Information & Ethics Committee on Nov. 20th, 2023

[The Chair, Conservative, John Brassard]

I call this meeting to order.

I want to welcome everyone to meeting number 92 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Tuesday, January 31, 2023, the committee is resuming its study of the use of social media platforms for data harvesting and unethical or illicit sharing of personal information with foreign entities.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely using the Zoom application.

I want to remind all members and witnesses that care must be taken with regard to the earpieces for interpretation. Please be mindful not to place your earpiece near the microphone as this could result in feedback, causing injury to our interpreters.

I would now like to welcome our witnesses for the first hour today.

From the Canadian Security Intelligence Service, we have Peter Madou, director general of intelligence assessments—welcome, Peter—and Cherie Henderson, who is the assistant director of requirements.

From the Communications Security Establishment, we have Sami Khoury, who is the head of the Canadian Centre for Cyber Security.

I am going to start with our representatives from CSIS. You have up to five minutes for your opening statement.

Cherie, go ahead, please. Thank you.

[Cherie Henderson, Assistant Director, Requirements, Canadian Security Intelligence Service]

Thank you.

Good afternoon, Mr. Chair and members of the committee.

My name is Cherie Henderson, and I'm an assistant deputy minister and assistant director of requirements at CSIS.

It is an honour to join you today and to have the opportunity to contribute to your important discussion on social media and foreign entities. I am joined by my colleague Peter Madou, who is Director General, Strategic Bureau.

Today, we hope to provide insights to this committee on the national security concerns related to data sharing with foreign entities like the People's Republic of China and the role that CSIS plays in ensuring the protection of Canada's prosperity, national security interests and the safety of Canadians.

Foreign state actors leverage all viable means to carry out their foreign interference activities, and social media platforms are ideal tools.

Threat actors, including the Russian Federation and the PRC, exploit media to spread disinformation, leveraging suggestive algorithms to amplify echo chambers and manipulating content for unsuspecting viewers. This utility was indeed evident in the 2016 United States presidential election, and it continues to be of concern in Canada. These same characteristics of social media are also weaponized by extremist threat actors to radicalize and recruit users.

Social media platforms are of interest to threat actors because of the data they generate and collect. Social media platforms run surveys, collate datasets and request access to users' personal data through terms and conditions, enabling access to users' photo albums, messages and contact lists. Although some of this data is benign in isolation, when collected and collated on a massive scale, it can provide detailed patterns and insights into populations, public opinion and individual networks. Canadians should therefore be aware of the privacy considerations at play when choosing to share their personal information online, especially when it is with foreign-owned companies that are based outside of Canada or our allied countries.

Authoritarian states like the PRC leverage big data, including from the private sector, to carry out their foreign interference activities. While government use of data in Canada is strictly governed to respect ethical, legal and privacy considerations, authoritarian states are not similarly limited. The PRC uses this unfettered access to harvest data at a scale that outpaces all other countries in the world combined, while fiercely protecting its own information.

Emerging technologies, such as artificial intelligence, will only further enable its nefarious activities. Through its 2017 National Intelligence Law, the PRC compels individuals, organizations and institutions—including social media platforms operating in China—to provide mass information to the Government of China. This information is then used to assist the PRC security and intelligence services in carrying out a wide variety of intelligence work. PRC-based organizations and PRC citizens are also required to protect the secrecy of all state intelligence work. This policy supports and is reflective of the PRC's bold and sustained attempts to conduct foreign interference in Canada.

It is imperative that Canada builds resilience against foreign interference. This includes bolstering awareness of the PRC's ability to harvest and use Canadians' information obtained through social media to conduct foreign interference.

For example, CSIS' X account recently posted a thread on how PRC intelligence services used LinkedIn to target Canadians by deceptively posing as interested business contacts looking for consultants in Canada, so that they would unknowingly provide privileged information that is of interest to the PRC to trained intelligence officers.

Now more than ever, protecting Canada's national security requires a whole‑of‑society effort that begins with informed and trusted discussions among communities, academia and governments at all levels. Individual users of social media need to be aware of the risks when sharing personal data with platforms. CSIS remains a committed partner in this effort, and our team of dedicated and talented professionals are working hard to keep Canadians safe, secure and prosperous.

I will be pleased to answer any questions.

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Cherie, for your opening statement.

Next, we're going to go to Mr. Khoury, who is the head of the Canadian Centre for Cyber Security.

Sir, you have five minutes to address the committee. Go ahead, please.

[Sami Khoury, Head, Canadian Centre for Cyber Security, Communications Security Establishment]

Good afternoon, Mr. Chair and members of Parliament.

I'm pleased to be joining today's meeting. I'd like to acknowledge that we're meeting on the traditional unceded territory of the Algonquin Anishinabe nation.

My name is Sami Khoury and I'm the head of the Canadian Centre for Cyber Security, also known as the cyber centre. The cyber centre is part of the Communications Security Establishment.

As Canada's technical authority on cyber security, we use our expertise to keep safe the information and systems that Canadians rely on every day.

We work to protect and defend the country's valuable cyber assets, lead Canada's federal response to cybersecurity events and raise Canada's cybersecurity bar so that Canadians can live and work online safely and with confidence.

At the cyber centre, we share advice and guidance with Canadians regarding online dangers. This includes informing them how they can protect themselves and their organization most effectively from the threat social media apps could potentially pose.

We also help inform Government of Canada policy decisions regarding cyber security, including the use of social media apps, which are an important online communications tool to reach Canadians.

In February of this year, the Treasury Board Secretariat issued a statement announcing the ban on the use of the TikTok application on government-issued mobile devices. As recently as last week, a similar announcement was made regarding the use of WeChat. Both decisions were made by the chief information officer of Canada, who assessed that the apps in question present an unacceptable level of risk. While these bans apply solely to government-issued devices, both TBS statements led Canadians to guidance published by the cyber centre.

In our unclassified national cyber-threat assessment 2023-24 report, we assessed that foreign states are using social media to target Canadian individuals. Public reporting by the University of Toronto’s Citizen Lab detailed how cyber-threat activity has targeted activists in Canada through disinformation or intimidation on social media, denial-of-service attacks against their organizations and compromise of their personal devices.

Beyond cyber-threat activity against individuals, states are very likely using foreign-based social media and messaging applications popular with the diaspora groups in Canada and around the world to monitor communications. States can take advantage of permissive terms of use and their own legislative powers to compel data sharing. This activity threatens the privacy of the communities using these applications.

Canadians with commercially sensitive information on their devices should be especially cautious when granting access to their devices.

Not all instant-messaging apps and social media platforms are created equal. Some platforms are more responsible, where you potentially don’t have to worry about the data falling into the hands of a nation-state, but other platforms are too close to that line.

The cyber centre strongly recommends that Canadians make well-informed decisions for themselves about what online services they are willing to use.

Conducting these assessments and making these decisions does not have to be difficult, and the Canadian Centre for Cyber Security has published online resources to make this process easier.

The cyber centre recommends researching the app or platform to determine whether it is trustworthy. This includes reading the terms of use and conditions. Find out what is being said about a particular app in the media and other trusted sources and, most importantly, know what you are consenting to. Ask yourself whether this app really needs access to your personal data, like your contacts list. While it may seem unimportant to review a platform’s security and privacy functions, doing so allows you to avoid using apps that lack strong authentication protections and is well worth the time invested.

Finally, always prioritize security over convenience, and consider where your data is being stored and how this may affect your privacy.

In conclusion, social media has changed the way Canadians communicate, stay in touch and build new relationships.

As the social media threat landscape continues to evolve, Canadians must make sure to make responsible and informed decisions about how best to protect themselves and their information online.

If you can inform yourself to adopt better privacy and security protection, you could also help to support your family members and loved ones.

Again, thank you for the invitation to appear today. I welcome any questions you may have.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Khoury. That's great advice.

For the benefit of our witnesses, just make sure you have us on the language of your preferred choice, because you will be getting questions in both languages.

We are going to start with Mr. Barrett for six minutes.

Go ahead, Mr. Barrett, please.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks very much.

How many illegal police stations are operating in Canada?

I'll direct the question to CSIS, please.

[Cherie Henderson]

I'm sorry. I had to go back a bit in my memory here.

First of all, I'm not sure that I would necessarily call them “police stations”. I think what we have seen over the past few months is individuals who have links back to the PRC or who are supporting some of the work of the PRC—often, individuals who have been perhaps co-opted. At one point, we were looking at three—and it was in the media—where the RCMP was fully engaged in regard to those stations.

I wouldn't want to comment any more in regard to the activities of the RCMP.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Is it your understanding that they're continuing to operate, or have they been closed?

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I have a point of order, Mr. Chair.

[The Chair, Conservative, John Brassard]

Go ahead with your point of order.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you.

Our study is on social media platforms. I'm trying to see the connection between our study and the questions being asked of the witnesses.

[The Chair, Conservative, John Brassard]

I'm sure Mr. Barrett will make a connection at some point. I understand your point, but it's his time. I'm going to give him his time.

Go ahead, Mr. Barrett.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

On the point of order, Mr. Chair, the question speaks to transnational repression. I think it's important to establish that there are foreign state actors engaged in this and what activity is done. The example I'm attempting to ask the witnesses about is perpetrated by the same state actors who are engaging in this transnational repression using social media technologies, some of which were outlined in the initial statements.

I'm not sure how much I need to qualify my line of questioning. I'm happy to go further on the committee's time, if that's what you'd like, but not in my questioning time.

[The Chair, Conservative, John Brassard]

Thank you.

For the benefit of members of the committee, I generally try to give a lot of latitude to each member who's been given their five or six minutes, or whatever the case is. I expect Mr. Barrett is going to make a connection. He made a compelling argument there. I'm going to continue with Mr. Barrett.

I stopped your time. You have four minutes and 51 seconds. Go ahead.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Beijing conducting transnational repression activities here on our soil—evidenced by these so-called police stations, if you will—means that Chinese Canadians are being targeted for intimidation and influence. That's the purpose of these so-called police stations.

[Cherie Henderson]

I wouldn't specifically focus on the so-called police stations. What I would say to you is this: There is absolutely foreign interference activity happening in our country, but it can come in all forms and varieties. By focusing on just the police stations, I worry that individuals will then miss what else is happening in the environment.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

I appreciate that.

Is it understood that it's a technique of the dictatorship in Beijing to scrape social media in order to isolate and target the people who are the intended targets of those repressive activities? Is social media a tool used by agents acting out of these locations to gather intelligence and then target those individuals?

[Cherie Henderson]

I think that's a very interesting question and one we need to discuss.

A lot of it comes down to how Canadians protect their own personal information—or any citizen of the world, let's say. If you are quite open and put a lot of your personal information out on social media, absolutely, hostile states will be able to scrape that data, regardless. It doesn't have to be China. It could be other hostile states we're dealing with. I think that's also very important. Don't lose sight of all the hostile activity directed against Canadians by focusing on just one actor. It's very important to totally protect all of your social media access and the data you put on there.

You're absolutely right in the comment you made. Hostile states will pull that information. They can collate it, crunch the big data and do very targeted attention, if they want to.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Foreign state actors don't just target the diaspora communities within our country. They also target elected officials. We've seen media reports about those efforts. In recent months, we've seen stories about a “spamouflage” campaign targeting certain politicians on their social media.

Has the dictatorship in Beijing been identified as the source of that campaign?

[Cherie Henderson]

Sami, would you be able to answer that particular question?

[Sami Khoury]

No, I can't, unfortunately.

[Cherie Henderson]

I'm not sure whether I could indicate that it went back to China. I'd have to go back and see what we know about it.

What I can say is that, again, you're very right. Individuals will pull all of that data and target whoever they feel is somebody they need to try to repress, want to get more information on, or want to try to influence in regard to the activities they may be engaging in.

Absolutely, social media can be used to collect the information to do that.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

These are foreign interference activities. Even if you aren't able to say which foreign state actor is responsible, that's what these activities are.

[Cherie Henderson]

I would term that as a foreign interference activity, yes.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Are you able to say how many Canadian politicians have been targeted by foreign state actors engaging in these interference activities—just a number, if you could?