I would say that privacy impact assessments from the Treasury Board should be mandatory in law but also should come before anything is purchased. To date in my broader research, we've asked for around 250 to 300 ATIPs for hundreds of contracts, adding up to about 800 million dollars' worth of purchases related to surveillance. It's a huge amount of money.
Just recently, I got an updated contract from Teel Technologies for mobile forensic devices—the Copyright Board was a new agency that came up as a receiver of these things—for $11 million. It was a recent contract, a renewal. If we're going to be careful with money, we should really ask hard questions about what technology is purchased before it's purchased.