Information & Ethics Committee on Feb. 19th, 2019

[Peter Kent, Conservative, Thornhill, ON]

Just to my final part of my question, does the expertise exist in your agency to recognize that if a vendor or supplier of a certain technology says you need the whole package at the full price, because if you buy less there are going to be problems, you have the expertise to accept or analyze what that provider is telling you?

[Alex Benay]

At this point we do, and if we don't, we go get it, and we recognize when we don't. But, again, the way we've designed this process has been iterating with the vendors. We're talking to them as we're going through the process, which is slightly different from a traditional procurement process, where we talk through binders and responses and 200- and 300-page RFPs. In this case we're working with them as we're designing the process, at every gate, because we've gated our entire process. If we know from talking to them that we have some gaps, we will go get them.

You heard me say in my earlier statement that it's very hard to be an expert in absolutely everything in digital. I think if we start with that premise, we'll make sure we have the right people around the table when we know there's a gap.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up for seven minutes, we have Mr. Angus.

Go ahead.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you so much for your presence today. This is a fascinating discussion. When I was a much younger and much better looking man, I sat on a committee that did government operations, and much of what we're talking about I think is under the purview of government operations. We need to focus on what is the purview of this committee, which is issues of the ethical rights of citizens and privacy rights. Therefore, I'm going to mostly focus on that.

Mr. Snow, Canada has suffered endless numbers of security attacks against government servers, in particular government agencies, over the years. These tended to be by state actors. Are you seeing a change between security threats from state actors or from individual actors and gangs who are trying to access information?

[Aaron Snow]

CDS works with a limited number of partner departments at a time. We don't have that sort of horizontal data. We aren't privy to the kinds of threats that various departments are seeing in the back-end systems that we don't touch.

That's probably not a question for me.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Benay.

[Alex Benay]

I don't have the data readily available for state actor versus individual actors. At this point, we're trying to operate with the idea that an attack could come from someone in a basement, all the way to a state actor and everything in-between. We have people who are knocking on the front door of government systems hundreds of thousands of times a day.

We've been able to centralize some of our infrastructure with Shared Services Canada in order to build a moat around this. We've created a new national cybersecurity centre that was launched this year. It's trying to bring the private and public sectors together as well, because an attack on one sector can often bleed into another. Critical infrastructure is an example.

When we're designing our services, we have to bake in security from the beginning. You heard me speak about the architecture review board that we created. The security lens is applied for every major digital project moving forward in the government and over the last 12 months.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I remember when the fax machine was cutting-edge technology. Among the first people to use this cutting-edge technology were the scammers running the Nigerian 419 scam. You had to do a lot of work to get all of those faxes out there and you probably didn't get a lot of pickup. Then the Internet came along and the ability to hit millions increased.

When you have one point of contact of information you can only be so successful. When you have two or three points of information about a person you can become very successful.

In my office, I deal—as I'm sure my colleagues do—with people who have been or are being victimized by these scams all the time. These scams are much more sophisticated now as the technological changes happen.

My question is in terms of government, financial and medical information. Protecting that information is vital because that's where the non-government actors are going and what they're looking to use. What assurances do we have that as we put more of our private information into one big system, we're actually being protected?

[Alex Benay]

I'll start, and you may want to jump in.

Just to be very clear, we're not advocating putting our government information in one big system, one big data lake or one big pool of information.

For example, the Canada Revenue Agency is responsible for the business number in our policies. It doesn't mean that the information is not located in other places as well. We're not advocating for a central system.

I think that—

[Charlie Angus, NDP, Timmins—James Bay, ON]

When we have cases of citizens' information being improperly accessed in the Canada Revenue Agency, are you involved in the review of how that goes down, or is that siloed under CRA, saying that those were just a few bad apples in the operation? If we're putting more information out there, do you actually get to be part of these conversations about the misuse of that personal information within government services?

[Alex Benay]

Yes. For privacy breaches, luckily Ruth's team is responsible for overseeing and being involved in these discussions. On the cyber front, we have another executive director who works closely with Shared Services Canada and with CSEC on major incidents. They do make their way into the office of the CIO on a daily basis.

Ruth, I don't know if you want to comment on privacy breaches and the process.

[Ruth Naylor, Executive Director, Information and Privacy Policy Division, Chief Information Officer Branch, Treasury Board Secretariat]

Yes, I can speak to that a little bit.

Institutions have a responsibility or an obligation under our Treasury Board policies to report privacy breaches that are material in nature, both to the Office of the Privacy Commissioner and to TBS. We work quite closely with the Office of the Privacy Commissioner to compare notes on those reports.

At TBS, we make a range of tools available to institutions to support them to identify, manage and do the reporting aspect of this. We work with the OPC and follow up with institutions where that's warranted.

[Charlie Angus, NDP, Timmins—James Bay, ON]

I find that very impressive.

I studied privacy breaches in the previous Parliament when that was my beat. My concern is how often departments decided not to tell the Privacy Commissioner. Maybe 10% of the time they came forward, and they said that they didn't think it was big or that it was a problem.

People don't want to make it look like they really blew it. When you have hundreds of breaches, it doesn't look good for the department.

How do we know that all the breaches are being reported? That was the Privacy Commissioner's frustration before. It should be the Privacy Commissioner who decides whether or not the breach is significant, not the department.

[Alex Benay]

Yes, from a cultural perspective you heard my colleague Aaron mention the fact that we have to get to a place where escalating issues are not necessarily seen as a negative, but a positive. There have been some good steps taken toward that throughout the public service. We've had a lot of support from senior government officials on the transparency required to raise some of these issues, and we're seeing deputy ministers, ADMs, and DGs asking for an update on the red status of either projects or breaches.

Culturally speaking it's going to continue to be a work in progress. There's some good momentum on that side in the public service from a transparency perspective, but Ruth probably has some details on the two-year action plan we're developing in partnership with the departments and the Privacy Commissioner's office.

[Ruth Naylor]

We had the benefit of some recommendations from the Privacy Commissioner in his last annual report on exactly this issue and that office's concerns about the varying numbers of breaches reported. Often, the institutions up that decision about what to do and what not to do. I think institutions are working in good faith on that, but we want to be doing some work over the next two years.

We're developing a two-year action plan. We've shared it with the Office of the Privacy Commissioner, because we want their input before it's finalized, and we'll be working in partnership with them to deploy it.

It will be focusing on increasing awareness about the nature of personal information, what a breach is and how to report a breach. Also, at the recommendation of the Office of the Privacy Commissioner, we're focusing a lot of those efforts on the IT and security community, because they are the people on the front lines when there could be a compromise or information could be lost. Therefore, we want to make sure they have the instinct to say that personal information was involved in this.

We have a small team working on this in partnership with government institutions. We're hoping we'll be able to make a difference on that front over the course of the next two years.

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Angus.

Next up for seven minutes is Mr. Erskine-Smith.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thank you very much.

Thank you all for being here.

While I don't think Estonia is a perfect solution, there are some perfect solutions within Estonia that we have to learn from.

Digital ID, I think, is a critical aspect of moving toward more digital government. X-Road is another aspect, and I'm glad you're doing work on that front. Then there's obviously a transparency component where, in their law, when a public official accesses personal information, it's transparent to the citizen.

I want to walk through the first two pieces, at the very least, which are more under your purview.

You mentioned with respect to digital ID, Mr. Benay, that there is Sign In Canada. Maybe you could give me a bit more background on when that started, where we are at with it and what we are looking at doing moving forward.

[Alex Benay]

Yes. Sign In Canada itself is in its infancy. In the last few years we have been focused on the rules framework underneath it instead of the technology.

We have been working on the pan-Canadian trust framework with the provinces, NGOs, non-profits and the corporate sector as well. It's essentially a set of rules that we all agree to abide by to respect each other's identities.

If a province abides by the pan-Canadian trust framework, it should be good enough for the federal government and for a bank. It's more of a federated model. It matches the governance framework of the country more.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

If I'm a citizen and I want to log into the CRA or EI or to renew my driver's licence at the provincial level, I don't want all of these passwords. I don't want to have to remember that my CRA password and my user name are different. Then I have to store them in a separate password folder. I want simplicity as a citizen. What does it look like from a citizen perspective?

[Alex Benay]

I fall victim to them myself as well, and I have a vested interest in ensuring that these things don't happen.

Sign In Canada will essentially permit you to choose the “no wrong door” approach to services, accessing federal services from a province or a territory, or vice versa, and possibly from your bank as well. We do have the security regime to put this in place, but we didn't have the rules framework in place.

Sign In Canada means that you could have access to ESDC services from CRA. Also, we are in active discussions on possible pilots and projects with the provinces, where we would give federal services through the provincial ID system as well.

It's very different from the Estonian model, which is a singular approach to it. We are taking more of a “no wrong door” approach to services, as long as a rules-based approach is followed.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Does your office, in consultation with the OPC, have a list of potential privacy concerns and how to address them?

[Alex Benay]

Yes. As part of the new governance that we put in place roughly 18 months ago when we changed the Financial Administration Act to create standards, we changed the governance process around the architecture review board. It means that any one of these kinds of major projects has to go through this review board, where privacy is looked at.

Another part of this may possibly be legislative impediments as far as data-sharing is concerned, which is another tombstone piece of work that we have to do. We have been in conversations with the Privacy Commissioner's office on those, for example, as well.

I suspect that the dialogue will continue to increase as we do more and more digital services between my office and the Office of the Privacy Commissioner.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Is there any written analysis that can be shared with this committee with respect to any privacy implications of digital ID?

[Alex Benay]

We can certainly make any of that documentation available. We've also started a legislative review process, so we can look into—

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

That would be appreciated. It would certainly be helpful, I think, for our committee's work.

You mentioned X-Road and said that we're moving down that path as well. Presumably, that's in its infancy, too, but maybe you could give me an update as to where we are and what the road ahead looks like.