Information & Ethics Committee on Feb. 8th, 2024

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Okay. Thank you for that.

There is concern around the privacy impact assessment. Certainly I hear from constituents often who will look at a job advertisement they see through ECCC, and it looks like the minister is hiring climate police who may target a farmer. Certainly that has led to an incredible erosion of trust in our institutions, and certainly the people I speak with have very little trust in what this government is doing.

As well, when the Privacy Commissioner was here, I asked very specifically about whether or not he would be able to provide advice to departments that were interested in ensuring they were compliant. The Treasury Board rules indicate that PIAs are not an option. There are some questions about whether they're a legal requirement, but the regulations say very clearly....

It baffles me as to why there would not be pre-emptive work done to ensure that Canadians' rights and privacy are protected.

In 20 seconds or so, I'll start with DFO. Why was a PIA not done beforehand?

[Brent Napier]

I think you've heard that many of these tools are long-standing, so 2013 was when DFO first started to use them. At that time there was a different environment. There were rigorous measures taken to secure and ensure that privacy was respected.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you for that, but a PIA was not done before this most recent tool was purchased. My unsolicited advice to you and your superiors, which I would encourage you to pass on, is do the PIA, call the Privacy Commissioner and get it done.

I'll give ECCC the same opportunity.

[Donald Walker]

Certainly, I think the Treasury Board directive associated with privacy impact assessments appears to have been viewed, at the time, as not applicable to this particular work because it was not intended to collect, store or treat personal information. As a result of a more comprehensive review undertaken in 2022, the decision was undertaken to complete privacy impact assessments across areas of our work.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'm basically out of time here. Again, I'm going to give unsolicited advice: Do the assessment. Pick up the phone. To your superiors, pick up the phone and call the commissioner, because right now Canadians do not trust what agencies and departments of this government are doing. They do not trust them with their private information, and when possibly misleading information is being provided to reporters, which has been acknowledged here today, there are a whole host of reasons as to why that trust seems not capable of being extended to this government. Please pick up the phone and do the work beforehand.

[The Chair, Conservative, John Brassard]

You are out of time, Mr. Kurek. Thank you.

Mr. Housefather, go ahead for five minutes.

[Anthony Housefather, Liberal, Mount Royal, QC]

Thank you, Mr. Chair.

This government has been mentioned multiple times. You bought the software in 2013. Is that correct?

[Donald Walker]

Yes. We established the computer forensics unit in 2013.

[Anthony Housefather, Liberal, Mount Royal, QC]

Who was the prime minister in 2013?

[Donald Walker]

It was a different prime minister in 2013.

[Anthony Housefather, Liberal, Mount Royal, QC]

It was Stephen Harper. Thank you very much.

When did you buy the software?

[Brent Napier]

It was in 2013 as well.

[Anthony Housefather, Liberal, Mount Royal, QC]

Who was the prime minister in 2013?

[Brent Napier]

It was Stephen Harper.

[Anthony Housefather, Liberal, Mount Royal, QC]

At that time, the requirements were the same—to do a PIA—so obviously, if you're going to blame the Treasury Board president, whoever was Treasury Board president at that time is the one who should be accountable. Thank you very much.

Now let's get to the real chase of things. We're doing this study because people are worried that there is some type of.... The original CBC article that Mrs. Kusie read from talked about spyware. Spyware is a surreptitious thing that you're putting on somebody's phone to extract information on an ongoing basis, to use for nefarious purposes. Do you guys use spyware at all, or malware?

[Donald Walker]

No, and I can pass it to my colleague for greater detail.

Unlike spyware, the tools that we use are for the extraction of existing data under a specific court order and with the owner's knowledge. It is not clandestine. It is not ongoing. There is no software installed on the device, and it is not conducted remotely. There's no ongoing component, which would be required for it to be spyware.

[Anthony Housefather, Liberal, Mount Royal, QC]

At Fisheries and Oceans, is it the same?

[Brent Napier]

It's exactly the same answer, yes.

[Anthony Housefather, Liberal, Mount Royal, QC]

The correct word for this would be an extraction tool. Is that right? It's something that you have in a secure location, and you need the device to extract the information, so somebody has voluntarily surrendered their device in each and every case or had a court order to order the production of that device. You then take the information off the device, but then you don't put some program on the phone so that, when it goes back to that person, on an ongoing basis you can take away their information again. Is that correct?

[Donald Walker]

That is correct, except that in Environment and Climate Change Canada's case it is not a voluntary submission.

[Anthony Housefather, Liberal, Mount Royal, QC]

You do not also use it for employee discipline or violations of codes of conducts by employees, where at Fisheries and Oceans that is a possibility. For you, it's a court order. For you, either it's a court order, or it's voluntary surrender based on an agreement with the employee concerned.

I would imagine that at Fisheries and Oceans... Let's get into that because the other departments so far have generally said, or there are some that have said, that they use it for internal.... Once at the RCMP...but mostly they don't. In your case at Fisheries and Oceans, when somebody signs up as an employee, is it clear in the policies that the device could be used in this way?

[Sam Ryan]

Every time you log into the network we have an acceptable use policy. Every time you reboot your computer you access via a virtual private network—a VPN—the acceptable use policy. You accept it. It details what you can and cannot do. Again, these are not Department of Fisheries and Oceans policies. These are Government of Canada policies, so we are applying all of those policies.

[Anthony Housefather, Liberal, Mount Royal, QC]

I just want to get back to some terms that got used in the first round, which I think were maybe misinterpreted by people. I just want to come back to them.

You, sir, had talked a little bit about surveillance and surveilling Canadians when Ms. Khalid asked that question. It seemed frightening at the time because it made it sound like we were using technology, because this is all about using technology to surveil Canadians. That's not at all what you meant. Is that right?

[Brent Napier]

Fishery officers do monitoring, control and surveillance of the fishery, so there are Canadians active in the fishery—

[Anthony Housefather, Liberal, Mount Royal, QC]

But they're not using this technology to do it.