Information & Ethics Committee on Feb. 15th, 2024

[The Chair, Conservative, John Brassard]

Good morning, everyone.

I'm going to call the meeting to order.

Welcome to meeting number 104 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Wednesday, December 6, 2023, the committee is resuming its study on the federal government's use of technological tools capable of extracting personal data from mobile devices and computers.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders of the House. Members may participate in person, in the room, and remotely using the Zoom application.

I just want to remind everyone again, as I always do, to make sure to keep the earpieces away from the microphones so that we don't harm our interpreters or Mr. Light.

I'd now like to welcome our first witness for this hour. As an individual, we have Mr. Evan Light, an associate professor.

Mr. Light, I want to welcome you to the committee. You have five minutes to address the committee.

Go ahead, please.

[Evan Light, Associate Professor, As an Individual]

Good morning, ladies and gentlemen.

My name is Evan Light, and I am an associate professor at York University's Glendon College.

I am an associate professor of communications.

I will give my opening remarks in English, but I welcome comments or questions in French, as well.

I am, as one of you mentioned on Tuesday, the source of the documents from which Radio-Canada has been doing the reporting since November 2023 on the use of tools capable of extracting personal data from mobile devices and computers.

The speed with which you've taken up the challenge of investigating the widespread use of mobile forensic devices throughout the federal government is, for me, quite impressive and demonstrates a deep respect for the fundamental human right to privacy. Privacy is not an abstract thing. It is a fundamental human right that is tied to other human rights. In Canada, it's been a human right since 1977. We're talking about something that's quite fundamental.

For me, that means it's a right that should not be violated unless we have a very good, well-documented reason to do so. I think the testimony that's been given to you by agencies so far hasn't necessarily shown that their use is what we could call “necessary and proportionate”, which is a term that has come up at various times during your recent meetings.

From 1977 forward, successive governments have failed to protect our fundamental right to privacy. This committee, at this moment, has a really great opportunity—not just an opportunity but an obligation—to step up and examine how government protects the fundamental right to privacy.

I've forwarded numerous documents to the committee. Some have been translated and some have not, so you don't have everything I'll be talking to you about today. I want to talk about these issues and get into some of the testimony from the agencies you've spoken with so far.

I first encountered these devices in 2020 when doing research for a course. A group in the United States documented their use throughout over 2,000 police forces in the United States. There's been further documentation by the Carnegie Endowment in the United States, documenting the use of these tools by various regimes throughout the world and how they're tightly integrated with spyware.

As a quick note on terminology, I don't see MFDs—mobile forensic devices—as being spyware. It's come up numerous times at this committee. However, they have essentially the same capabilities. They're sold by the same suppliers and they're used by the same entities. I don't think we need to get hung up on terminology. I think it's important that they are equally invasive and equally unregulated in their use—if not more widespread and more unregulated in their use.

My concern is not that these devices exist, but that their use is completely unregulated. Various agencies that have testified to you have said that they don't really know how they use them. They don't keep numbers. CBSA said they use them all the time, but they can't tell us how many times they use them. Shared Services Canada testified on Tuesday that they don't have any actual policies or procedures on how they use them. Scott Jones decides, as an individual, when their use is warranted.

As noted by witnesses to this committee, the devices are relevant. They've been renewed many times. I believe Mr. Mainville, from the Competition Bureau, mentioned on Tuesday that they've been using these devices since 1996, which was an amazing revelation to me. It shows that these things have been used regularly by government for decades. They have been and continue to be unregulated and without any oversight.

Throughout the committee meetings related to this study, members of the committee and witnesses have used the phrase “necessary and proportionate”, or portions of it. I think this phrase is really key to understanding the use of mobile forensic devices or any sort of surveillance technology by government. It's actually tied to a document that came out in 2014, which was developed by 16 civil society organizations around the world. It's been endorsed by about 600 organizations and around 300,000 individuals. It's called “Necessary and Proportionate: International Principles on the Application of Human Rights Law to Communications Surveillance”.

There are legal frameworks to work on. There are standards for understanding how to do surveillance while respecting human rights, which is something that I think Canada can learn from and maybe should.

I'll be quick. I'm almost at my five minutes. I'll finish with a quick note on some of the recent testimony.

Shared Services Canada and various other organizations have said they only use mobile forensic devices in isolated labs, which gives the impression that they're really cut off from the world. Based on the capabilities of the devices they own, this is patently false. In the contracts that I forwarded to this committee, various entities, including CBSA, CRA, ECCC, the RCMP and TSB all have what's called UFED Cloud, which is a software package from Cellebrite that essentially lets someone access any cloud applications that are on somebody's phone. It's advertised as a way to get around warrants.

In addition, as my last comment, various agencies have ruggedized versions of these devices. “Ruggedized” means they're able to go into the field and be dropped and thrown around. They would not be buying ruggedized devices if they were to be used only in isolated clinical labs.

I welcome any questions.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Light. I appreciate it. You had a little extra time there. That's okay for one witness. I don't mind giving a little extra time to a single witness.

Regarding the documents that Mr. Light referred to, there are literally thousands of them, and some of them are quite large. It would be quite the task to translate those documents, as you can imagine, but there are some documents that are being distributed to the committee based on what Mr. Light has provided us, and they are being translated.

We're going to start our first six-minute round with Mr. Kurek.

Go ahead, sir, for six minutes.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Mr. Chair.

Thank you, Mr. Light, for coming here and for the information and the workup that has led to this investigation.

I would just note—I guess this is a request because it's tough sometimes to get to the meat of the matter within the time frame of questions—that you did mention that there are some recommendations on how a government can ensure that rights are respected while investigations take place. I would ask if you could, with your expertise, send to the committee specific recommendations—generally, a recommendation could be a couple of sentences—and if you could distill that to a point where the committee could say, “Okay, here's something that we could recommend to the government.”

I would also just note, for your information, Mr. Light, that I've filed what's called an Order Paper question asking for some more details on this over the extent of the entire government. I know that 13 departments were highlighted. Shared Services Canada indicated that there may be more than 13, so I have asked this question, and I am hopeful that the government will be forthcoming with that information. I think it has 45 days to reply to that, so that's probably in about a month and a half.

You talked about the right to privacy and that it's been acknowledged as a human right in Canada since the 1970s. One thing that I've found very interesting and that has led to a host of concerns is the differentiation that you have of these very powerful forensic tools for use for administrative purposes within the context of a department to look at an employee's device in administrative investigations or something to that effect versus a court order for investigative purposes for someone who is not an employee of the department and didn't sign a terms and conditions contract but rather is the subject of an investigation or a periphery witness to an investigation.

Could I ask you to expand a bit on what the difference is and how one reconciles the difference between the use of these very powerful tools for administrative purposes within, say, a department or agency versus for investigations where they would be used on Canadians, whether with judicial authorization or the various other forms for which we've been told they could be used?

[Evan Light]

Regarding their use internally, I think that most of the representatives of agencies who have testified so far say, “We use them on our employees, and we get their consent.” It's difficult if not impossible for employees to give informed consent in these situations, because there's an imbalance of power, and there's an imbalance of knowledge. We've seen in sessions of the committee just how difficult it is to explain what these devices are capable of. Consider this: If you are a junior employee and your manager says, “We're going to use this device on your cellphone”, you have no real alternative other than to say yes. I think that use internally is quite fraught and imbalanced.

In terms of its use with warrants, I think there needs to be a step before you get to a warrant. If we are talking about “necessary and proportionate”, there are questions that we should ask. Is this technology valid to be used to begin with? This is where privacy impact assessments come in, which I personally think are useless to a degree.

They basically account for self-regulation right now. There's no process that agencies or ministries are obliged to go through that would forbid them from using any technology. We saw in Scott Jones' testimony on Tuesday that he will buy this for anybody in government who wants it. There's no standard, which is mind-blowing.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

It's interesting that you bring that up. I've been very forthright in my advice—I reference it as unsolicited advice—to pick up the phone and call the Privacy Commissioner. We have an independent officer of Parliament, and any and all departments and agencies are a function of Parliament. I think that often gets forgotten.

Specifically with privacy impact assessments, if departments, agencies and the government in general were more forthcoming, doing things like privacy impact assessments and doing the outreach to the Privacy Commissioner prior to the use of these tools, do you think that would go a long way in helping ensure that the trust Canadians expect they should be able to have with government could be restored?

[Evan Light]

Personally, I don't think it would be enough.

The Office of the Privacy Commissioner should be properly resourced and empowered with judicial authority and with proper financial resources to be a proactive regulator. In the whole process of procurement, the Privacy Commissioner should be the one to decide whether or not technology should be used and in what use cases. I think that agencies themselves are in a conflict of interest, really, when it comes to making their own decisions around whether things should be used or not. There should be an objective arbiter, which would be the OPC.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Okay.

You're suggesting going beyond the privacy impact assessment and ensuring that there are more steps and more tools than the office has.

[Evan Light]

Absolutely. I think the privacy impact assessment is a useful tool for getting individuals and agencies to think about these ideas. I don't think it's a useful regulatory tool.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

If you have those specific recommendations, please feel free to send them to the committee. Often it's a sentence or two that articulates exactly what you've suggested, and with your expertise and background as well, you are also welcome to send supporting documents. I know that there is a ton of other information, but please feel empowered that you are welcome to send that to the committee after your testimony here today.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Kurek.

Mr. Light, generally what we try to do at committee is set a deadline on when that information can be provided. I'm going to set that deadline for a week from today at five o'clock. The clerk will follow up with you and remind you of what Mr. Kurek's request was.

Mr. Housefather, you have six minutes. Go ahead, please.

[Anthony Housefather, Liberal, Mount Royal, QC]

Thank you, Mr. Chair.

Thank you, Mr. Light, for being here today.

You were quoted in the CBC story as saying that you were troubled—deeply worried, I guess—by the information with which I presume you were presented by the reporter about the PIAs not being done in the 13 departments. You've heard, I imagine, the testimony from the different departments.

You don't in any way deny or disagree with their assessment that they're not using spyware or malware and seeking to spy on Canadians at large. Is that correct?

[Evan Light]

I have no evidence that would point one way or the other. I haven't done that research. I've done some.

Procurement is difficult to do research on. We work on contracts that are out there on the public record. I think that a lot of spyware companies sell their wares through third parties, so it's actually difficult research to do within government.

However, in the data that I've had, I haven't seen anything one way or another, so I cannot—

[Anthony Housefather, Liberal, Mount Royal, QC]

No, but they have testified that they don't use it.

You have nothing whatsoever to contradict that testimony. Is that correct?

[Evan Light]

No, I don't.

[Anthony Housefather, Liberal, Mount Royal, QC]

Okay. So, you have no basis to state the opposite. You just don't know. You're saying that you can't be sure that their testimony was truthful.

[Evan Light]

Exactly.

[Anthony Housefather, Liberal, Mount Royal, QC]

Okay.

With respect to data extraction technology, you have to have the device in your possession. Do you agree with that? That's not spyware or malware.

[Evan Light]

You need to have the device initially. There are hardware components to mobile forensic devices that enable creating an image from a phone. Imagine that you're pulled over at the border and that you're asked for your phone. It can take maybe five minutes to make a copy of somebody's phone. Then you have an image, just like a CD image, that can be put on a USB drive and that can be shared between agencies. Data becomes a portable thing.

[Anthony Housefather, Liberal, Mount Royal, QC]

Now you're saying that people are acting completing outside of the law, the limit of a warrant and the limit of their authority to do that.

You've had no testimony that has ever shown that any of that has happened. Is that correct?

[Evan Light]

That's correct.

[Anthony Housefather, Liberal, Mount Royal, QC]

You have no basis to say that, other than your supposition that this is hypothetically possible.

[Evan Light]

That's correct.

As well, I'm going on the basis of just the capabilities of these technologies and what they are advertised for. For instance, if you look into the Cellebrite marketing materials, you will see that they advertise their cloud capabilities as ways to work around warrants. In the past, you would need to get a warrant to use anybody's cloud account, to access their banking through their phone, to access their Google Maps or GPS history, etc. With regard to the cloud functionality that I mentioned these five agencies have, they advertise it as a way to work around warrants. You no longer need a warrant. You just need a phone or an image of the phone.

[Anthony Housefather, Liberal, Mount Royal, QC]

Again, I understand hypothetically what can be done with the technology. All I am substantiating is that we've had multiple people here who have testified, and none of them have said any of these things. As you know, when you're at a committee, whether you're sworn in or not, you are beholden to tell the truth under penalty of perjury or penalty of contempt of Parliament.

Nobody has testified to this. In fact, I'm just going to read what the CBSA said:

Devices examined by the CBSA's digital forensics teams have been seized pursuant to specific court orders such as search warrants or judicial authorizations issued to CBSA investigators. The data extracted from seized digital devices is processed only within the CBSA's own digital forensic laboratories and is provided only to those having lawful authority to access that data.

The CBSA also said:

I'd also like to clarify that spyware is typically defined as software installed in a device for the purposes of covertly intercepting, monitoring and/or gathering a user's activities or data. I want to assure the committee and the Canadian public that digital forensic tools utilized by the CBSA's investigators are not spyware. We use digital forensics hardware and software to unlock and decrypt seized digital devices as an important tool in our efforts to enforce border-related legislation and to protect Canadians.

You have no basis to dispute any of the things that are said there, do you?

[Evan Light]

No, I don't.