Information & Ethics Committee on Feb. 5th, 2019

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much.

I'm going to go around with some different questions for each of you.

I appreciate your all being here today.

Mr. Vickery, I want to start with a question on digital government, which is the principal focus of the next few weeks of our time here at this committee. With respect to, say, blockchain, you raised some red flags with respect to privacy about moving more services online. The model that is the foundation of this study is the Estonian model, and I would say that they have three core aspects to that system that help to protect privacy, as far as I understand it.

One is the digital ID, which is an encrypted device that allows for me to access government services and requires additional levels of authentication. Second, they do use blockchain technology. They were using it before the rest of us understood it as blockchain technology. It's KSI Blockchain. It's a particular blockchain technology that they claim was invented in Estonia and is used in over 100 countries around the world. Third, when government employees access people's profiles, it is time-stamped and the purpose and reason for which the government employee accessed that information is transparent.

I guess the real question that I'm driving at is what is the problem with the Estonian model?

[Chris Vickery]

The problem with that model is that it only takes one little defect in the armour to ruin the whole thing. Day in and day out for the past few years, I have been hunting down data breaches. I found quite a few and every single company's website that's involved in these data breaches has a statement to the effect that, “We follow industry standard practices”, “we use umpteenth level security and encryption”, etc. I find these databases to be open to the public Internet, not encrypted. They have no password and no user name whatsoever. It only takes one developer to mess things up and cut a corner and do something that is a little too risky and not best practice.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Just to clarify, if you ever find a way into the system in Estonia, I'd certainly like to know that because if the digital ID is stolen in some way, I understand that they revoke the certificate. I understand they have been operating the system since 2000 and they claim they've never had any identity theft.

If there were to be a significant problem in their system, you would think it would have occurred, since they have been operating it for so long already, but I could be wrong.

[Chris Vickery]

Compare that to the claims of the Indian government with the Aadhaar database. They have have made similar claims for that database, yet on several occasions, it's been proven that they have had massive data breaches, both in the access portal and in the basic encoding system of the Aadhaar ID card itself.

I don't know if I believe Estonia when they say they've had no data breaches or problems whatsoever, or if that's just bluff and bluster. Maybe that's something I could look into a little more in-depth.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

If you could, I would appreciate it if you could take some time and look at that with the expertise you have and come back to us with something in writing. That would be very helpful to this committee.

Mr. Carroll, from what you've seen, you have raised concerns about the weaponization of data and the erosion of a shared discourse. Obviously, you've pursued this yourself in a very useful way, in trying to get at this major scandal and really uncover as many answers as you can.

Mr. Kint had referred to some of our recommendations. Have you read our report as well?

[David Carroll]

Yes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Okay. Is there something we missed?

[David Carroll]

I'd like the opportunity to go back and reread the report with that question in mind, but I think I admire the audacity of the report to cross potentially a third rail of how our political parties are supposed to be regulating themselves on these issues. That, in my observation, went further than Information Commissioner Denham's recommendation to put an ethical pause on micro-targeting.

I do appreciate that. I think this is the main question for multiple governments around the world. How does the exemption of political targeting break down the whole system? In the case of Cambridge Analytica, political data was used for commercial purposes, and commercial data was used for political purposes. It's quite difficult—

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It would certainly be illegal here, I think it's fair to say, even under our existing rules.

Let's use an example of a change that we have adopted as a government in Bill C-76 with respect to a database. When there are political ads, they have to be put into a searchable database. We then recommended that it has to be as user-friendly as possible, and really, I would say, designed with journalists in mind so that they can do their job and hold people like me accountable for the ads we put in place during elections. Is that sufficient?

When you talk about a shared discourse and echo chambers, as it were, is that a sufficient answer, do you think?

[David Carroll]

It's an important start. The level of transparency required to hold this kind of advertising accountable needs to be maximal, I believe. For example, most Facebook users are not aware that political parties and campaigns upload their voter registration files into Facebook to target them individually, by name. The way you find that in the Facebook interface is very difficult, and it doesn't show that one-to-one level marketing in even Facebook's transparency tool that it launched here in Canada.

I think the maximum amount of disclosure will be beneficial to concerned citizens as well. I think it comes down to that granular level. You should know that you've been targeted as an individual voter for particular messages, rather than the segmentations that they claim. Also, people need to know if they've been assigned to what's called a “lookalike audience” as well. That creates a similar kind of one-to-one targeting without your name being attached to it.

I would advocate for as much disclosure as possible when it comes to political advertising, and maybe advertising in general.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm out of time, but I'll take you up on that. When you read our report a second time, get back to us in writing with anything we've missed.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Erskine-Smith.

Next up for seven minutes is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair.

I'd like to start with you, Mr. Vickery. Certainly, the establishment of digital government in Canada will be very different from Estonia's, given that we have provinces and territories, municipal governments, regional governments and the federal government and there are quite clearly defined lines of authority in terms of who has jurisdiction or not.

Even in the establishment of early forms of limited digital government.... Let's say the Canadian government were to look at only the areas of its jurisdiction in relation to the entire population of the country. One would expect that there would be something of a gold rush by companies looking to be the creators, the administrators or the partners, if you will, in creating such a huge digital operation.

The Canadian Bankers Association, or at least the president of the association, has suggested that banks are the most trusted handlers of personal data. They have two-factor logins and they're more responsible, say, than the Equifaxes or other collectors of data, the data brokers, and certainly more responsible than companies such as Alphabet, Google, Facebook and so forth.

I'm just wondering what sorts of guidelines you would suggest to the Government of Canada if it were to set up digital government. What sorts of companies would you recommend to be on the inside in the creation and the maintenance and guarantor of security?

[Chris Vickery]

I think the banking idea is not a bad one. That is a highly regulated industry accustomed to things such as very intense audits, keeping paper trails, and doing everything by the book—hopefully. I think they are definitely a good industry to lean on; however, I would be very, very cautious about how you allow the data to then be used in other ways. I would make very bright lines with whoever you go with to lean on and use their expertise and infrastructure, whatever, indicating what is acceptable and what is not. You can't budge or blur the lines here. This is a bright line, and these are the penalties if you break the line, and then enforce that if it happens.

[Peter Kent, Conservative, Thornhill, ON]

With regard to the Estonian model, where there are silos—depending on the different authority concerned, of education, health, taxes or whatever—the individual chip used to access one's personal information or that can be requested from the individual is siloed. However, you raised concerns about the movement of information between silos and the possible points of penetration through either a deliberate or an accidental process in the creation.

[Chris Vickery]

Yes, I would caution against allowing the segmented siloed databases to talk to each other. If you need data, get it from the person the data belongs to, because if the databases can talk to each other, the data doesn't really belong to that individual citizen; they're just an optional gatekeeper at that point.

[Peter Kent, Conservative, Thornhill, ON]

Would you suggest that every silo be administered by the creator of the central program?

[Chris Vickery]

I think that if you mix and match administrators, that's basically the same thing as mixing and matching the databases. The administrators are just human, and humans want to eliminate work and make things as simple as possible, so that's where corners get cut.

[Peter Kent, Conservative, Thornhill, ON]

I have a couple of questions for Mr. Carroll and Mr. Kint.

Given the impact of the Facebook-Cambridge Analytica-AggregateIQ scandal and the stories that have come out, we saw people cancelling their Facebook accounts. There is skepticism and fear in some quarters about invasion of privacy through social media. How does one reassure the public that digital service provided by government can be secure and protected and that violation of privacy is unlikely, if not impossible?

Mr. Carroll, you may like to go first.

[David Carroll]

I think the reaction to the Cambridge Analytica scandal worldwide shows that we have a visceral response to it. We don't know exactly why it upsets us, but it became a household name around the world overnight. To that specific thing, we understand that there are incentives at play, and the government doesn't have an incentive to profit from data or necessarily to use it for nefarious acts. There isn't the sense that there could be rogue actors abusing a system.

My opinion is that as long as breaches at the government level are protected against, as the sort of worst-case scenario, trust in digital government is much more possible than trust in digital advertising.

[Jason Kint]

I would only add that this does speak to the issue of why Facebook needs to be held accountable. There's a study each year from Edelman called the “Trust Barometer”, and we saw that institutional trust declined in light of Facebook. Edelman went deeper for the first time and started to unpack what was happening, particularly with the trust in media, which is the part I get most concerned about in my role. The trust in journalism was going up or rebounding, and it was actually the trust in platform itself where the issue was. These platforms are embedded in our lives, and they start to affect trust in other areas, so the question of whether we could trust the media started to be impacted by what was going on with Facebook and the declining trust of that platform.

They just put out their new research three weeks ago, and there was a 30-point gap in trust between social media and traditional media. It worries me when you have a platform that's kind of gone awry and it starts to affect everything.

[Peter Kent, Conservative, Thornhill, ON]

How would government reassure for the same reasons? Would you share the same reasons that Mr. Carroll—

[Jason Kint]

I think it's holding Facebook accountable. It forces them to raise the trust in their own product, which can be a very long term issue for them—they might be stuck in this bad cycle—and it raises the trust level in the entire platform.

[The Chair, Conservative, Bob Zimmer]

Thank you. You have five seconds.

[Peter Kent, Conservative, Thornhill, ON]

No, I'll come back.