Information & Ethics Committee on April 17th, 2018

[Daniel Therrien]

We actually have robust authority to share information with other data protection authorities, either in Canada or internationally, in the conduct of investigations. What we're missing, as we all know, at the end of the investigation is the ability to make orders and impose fines when needed, but the powers to actually compel the production of evidence and to share information with other privacy regulators is adequate.

[Raj Saini, Liberal, Kitchener Centre, ON]

Do I have some time, Mr. Zimmer? Okay.

[Daniel Therrien]

On the point raised by Mr. Angus, though, who says there are many regulatory areas, including perhaps competition, there are holes there. I can share with the U.K. privacy office, but I cannot share with the Canadian Competition Bureau.

[Raj Saini, Liberal, Kitchener Centre, ON]

Okay. That's a good point.

Mr. Vickery, I have a lot of questions, but unfortunately I have limited time. Let me just start off with one.

There are stories about Cambridge Analytica retaining AggregateIQ in order to get around certain British laws. Can you comment on this, and perhaps comment generally on some of the outsourcing work that may have been done to get around the laws of particular countries, especially when you talk about foreign campaigns? Kenya is an example also.

[Chris Vickery]

What I can say on this is that there were not invoices, receipts, or things of that nature included in the GitLab repository that I downloaded. Exact smoking-gun receipts and pieces of paper saying “we paid this much to this person”—that's not present. However, I can clarify my current understanding that is based upon everything that I have read and looked into and believe. A good example of money flowing between Cambridge Analytica and AggregateIQ is the development of the Ripon platform that was developed during the early time of Ted Cruz's 2016 presidential campaign, where Ted Cruz's campaign believed they were paying Cambridge Analytica for this product, development, or whatever service, but in actuality it was AggregateIQ that was doing the developing, creating the product, and basically being the workhorse on it, while the cheques were going to Cambridge Analytica.

Does that give a good example of the flow there?

[Raj Saini, Liberal, Kitchener Centre, ON]

You mentioned cryptocurrency. Could cryptocurrency be used as the way to hide payment between entities who may be using the information?

[Chris Vickery]

The possibility is there. I want to emphasize that I have no current reason to believe that any money laundering has occurred, but I think it is worth looking into.

[Raj Saini, Liberal, Kitchener Centre, ON]

Okay.

I know that UpGuard produced a report on deciphering AggregateIQ's activities. I tried to read the report, but unfortunately, I don't know code. Can you kind of summarize the report for us?

[Chris Vickery]

Which one? We've put out four now.

[Raj Saini, Liberal, Kitchener Centre, ON]

I think it's the fourth part.

[Chris Vickery]

That's the most recent one regarding Canadian politics and such. That report confirmed the names that are present. It doesn't necessarily mean that because a candidate's name appears in a project that AggregateIQ was working on.... It doesn't mean that candidate was necessarily doing anything nefarious or that anything unlawful occurred. They could have been hooked up with AggregateIQ through no malicious intent whatsoever; somebody just suggested them or whatever. But we did see projects with names, including Todd Stone, Andy Wells, and Doug Clovechok. The B.C. Greens had some folders in there. I believe a lot of this has been sussed out by the Canadian media already. There should be several articles explaining the various levels of involvement, if our reporting didn't give you a good enough view.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Saini.

Next up, for five minutes, we have Monsieur Gourde.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

My question is for you, Mr. Therrien.

About two weeks ago, in an interview that you gave to a national French-language media outlet, I heard you say that a gray area surrounds the information collected by the political parties. I would like some clarification on that.

All politicians and political parties receive the voters' list, which includes each citizen's first and last name, full address, permanent voter number, and polling station location. Everyone has access to that, not only the political parties, but also the candidates running in a constituency, whether they are independent candidates or not. However, to the great dismay of all those politicians, the list has no phone numbers.

When we were all younger, it was relatively easy to find a phone number using a phone book, because 80% of subscribers to a fixed telephone network were listed in it. When we wanted to call someone, we just had to look up their name in the directory. Then we could add their phone numbers to the voters' list.

Mr. Therrien, are Canadians' telephone numbers now considered information covered by privacy? Should they not be accessible to political parties, or is this an example of a gray area? We have fixed telephone networks and we also have cellular networks. However, cellphone numbers are becoming more difficult to find. A phone number in a fixed network is public, but a cellphone number is not.

[Daniel Therrien]

There is obviously nothing wrong with political parties wanting to communicate with voters. However, to answer your specific question about whether the parties should have access to telephone numbers or other personal information, I would say that the notion of consent should come into play, given the principles of privacy. If an individual's phone number is not public and that person does not want to disclose it to anyone, including a political party, it should be possible for them to keep that number confidential.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

So there is a distinction to be made between the telephone numbers in a fixed network, which can be found in any telephone directory, and the ones in a cellular network.

Can we assume that, when a telephone number is listed in a telephone directory, it means that it has been authorized in advance?

[Daniel Therrien]

It's public information.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

So a cellphone number is not considered public information?

[Daniel Therrien]

Some are public and others are not; it depends on an individual's decision whether or not to give consent.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

To obtain someone's consent, you have to phone them. If we do not have a phone number to reach that person, what can we do? Should we go and see them?

[Daniel Therrien]

Um, yes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

You will understand that that is a great challenge: we have to reach 85,000 voters in the 40 days of an election campaign, not to mention the fact that people are not there year round. That's about 2,500 doors a day to knock on, which is physically impossible, even with a team of 15 people. You really have to take the time to talk to people.

The basic problem for people wishing to engage in politics is that they cannot access a minimum of information about voters. So we use technological means to get an idea of their allegiance. We do not hide it: if we want their phone number, it is so that we can call them, even if we can always go see them. At the end of the day, the information that politicians want is whether they can count on their support. If the person clearly says that they support a certain candidate, the candidate will keep the information, and then make sure that the person goes to the polls on election day. Political party lists get longer over the years, and they can still be used if, of course, the information is up to date. But there is a margin of error, nevertheless.

If Canadians decide to get into politics and do not have access to a minimum amount of information, can we blame them for using tactics that will save them time and show them voting patterns as early as possible?

[Daniel Therrien]

I would actually tell you to tackle the problem of access to a minimum of information. As I understand it, you are saying that the voters' list does not allow you to obtain the minimum amount of information you need to be able at the very least to communicate with someone and to check whether they are going to support you or not. Revisiting what constitutes a minimum of information seems to be the solution to me, not finding other ways to communicate with people.

At the end of the day, we have the concept of consent, but I fully understand that the desire of parties to want to communicate with voters is extremely legitimate and that it may be necessary for them to obtain a minimum of information in order to do so.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Let me go back to the gray area. Would it not be fairer for the legislation to allow the numbers to be distributed to all political parties and to all those running for election in the ridings? We could perhaps take the phone numbers out of the gray area and make the information accessible to everyone.

For example, someone running as an independent candidate, who has never done the research, can use the list of first and last names and addresses, but they will never have the time to find the phone numbers. So they are at a real disadvantage compared to all those who have been representing political parties for 25, 30 or 40 years.

Do you not think it would be fairer to at least give the same basic information to everyone so that everyone is on the same footing at the beginning of an election campaign?

[Daniel Therrien]

That seems to be the case. I am not an expert on the subject, but I understand that all parties have some information that comes from the voters' list.

You say that the information does not give you the minimum amount of information you need to communicate with electors. So that is a valid question that can be studied. You could look into the matter.

On the other hand, when I talked about a gray area, it was in the sense that, since I do not have the jurisdiction to verify how the parties use the information, I do not know what is going on. Parties have privacy policies in place to ensure a minimum of rules in their dealings with voters. However, neither I nor any other independent person can verify what is happening. So that's what I meant by “gray area”, an area with no independent arbitrator who can ensure that the rules in place are followed.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Gourde.

Next up is Mr. Baylis for five minutes.