Information & Ethics Committee on Dec. 6th, 2016

[Anil Kapoor]

I would say that it's important to participate and to be involved in it.

Some of these countries have threat levels that are radically different from ours. For example, the threat level in the U.K. is much higher than the threat level here. Their tolerance for incursions on the ECHR, or what we would call charter rights, is calibrated differently as a result of the threat environment.

If a state has, let's say, indefinite detention for 14 days, that doesn't necessarily mean that we ought to deploy that tool, even if they are Five Eyes. When it comes to information sharing with our Five Eyes partners, I think that's crucial, but the tools that we deploy are tools that are made in Canada and relevant to the Canadian threat environment.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Can you comment on some of the other countries within the Five Eyes and some of their information-sharing agreements that you either see as crucial that we adopt here in Canada that we should stay away from?

[Anil Kapoor]

In the case of the U.K., not a lot is known about the internal ministry arrangements. Much of it gets done at the ministerial level. There is some control of information by various administrative bodies, and certainly the independent reviewer in the U.K. reviews the extent of information-sharing.

In Australia and New Zealand they have information-sharing arrangements between, for example, federal and state police and ASIO in the Australian environment. Information does, then, get to be shared.

From a comparative law perspective, whether their particular tests for sharing information comply with ours or not, I couldn't tell you offhand. I can find out, as could one of your clerks, I suppose, but my view would be that the test of relevancy is too low in our statute. The test should be that it be necessary, as Daniel Therrien mentioned in his evidence.

I want to round out by responding to something that some of the service witnesses said on this question, and that I think Scott Doran from the RCMP said as well: that there's the sense that no one is going to know in some other agency what CSIS's mandate is, so how do I know whether it's “necessary” for CSIS? How am I going to divine that?

If you look at their testimony, you will also see that they talked about these agencies' having sectors or groups within the agency for whom there's going to be training on how to comply with the statute. Well, if there's going to be training on how to comply with the statute, you can train them to understand what “necessary” means for CSIS. It's not rocket science. CSIS does it; they deploy it. Somebody sitting in Health Canada, then, or one of the other agencies—CRA, let's say—can learn what the mandate is and can apply it. It's not as if it's mysterious; it's just a matter of training.

[The Chair, Conservative, Blaine Calkins]

Thank you.

[Anil Kapoor]

I'm sorry; I think I took too long.

[The Chair, Conservative, Blaine Calkins]

No, not it's fine. It's a great conversation.

We now move to Mr. Blaikie for seven minutes.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much for being here today.

When we talk about trying to strike the right balance between the need to share information for security purposes and the need to protect Canadians, I think it's often easier for folks to understand the risk of not sharing enough. You can understand the idea quite readily and in an abstract way that there's a threat and that if the left hand doesn't talk to the right hand and they don't get the information on time, then that threat is allowed to get through.

You've referred to the Arar case, and I'm sure most of us are familiar with the broad strokes of that case. Could you guys help us by explaining a little more concretely some of the details of that case? It might be helpful even to speak more generally about what the risks are. In what ways can unrestricted information sharing end up posing a threat to Canadians?

I think many people think that if you don't have anything to hide and you're not up to anything, then it shouldn't matter how much information they're sharing about you, because what possible harm could come of innocuous information? If that's not the case, maybe you could just help....

[Anil Kapoor]

Very briefly, then, and I'll let my colleague pick it up, the concern here is that you have two ends. You have the relevancy test for passing information over, and it's information relevant to activities that undermine the security of Canada, meaning the sovereignty, security, or territorial integrity of Canada. I sense that it's an incredibly broad definition, and the examples that are given are simply illustrative; they're not closed sets. Even if they were closed sets, even within them they're pretty broad, so you have broadness on both ends of this equation.

The concern I have with robust information sharing along these lines is that there's no real control for false positives. I appreciate that when it gets to the service—let's take the service as an example—they will apply their analytics and will ask whether this person is really engaged in something that undermines the sovereignty of Canada, whatever that means, and whether they'll take any national security action against the person.

However, it's rather like this: once they're on you, they're on you, and they just don't let go. It sits in the database, and there are no real retention issues spoken about here in this legislation. There are, at the service; they have their own retention standards, but what I'm concerned about is that the agency that sends information on, the transmitting agency, doesn't really turn itself to false positives. The “necessary” test would impose some rigour that at least has the prospect of doing so more efficiently than a relevancy test would.

Part of the training for those folks who are in the transmitting agencies is to really have some understanding of national security and to appreciate the ease with which there can be false positives. If you're alive to that possibility, then you'll be vetting for it, and the risk is diminished on the false positive side.

That's what my concern is.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Am I right to hear, then, that you're suggesting that a necessity test is as important as a screen for false positives?

[Anil Kapoor]

Yes.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Do you think it matters whether that happens at the transmission end or if there's a duty on the part of CSIS to only receive into their databases certain kinds of information? Do you think that would be just as good, from the point of view of screening for false positives?

[Anil Kapoor]

I think it ought to happen at the transmitting agency side, and it will happen anyway at the surface.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Right.

[Anil Kapoor]

They will vet and employ analytics in any case, but in order to maintain protection for privacy rights, it ought to happen at the transmitting agency as well.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Mr. Mia, do you have some examples of how, concretely speaking, information sharing can impact Canadians?

[Ziyaad Mia]

I concur with my colleague's comments. How do we find reliable information? That's what ought to be shared. That reduces the hay pile, for one, so we can get at the needles. The other piece is that then we avoid mistakes.

I'll give you some hypotheticals. Let's look at the definition, as Anil's pointed out. The real risk is that we've cast the net so wide when it was styled as “terrorism”. Terrorism is item (d) here. That's not even a Criminal Code offence, so that's something that needs fixing. Let's assume that's one piece, and we can agree with that. Nuclear proliferation and all of those are fine. Those are national security issues. However, then it's so broad that it's open-ended. Who hits the national security radar? If you see my submission, that little chart shows whole-of-government information sharing, so all these disparate decision points across government are making a low-threshold test to put information into this bucket. Someone may say, “Well, I have nothing to hide”, but in today's world, with data management....

Let's use my Saudi example. You're involved in trying to get Raif Badawi out of that hellhole in Saudi Arabia and you go to protests. The Saudis' intelligence says, “Some of these people are causing trouble for us.” Obviously they have a very low threshold of what's undermining their state security.

These countries usually see everyone as a terrorist. You or I are going to a protest, starting a petition against Saudi Arabia, boycotting Saudi oil or something, and we get picked up on their radar, so now we're in this bucket of data. It isn't just that piece of information, but it's the data crunching now as well, because it's whole of government. Now somebody might say, “Well, you know what? I've flagged someone of some suspicion at that low threshold, so let's see what else. Let's see what FINTRAC has on this person.” Those points are then put together and may create a false positive suspicion, so it's not clear, but there's a lot of data mining and data crunching going on through analytics.

Then we may share. This is the Arar-type situation. We may then say, “Here's the Saudi threat profile of protesters in Canada, and let's share it with the United States or with Saudi Arabia.” Then, after the fact, we may say, “Well, this was a mistake.” In our case, the agency may say, “Well, Ziyaad's cleared; expunge him from our CSIS database.” First of all, you're now in a bunch of other Canadian databases, so who's controlling that? The rules on retention and expunging are not clear. They're not even not clear; they're not there.

Then the other piece is, who's reeling back the information? In today's world, you see what a tweet does. You can't reel back a tweet, and this is much worse than a tweet. The worst thing would be if your name shows up and you're flagged and you go somewhere. Arar showed up in the U.S., and he was sent to Syria. Many Muslim Canadians travel to Saudi Arabia for a religious ritual, but if you now show up and land in Saudi, everything's integrated. Your passport's scanned and you're red-flagged there, and there's a real risk you won't just be sent back: you're going to be kept there, and that's worse than being sent back.

Those are the types of risks with data mining and harvesting all sorts of information under this very broad definition. What does “undermining the financial stability of Canada” mean? We make the debate about people who are involved in activities that criticize Canada's policies or whatever, and that's fine. We should have that debate. My worry is that this definition is going to put all sorts of innocent Canadians onto the national security radar when they should not be.

[The Chair, Conservative, Blaine Calkins]

Thank you. We're going to have to move on. We're well past the eight minutes.

Go ahead, Mr. Saini, for the last of the seven-minute rounds.

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you, gentlemen, for being here. I want to pick up on a point that both of you have emphasized throughout your testimony, and that is the amount of information.

I understand, Mr. Mia, that you sent in a brief from the Canadian Muslim Lawyers Association.

[Ziyaad Mia]

Yes.

[Raj Saini, Liberal, Kitchener Centre, ON]

In it, you talked about a term that struck me: “a multiplicity of decision points”. Let's say, for example, that there are 17 government agencies and 111 departments, and foreign actors are also involved. Let's say, then, that the information was necessary. We clean that up, and it's not relevant anymore. It's necessary, so it goes to three, four, and maybe five government departments. Each department is going to retain that information and pass it on.

My question to you is—and you mentioned it a bit earlier—what do you recommend as a disposal mechanism to make sure...? When you talked about “expunging”, you said there was a problem if four or five different agencies or four or five different departments have that information. What could you suggest to have that information expunged or disposed of so that we don't get that multi-layering that you spoke about earlier?

[Ziyaad Mia]

That's a tough nut to crack, because I'm not an IT guy. I'm an Indian guy, but I'm not an IT guy; I'm probably one of the only Indian guys who doesn't know anything about computers.

[Voices]

Oh, oh!

[Ziyaad Mia]

I think the one of the solutions is to have a sort of centralized control over it. I recommended in the submission that there needs to be some centralized control of information sharing. The departments could do their piece, but somewhere in government—maybe in Public Safety—there would be someone overseeing all of this. The Privacy Commissioner and SIRC and everybody will do their audits, and we're calling for a national security review agency. Those will be the watchdogs, but someone in government needs to be shepherding the whole thing by asking what's being shared, what are the thresholds that are the same across government, and then asking, “Are we doing this and is it consistent?” Then if there's a false positive or something, that person or that entity within government would be able to issue instructions across government to say, “Search your databases for this record and this person and remove that information.”

It's not a fail-safe method, because government is so huge and people forget and whatnot, but it still leaves us with the real problem back in the world, because if it has left here and has gone to the Five Eyes or to Saudi Arabia, we'll never get it back. We have no control over how they deal with that information. We don't even have control anymore to tell them that they have to use that information “relevant to these issues”. They could use it for some other purpose completely.

I think there's a possible fix, but in today's big-data world where there is so much information, it's very hard to clean that up. I think one attempt would be a centralized review, and then a way to issue instructions across government.

Take, for example, the no-fly secure air travel passenger protect program. I don't even know what's happening, because it's shrouded in secrecy. We can debate about whether it works, but let's say you get the passenger manifest and you check for the names. If none of the names are on the flight and the flight lands safely, why should that information be kept?

I remember Bill C-17 years ago, when they introduced the regulatory framework for the no-fly list. That information could be shared around and kept indefinitely. I do not want the travel data of all Canadians flying on Canadian airlines kept in government databases to then be mined for travel patterns. We know that CSIS and CSE have played funny with metadata and and have crossed the line.

You have metadata and travel patterns, and you might be pulled in here now. You can see that all of this is there in government databases, and the preamble to the act says that there is the ability to collate. That, to me, is data mining. That's what it's enabling. Clearly, that's what part of it is. We do need to do some of that, but again, the net is cast so widely.

My starting position is that Canadians' privacy needs to be protected. If the government doesn't need to have information about you to do business with you—to vet your taxes or your health records—they should not have it as a starting point. If they have collected it in this process of security screening, once you're not a suspect or the flight has landed, etc., they should expunge that information. That's how we minimize the databases and avoid errors.

[Raj Saini, Liberal, Kitchener Centre, ON]

Now we have an international issue, because as part of Five Eyes and as part of our international tax treaties and other things that we're doing, we may have an agreement with one country that may have an agreement with a tertiary country or a secondary country that we don't have an agreement with. If we send information to the country we have an agreement with, how do we make sure that they use the information specifically for what it was sent for, and not allow it to be sent to another country? Is there any way to do that?

[Anil Kapoor]

Generally speaking, in intelligence matters there is an implicit caveat. When the service passes intelligence—let's say, to MI6 or MI5—there is an implicit caveat that it remains the property of the service and will not be passed on.