Information & Ethics Committee on Feb. 8th, 2024

[The Chair, Conservative, John Brassard]

Good morning, everyone. I call the meeting to order.

Welcome to meeting No. 102 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Wednesday, December 6, 2023, the committee is resuming its study of the federal government's use of technological tools capable of extracting personal data from mobile devices and computers.

Today’s meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I just want to remind all members—I know that the witnesses have been briefed on this—to be mindful of the earpieces. If they're too close to the microphones, they could cause hearing damage to our interpreters.

I would now like to welcome our witnesses for the first hour. From the Department of Fisheries and Oceans, we have Brent Napier, acting director general, conservation and protection; and Sam Ryan, director general, integrated technical services. From the Department of the Environment, we have Hannah Rogers, director general, environmental enforcement; and Donald Walker, chief enforcement officer.

I'll start with the Department of Fisheries and Oceans. You have up to five minutes to address the committee.

Please go ahead.

[Brent Napier, Acting Director General, Conservation and Protection, Department of Fisheries and Oceans]

Hello and good morning, Mr. Chair and committee members.

My name is Brent Napier. I am the acting director general of the conservation and protection directorate at Fisheries and Oceans Canada. I am joined today by my colleague Sam Ryan, director general of DFO IT operations.

Before I begin, I would like to acknowledge that I am grateful to be joining you here on the traditional, unceded territory of the Anishinabe Algonquin people.

Mr. Ryan and I appreciate the opportunity to appear before this committee on behalf of Fisheries and Oceans Canada and provide you with information on the conservation and protection program and our national digital forensics service, which fall under my responsibility, and the cybersecurity digital forensic investigator service, which is under Mr. Ryan's responsibility.

It is the enforcement program of Fisheries and Oceans Canada. The Department’s mandate is to sustainably manage fisheries and aquaculture. The proper management of fisheries and marine and aquatic resources requires a robust compliance verification program.

C and P has over 550 fishery officers in locations across Canada. Our officers work with the general public, harvesters, indigenous communities and industry to conserve and protect Canada's marine and aquatic resources. Fishery officers verify compliance with fisheries-related statutes, such as the Fisheries Act and the Species at Risk Act, and take enforcement actions, including undertaking investigations and recommending prosecution for offences.

Historically, the harvesting and reporting of fisheries resources was all done using paper forms, such as logbooks and charts. As technology has advanced, harvesters have adopted new technology, such as chart plotters, electronic logs and electronic communication devices into their harvesting operations. To remain an effective enforcement organization, C and P has adapted its capacity, tools and use of technology. This includes the implementation of new units to support complex investigations, including those involving complex digital files, components and data. Digital forensics examiners are now part of the C and P team. They use new digital technologies, technological solutions and approaches to support digital enforcement investigations.

C and P's digital forensics team is centrally managed in Ontario and supports fishery officers across the country through regional labs. The digital forensics team is made up of seven experienced, highly trained and highly skilled digital forensics examiners. The training and technical solutions used by the C and P digital forensics team is in line with Canadian municipal, provincial and federal law enforcement standards. Before deploying any technical solution or retrieving any digital data, C and P's fishery officers and investigators seek a judicial authorization or warrant.

The IT operations' cybersecurity digital forensic investigator team uses digital forensics tools to support the department's mandate to promote and maintain compliance with legislation and regulations as well as internal administrative investigations into violations of Government of Canada policies, such as fraud or harassment in the workplace, and for supporting such cybersecurity activities as investigating cybersecurity incidents.

In the context of an administrative investigation, it is important to note that judicial authorization is not required. It is conducted with the full awareness and co-operation of the involved individual. The nature of the allegations and the subsequent investigation are defined within the investigation's terms of reference, which are shared with the involved individual.

In closing, the Government of Canada, including Fisheries and Oceans Canada, is committed to working with other federal departments and agencies, provincial and territorial governments, indigenous peoples and other partners to fulfill its commitment to protect, enhance and restore the biodiversity and health of Canada's marine and freshwater environments through an integrated ecosystem approach that supports the sustainable use of marine and aquatic resources.

Thank you for your attention. I will be happy to answer any questions you may have.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Napier.

Next, we're going to the Department of the Environment. You have up to five minutes.

Mr. Walker, I assume you're going to start. You have five minutes, sir, to address the committee. Go ahead.

[Donald Walker, Chief Enforcement Officer, Department of the Environment]

Good morning, members of the committee. It is a pleasure to be here with you today.

My name is Donald Walker, and I am the chief enforcement officer at Environment and Climate Change Canada. I'm joined by my colleague Hannah Rogers, who is the director general of environmental enforcement.

We are pleased to be here to explain our mandate and provide you with an overview of our operations. I will also talk about our use of digital forensics software.

Environment and Climate Change Canada administers several environmental statutes and their associated regulations. These include the Canadian Environmental Protection Act, the pollution prevention provisions of the Fisheries Act, and the Greenhouse Gas Pollution Pricing Act, among others. We also enforce wildlife laws, such as the Wild Animal and Plant Protection and Regulation of International and Interprovincial Trade Act, the Migratory Birds Convention Act and the Species at Risk Act.

The Environment and Climate Change Canada enforcement branch was formed in 2005 with a mandate to conduct inspections to verify compliance with these laws and their associated regulations, investigate possible violations and take action to compel compliance when violations are identified.

With nearly 500 employees across Canada, the Environment and Climate Change Canada enforcement branch is comprised of uniformed enforcement officers who have the powers and protections of peace officers when enforcing the laws under which they are designated. These officers conduct thousands of inspections per year to verify compliance.

If enforcement officers find sufficient evidence of an alleged violation under the environment and wildlife protection acts for which they are responsible, they will take appropriate action in accordance with our compliance and enforcement policy. These actions are designed to restore compliance and may include issuing warnings, directions, compliance orders, tickets and administrative monetary penalties. When the environmental harm or the factual circumstances warrant it, officers conduct investigations and collect evidence to support the laying of charges.

To this end, Environment and Climate Change Canada's enforcement branch works closely with colleagues at the Department of Justice Canada and the Public Prosecution Service of Canada to build prosecutable cases.

Since the creation of the enforcement branch, the nature of the non-compliance we uncover has changed and the evidentiary requirements to establish non-compliance in court have grown more complex.

While the majority of our regulated sectors are compliant, we also respond to non-compliance by organizations and individuals who sometimes go to great lengths to conceal or hide the negligence that led to serious environmental damage or biodiversity loss. This has only increased as the courts have issued more serious penalties.

In response to this changing reality, enforcement received a mandate in 2020 to modernize its operations. This included the implementation of a risk-based approach for setting its inspection priorities to ensure that its resources are targeted where the potential for environmental damage or impact on wildlife is greatest. It also included investments in new information technology infrastructure, data analytics capacity and digital forensics software, in large part to ensure that we could meet modern information management expectations as well as provide evidence to meet the standard of the courts.

Our digital forensics lab is staffed by a small number of specialized analysts. These employees are highly trained professionals, who are trained first as enforcement officers and then as digital forensics experts. This training ensures that they understand the limits of their authorities and the specific mandate of the digital forensics unit.

The digital forensics software we use can only be employed under warrant, and only within the context of enforcing Environment and Climate Change Canada legislation. Digital data that can be imaged or acquired are extracted on site during the execution of a court order. Devices from which data cannot be extracted on site are collected and brought to the national laboratory. Digital evidence that is collected typically consists of information that can be stored on smart phones, laptops, cloud-based storage systems, servers and flash drives.

Digital forensics analysts are the only people within Environment and Climate Change Canada who use such tools. Our department must continue to evolve and innovate to remain effective, but these new tools require that we continue to pay close attention to how we manage information, particularly as it relates to privacy.

Environment and Climate Change Canada takes privacy very seriously and to this end enforced a comprehensive review of its information management procedures, including for the use of digital forensics software. We are completing new privacy impact assessments, with those that focus on our operational activities being prioritized. We communicated our intentions to the Privacy Commissioner in June 2022.

This review, which started in 2023, will include specific tools like digital forensics software. The operational components are our priority. The privacy impact assessment that covers forensics software will be completed in the upcoming fiscal year.

Thank you for your attention. I will be happy to answer questions from the committee.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Walker.

First of all, I want to welcome the members of the committee who are here today. We have an all-star cast.

Mrs. Kusie, Mr. Oliphant, Mr. Housefather and Ms. Idlout, welcome to the committee.

We're going to start our first six-minute round with Mrs. Kusie.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Thank you very much.

Mr. Chair, it's always a pleasure to be here at the ethics committee, the ethical heartbeat of Parliament, since the Prime Minister doesn't have one.

I'd like, first of all, to thank my colleagues for their good work with the Privacy Commissioner, Philippe Dufresne, who said he first learned of these tools being used by at least 13 federal departments and agencies through a Radio-Canada report published in November—shocking. He also stated that his office should not be learning about the use of such technology after the fact, which I think is a very important piece of information, despite the fact that in appendix B of the directive on privacy impact assessment, it states:

Government institutions seeking Treasury Board approval for—

Of course, Mr. Chair, I do fundamentally hold the President of the Treasury Board responsible for this incredible lapse. It continues:

—activities that involve personal information are responsible for:

Making every reasonable effort to initiate the PIA at the earliest possible phase of project planning; [and]

...identifying the timelines for the completion of the PIA....

However, the Privacy Commissioner told this group, my colleagues, that he learned about this after the fact.

Mr. Ryan, did your department procure surveillance gear that can be used to access employees' information and potentially the information of Canadians at large—yes or no?

[Sam Ryan, Director General, Information Technology Operations, Department of Fisheries and Oceans]

Thank you very much for your question.

We do not have surveillance equipment. I think you asked about surveillance gear. We do not have surveillance equipment. The actual software that we have is used as part of our administrative investigations, and it's used with the full understanding of the employees involved. It follows a very rigorous process where we go through a terms of reference that is shared with the individuals, and they're fully aware about what is within and not within the scope.

Again, it's not surveillance, because we actually have to have the equipment. Whether it's a laptop in question or a government-issued phone in question, they have to be within our forensics unit.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Okay.

Was this software procured without the use of the privacy impact assessment?

[Sam Ryan]

I believe the software in question is one of our forensic tools. Again, like all software, it goes through many different iterations of the tool. I think that tool has been sold for many years, potentially more than 10 or 15 years. I believe it started to be used when it wasn't possible to actually copy your contact details from your flip phone. I believe that's how this software came into being.

Again, it's more than, I think, 15 or 20 years that these forensic tools have been in place, and I believe the PIA came into force in 2010 approximately.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Okay, but is a PIA required for these tools?

[Sam Ryan]

Again, a PIA, as I understand it, is part of the overall process or program that's being evaluated. When we're looking at it, again from my perspective, it is administrative investigations, so that process or that program has been in place for many decades. The tool that we're talking about—

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Was it required for the tools, the PIA? Is it required for this software?

[Sam Ryan]

Again, the PIA is not software-specific. It is for the program. The tool is one part of the program.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Okay. I will take that as a yes.

Did you receive any direction from the Treasury Board when it was announced that your department had not filled out the required PIAs?

[Sam Ryan]

I, personally, was not a part of those communications. I know within our department the ATIP office was in communication, I believe, both with the Privacy Commissioner and with Treasury Board. That is the mechanism by which the communication happens within our department, the central agency and the Privacy Commissioner.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Okay.

Have you received any indication from the President of the Treasury Board on enforcing compliance with this important requirement for the PIA? Have you received any direction from the Treasury Board specifically?

[Sam Ryan]

Again, from my perspective, all those communications would happen between our ATIP office, the Treasury Board and the Privacy Commissioner. Those communications have happened, I believe, but I'm not personally privy to the specific communications.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Mr. Walker, do you have the same software, or has your department procured surveillance gear similar to that of Mr. Ryan or otherwise, to access employees' information and potentially the information of Canadians at large?

[Donald Walker]

We have acquired the same software about which we are speaking today.

It is not intended for ongoing surveillance of Canadians. We do not, in Environment and Climate Change Canada, use the software for employee devices.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

What is your justification for procuring this software without the use of a privacy impact assessment?

[Donald Walker]

I will turn shortly to my colleague, Ms. Rogers, to talk a little bit about the protections we have in place.

At the time that the digital forensics unit was established in 2013, this was viewed as a natural evolution of the search warrant process, where we seek court orders to acquire specific information.

Certainly, we would not expect that the enforcement branch of Environment and Climate Change Canada would not access information unless it had been printed for the purposes of pursuing non-compliance under environmental or wildlife protection legislation.

I would ask Ms. Rogers to speak briefly about the protections in place.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

That's fine, Mr. Walker.

Can you be clear as to whether you received any direction from the Treasury Board when it was announced that the required PIAs were not filled out for this type of software?

[Donald Walker]

Like my colleague, I cannot say definitively whether the department received specific information from the Treasury Board, but Environment and Climate Change Canada already had a privacy impact assessment development process under way at the time of the reporting on this last year.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Thank you, Chair.

[The Chair, Conservative, John Brassard]

Thank you, Mrs. Kusie.

Next, we're going to Ms. Khalid.

Go ahead for six minutes, please.