Information & Ethics Committee on Feb. 6th, 2024

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

I have one last question, if I have the time.

During the course of your testimony, Mr. Brisson, you indicated that Natural Resources uses forensic digital tools in order to mitigate threats. Are these threats solely with respect to the department's own internal systems, or does this include threats relating to Canada's natural resources?

[Pierre Pelletier]

That's a really good question. I would argue that it's mostly related to the data that are transiting within NRCan's business—the science and the research associated with it. For natural resources, it's outside of my ability to answer. I do not know.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you, Mr. Chair.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Kelloway.

On behalf of the committee, I want to thank the witnesses from our first panel: Mr. Yarker, Ms. Martel, Mr. Brisson and Mr. Pelletier.

We will suspend the meeting for a few minutes to set up the next witness panel.

[The Chair, Conservative, John Brassard]

Welcome back, everyone.

We're going to start our second panel.

As a reminder to all our witnesses, please be mindful of the earpieces. Keep them away from the microphones when you're speaking to protect our interpreters from any hearing damage.

I would like to welcome the witnesses appearing during the second hour of our meeting today.

From the Canada Border Services Agency, we have Mr. Aaron McCrorie, who is the vice-president, intelligence and enforcement. From Correctional Services Canada, we have France Gratton, assistant commissioner, correctional operations and programs, as well as Tony Matson, assistant commissioner and chief financial officer, corporate services.

From the Royal Canadian Mounted Police, I want to welcome Mr. Bryan Larkin, who is our deputy commissioner, specialized policing services, and Nicolas Gagné, superintendent, Royal Canadian Mounted Police.

We're going to start with opening statements of five minutes.

Mr. McCrorie, I understand that you are going first. You have five minutes. Please start.

Thank you.

[Aaron McCrorie, Vice-President, Intelligence and Enforcement, Canada Border Services Agency]

Thank you, Mr. Chair.

As stated, I am Aaron McCrorie. I am the vice-president for intelligence and enforcement at the CBSA. It's a pleasure to be here today.

Beyond the CBSA's role of processing people and goods at the physical border, the CBSA is responsible for enforcing Canada's border legislation, including the Customs Act and the Immigration and Refugee Protection Act.

This responsibility includes conducting criminal investigations into alleged offences under border legislation. It is within this investigative purview that the CBSA uses digital forensics hardware and software in order to unlock and decrypt seized digital devices and subsequently search for evidence of offences. I like to think of it as using a locksmith to open a locked box that has evidence within it.

Devices examined by the CBSA's digital forensics teams have been seized pursuant to specific court orders such as search warrants or judicial authorizations issued to CBSA investigators. The data extracted from seized digital devices is processed only within the CBSA's own digital forensic laboratories and is provided only to those having lawful authority to access that data.

We are currently governing our use of this using the privacy information bank, which outlines clearly the types of information that we are gathering and the uses that we put it to.

We are also in the process of working with our internal partners on a privacy impact assessment. We started that work in 2020. Unfortunately, it was delayed for a number of reasons. We are continuing that work and will be engaging with the Office of the Privacy Commissioner to finalize that privacy impact assessment.

I'd also like to clarify that spyware is typically defined as software installed in a device for the purposes of covertly intercepting, monitoring and/or gathering a user's activities or data. I want to assure the committee and the Canadian public that digital forensic tools utilized by the CBSA's investigators are not spyware. We use digital forensics hardware and software to unlock and decrypt seized digital devices as an important tool in our efforts to enforce border-related legislation and to protect Canadians.

I want to assure the committee members again that only properly trained investigators acting with judicial authorization use this technology.

Thank you for the opportunity to appear before you. I will be happy to answer any questions you may have.

[The Chair, Conservative, John Brassard]

Thank you, Mr. McCrorie.

Next, we'll go to Ms. Gratton.

Please go ahead for up to five minutes.

[France Gratton, Assistant Commissioner, Correctional Operations and Programs, Correctional Service of Canada]

Hello everyone.

Mr. Chair and members of the committee, thank you for the opportunity to appear before you today as part of your study.

My name is France Gratton, and I am the assistant commissioner for correctional operations and programs with the Correctional Service of Canada. With me today is Tony Matson, assistant commissioner for corporate services and chief financial officer.

Protecting the safety and security of our institutions and our communities while promoting the safe rehabilitation of offenders remains our biggest priority.

By its very nature, managing offenders poses various challenges, including the ongoing threats posed by the introduction and circulation of contraband. Contraband is defined as any item that could jeopardize the security of the institution or the safety of persons when that item is possessed without prior authorization.

As per our legislative authority, contraband such as electronic devices will be seized. In response to the risk posed by the presence of contraband cellular phones and illicit drugs, CSC must leverage technologies to aid in detection and in intelligence development.

In this context, CSC secured tools to extract digital information for intelligence purposes. We do not use these tools to conduct investigations on devices that are owned by staff, visitors or volunteers. Access to these tools is limited and controlled. The tools are used only on stand-alone computers that are not connected to any corporate network. Strict safeguards are in place to limit access to any extracted data.

In the past, CSC has undertaken the privacy impact assessment checklist on CSC's digital forensic activities. As the use of enhanced tools to combat criminal activity has expanded over the past few years, CSC has committed to renewing the initial assessment and to completing an updated checklist.

We remain committed to upholding our privacy obligations with established and appropriate safeguards in place.

Thank you. I welcome any questions that you may have.

[The Chair, Conservative, John Brassard]

Thank you for your opening remarks, Ms. Gratton.

Mr. Larkin, you're next for up to five minutes. Go ahead, sir.

[D/Commr Bryan Larkin, Deputy Commissioner, Specialized Policing Services, Royal Canadian Mounted Police]

Thank you.

Good afternoon, Mr. Chair and honourable members of the committee.

I'm pleased to be joined by Superintendent Nicolas Gagné, who's the director of the RCMP's technical investigative services operational directorate.

We're also very grateful for the opportunity to speak to you today about the RCMP's use of tools that extract and analyze information from digital devices that are essential to modern-day policing.

First, I would like to acknowledge and confirm that the RCMP does use some of the digital forensic tools that were cited in the December 2023 CBC article, including both Cellebrite and Graykey, which is now also known as Magnet Forensics.

The media reports suggesting that these digital forensic tools are considered spyware are inaccurate, though, and I will clarify that through your questions.

These tools are used on digital devices that are lawfully seized through criminal investigations. They obtain and analyze data on a device that is in possession of the RCMP. We use judicial authorization, search warrants and general warrants required from the courts, specifying how, what devices and the time frame during which we can collect the information from these devices by trained and skilled investigators. These tools are not used in any way for surveillance and/or mass surveillance.

For criminal investigations, the RCMP only uses these tools to extract and recover data in support of its mandated activities under the following circumstances: prior judicial authorization from our Canadian courts and within the prescribed limits of the search warrant; voluntary consent from the device owner, such as a witness to a crime and/or the victim of the crime; and/or under exigent circumstances when it's not possible to obtain a warrant, as defined under the legislation of the Criminal Code of Canada.

For administrative investigations, the RCMP does have legislation and policies that govern our use. The lawful ability to request assistance from our digital forensics program does exist within our organization. The collection of evidence through these tools is based on necessity and proportionality to the allegations of the internal conduct investigation. We would only perform an examination on RCMP-owned devices, and any personal device would require a judicial warrant.

While these tools can allow full access to all the information on the device, only that which is specified in the warrant or relevant to the administrative investigation is provided to the investigators.

Despite the privacy protections in place, the RCMP recognizes the inherent privacy issues related to these tools and the need for transparency and accountability. In January 2021, we provided a technical briefing to the Office of the Privacy Commissioner on digital forensic tools, and a privacy assessment is currently under way and is expected to be completed by mid-2024.

Again, thank you for the opportunity to be here. We look forward to your questions.

[The Chair, Conservative, John Brassard]

Thank you, Deputy Commissioner Larkin.

We're going to start with our first six-minute round.

Mr. Brock, you have six minutes. Go ahead, please.

[Larry Brock, Conservative, Brantford—Brant, ON]

Thank you, Chair.

Thank you to the witnesses for your attendance today. I'm going to start by making some opening remarks.

This story broke as a result of an ATIP from a York University professor, an expert in privacy. The data was turned over to Radio-Canada. Radio-Canada reached out to your respective departments asking if you're using the software, confirming that you're using the software, and if you had first conducted privacy impact assessments. According to their written responses, as per Radio-Canada, none did.

My first question is for the CBSA.

When did you purchase the software, sir, from Shared Services Canada?

[Aaron McCrorie]

The first procurement of Graykey was in March 2019. The first purchase of Cellebrite premium units was in March 2021.

[Larry Brock, Conservative, Brantford—Brant, ON]

How many times have you used this particular software in question?

[Aaron McCrorie]

I couldn't tell you exactly how many times we've used the software. What I can tell you is that, for example, in 2023, we had 119 criminal investigations during the course of which we seized 712 devices. When we say, “712 devices”, that will include, for example, the memory card or the SIM card that's in the cellphone, so a cellphone could count as three devices.

[Larry Brock, Conservative, Brantford—Brant, ON]

Will you table with this committee a number as to how many times you used this specific software from the date of purchase?

[Aaron McCrorie]

We'll do our very best. I can't assure you that we can count every single instance, but we can certainly give you stats.

[Larry Brock, Conservative, Brantford—Brant, ON]

We're talking hundreds.

[Aaron McCrorie]

I'd say yes.

In 2021, we seized—

[Larry Brock, Conservative, Brantford—Brant, ON]

We're talking about hundreds of investigations using this software and not once did your department seek out a privacy impact assessment. Is that correct?

[Aaron McCrorie]

We do have the PIB, which is the privacy.... I apologize—the acronym is slipping my memory.

[Larry Brock, Conservative, Brantford—Brant, ON]

Is it the PIA?

[Aaron McCrorie]

It's a PIB.

We post online what types of information we are gathering, under what circumstances we're gathering it and how we're using it.

We've started our internal process to do a program-level PIA because we want to do it at the program level, not at the device level.

[Larry Brock, Conservative, Brantford—Brant, ON]

You understand, sir, that the PIA is not optional.

[Aaron McCrorie]

Agreed.