Information & Ethics Committee on Aug. 9th, 2022

[Ronald J. Deibert]

No, I don't find it acceptable at all, Mr. Chairman. I think that I heard something slightly different from the testimony. It sounded to me like one of the RCMP officers testified that they were using this type of technology much further back than 2017, which really is no surprise. As Ms. McPhail testified a few moments ago, there is a pattern of law enforcement agencies being reluctant, for whatever reason, to disclose what types of surveillance techniques they're using or specific technologies, hiding them from the public, and then somehow this information gets out, through media, ATIP requests or whatever, and they have to scramble to produce documents to justify ex post facto how they're using it.

[Ryan Williams, Conservative, Bay of Quinte, ON]

One of the recommendations I feel we're going to have from this study is that all government agencies, no matter which they are, should have to complete or be mandated to lawfully complete a privacy impact assessment. Do you agree with that recommendation?

[Ronald J. Deibert]

Yes, 100%. It's the least that could be done, in my view.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

Ms. McPhail, your organization has called ODIT the nuclear option for surveillance for the RCMP. Why do you refer to it as the nuclear option?

[Brenda McPhail]

Thank you for that question.

I think Professor Deibert has referred to this, but I'll elaborate.

We had yesterday an RCMP witness say, to paraphrase, that they don't actually think about doing a privacy impact assessment just because they're using a new technology. They consider whether the technology permits a new kind of invasion.

This sounds kind of logical until you break it down because that formulation of the nature of the search ignores the reality of an ODIT, which allows all the invasions all at once on a device that we— not they—own.

Did they do wiretaps before? Of course. Did those wiretaps allow access to the contents of every form of communication written and oral, professional and private, retrospectively and prospectively, including data that's not actually on the device itself but in the cloud? Of course not. Is it the same level of invasion? No. Did police install covert cameras in homes and places of business with warrants in the past? Of course. Did a single camera have the ability to move with an investigative subject from work to home, from bedroom to bathroom, 24 hours a day? Of course not. Is it the same level of invasion? No.

An ODIT can do more. It can record live audio. It can track locations. It collects device identifiers. It tracks Internet searches. It follows application use.

Should a PIA have been required? Of course. Even that, as Professor Deibert says, is not enough when we're talking about the enormity of the invasion.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Do you believe that, no matter who they are, any government agency using new technology should be required to do a privacy impact assessment?

[Brenda McPhail]

Any government agency wishing to use potentially rights-infringing surveillance technology that carries high risk to the public should absolutely have to do a mandatory privacy impact assessment, which should be made public in an appropriate form.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

Mr. Juneau-Katsuya, in your work with government in the past or in your research, are any other agencies beside the RCMP using any technology similar to what we're investigating with the RCMP?

[Michel Juneau-Katsuya]

You would have to be a little bit more specific, but some of the technology of course—

[Ryan Williams, Conservative, Bay of Quinte, ON]

I mean CSIS, CSE, anybody like that. Do you have any knowledge that any other government agencies besides the RCMP would be using Pegasus-like technology?

[Michel Juneau-Katsuya]

Other agencies are using it, probably, yes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

Mr. Chair, I think I'm out of time.

[The Chair, Conservative, Pat Kelly]

You have about 15 seconds, so I don't know if—

[Ryan Williams, Conservative, Bay of Quinte, ON]

I will cede my time.

[The Chair, Conservative, Pat Kelly]

All right, that's what I like to hear. It keeps us on schedule.

With that, we'll go to Ms. Shanahan for up to five minutes.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

I'm sorry, Chair. I'm not ready to ask any questions.

[The Chair, Conservative, Pat Kelly]

Oh, I hope I didn't get the order wrong.

Ms. Vandenbeld, go ahead please.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you very much, Mr. Chair.

It's good to be back on this committee. The last time I was on the Standing Committee on Access to Information, Privacy and Ethics was for the Cambridge Analytica and Facebook study, and I found that we did some very good cross-partisan work on that issue.

This is, of course, an issue that concerns me very deeply. I'd like to direct my first question to Professor Deibert. As you know—and I think we're both on the World Movement for Democracy steering committee—I've long been an admirer of much of the work that Citizen Lab has been doing globally, both on disinformation and on cyber harassment of human rights activists. I think you've raised some very concerning points with regard to how authoritarian regimes are using these kinds of tools.

In terms of what this committee is looking at specifically, I know that some of the things you mentioned, particularly when you're talking about the digital transnational repression and other things, might more suitably be discussed at the foreign affairs committee or even the Subcommittee on International Human Rights, on which I sit. I think there would be significant interest in looking at that, including things like export controls.

My question for you is more specific. I think you'll agree that when the RCMP are using these tools in a very narrow scope—I think you mentioned things like “proportionate” and “necessary”—with judicial oversight and warrants, that's a very different thing than how regimes like China or Iran are using this kind of technology. Setting aside issues like the vendors and the export controls, you mentioned something that I think was interesting. You talked about having thresholds. Could elaborate a little bit about what those kinds of thresholds to prevent abuse of these kinds of powers would look like?

[Ronald J. Deibert]

I think overall it's reassuring that we heard testimony from the RCMP yesterday and from the minister that the instances of the use of this type of technology were undertaken with judicial authorization. However, as I said before, I think just because we hear from the RCMP that there was judicial authorization, it shouldn't be seen as some kind of magic wand that makes everything else magically disappear: “Nothing to see here. Go about your business.”

First of all, we know that there is a well-documented history of abuse within law enforcement in this country. There is a documented history of discriminatory practices. I also have concerns about the nature of the technology itself and whether, with all due respect to judges who I have confidence in, they truly understand the scope and scale and sophistication and power of the type of invasive technology we're talking about that Ms. McPhail just really accurately described.

I also think there are equities issues that need to be discussed here. My team and I routinely forensically analyze victims of spyware. In several instances, we've actually recovered copies of the spyware and made responsible disclosures to the vendors, unlike what the government agencies do. These disclosures have resulted in security patches affecting several billions of people worldwide. If the government is going to withhold that information from the vendors and put all of our safety at risk, there needs to be a proper process around that. That process typically is called the “vulnerabilities equities process”. Right now, as I said in my testimony, our process around that in this country is weak. It's opaque. Frankly, it's nowhere near the level of where it should be for a mature liberal democracy.

Those are some of the concerns I have that go well beyond whether the RCMP simply told us that these instances were authorized by a judge.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you. That's very helpful.

Mr. Juneau-Katsuya, I noted that you didn't finish the last part of your opening statement. I want to give you some time to do that now.

[Michel Juneau-Katsuya]

I thank you very, very much.

I want to bring to your attention the fact that, unfortunately, our society, particularly our democracy, is under siege. We're facing an enormous threat. Probably since the 1600s and 1700s, when the initial concept of democracy started to appear, we've never been under threat the way we are currently. The far right, the alternative right, is taking place. There's populist discourse. People are using demagoguery to try to convince people and bring insecurity.

From that perspective, I totally support the idea of bringing more control, more accountability and more transparency. What I seek is a balance, a balance that does not prevent the capability of also catching the bad guys. Unfortunately, all the nice discourses, theories and philosophical debates—they don't care about this.

[The Chair, Conservative, Pat Kelly]

Thank you. We went quite a bit over there, but we got it all in.

We will now go to Monsieur Villemure for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Deibert, I have a limited amount of time, so I would appreciate it if you could keep your answer brief.

Are you in favour of having a third party examine the RCMP's activities in relation to surveillance tools?

[Ronald J. Deibert]

Yes. I'm in favour of as many legitimate parties as possible that are appropriate to make sure that we have proper accountability relative to the great leap forward in technological capabilities that law enforcement and security agencies have at their disposal today.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Juneau‑Katsuya, at the tail end of a previous answer, you said that other agencies were probably using this technology.

Do you think that parliamentarians and elected officials have been put under surveillance by law enforcement agencies in the past?