Evidence of meeting #102 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pia.
A recording is available from Parliament.
Conservative
Damien Kurek Conservative Battle River—Crowfoot, AB
Thank you for that, Chair.
In relation to COVID-related programming—so CERB, for example—I know there were 185 employees, it was reported, who had inappropriately collected CERB cheques. I'm wondering; was this tool used in the process of determining the fault of those 185 employees?
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
The criminal investigations program does not have the mandate to investigate CERB offences. We do have the mandate to investigate other COVID benefits, and—
Conservative
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
I believe it would be the ESDC or law enforcement.
Conservative
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
The criminal investigations program, if we are investigating an offence of one of these pieces of legislation, we could use the tool to gather information if we've seized an electronic device during a search, but we would not use the tool to do an internal investigation of the actions of people within the agency.
Conservative
Damien Kurek Conservative Battle River—Crowfoot, AB
Over the course of COVID, was there...? I guess this is something that you could provide to the committee as well, whether there was an increase in the number of investigations that took place.
When it comes to the invocation of the Emergencies Act, were there any instances during the course of the invocation of the act when this technology was used?
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
No, not for the CRA.
Conservative
Damien Kurek Conservative Battle River—Crowfoot, AB
Okay. Thank you very much. Has there been an instance when it has ever been used without judicial authorization?
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
No. You need judicial authorization to do your search, and that's when you would seize an electronic device. You have to have judicial authorization.
Conservative
Damien Kurek Conservative Battle River—Crowfoot, AB
In terms of safeguards to protect Canadians' data, I know there have been a number of...and it makes headlines when the tax authority gets hacked. I'm just curious if you can outline what some of the safeguards are to ensure that Canadians' data is protected. It's incredibly intrusive to have a copy of someone's cellphone. I'm wondering what safeguards are in place to ensure that Canadians' privacy is protected during the course of an investigation.
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
When we have a judicial authorization, that allows us to do a search and then we seize an electronic device. This would then be stored in a stand-alone computer, in an area that only our computer forensic analysts have access to. It's not connected to the Internet. It's not connected to the network of the CRA. These stand-alone computers are in a secure area that allows for maximum protection.
Conservative
Damien Kurek Conservative Battle River—Crowfoot, AB
Just to wrap up—it's not a question; it's just to make sure—the Privacy Commissioner was here, and he said that phone calls are welcome when asking for advice. I appreciate that there were PIAs done. That's certainly helpful, but make sure that you, your employees and superiors.... The Privacy Commissioner wants to work with you to make sure that the information of Canadians is protected. Certainly, transparency by default is an expectation I would hope we all have for every agency of government.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Kurek.
Mr. Bains, you have five minutes. Go ahead, please.
Liberal
Parm Bains Liberal Steveston—Richmond East, BC
Thank you, Mr. Chair.
Thank you to the agencies for joining us today.
My first question is for the CRA. We heard before how you gather evidence, and if the evidence requires, then the steps are taken to get judicial consent to go in and try to extract information by using these tools. I have just a couple of questions.
How many CRA employees have access to these forensic tools?
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
We have, in criminal investigations, approximately 700 employees. Approximately half of them are part of the investigative groups, but the computer forensic analysts are a very small subgroup of specialized people who can do this type of work. I don't have the exact number, but that's something we can provide to the committee.
Liberal
Parm Bains Liberal Steveston—Richmond East, BC
Please do, but let's say an investigation takes place. Only a specific number of investigators would be looking at that. Not everybody would have access to these files.
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
It's only the people who are involved in the investigation. It's on a need-to-know basis, so it's not even all the investigators who would have access. It's only the people who are involved in the file, and actually, the investigators get access to only the information that is relevant. The CFAs—our computer forensic analysts—will sift through the electronic devices and take out what is relevant for the investigation, and that's what the investigators will look at.
Liberal
Parm Bains Liberal Steveston—Richmond East, BC
What's the level of security clearance inside the agency for those who are authorized to access these tools? What are some measures you've taken inside the agency?
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
Our criminal investigations, the investigators and the computer forensic analysts, have secret clearance, and the information that we have is stored in special areas that only our computer forensic analysts have access to on stand-alone computers. The security on these computers has been assessed to be adequate to protect the information, and the risks appear to be low.
Liberal
Parm Bains Liberal Steveston—Richmond East, BC
Now let's say someone who's not assigned to a case tries to access something. You would be alerted in some manner. You have those measures in place.
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
Yes, but not me personally. Maybe, ultimately, if there were some wrongdoing—
Director General, Criminal Investigations Directorate, Compliance Programs Branch, Canada Revenue Agency
The criminal investigations unit has some processes in place to limit who has access. Outside of criminal investigations, nobody has access to our files.
Liberal
Parm Bains Liberal Steveston—Richmond East, BC
Are these tools used strictly to access data? I think you've already mentioned that it's specific to the cases you've investigated. What about cloud-based databases or data that's out of scope that's accidentally accessed?