Evidence of meeting #32 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was rcmp.
A video is available from Parliament.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
As you know, this mobile hacking system that's been used on our devices has been banned—Pegasus in particular—from the United States. Are you advocating for this type of technology to be banned or to be used under more stringent guidelines by policing agencies and other organizations?
President, Privacy and Access Council of Canada
I think it's a broader problem than that, because it's not just a matter of banning the police use of a tool that can be used for legitimate purposes, whether by police or other law enforcement agencies. The problem is that these tools, however technically advanced they might be, each one of them, they're available commercially to anybody who has an Internet connection and wants to download them. That is what is the problem, because otherwise, we're all just working after the fact to try to catch whoever is using it.
Our Criminal Code, as far as I'm aware, does not speak to somebody putting spyware on my phone or yours—a spouse, an intimate partner, a stranger. If they take the intimate photos and distribute them without my consent, that's addressed in the Criminal Code, but not spyware itself. Nobody is talking about preventing the spyware from being used in the first place. Nobody is talking about how the spyware is able to take advantage of the shortcomings, the deficiencies in so many software programs.
Google just introduced 27 fixes, including critical fixes, last week in one day. They and others keep introducing fixes for faulty software. Require that software be tested properly to minimize the opportunity for spyware to be able to take advantage right now of the built-in deficiencies.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Knowing that some of this is available commercially, which I learned just in the last 24 hours.... We've talked about Pegasus, but now there's also Paragon, Candiru, Cognyte software. There's a possibility this has been onboarded onto drones.
Which examples or which software platforms are you aware of that have been used here in Canada?
President, Privacy and Access Council of Canada
I don't know specifically. I have spoken with colleagues who have been researching this area and I've been assured there are several, but it's not spoken about. Obfuscation is a wonderful thing. If you describe a tool as a digital investigative tool, it doesn't say that it's spyware. It gives it the air of legitimacy. I don't know in particular which is being used and which is not.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Do you believe that Minister Mendicino yesterday was obfuscating? Do you think that after his testimony he restored trust in our institutions on whether or not they are surveilling Canadians?
President, Privacy and Access Council of Canada
I found his responses interesting, particularly when he repeatedly assured us that these software tools are only used within the limits of the law, although, I believe it was he, or perhaps it was someone else, who said that there are provisions in national security law that allow for the exigent use of these without judicial authorization. Even that is within the limits of the law.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Yesterday there was the admission that the RCMP had been using ODITs since 2012 and before, but he skirted around the issue of whether or not other government agencies are using it.
Do you believe that Canadians have the right to know whether CSIS, CSE, CBSA, the Department of National Defence are using these tools as well?
President, Privacy and Access Council of Canada
I think Canadians do have a right to know. It is possible to reveal the use of these tools without compromising police investigations.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
How dangerous is it to our civil liberties and our ability to appropriately legislate the use of these tools when we have a government that has not admitted the basic facts of who's doing what with ODIT?
President, Privacy and Access Council of Canada
I do recall that our Prime Minister several years ago said Canadians deserve—I'm paraphrasing—the most transparent, accountable government. I agree that we do, but as a taxpayer, as a Canadian citizen, I'm skeptical whether that has come to pass. As a practitioner in access and privacy for many, many years and knowing many people in the industry, including in our nation's capital, it seems that the way the access laws were written is being used to create more of a shield than a view of what's going on.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
I want to thank our witnesses for being with us today.
Conservative
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Thank you, Chair.
I would like to return to Mr. Therrien and some of the conversations that we were having in the previous hour.
There have been a lot of suggestions that judicial oversight isn't enough. I think what I heard from you is that it's pretty good protection and that it's not the only protection that we have to ensure that the RCMP fulfill their mandate to the letter of the law. For example, if they were to collect information through the use of this technology and take it to the court to use in prosecuting their suspects, and the court found that they didn't use it properly, then the evidence is no good and it's worthless to them, so it's no good for the RCMP to be using this technology outside the letter of the law.
I'm wondering if you agree with that and if you could expand on that a little bit.
Lawyer, As an Individual
I think it's a fair characterization of what I said. The privacy safeguards in part VI of the Criminal Code are good. They may well be perfectible, particularly given the highly invasive nature of ODITs.
Liberal
Lawyer, As an Individual
Yes, the protections of the Criminal Code are good. Are they ideal? Are they perfect? Are they perfectible? I leave that to you. I think that certainly improvements are possible, but they are good. We have a good starting point.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
We also heard, as one of my colleagues brought up yesterday, that we may be more at risk in terms of MPs and our cellphones from outside actors and people outside the country who maybe aren't concerned with following the Criminal Code. Can you expand on your thoughts on that as well and the level of risk in this country from outside of Canada?
Lawyer, As an Individual
Canadian law governs Canadian institutions, including the RCMP, and by and large, we have good rules. As we know, there are a number of countries around the world that are not democratic and do not care much for the rule of law, and it is entirely possible, likely—the RCMP seem to suggest it's a fact—that other states do intercept the communications of foreign nationals, including Canadians, for their own purposes. According to the RCMP, it's a fact.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
How does Canada compare to other countries when it comes to valuing the right to privacy of its citizens?
Lawyer, As an Individual
Clearly, Canada is a country under the charter, the rule of law, and overall has good standing in defending human rights. At the same time, it was mentioned a few minutes ago that the public sector privacy law is 40 years old. The law was adopted when documents held by the government were held in writing in filing cabinets and the information could not be obtained or disclosed as easily as it is in 2022.
Overall, obviously we are a country that respects the rule of law, but our laws, particularly privacy laws, are in dire need of improvements from a privacy perspective.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
In the minute and a half or so that I have left, maybe you could go over some of your ideas, which I'm sure you've already brought up today, for improving our privacy laws to make sure that we are at the highest standard.
Lawyer, As an Individual
Canada's laws, for both the public and the private sectors, should recognize privacy as a fundamental human right. That's the starting point. We should ensure that the Office of the Privacy Commissioner, for both the public and the private sectors, has the authority to not just make recommendations, but make orders for the private sector and the public sector when it sees violations of the law. There should also be financial sanctions, certainly in the private sector, to ensure that these laws are respected.
I would say, because I think it's relevant to this particular study and it was referenced a minute ago regarding the use of these intrusive technologies in the private sector, that in 2022, information is shared between the private and public sectors extensively, and it is important that at the very least, public sector and private sector laws are compatible and interoperable. Ideally, they should be adopted in one statute, because data does not know frontiers between the public sector and the private sector. Again, at the very least, the rules should be similar and interoperable as between the public and private sectors.
