Evidence of meeting #82 for Industry, Science and Technology in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was casl.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Louis Lau  Digital Crime Officer, Cybercrime Directorate, INTERPOL
Kim Arsenault  Senior Director, Client Services, Inbox Marketer
Chris Lewis  Chief Scientist, Spamhaus Technology Ltd.

11:55 a.m.

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

The law already has provisions for a lot of that material, for a lot of that sort of thing: if there's an innocent mistake, you write a letter and tell us you're not going to do that again. That's actually in the law.

It strikes me that it's fairly gentle in that sense, in that someone can avoid major penalties, or any penalty altogether, if they can establish they were operating reasonably well and were doing reasonable things, and they simply made a mistake. For example, there are the override provisions from private right of action across to CRTC and so on.

I think the law is pretty well done that way. It is reasonable. It's not, “You did this, and it will cost you this amount of change.” It's not done that way. From a background of—

11:55 a.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Fair enough. Moving on, in your experience in looking at old Nortel emails and all that, do you see a reduction of spamming originating in Canada? Do you look at it that way, if you follow me?

11:55 a.m.

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

We do. I'm specifically looking at botnets, but I do see what's going on elsewhere. There is considerably less of what you would call “white spam”, which is somebody making a mistake and sending out stuff they shouldn't have. We're seeing the criminal side. There is more grey. More black is predominating. We are still tracking down people who are running botnets with a Canadian affiliate, and that sort of thing. We're seeing a lot of that. We're tracking back all sorts of stuff to Canadians. We're tracking all sorts of stuff to Canadian hosting, which is where the CRTC has been doing really well in being able to go to a hoster—

11:55 a.m.

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

You're seeing malicious ware, not necessarily originating in Canada but from a company that has affiliates in Canada. Is that what you're saying?

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

An example is advertising fake pills. These are being done by groups of people, many people, who when they send out their spam will have a link on it so that when someone follows that link to the illegal pill site, there's a cha-ching that gives the affiliate a penny. It's that sort of thing.

The other form is when I said hosting—

Noon

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

And that affiliate is a Canadian affiliate.

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

And that affiliate was Canadian.

Noon

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Is the CRTC, to your knowledge, taking any action against any of those things you're seeing?

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

They are. I don't know if any of them have gone all the way through yet, but they are looking at that.

The other thing they are working on, at a less than “in front of a judge” level, is dealing with Canadian hosting environments or hosting providers who provide web services to someone when, through one way or another, they take on part of a criminal spamming infrastructure, meaning that the website for pills is there, or a command and control point for malicious botnets—

Noon

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

Is the way CASL is written, specifically for this type of malicious activity, strong enough? Does it need to be more enforced, or are there changes—

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

It's quite good. The CRTC needs more time and experience in dealing with them.

Noon

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

You're saying the law is good, but CRTC could do more to go after these people. Is that it?

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

Yes. It's a matter of experience and time and working away at it. Mr. Lau is not seeing it, but I'm seeing how the CRTC is interacting with international organizations, law enforcement, and regulatory bodies.

Noon

Liberal

Frank Baylis Liberal Pierrefonds—Dollard, QC

You're seeing that they do—

Noon

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

I'm seeing it. There's a lot more going on than we used to see.

Noon

Liberal

The Chair Liberal Dan Ruimy

Thank you very much. We're going to move on.

Mr. Bernier, you have five minutes.

Noon

Conservative

Maxime Bernier Conservative Beauce, QC

Thank you, Mr. Chair.

My first question would be to Ms. Arsenault.

Good morning, Ms. Arsenault.

The costs—it's all about the costs. You explained, in answer to the questions from my colleagues, about the costs for big business, but for a small or medium-sized business that wants to do good marketing, what would be their option to be in line with the legislation and respecting it? Do you have any clients that are small and medium-sized businesses? Do you know what they are doing to be in line with the legislation?

Noon

Senior Director, Client Services, Inbox Marketer

Kim Arsenault

Yes. We talk a lot about the level of risk that organizations are willing to take. A big financial institution with a big brand is going to have a very low level of risk, whereas a smaller organization might be willing to take a little more risk, so its policies and procedures may not be as tight as those of a big corporate brand. We see that a lot of them are following typical industry best practices. Even though they might not be able to do everything as a strict reading of what the law says, they feel comfortable enough if they are following legitimate industry email best practices—sending to people who have expressed interest in receiving email from them, sending relevant content, and suppressing unsubscribes. Then it's a little easier for them to take advantage of the email marketing initiative. For them, the costs are not going to be as high.

Again, with a big brand, they have to have the technology so that if they are called upon, they can actually prove exactly what version of any email has gone out.

Let me give you an example. Some of the large organizations want to send a million different variations of an email. They're beyond the “batch and blast”, in which everybody gets the same message. Some of these big companies are trying to figure out how they are going to set up their system so that if they are called upon, they can prove the exact variation of any email that any customer was given on any day. That's difficult to do. The smaller organizations aren't that sophisticated.

Noon

Conservative

Maxime Bernier Conservative Beauce, QC

You are asking for more clarity in the guidelines from the CRTC and the government.

Noon

Senior Director, Client Services, Inbox Marketer

Kim Arsenault

Absolutely.

Noon

Conservative

Maxime Bernier Conservative Beauce, QC

Okay.

Mr. Lewis, you are offering your services to big government organizations, but my understanding is that the public cannot have access to your software. Could you explain the process for a small business, if they want to be as secure as the government organizations? How are they going to be able to have access to the kind of technology you are offering to the government?

12:05 p.m.

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

Spamhaus offers its threat intelligence data to individuals and small organizations for free. It always has. We are all believers in doing that. However, when we get into a big organization, we figure that we are saving them millions of dollars and making their customers happier. It costs us money to run our organization and to buy equipment, so they need to pay for it. All the small guys get it for free, though.

All the country-based incident response teams get our data for free so they can help secure their countries. CCIRC gets our data for free. CRTC gets some of our data for free. We are doing a lot of that. Not very many other companies do that; some do.

In terms of small companies trying to protect themselves, they can use our data as we suggest. They can go with other organizations that have similar data or with software techniques. We tend not to require the user to buy software. They are buying the information and they are using the software they already have to use it, but there are other solutions that do a much better job.

12:05 p.m.

Conservative

Maxime Bernier Conservative Beauce, QC

Do you think that in the private sector there are a lot of corporations that can offer these services to the small and medium-sized businesses?

12:05 p.m.

Chief Scientist, Spamhaus Technology Ltd.

Chris Lewis

Yes. In fact—as she was referring to with the question about how small organizations do their marketing and whether they are going to worry about trying to do it themselves—there is a burgeoning market of companies that are specifically intended to run mail and marketing campaigns for small companies. Some of them are free, or virtually free. You can use their machinery, their software, and their stuff, and for very small amounts of money you can be pretty sure that you are very close to being fully in compliance with CASL.

12:05 p.m.

Conservative

Maxime Bernier Conservative Beauce, QC

Thank you.