transformed as new technologies change the way businesses operate. For consumers, digitalization means that households can purchase a seemingly ever-widening range of goods and services 24-7 from around Canada and from around the world.

Digitalization will contribute to higher productivity, and hence higher living standards, in the coming years and decades.

There is a lot of concern about the rise of the robots and how they could take away people's jobs. Naturally, we tend to focus on these initial effects. But we also need to be mindful that it takes a long time to fully replace a worker with a robot.

Still, there is no doubt there will be disruption for some, and there is time for society to adjust. People whose jobs are affected will need support. Job training and a strong safety net are key.

We must also remember that digitalization is creating new kinds of jobs and will create some that haven't even been imagined yet. These new jobs will help the economy grow. New jobs mean new incomes, which will be spent not just in the digital economy but across the whole economy, with benefits for workers in traditional jobs too.

One of the driving technologies of digitalization is the application of artificial intelligence and machine learning in conjunction with big data to a wide range of business applications. AI and ML increase firms' productivity in three major ways. First, AI and ML help companies make better products and improve their customers' experiences. Second, they help develop products and services more efficiently and more quickly. Finally, they help firms reach new markets and customers.

There are practically countless examples of such applications.

They include farmers using GPS autopilots to drive their tractors and optimize fertilizer and pesticide use; robots working on factory floors and in warehouses, "driving" forklifts to move goods and digitally track them from supplier to retailer; Al offering up suggestions for products or services you may wish to buy; and having chatbots and robo-advisers standing ready to answer your questions when you visit websites.

By implementing AI and ML with big data, firms can gain a competitive advantage, ultimately through offering a better product or service at a lower price. One of the features of AI and ML, big data and network effects is that there are often significant benefits in being a first mover. In fact, market concentration happens quite naturally in industries with prominent network effects and other scale economies.

In the current environment, this dynamic can lead to the creation of superstar firms. These firms tend to have fewer employees than conventional companies and they often earn impressive monopoly profits.

What is new is that the winner-takes-all effect is magnified in the digital economy because user data has potentially become another source of monopoly power. Data from a large network creates a formidable barrier to entry in some cases. Another barrier to entry can come from firms using the position as gatekeepers of crucial online services to impede their competitors and thwart innovation. In this context, we believe competition policy can be modernized appropriately to help ensure that benefits of digitalization are fully realized.

What do we know? What evidence do we have on the issue of market concentration, markups and prices?

In recent years, economists have paid considerable attention to the secular rise of market concentration in advanced economies. In particular, models have been developed that tie this rise to digitalization. Specifically, these firms are able to capture an increasingly large share of the market because of technological advances, such as AI and ML with big data, thereby increasing concentration. They also have a high share of profits, which can lead to a fall in the labour share of income.

Overall, most industries have seen an increase in their concentration over the last 15 years. Although the evidence is not conclusive, a broad increase of industry concentration across countries suggests that technological change, that is, digitalization, rather than country-specific factors, is perhaps the main driver.

One concern in an environment dominated by superstar firms is that those firms have more power when setting prices, which could lead to an increase in prices. That's why economists have also been looking at the secular rise in market power of firms as measured by markups. For example, researchers documented a rise in average markups in the U.S. from 1980 to 2014. They also found that global markets have risen as well. This increase is also observed in Canada. For Canada, they document a very similar overall trend to the U.S., a finding confirmed by the IMF. This suggests that market power's been rising in many countries over the past few decades.

The next question is whether digitalization has affected consumer prices. This is often referred to as the “Amazon effect”, where competition from digital retailers results in lower prices. It may appear inconsistent that digitalization can lead to both higher markups and lower prices. However, it is simply that the benefits of technology partly go to the customer in the form of lower prices, but also to the firm in the form of higher markup over lower cost.

While the direct evidence of the impact of digitalization on inflation is mixed, it does tend to point to downward pressure overall. In a research paper published last year, bank staff found that the direct evidence pointed to a small negative impact of digitalization on inflation. That is, digitalization was weighing on price increases rather than feeding them. Evidence using online prices data, such as the Billion Prices Project, is mixed. Some find that online prices tend to behave similarly to bricks-and-mortar store prices, while others find big effects on inflation year over year on the downward side. Most of us are familiar with why this might be happening—our ability to check competitor's prices using our smart phones before we head to the checkout.

Finally, when using the framework upon which the bank's main economic models are built to assess the channels through which digitalization may affect inflation, we find that most developments associated with digitalization would put downward pressure on inflation.

Overall, the impact of digitalization on market concentration, and hence competition, remains an open question. The bank will continue to examine the impact of digitalization on the Canadian economy as we pursue our objective of promoting the economic and financial welfare of Canada.

Thank you once again for the invitation to appear.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thank you all for your presentations.

We'll go to our seven-minute round.

The first seven minutes go to Mr. Saini.

[Raj Saini, Liberal, Kitchener Centre, ON]

Good morning.

Thank you all for being here.

I can't resist asking this question of Mr. Santor.

Inflation might not be a really trendy topic, but I know that central bankers worldwide have pursued an inflationary rate target of being less than 2%. Now you're bringing retailers into the mix. They have two models: bricks-and-mortar and online. There is a price differential. I've seen it myself when I go to the store. Some of these products are not calculated in your consumer price index, so how do you make an accurate measurement of what's actually happening in the marketplace? The marketplace itself has changed.

[Eric Santor]

Our mandate is to target inflation at 2% with a range of 1% to 3%. The CPI itself is constructed by Statistics Canada, so you would need to direct your question towards them to ask whether or not the CPI is reflecting these developments.

I know that they are aware of this issue. That is certainly on their agenda.

[Raj Saini, Liberal, Kitchener Centre, ON]

Does it not make it difficult for you, then, when you do your assessments?

[Eric Santor]

What we do observe is the CPI, and that does have both online and bricks-and-mortar prices in it. We observe this. Since we know that online prices would be putting downward pressure on bricks-and-mortar prices, that would be already embedded in the CPI as that competition effect feeds through. When we talk to [Technical difficulty—Editor] in our surveys, they tell us that, yes, they are feeling downward pressure on their prices from online competition, so that is captured to some extent.

[Raj Saini, Liberal, Kitchener Centre, ON]

Okay.

Mr. Rogers, I'm going to spend some time with you this morning.

How would you assess the current threat level to the Canadian democratic process, specifically in terms of the 2019 election? In your opening comments, you talked about 2015, when there was low-level activity, but now we're going into 2019 and obviously there are more actors on the stage. How would you assess our threat level right now?

[Dan Rogers]

I'm happy to take the question, and thank you. This is something that the last report touched on. I know that our cyber centre is preparing a new report that will touch on that topic.

Maybe I can ask André to pick that up.

[André Boucher, Assistant Deputy Minister, Operations, Canadian Centre for Cyber Security, Communications Security Establishment]

All right.

We indicated in our June 2017 report that we were expecting an increase in the use of cyberspace and that various types of threats would increase as a result.

An update to that report is expected early next year, but I'm going to tell you now what you can expect from it.

Threats have indeed increased, but the main difference is the speed at which threat levels have risen. We were expecting them to rise, but it's happened more quickly. This also applies to Canada. No one will be surprised given what's happening internationally.

[Raj Saini, Liberal, Kitchener Centre, ON]

That leads to my second question. Is there any risk that Canadian voter lists or those of Canadian political parties could be compromised? We saw an example of that in the 2016 election with the DNC and the Clinton campaign. Where are we with that now?

[André Boucher]

Thank you for that question, Mr. Saini.

We're really on the lookout because we know what's happened internationally. We began working with the Elections Canada people early on to ensure that the networks, systems and procedures put in place were equal to the task of handling the rising threats I just mentioned. I'm entirely satisfied that the measures, processes and technologies put in place will help Canada tackle those threats to voter lists.

[Raj Saini, Liberal, Kitchener Centre, ON]

I don't want to mention any names, but obviously there are certain state actors around the world that have been known to engage in activity to disrupt elections. One of the things that concerns me is that sometimes the state actors don't come forward themselves. They have other entities, other organizations and other groups that act on their behalf to disrupt not only elections but other activities in other countries.

I don't want you to compromise your tactics of how you deal with this, but how do we deal with that? It seems to me that it's a problem. There's a great proliferation. How do we deal with that? You have certain entities that you are aware of and you're known to be aware of those entities, but then they have so many sub-entities that work in an arm's-length process and can contribute to the destruction of a campaign. In what way will you manage that?

[André Boucher]

We ranked threats by category in our June 2017 report.

Here's an example that goes to your question. Synchronization and subcontracting do occur between states and perhaps between criminal entities.

In reality, we constantly monitor all threats. Threat prevention and detection measures and ways to react to threats are based on each group, not on a more dominant group. We monitor all groups. We, of course, observe any interconnections that didn't previously exist. People employed by others become threats without knowing it. Some firms even believe they're operating entirely legally in executing contracts, but are in fact being used to conduct research on others. This phenomenon is real, and we're aware of it. We're doing what we can.

Mr. Rogers, do you want to add something on the subject of threats?

[Raj Saini, Liberal, Kitchener Centre, ON]

Mr. Chair, how much time do I have?

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

You have 40 seconds.

[Raj Saini, Liberal, Kitchener Centre, ON]

This is my last question, as I'm running out of time.

Obviously, now there are different ways of communicating with the public. We use social media platforms like Facebook and Twitter.

Do you work with them in any concerted way to make sure that if there are threats emanating, they can be shut down really quickly so they don't proliferate to an extent which can have a material impact on an issue or a campaign, whether it be bots or trolls or misinformation that's put out there? Do you have a relationship with them? I think that would be critical to making sure that misinformation is not being spread online.

[André Boucher]

Absolutely. To protect Canadians, the Canadian Centre for Cybersecurity uses a cooperation model, under which all stakeholders work together. It involves the user, as Mr. Rogers said, the manufacturer, the people who produce the source codes and the software, right up to the Internet service provider. The provider also has a social responsibility, and we treat it as a Canadian business. If we discover something unusual, we immediately advise it of the fact. If it hasn't already detected it, it will be very receptive and will immediately take measures.

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you.

[The Vice-Chair, Liberal, Nathaniel Erskine-Smith]

Thanks very much.

I understand that Mr. Kent will be leaving us shortly, but we'll give him seven minutes just before he does.

[Peter Kent, Conservative, Thornhill, ON]

I appreciate that, Chair. Thank you very much.

Thank you to all for appearing this morning.

I recognize that the Competition Bureau and the bank have only peripheral suggestions that might be applied in the recommendations we make to government on completion of this report on the digital vulnerability of the Canadian electoral system, or threats to the Canadian electoral system. Therefore, I'd like to direct all of my time to the CSE witnesses today.

As a politician, I participate in social media almost entirely for political benefit, and there are significant benefits to using Facebook, Instagram and other social media—Twitter.

This week the digital threat was brought home to me when my Instagram account was seized by someone from outside of the country. My Facebook account was hacked and took some time to be recovered.

It brought to mind the so-called Beyoncé trick, which previous witnesses have spoken to before the committee. In the United States, in the last federal election, a Facebook fan page was created paying tribute to Beyoncé, which accumulated millions of followers. Then, in the final days of the election campaign—and this was set up, we understand, by Russian players at one level or another—messaging went out which, in the end it has been concluded, was aimed at discouraging black voters from voting in that campaign, or in some of the campaigns.

We asked one of our previous witnesses, Dr. Ben Scott, about how Canadians might protect themselves from the sort of Trojan Horse social media time bomb that was set to go off in the decision-making period in an election campaign. He suggested that agencies like the CSE would be playing what he called "red teaming", Cold War game playing, in trying to anticipate threats, how one would respond to threats, how one would see this as a fraudulent attempt to interfere with the election process. He essentially said that security agencies have an ability—and I recognize you have no authority over social media—and certainly American security agencies have an ability, to see foreign intervention or foreign players in the social media sphere.

I'm wondering if you could address what the CSE is doing in that area.