Information & Ethics Committee on Aug. 9th, 2022

[Matthew Green, NDP, Hamilton Centre, ON]

I would agree. In my position, having been on public services and procurement and public accounts and now this committee, we have a government that is really great at writing good policy. They actually write some decent policy. The challenge is that we never have the outcomes. We never have the measurables. We never have the deliverables when it comes to taking something like the directives of the Treasury Board president and watching them actually be implemented in government.

From that perspective, what I'm hearing today, and we can get into distinctions between whether or not it's prescriptive or non-prescriptive or whether or not it's preamble, I'm a firm believer that if we don't direct law enforcement to improve, to increase their transparency, and to provide clear measures of accountability and privacy by design, it won't happen.

Would you agree with that, that if we don't provide those guidelines, it just won't happen?

[Daniel Therrien]

Yes. Further, I think it is possible to have these requirements at a sufficient level of generality, but still meaningful, without being overly prescriptive and preventing officials, whether by the police or others, from exercising judgment. But—

[The Chair, Conservative, Pat Kelly]

Thank you.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

[The Chair, Conservative, Pat Kelly]

We'll go now to Mr. Williams for up to five minutes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

Ms. Polsky, it's nice to see you again.

After the RCMP was caught having used mobile device identifiers, or IMSI, in 2017, they said they wanted to start a public debate about police powers and privacy. That discussion was clearly never started. Do you agree with that statement?

[Sharon Polsky]

I'm not aware that they did engage in that study.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Do you think that the balance between police powers and privacy should be changed? What should it look like?

[Sharon Polsky]

I think police need to recognize that they're not always going to be in uniform and that it affects them individually just as easily as it does you and me and anybody else.

Members of law enforcement are like everybody else. They, too, lack the fundamental education about privacy rights and responsibilities and legislation. They are law enforcement, and that's what they do. They see it from that perspective, as they ought to, but they need to be encouraged to see it from other perspectives.

[Ryan Williams, Conservative, Bay of Quinte, ON]

What does Parliament need to do to properly regulate these types of uses of spyware by the RCMP, CSIS and CSE, for example?

[Sharon Polsky]

First of all, I think if the spyware is regulated in the hands of RCMP and federal agencies, that doesn't address the municipal and the provincial law enforcement agencies, so it has to be all encompassing.

I think it's a matter of crafting laws—again, without the direct or indirect influence of industry—that put the liability first on the hardware and software companies and their executives who sell products that are full of vulnerabilities that allow spyware, ransomware and malware attacks. Ban federal procurement or use, directly or indirectly, of spyware by legislation, regulation or order in council, with equivalent bans in each province and territory, and work with foreign governments to ban the sale, export, distribution, use of and investment in commercial spyware.

We already have international free trade agreements that have mandatory cross-border information-sharing provisions and all sorts of other provisions. They need to include provisions where signatories agree to criminalize and prosecute the individuals and the organizations that create, test, market, fund and distribute spyware—and the executives and the investors. There have to be penalties because, otherwise, it's like policy: It's on the books, but if someone in another country can use these products against us, their own governments have to be involved in stopping it because that's in that country, of course. It's out of our reach.

[Ryan Williams, Conservative, Bay of Quinte, ON]

To just add to my colleague's sentiment or statement earlier.... What good policy has actually been implemented in other countries that we should be implementing here in Canada?

[Sharon Polsky]

One of the most important differences, I think—a distinction—that the GDPR in Europe brought to bear is that when a privacy impact assessment is conducted, when an organization has a data protection officer, which they must, their focus under the GDPR is the risk to the individual whose information is being collected, used, etc. It's not the risk to the organization. In my experience, that is all too often how Canadian organizations look at it.

First of all, if they have a preliminary PIA—because we're busy; we're a large organization—the few people who actually understand it are too busy to do a PIA for everybody, so they ship it back to the department and say, “Here, you do a preliminary PIA, and you tell me if you think we need to do a PIA.” They don't know what they're looking at, so of course it's easy to say, “Nah, it doesn't affect personal information, so we don't need a PIA.” That's where it ends. That's a flawed system.

When they do do a PIA, some of them are just so cursory. It talks about the benefits of a product or a new system or something, but it doesn't talk about the risk to the individual. It's as if their role is to protect the risk of the organization. That has to change.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Chair, my last question for—

[The Chair, Conservative, Pat Kelly]

You're—

[Ryan Williams, Conservative, Bay of Quinte, ON]

It'll be for a yes or no. That's all it'll be.

[The Chair, Conservative, Pat Kelly]

You have 10 seconds.

[Ryan Williams, Conservative, Bay of Quinte, ON]

This is for both witnesses: Should skipping the PIA be an option at all?

[Daniel Therrien]

No.

[Sharon Polsky]

No.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Well done.

Now, we'll go to our next questioner, who will be Mr. Erskine-Smith.

Welcome back to the ethics committee.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks, Pat. It's good to be back. It's good to see you.

It's especially good to see you, Mr. Therrien. I have appreciated your advice and guidance over the years when I did sit on this committee.

I want to start with what I took to be the RCMP's view around “We can't disclose the vendor because of national security.” Yet, from a government procurement basis, it's quite concerning to me, because I see some of this technology—and I know the RCMP has said it doesn't use Pegasus, but Pegasus is an example—has been used to seriously undermine human rights around the world, attacking journalists and other human rights advocates.

As a matter of public interest, shouldn't we know who the vendor is so that we can conduct some level of due diligence around government procurement?

[Daniel Therrien]

That there be transparency in the procurement process is certainly a very good idea. It's necessary, actually. On whether the name of a particular vendor should become public, I would go back to the general standard: There should be transparency as a rule, except if methods would become ineffective through transparency.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I think that's the right standard. It's hard to imagine that having the name of a vendor would undermine national security, despite the protestations we heard yesterday.

Moving to the core issue, we've talked about the nature of the tool and how expansive it is with respect to collecting data, but I want to take a slightly different tack, Mr. Therrien, because what these tools tend to do and what makes them demonstrably different from other tools is they take advantage of and exploit an existing vulnerability in the technology as it is. You have law enforcement that is exploiting a vulnerability, and that vulnerability affects all Canadians fundamentally, because that vulnerability is on all devices.

Isn't there an argument that law enforcement should be identifying that vulnerability and then letting the company know about the vulnerability such that it's fixed on all of our devices?