Information & Ethics Committee on May 29th, 2019

[Erik Neuenschwander]

I think the application you're referring to is the Keychain Access application on the Mac and on iOS devices. Within “settings”, “passwords” and “accounts”, you can view the passwords. They are, as you say, auto-generated by the platform. Most users experience that through our Safari web browser, which offers a feature to link into the keychain. It is, as you say, stored in the cloud.

It is stored in the cloud end-to-end encrypted—I want to make that clear—so it's actually encrypted with a key that Apple never possesses. While we put that in the cloud, both to allow you to recover the passwords and to synchronize them among all devices that you've signed in to iCloud, we do that in a way that does not expose the passwords to Apple.

I think that you're right that passwords continue to be an area of challenge in terms of protecting user accounts. You see many companies, certainly Apple among them, moving to what's called two-factor authentication, in which merely the password is not sufficient to gain access to the account. We're very supportive of that. We've taken a number of steps over the years to move our iCloud accounts to that level of security, and we think that it's good industry progress.

The last thing I would say is that absolutely, the password data is extremely sensitive and deserves our highest level of protection. That's why, separate from the Keychain Access application you're talking about on the Mac, on our iOS devices and now on our T2—that's the name of the security chip in some of our latest Macs—we're using the secure enclave hardware technology to protect those passwords and separate them from the actual operating system. We have a smaller attack surface for that, so while it's absolutely a risk that we're highly attentive to, we've taken steps, down in our hardware design, to protect the data around users' passwords.

[Alan Davidson]

It's a great question. I would just add that it seems counterintuitive, right? I think that 10 years ago we would have said, “This is crazy. You're going to put all your passwords in one place?” We offer a similar product—Lockwise—on our browser to help people.

I think that today the security experts will tell you this is a far better solution for most people because the biggest problem that we all have is that we can't remember our passwords, so we end up using the same password everywhere, or we end up using dumb passwords everywhere, and then that's where we get into trouble.

Our own polls of security experts and our own internal experts have said that it is actually far smarter to use a password manager, to use one of these systems. For most of us, the threat of that central vulnerability is actually a lot lower than the threat otherwise. I'd encourage you all to use password managers and think about that.

I've just sent out a note to all of our employees saying that they should do it. We all take that incredibly seriously. Two-factor authentification is an important part of this, and it's an important part of how those managers work. We take the responsibility to guard those things very seriously, but it is actually, as it turns out, a better solution for most consumers today.

[John Weigelt]

Just to chime in, we see that local hardware-based protections based on encryption are important to help support that password protection. Work that together with multifactor authentication, perhaps using something you have, something you own.

I think an interesting counterpoint to this and an interesting add-on is the ability to make very robust decisions about individuals, about their use of a particular system. We use anonymized, pseudonymized data to help organizations recognize that “Hey, John's logging in from here in Ottawa, and there seems to be a log-in coming from Vancouver. He can't travel that fast.” Let's alert somebody to do that on an organizational perspective to intervene and say, “Look, we should perhaps ask John to refresh his password.”

There's another thing that we're able to do, based upon the global scope of our view into the cyber-threat environment. Often malicious users share dictionaries of user names and passwords. We come across those dictionaries, and we are able to inform our toolsets so that if organizations—say, food.com—find out that one of their names is on there, they are able to go back there as well.

For data associated with the use of a particular toolset, anonymization and pseudonymization help to provide greater assurance for privacy and security as well. Let's make sure we recognize that there's a balance we can strike to make sure that we maintain privacy while at the same time helping safeguard those users.

[James Lawless]

It's a very interesting area, and it continues to be challenging. There's a usability trade-off versus security.

I remember an IT security manager in a large corporation telling me about a policy he implemented before there were password managers, going back maybe a decade. He implemented a policy of robust passwords so that everybody couldn't use their household pet or their birthplace and so on. Then he found that despite having this enforced policy, everybody was writing their passwords down because there was no way they could otherwise remember them, so it was kind of counterproductive.

I have one final question, and then I'm going to share time with my colleague. I think there's a website called haveyoubeenhacked.com or haveibeenhacked—something like that—which basically records known breaches. If your data and any of your platforms or other third party apps or sites are in the cloud and are compromised, you can do a search for yourself or for your details and pull it back.

Is there any way to remedy that? I ran it recently, and I think there were four different sites that had been compromised that my details were on. If that happens on your platforms, how do you do that? How do you mitigate that? Do you just inform the users? Do you reach out, or do you try to wipe that data set and start again? What happens there?

[John Weigelt]

We have breach notification requirements, obligations, and we notify our users if there's a suspected breach of their environment and recommend that they change their passwords.

For the enterprise set, like that toolset that I mentioned—“Have I been pwned?”, I think it's called—

[James Lawless]

That's the one, yes.

[John Weigelt]

—that site has readily available dictionaries, so we feed those back to enterprise users as well. There's the notification of the individual users, and the we also help enterprises understand what's happening.

[Alan Davidson]

We do the same thing in the sense that we all have data breach obligations and would do those things in such a situation. We've also put together our own version of that “have I been hacked” Firefox monitor. For Firefox account holders who opt into it, we'll actually notify them affirmatively of other attacks that we're notified about, not just any breach on our system but on others as well. I think that's going to be a service that people find valuable.

[James Lawless]

That's good.

[Erik Neuenschwander]

If Apple security teams, in addition to the steps that have been discussed here, become aware that an account has likely been breached, then we can take steps through what's called “automated reset” on the account. We will actually force a password reset and do additional challenges to the user if they have two-factor authentication using their existing trusted devices to re-establish access to that account.

[James Lawless]

Yes, it's very hard to get back in when you're out, because I've had that experience.

[Voices]

Oh, oh!

[Erik Neuenschwander]

You mentioned balancing usability and security.

[James Lawless]

Yes.

[Erik Neuenschwander]

We try to strike a balance there between whether you are the good guy trying to get back in, so let's not make it hard for you, or let's definitely keep that bad guy out. That's an evolving space.

[Hildegarde Naughton]

Can I just come into that, please?

[The Chair, Conservative, Bob Zimmer]

We're actually way over time. The chair is taking the second round, and I already have you as number one on our second round, Hildegarde. Once we get through everybody, we'll start through that next round. It shouldn't be very long.

We'll go to Ms. Vandenbeld now for five minutes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you very much.

I'd like to begin with the lack of utility of the idea of consent anymore. When you want to use a certain app or you want to use something, there are good purposes and bad purposes. Let's say that, for instance, I'm on my iPhone and I'm leaving Parliament and it's 9 p.m. My iPhone tells me exactly which route to take to get to my home. It knows where I live because it has seen that I take that route every day, and if I suddenly start taking a different route to a different place, it will know that as well.

Well, that's great when I want to know whether or not I should take the 417, but for my phone to know exactly where I'm sleeping every night is also something that could be very disturbing for a lot of people.

We don't really have a choice. If we want to use certain services, if we want to be able to access Google Maps or anything like that, we have to say yes, but then there's that alternate use of that data.

By the way, on the comment about this being a public hearing, we have a tickertape right on the side of the wall there that says this is in public. I wish there were a tickertape like that when you're searching on the Internet so that you know whether what you're doing is going to be recorded or made public.

My question, particularly to Apple, is on your collection of data about where I've been. It's not just a matter of where I'm going that day. It's not that I want to get from A to B and I want to know what bus route I should take; it's that it knows exactly the patterns of where I am travelling in terms of location.

How much of that is being stored, and what are the other purposes that this could be used for?

[Erik Neuenschwander]

I'd like to be really precise, madam, about the “you” and the “it” in your sentences because I think you used them correctly, but there is a subtle distinction there. “It”—your phone—does know that. Your phone is collecting based on sensor data and behavioural patterns and tries to infer where your home is—and that is your iPhone. “You”, being Apple, does not know this information, or at least not via that process. If you leave a billing address with us for purchases or something, that's different, but the information that your iPhone is becoming intelligent about remains on your phone and is not known by Apple.

When you ask about how much of it is collected, well, it's collected by the phone. It's collected under our “frequent locations” feature. Users can go and browse and remove those inside the device, but the collection is just for the device. It's not actually collected by Apple.

As for the purposes to which it can be put, over our versions of the operating system we try to use that information to provide good local experiences on the device, such as the time-to-leave notifications or notifications of traffic incidents on your route home; but that isn't going to extend to purposes to which Apple, the corporate entity, could put that data, because that data is never in our possession.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

I think that goes to what Microsoft started talking about in their opening statement, which is the ability of hackers to access the data. Apple's not using this data, but is it possible, through cyber-threats, that other bad actors might be able to get in and access this data?

I'm actually going to ask Microsoft.

You talked about doing $1 billion a year in security research and development, and there's a term that you threw out, “co-operative botnet takedowns”. I'd like you to explain that a bit, as well as the work that you're doing on cybercrimes.

We know that once the data is out there, it's impossible to put back, and a lot of these Cambridge Analyticas and other data aggregators are using it, so what are you doing to make sure that this data doesn't get out there in the first place?

[John Weigelt]

When we look at the marketplace, we see it's continuously moving, right? What was put in place for security controls 10 years ago is different today, and that's part of the efforts of the community that's out there securing the IT environment.

From our case, we analyze those common techniques. We then try to make sure that those techniques go away. We're not just trying to keep up; we're trying to jump ahead of the malicious user community so that they can't repeat their previous exploits and they will have to figure out new ways to do that.

We look at tools like encryption, tools like hardening up how the operating system works, so that things don't go in the same place every time. Think of it as if you change your route when you go home from Parliament at night, so that if they are waiting for you at the corner of Sparks, then they won't get you because you have changed your route. We do the same thing within the internal system, and it breaks a whole bunch of things that the traditional hacker community does. We also include privacy within that, and accessibility, so our whole work is around trust, security, privacy and accessibility.

At the same time, there is a broader Internet community at large, so it's nothing we can do alone. There are Internet service providers, websites, and even home computers that get taken over by these zombie networks. Hackers have started to create networks of computers that they co-opt to do their bidding. They may have up to a million zombie computers attacking different communities. It really takes the Internet down and bogs it down with traffic and whatnot.

In order to take that down, you need technical sophistication to be able to take it over, but you also need the support of legal entities within regions. One of the things that's unique for us is that our cybercrime centre has worked with government authorities in finding novel legal precedents that allow these networks to be taken down, so in addition to the technology side, we make sure we're on side from the legal side to conduct our operations.

Lastly, what we did for the Zeus and Citadel botnets, which were large zombie networks that had placed themselves into corporate Canada, was work with the Canadian Cyber Incident Response Centre as well as the corporation to clean up those infections from those machines so they would go quietly, and they could start up again.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Mr. Davidson, would you comment?

[Alan Davidson]

I have two quick points.

First, we work on something that we call “lean data practices”. It's the idea that we should not keep data if we don't need it. The best way to secure data is not to retain it. Sometimes it's needed, but sometimes it's not. The industry could do a better job and consumers could learn more about insisting that data not be kept if it's not needed.

Second, location is a particularly sensitive area. It's probably an area that is ultimately going to need more government attention. Many users probably would feel really comfortable with an Apple or a Microsoft holding this data, because they have great security experts and stuff like that. We worry a lot about some of the smaller companies and third parties that are holding some of this data and maybe not doing it as securely.

[The Chair, Conservative, Bob Zimmer]

We will go to Ms. Jo Stevens from the U.K.

[Jo Stevens, Member, Digital, Culture, Media and Sport Committee, United Kingdom House of Commons]

Thank you, Chair.

I would like to turn to a different subject altogether, competitions and markets. I would like to ask Mark and Erik if they think different competition and antitrust rules should apply to tech giants, considering their unprecedented influence and market power.