Evidence of meeting #92 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Assistant Director, Requirements, Canadian Security Intelligence Service
I couldn't give you a specific number.
Again, what I would say is that every single politician, every member of Parliament, should always protect their personal information, their privacy, and be aware if somebody or an entity is trying to approach them in order to engage in some sort of foreign interference activity. It can come in all forms and shapes.
Conservative
Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON
Are you able to say how the rapid response mechanism came into play in the case of the “spamouflage” targeting of elected officials?
Assistant Director, Requirements, Canadian Security Intelligence Service
No, that would be GAC. Foreign Affairs is the one that manages the rapid response mechanism.
Conservative
Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON
At what point is it your understanding that government is made aware of attempts by foreign state actors to target Canadians, including Canadian politicians? Is it specifically GAC, or does our national security agency, CSIS, engage at some point, obviously being aware that this is ongoing?
Assistant Director, Requirements, Canadian Security Intelligence Service
Yes, absolutely.
Several months ago, the Minister of Public Safety issued a ministerial directive indicating that if we became aware, within the service, of negative activities directed against politicians by hostile foreign states, then we were to look at the information, determine the threat value of that information and then reach out and advise the various political actors.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Barrett and Ms. Henderson.
Ms. Damoff, you have six minutes.
Go ahead, please.
Liberal
Pam Damoff Liberal Oakville North—Burlington, ON
Thank you, Chair.
Thank you to both organizations for the work you do to keep Canadians safe. You don't get enough credit for the work you're doing behind the scenes, so I want to thank you for everything that both organizations are doing.
Specifically on TikTok, we had them appear here as a witness. They told us that the only thing they collect is an email address and the age. I'm going to ask about age in a minute. Would you say that's accurate, in terms of the information they are collecting from individuals online? My understanding is that you can gather a lot more just by what people search for, and I asked them about that. You can tell whether people have a heart condition because of what they're looking for in their searches.
I'm not sure who is better prepared to answer this. Mr. Khoury, you look like you're ready to respond.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Thank you for the question.
I think we need to distinguish a little bit between what is required to register for a TikTok account and what is being asked for to enhance user experience. There might be additional access, as I pointed out in my opening comments, to your contacts list, your calendar, or other sorts of privacy settings in your phone, in order to enhance the user experience. That's maybe the secondary offer of information that is being collected through TikTok.
Liberal
Pam Damoff Liberal Oakville North—Burlington, ON
They were quite adamant that no information was being shared with China and that their servers were in the United States, Indonesia and Malaysia, I think.
What led the government to ban TikTok from government devices? It wouldn't have been a decision that you took lightly.
Head, Canadian Centre for Cyber Security, Communications Security Establishment
The banning of TikTok on government devices was a decision made by the Treasury Board CIO of Canada, based on an aggregate risk level that was deemed too high. From a government perspective, the aggregation of all that information could potentially expose who our contacts are within government and our activities within government. I suspect that, from a privacy perspective, this is what led the CIO to promulgate the policy around banning the application from government systems.
Liberal
Pam Damoff Liberal Oakville North—Burlington, ON
I want to talk about youth, because TikTok is not alone in this.
They said that they have all of these safeguards in place so that young people are not using TikTok. I would argue that it doesn't matter whether it's TikTok or Instagram or a number of other social media platforms; youth are sharing an inordinate amount of data on their social media accounts, which can lead to exploitation.
First, I would like you to comment on youth exposure to social media platforms and whether the platforms are doing enough to limit their exposure. Also, what can we be doing, as a government, to support young people so that they know what is happening, because they don't right now?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Our concern at the cyber centre is one of raising awareness of the threats posed by social media and educating users about the privacy settings and best practices on how to use those applications—not to volunteer too much personal information and to ensure that the privacy settings on the apps are as attuned as possible to the particular user, recognizing that in some cases where the data is hosted and who has access to the data can pose an additional risk to the user. In that case, the data hosted in some countries might pose less of a risk than it would in a place like China or somewhere else.
Our role is really one of education and raising awareness about the threats posed by these applications.
Liberal
Pam Damoff Liberal Oakville North—Burlington, ON
Would you support social media platforms having their privacy terms and conditions in a more user-friendly way? You could have those things in legalese but sort of highlight what people are actually agreeing to. I would bet that 95% of Canadians don't actually read those terms and conditions when they go through them.
Do you think there should be more of an onus on them to simplify that so that you have to agree to the simplified one and the longer one?
Head, Canadian Centre for Cyber Security, Communications Security Establishment
Informing Canadians of what it is they are signing up for is absolutely important. We can describe it through our cybersecurity advice and guidance, but if it's also explained in individual apps in such a language that users understand exactly what they're consenting to sharing and with whom, that will definitely help everybody be aware of what is happening in the background.
Liberal
Pam Damoff Liberal Oakville North—Burlington, ON
I have only about 30 seconds left.
Are there any other recommendations that either of you would have for us that you haven't already shared, particularly with regard to young people?
November 20th, 2023 / 4:15 p.m.
Assistant Director, Requirements, Canadian Security Intelligence Service
I don't have any recommendations per se, but I would like to pick up on one thing that you noted, and that was the vulnerability of our youth. What I am very worried about is that some of the youth do get onto these social media platforms and then they can get into some extremist milieu and get very influenced in a negative way. That is something we need to be quite concerned with and aware of. They make connections and they get into almost an echo chamber. That's something we need to be aware of.
Conservative
The Chair Conservative John Brassard
Thank you, Ms. Damoff, Ms. Henderson and Mr. Khoury.
Mr. Villemure, you have six minutes.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much, Mr. Chair.
I thank all the witnesses for joining us today.
Ms. Henderson, I'd like you to provide us with more details about the links you've drawn between foreign interference, TikTok and the risks of using platforms.
Assistant Director, Requirements, Canadian Security Intelligence Service
Thank you for the question. I will respond in English.
What I would like to explain a little bit more is the fact that a lot of individuals do go onto social media platforms and they do share a lot of information. As my colleague Sami noted, sometimes it's just what you like, and sometimes it's things that you follow. You have your camera on, or you have your pictures, and it's all up on social media. Foreign actors with a hostile intent can pull all of that information together and get a very good picture of who you are as an individual and how they might be able to influence you.
The other thing we find happening within social media is that it seems to be a very good place for trends to be noted and seen. If a foreign actor wants to determine what kind of trend might be happening in a certain area, they can keep an eye on what's happening on a social media platform: Where are people voting? What are people worried about? What are people concerned with? What misinformation or disinformation are they following? That is why I say that these are very strong tools that can actually be used to harm and to engage in foreign interference activity.
Bloc
René Villemure Bloc Trois-Rivières, QC
If I understand correctly, in order to not share that information, it's essential to read the conditions and consent to not sharing one's personal information.
Once people start using a social media platform, is it too late to step back?
Assistant Director, Requirements, Canadian Security Intelligence Service
I don't think it's ever too late to step back, but what I would say is that in some cases the horse may already have left the barn. You do have to be a little bit worried about that, but people do change as they move forward. If you stop sharing that personal information or you are more attuned to what you're sharing, even from today moving forward, I think you will be starting to put in some protections around your social media presence.
Bloc
René Villemure Bloc Trois-Rivières, QC
You said that China isn't the only actor engaging in foreign interference. Which networks should we be very wary of, other than TikTok? Which ones should we be very careful of, and to which countries are they tied?
Assistant Director, Requirements, Canadian Security Intelligence Service
I always hate to narrow things down, because then I worry that people will start to focus only on those threat actors.
I think everyone in this room is probably already aware that another actor we're concerned about is Russia. We are also concerned about Iran and North Korea. Those are at the top of our list at the moment, but I would say that you should think even more broadly than that and always protect whatever's on your social media account. You never know who's looking and who's trying to gather more information on you.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much for your answer.
When we think of TikTok, we think of China. What should we associate with Russia, Iran and North Korea? Which networks could be associated with those three foreign actors?
Assistant Director, Requirements, Canadian Security Intelligence Service
I, myself, am not fully aware of all the networks within those specific countries.
Again, as an innocent individual on a social media account, you need to try to find out where that social media account is being generating from. The more information Canadians take to get themselves informed, the more they will be protected. You may think it's not coming out of a state that we may be concerned about, but if you start to dig a little deeper, you might get there.
I would say, always double-check to make sure you know exactly what you're engaging in and whom you're engaging with, to the best of your abilities.