Information & Ethics Committee on Dec. 4th, 2017

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It sounds as though there's some potential there for protecting people, but again, I come back to the integrity of the data. You buy and sell that data; it's for you to protect that data. It's your cost to protect that data. If you need to charge somebody, charge the businesses, the financial institutions, that use that data to then charge 24% on a credit card.

[The Chair, Conservative, Bob Zimmer]

Thank you, Ms. Shanahan.

Next up is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

That's a tough act to follow.

Given that the vulnerability of Equifax in the United States wasn't detected by the company, by those responsible for the Apache Struts patch being put into place—it was a national security agency, or an aspect of a national security agency, the United States Computer Emergency Readiness Team—I'm just wondering, given the increasing threats to cybersecurity around the world, whether in fact Equifax Canada would be more comfortable if there were a similar national security agency that monitored its networks, all business networks in Canada, to prevent exactly the sort of problems that evolved during that very significant delay between the original vulnerability being detected and the hacks and the shutting down of the system.

[John Russo]

That's an excellent question, Mr. Kent. We're looking at all alternatives with regard to how we can better do our business. Security starts with us as employees, and I can assure you, as our interim CEO said in the Senate hearings, that we will fix this, and whatever the options are in terms of working with this committee or working with others in Parliament to better serve Canadians, we're all for them.

[Peter Kent, Conservative, Thornhill, ON]

My last question is about the interim CEO. Is there any understanding of how long the term of the interim CEO is going to last? Is this because there's headhunting going on for an appropriate replacement, or would you expect that the interim CEO would be responsible throughout the litigation process, which as you indicated earlier, could drag on for some time?

[John Russo]

That's at the board level, and I'm not privy to that decision. I can assure you that I've worked with Mr. Barros for the past 10 years. He has been in many capacities, as international president and as president of U.S. business, and he's a man of integrity. His background is in engineering, and when he says he'll fix it, he'll work his darndest to make sure it gets done.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

Can I concede my time to Sylvie?

[The Chair, Conservative, Bob Zimmer]

Go ahead. She already has another seven following.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Now?

[The Chair, Conservative, Bob Zimmer]

Ms. Boucher, go ahead for seven plus two minutes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

I'm replacing one of my colleagues today.

After what I've heard, I would like to ask a few questions.

I am amazed just to what extent Equifax's reputation is being eroded by this breach. With all due respect, I must say that your answers do not enlighten me enough.

I have several questions for you, but there is one in particular that has been on my mind for a while.

In the wake of the Equifax breach in the United States, has Equifax Canada, which protects Canadians on this side of the border, put in place a much greater form of protection against this kind of fraud?

And, as everyone knows, when there is a problem like fraud, for example, or when someone steals their identity, it's also the consumer's reputation that is tarnished. Have you looked at this issue and have you provided for compensation? It took you a long time to discover the breach. Here in Canada, we had a press release in September.

Lastly, did you plan to rectify this type of situation, which could have happened if one of your Canadian consumers had their identity stolen somewhere between the time of the fraud and your reaction?

[John Russo]

Thank you very much for those two questions.

In regard to what we're doing here in Canada, as I mentioned, we've retained globally PwC and Mandiant to work with all the Equifax entities. We have 24 companies across the world, and we're working with them.

In terms of the closed-loop confirmation that I mentioned earlier, where we not only issue the order to patch, but we also receive confirmation that it was patched, that's in place. I mentioned in my opening statement that it used to take 48 hours to put such patches in place. That has been decreased to 24 hours or less, in terms of what we're doing globally.

We're also refining any existing industry best practices, procedures, and standards. We want to be above industry best practices. I didn't mention that the chief security officer now reports to our interim CEO, so the corporate governance structure has changed at Equifax in terms of accountability. We're centralizing that security rather than having a decentralized system country by country. We're working with all those individuals. We've appointed a chief transformation officer as well to get some better transparency from a security and IT perspective not only in Canada but also globally, so that this incident won't occur in the U.S., in Canada, in Argentina, or anywhere else we operate.

In regard to your second question, on the reputations of affected consumers, Toni's team works individually case by case with each individual consumer. We have call centre representatives who are able to alleviate any consumer concerns or frustrations in terms of walking them through what has transpired, if anything, with their information. We have protections in place that have been used in incidents a lot larger than ours to afford Canadians protection. Again, our number one priority is the Canadian consumer. I've heard from neighbours, friends, family. This affects everybody's reputation. We have 10,000 employees globally. It affects them as dearly as it does the Canadians who were impacted.

At the same time, we want to ensure that Canadians are afforded the best protections there are in the market, based on the regulatory situations in each country. There's a different regulatory situation in the U.S. from that in Canada. We want to make sure we apply those to each country individually to best represent those individuals.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Do I have any time left, Mr. Chair?

[The Chair, Conservative, Bob Zimmer]

You have four minutes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Okay.

That's what I'm wondering. The criminals or the people who got this information will not necessarily use it today or tomorrow, but they might use it in 2018, for example. How will Equifax help to ensure that consumer data is 100% protected?

It's all well and good, but wherever consumers go, they're asked to have the Equifax file. We consult Equifax and everything is supposed to be great.

This is what worries me about your answers. I have the impression that you waited to see what the United States was going to do before taking the ball here in Canada. You have put things in place, but what are you going to do now and in the future to protect more and more consumers? How are you going to make sure that consumers' personal data will never be made public?

[John Russo]

With regard to the impacted data, our core consumer and credit database, the daily transactions we do with banks, the information we sell to the banks, was not impacted at all here in Canada. Again, the 18,000 was with regard to payment, process, and data that resided in the U.S. where there was a transaction between a consumer and our U.S. merchant.

In terms of the timeline, I just want to clarify the Canadian portion of the records that were impacted came to light on or about September 4 or 5, with all the experts and everybody working around the clock. The Canadian pieces came to light late in the game, in the investigation. When we found out my timeline on the 7th, we notified all the appropriate commissioners. We contacted our clients. We did what we could from a Canadian perspective to best serve those Canadian constituents, and at the time we didn't even know how many there were. We worked with our incident response team and our leadership team in Canada to make sure we got the correct information, that we worked with our teams south of the border to ensure we had all the tools at our fingertips. Once we had that information, we provided the consumers with the protections in place, the monitoring they could subscribe to affording them protection of their identity, and you heard the features of that product.

To ensure this doesn't happen again, just to summarize, we've enhanced our vulnerability scanning, our patch management processes and procedures. We've reduced the scope of sensitive data retained in our back-end databases. We've also increased restrictions and controls for accessing data housed within critical databases. We've deployed additional web application firewalls. The list goes on in working with internal and external experts. It wasn't that we didn't have good systems in place, but we want to be better.

[The Chair, Conservative, Bob Zimmer]

Thank you, Ms. Boucher.

Next up is Mr. Weir, and then Mr. Erskine-Smith.

[Erin Weir, NDP, Regina—Lewvan, SK]

The Privacy Commissioner has initiated an investigation into the Equifax breach. I'm wondering if you could speak to that investigation, and how you're working with the Privacy Commissioner.

[John Russo]

Our team is working with the commissioner's office, along with our external counsel, Ms. Bernier. We've had regular meetings with them since the initial phone call within the first 24 hours when we were notified on September 7. We've worked with them. We've worked with all the privacy commissioners across Canada. The investigation is ongoing. We're, again, compiling our answers to the questions they had and working to answer them in a fulsome manner so they can complete their investigation in due course. We've been very transparent. Again, accountability and transparency drive our corporation, and we want to make sure we're doing the best for the consumers and the best for all our clients.

[Erin Weir, NDP, Regina—Lewvan, SK]

That's good.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Weir.

Next up is Mr. Erskine-Smith.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I have a few small questions.

There was a preliminary report released in relation to the internal investigation. Is there a final report that's public?

[John Russo]

In terms of the Mandiant report?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

That's right.

[John Russo]

It's a confidential report.