Industry Committee on March 10th, 2020

[The Chair, Liberal, Sherry Romanado]

Good morning, everyone. Welcome to the Standing Committee on Industry, Science and Technology. We have a tight schedule this morning.

Today we will be having our first panel on fraud calls in Canada.

Before us we have representatives from the Canadian Radio-television and Telecommunications Commission. We have Ian Scott, chairperson and chief executive officer; Steven Harroun, chief compliance and enforcement officer; and Alain Garneau, director, telecommunications enforcement, compliance and enforcement sector. From the RCMP, we have Eric Slinn, assistant commissioner, federal policing criminal operations; Guy Paul Larocque, acting inspector, Canadian Anti-Fraud Centre.

Gentlemen, each witness group will have 10 minutes to present, after which we will go to a series of questions. You can present in either of the official languages. If you see me waving the little yellow card, that means you have 30 seconds to wrap up. I will also remind folks in the audience there is absolutely no photo taking during committee, and I ask that you respect that. This meeting is being webcast live, so folks can follow from home.

With that, we will start with the CRTC. You have 10 minutes.

[Ian Scott, Chairperson and Chief Executive Officer , Canadian Radio-television and Telecommunications Commission]

Thank you, Madam Chair, for inviting us to appear before the committee, here on traditional unceded Algonquin territory.

My name is Ian Scott, and I am the chairperson and chief executive officer of the Canadian Radio-television and Telecommunications Commission, or CRTC for short.

You've already introduced my colleagues, so I will not repeat that in the interest of time.

We appreciate the opportunity to participate in the committee's study of fraudulent calls to Canadians, including robocalls and other types of unsolicited calls.

The CRTC's mandate includes helping Canadians reduce the number of unwanted telemarketing calls they receive. We do this by setting rules for telemarketers, overseeing the national do not call list, and conducting outreach and enforcement activities. While some unsolicited calls are fraudulent in nature, which is a matter outside the CRTC's mandate, we have a collective responsibility to protect Canadians.

We're pleased to be here today to share with you the steps we are taking to better protect Canadians. We recognize that these unsolicited calls impact everyone and are a scourge on our society. For some, however, particularly vulnerable people, they are an even more serious problem, because they often lead to criminal activity, such as fraud and identity theft.

Given the continuously evolving nature of the problem, addressing it requires broad and concerted co-operation and collaboration. To this end, we work closely with industry as well as our domestic and international partners to develop and implement solutions.

In 2008, the CRTC created the national do not call list, a tool that balances consumer concerns about unwanted calls with businesses' legitimate desire to communicate with existing and potential customers. It's important to recognize that striking and maintaining an appropriate balance between the two requires the participation of both consumers and telemarketers.

Since we started the national do not call list, more than 14 million numbers have been registered by Canadians who want telemarketers to respect their privacy. Last year, Canadians registered an average of 858 numbers each day—a sign that they have confidence in the list. In addition, more than 20,000 telemarketers have subscribed to the list.

We closely track and analyze complaints about unwanted calls—data that help to inform our outreach efforts and enforcement action. The CRTC regularly imposes monetary penalties on telemarketers and their clients who violate the rules and takes other enforcement action such as issuing warning letters, citations and notices of violation.

I'm pleased to report that the majority of legitimate businesses are following the rules. The challenge we currently face, as I'm sure the committee appreciates, is the illegitimate actors who are using the telephone system to take advantage of Canadians. These people often do not reside in Canada, have no interest in complying with the rules and are using technology to hide their identity.

To combat this problem, the CRTC required certain service providers to implement a system to block types of calls within their networks by the end of last year. Whenever the caller identification information exceeds 15 digits, or doesn't conform to a number that can be dialed, for example, all zeros, the call will not go through. These calls will be blocked before they ever ring on a subscriber's phone. Providers that offer their customers that call filtering service, which provides a more advanced call management feature, were exempted from this requirement.

While the call blocking system will help, it will obviously not stop all the illegitimate calls from getting through. For years, Canadians have used the caller ID function on their phones to identify and ignore unwanted calls. Now, however, some illegitimate actors use technologies that generate fake caller IDs, enabling them to conceal both their identities and intentions. This is often called caller ID spoofing.

I'm pleased to inform you there's a new weapon in the ongoing fight against ID spoofing. It's a framework known as STIR/SHAKEN. STIR is an acronym for secure telephone identity revisited, while SHAKEN stands for signature-based handling of asserted information using tokens. The CRTC expects Canadian telecommunications service providers to implement STIR/SHAKEN by September of this year.

The STIR/SHAKEN framework enables service providers to certify whether a caller's identity can be trusted by authenticating and verifying the caller ID information for Internet protocol-based calls. This new framework will enable Canadians to know, before they answer the phone, whether a call is legitimate or whether it should be treated with suspicion.

Last December, we joined forces with our American counterpart, the FCC, to hold the first official cross-border call using STIR/SHAKEN. This initiative highlighted the joint commitment of our two organizations to reduce unwanted calls and better protect consumers. The timely implementation of STIR/SHAKEN will enhance the security of citizens on both sides of the border.

We also continue to work with the Canadian telecommunications industry to develop a process to trace nuisance calls back to their points of origin in the network.

No organization, regardless of its size or power, can combat the negative impacts of illegitimate calls on its own. That is why the CRTC works with a number of federal departments and agencies, including the RCMP, the Canadian Anti-Fraud Centre, the Canada Revenue Agency, the Competition Bureau, Shared Services Canada, Employment and Social Development Canada and the Communications Security Establishment. An important purpose of this collaboration is to share relevant information with Canadians in a timely way to help them avoid becoming victims of fraud.

One challenge that I would like to raise is that we are currently limited in the information we can share with our domestic partners. Greater flexibility would enable a more coordinated response to this issue.

In this era of globalization, illegitimate calls are increasingly an international problem. We recognize the importance of developing a global and coordinated approach to address these calls, along with the threats that they pose to consumers and their confidence in critical communication systems.

To better protect Canadians from unwanted calls originating from outside our borders, the CRTC has signed memoranda of understanding with our counterparts in the United States, Japan, the United Kingdom, Australia and New Zealand. These arrangements allow us to share information and expertise, collaborate on education and training activities, and provide investigative support. Thanks to these activities, our investigators better understand the nature of the challenge and how best to meet it.

The CRTC also maintains partnerships with law enforcement agencies and private sector groups to enable effective enforcement, intelligence gathering and compliance promotion. For instance, as you'll see in our printed remarks, we are members of a number of international organizations. These networks help us to prevent international spam and telephony and encourage enforcement co-operation, and to address problems related to nuisance communications such as fraud and deception, phishing and the dissemination of viruses.

Canadians are rightfully proud of our systems. When these systems are abused by criminal elements, however, it erodes the confidence of Canadians.

[The Chair, Liberal, Sherry Romanado]

Mr. Scott, I'm sorry, but you're over your time. I'm sure, though, when we get into the rounds of questions you'll be able to finish your remarks.

[Ian Scott]

Thank you. We'll do our best to answer questions at that time.

[The Chair, Liberal, Sherry Romanado]

Thank you very much, Mr. Scott.

Now we'll move to the RCMP.

[A/Commr Eric Slinn]

Thank you, Madam Chair. It's a pleasure to appear before this committee as part of its study on fraud calls in Canada, particularly given that we find ourselves in fraud awareness prevention month, in the month of March.

I'm Assistant Commissioner Eric Slinn, responsible for the federal policing criminal operations program.

Joining me today is Acting Inspector Guy Paul Larocque, who is in charge of the RCMP's program to combat mass marketing fraud.

As part of our mandate to protect Canada's economic integrity, financial crime, including fraud, has long been a federal policing priority for the RCMP.

The RCMP works with partners across Canada in both the public and the private sectors.

As well, we work with law enforcement agencies around the world to pursue fraud cases, as highlighted by our recent success in Project Octavia here in Ontario. This array of partners speaks to the shared responsibility of combatting fraud not only in Canada but around the world. This is truly a global challenge that requires a global response.

Technology facilitates an increasingly interconnected and borderless world that provides tremendous benefit to Canadians. However, criminals also benefit. They are quick to adapt to the evolving technological landscape and use this landscape to target Canadians.

No one is exempt from these fraud calls. By way of example, just two weeks ago I received three separate calls within an hour from fraudsters pretending to be the CRA advising I was subject to criminal charges and a warrant would be issued for my arrest. This was only on my RCMP-issued cellphone. A lot of fun was had by me that day.

Fraud operations are so pervasive and profitable that relying solely on enforcement is an insufficient response to the scope of this criminal activity.

The Canadian Association of Chiefs of Police has made it clear through its organized crime committee that prevention forms a crucial component of the fight against fraud, and we agree.

On the topic of prevention, the RCMP continues to invest in this area. We've undertaken a number of local and national projects and initiatives that focus on prevention.

For example, in response to reports from the public and businesses on gift card scams, RCMP officers in Alberta took the initiative to create a fraud tip sheet, which they distributed to local businesses. A clerk in one store referenced the tip sheet and intervened to prevent an elderly individual from purchasing 50,000 dollars' worth of gift cards. These fraud tip sheets are being distributed to detachments throughout the province of Alberta.

Also in Alberta, officers created posters warning the public about Bitcoin fraud and placed them next to Bitcoin ATMs. RCMP federal policing is now working to expand this initiative to make it accessible across the country.

Nationally, the RCMP has operated the Canadian Anti-Fraud Centre in partnership with the Competition Bureau of Canada and the Ontario Provincial Police since 2009.

The CAFC acts as Canada's central repository for information on mass marketing fraud and other scams impacting Canadians. In recognition of the significant impact and collective role of this, the CAFC disseminates information to law enforcement agencies, private industry and the Canadian public to raise awareness and prevent Canadians and businesses from falling victim to these scams.

The CAFC invests in fraud awareness campaigns, drawing the public's attention to high-profile scams, such as the CRA scam, through a variety of mechanisms, including social media.

Beyond prevention, the CAFC, in conjunction with private sector partners, targets the tools of scammers.

When individuals who suspect a scam or who have fallen victim to fraudsters report to the CAFC, the information they provide, telephone numbers, for example, is shared with the appropriate service provider, who can then terminate accounts by these scammers. Similarly, email addresses, bank accounts and merchant information are also shared with the appropriate partners to alert them to fraudulent activities within their own network.

While some victims have indicated that it can be difficult to reach the CAFC by phone, it's important for the public to continue to report, using online tools. Public reporting provides valuable information to the CAFC, but there is also the potential for victims to recover money lost. The CAFC works with such partners as Canada Post to intercept packages, or with banks to prevent money being sent to accounts linked with fraudulent activity, and sometimes to return the cash to those victims.

Under the federal policing priority of transnational and serious organized crime, the RCMP has a mandate to investigate criminal activity, including financial crime that crosses international borders and is carried out by criminal organizations who target Canadians. Under this mandate, the RCMP conducted an investigation recently into the CRA scam called Project Octavia.

Project Octavia commenced in October 2018. It investigated a telemarketing tax scam, better known as the CRA scam, which I'm sure many of you have heard about. In February 2020 the RCMP investigators arrested and charged two people in connection with the CRA scam. Between 2014 and 2019 the CRA scam resulted in cumulative losses, that we know of, totalling over $16.8 million.

Highlighting the complex, borderless nature of modern-day fraud investigations, RCMP investigators, including the RCMP liaison officer in New Delhi, India, worked with law enforcement agencies across Canada; other federal agency partners, including the CRA, Canada Border Services Agency and FINTRAC; and foreign authorities, including the Indian Central Bureau of Investigation and U.S. authorities based in India.

Long-running international cases like Project Octavia are indicative of the challenges the RCMP continues to encounter when investigating fraud. Criminals hide behind technology and international jurisdictions to perpetrate their crimes in Canada. However, where there is a challenge there is always an opportunity. Part of the success of Project Octavia can be attributed to the public awareness campaign undertaken by the RCMP through the CAFC. Since 2015 the CAFC and CRA have released numerous bulletins and public relations documents to inform Canadians of this scam.

You may have noticed that I've spoken at length about the CAFC. It is a best practice initiative that provides a valuable service both to law enforcement and to the Canadian public.

However, the CAFC is overwhelmed given the growth in phone scams and other frauds and the inundation of calls and emails it receives every day. As an international best practice and an effective proven model in the fight against fraud, the CAFC and its dedicated team of paid and volunteer staff provide a valuable service to Canadians, particularly such vulnerable populations as seniors and new immigrants.

Telcos have worked with us and taken specific actions to aid Canadians by blocking fraudulent calls from numbers they know are associated with suspected fraudulent activity. Both telcos and ISPs rely, at least in part, on information they receive from the Canadian Anti-Fraud Centre. In turn, the CAFC is only as good as the information it receives from Canadians reporting frauds and scams.

Through Project Chameleon, financial institutions in Canada are working with the RCMP to identify perpetrators of romance fraud and to contact victims to protect their money. This is not to forget our international law enforcement partners, such as the Five Eyes law enforcement group. FELEG members have collectively undertaken work focused on vulnerable populations. These groups are not always comfortable contacting law enforcement, as we know, and are often specifically targeted by scams. Further work and international public and private sector partnerships along these lines could prove invaluable in combatting such frauds as the CRA scam, and offers an opportunity to gain further insight into the methods fraudsters use to bilk Canadians of their hard-earned money.

In conclusion, fraud impacts Canadians in a variety of ways: financial loss; potential loss of property or the ability to gain credit; and, most seriously, a loss of trust in the institutions that make Canada such a desirable place to live. I have highlighted that combatting fraud is a shared responsibility. It is one that we will not shy away from. The RCMP will continue to work with the public and private sectors and our international law enforcement partners to detect, investigate and prevent fraud to better ensure the safety and security of Canada and its citizens.

I thank the committee for the opportunity to stand before you and welcome the chance to answer any questions you may have.

[The Chair, Liberal, Sherry Romanado]

Thank you very much, Mr. Slinn.

We will start with our first round of six-minute questions.

The first group of questions comes from Mrs. Tracy Gray.

The time is all yours.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Thank you, Madam Chair.

Thank you, witnesses, for being here today.

The statistics provided by the CRTC website on enforcement, between 2018 and 2019, on calls to numbers on the do-not-call list, state that only about 500 cases of enforcement were undertaken, such as citations or warning letters. They also state that the CRTC has received over 84,000 complaints in the same time period.

Can you elaborate on why there is such a large discrepancy between the complaints and the enforcement actions?

[Ian Scott]

I can begin, and my colleagues may wish to add.

From the outset, it's important to point out the approach that we take on these enforcement matters. It is first about consumer education and the education of those participating in the telemarketing industry, to incentivize the correct behaviour. Our focus isn't on pursuing every single small case, whether or not by using AMPs as penalties; rather, it's a broader approach, to educate and incentivize proper behaviour.

AMPs aren't meant to be a punishment. They're meant to be an incentive to comply with the law. That's the simple explanation for those. What we do is pursue those who grievously offend the rules and who do not comply.

I don't know if my colleagues want to add to that.

[Steven Harroun, Chief Compliance and Enforcement Officer, Canadian Radio-television and Telecommunications Commission]

I'll just add one comment to that, to your volume question.

The 84,000 complaints are not validated complaints. That's what comes in to the national do-not-call list operator, and they say, “Here are your complaints for this year.” We get them on a weekly basis nonetheless.

Those have to be validated and sliced and diced. There may be hundreds if not thousands of complaints about the same campaign. We also have to stay within our mandate. For example, a lot of those complaints may be related to a charity that has called. Well, a charity is actually allowed to call you. They're exempt from the rules. There are those types of things. They may also be strictly fraud related, which would be for our colleagues at the RCMP to tackle.

Five hundred cases do take time. We want to make sure, if we are going after a particular target, that they are the correct individuals.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Thank you. My time is limited here, so I'd like to go into something else, if I may.

The CRTC states in its report on its website that there have been 2,067 purchases of the do-not-call list by telemarketers. The information in the briefing note you handed us today said that there are 20,000 telemarketers who subscribe to the list. First, what is the difference between someone purchasing and a subscriber?

The second question concerns a survey that was prepared by the CRTC in 2016 which revealed that only 10% of registered telemarketers subscribed to the DNC list. This shows that most are either not aware of their obligations or are not fulfilling them. Is this mandatory, and how are you enforcing these rules?

[Alain Garneau, Director, Telecommunications Enforcement, Compliance and Enforcement Sector, Canadian Radio-television and Telecommunications Commission]

I can answer this question.

Just to clarify the distinction between registration and subscription, registration is free, and there is a clear obligation for each telemarketer or client of a telemarketer to register with the DNCL operator, which is Raymond Chabot Grant Thornton LLP.

Basically, a subscription means downloading the list, paying to access the do-not-call list. You can access the valid phone numbers of people who have made a clear choice not to be contacted, and you can access it by downloading the list. You need, first, to be registered, and then you pay for the subscription.

That is the main distinction between the two.

I don't know if it answers your question.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Well, it answers the first part, but the second part is that, if it's mandatory, why did the report you put out in 2016 say that only 10% of people are participating in it? It seems there is a big gap.

[Alain Garneau]

No, I don't think there is a big gap. I think what we mentioned in the report is that since the inception of the do-not-call list, the proportion of telemarketers who are registered with DNCL is just going up. At the moment there are roughly 20,000 telemarketers or clients of telemarketers registered with the DNCL.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Okay.

I hear from people who say they've registered and yet they're still getting calls. There seems to be a gap.

[Ian Scott]

Most of those, the significant percentage, are because consumers don't understand the exceptions. That comes up during election cycles, for example, when they are being contacted by political parties, by charities and so on, or by pre-existing customer relationships. Many Canadians don't understand that it's not a carte blanche there will be no calls.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Okay.

Mr. Scott mentioned spoofing. A number of spoofing websites are available online that are accessible to anyone. Many of them market themselves as prank sites. I'm wondering if the RCMP is aware of these sites, and if you think there is a prevalent problem.

What actions are being taken against these sites?

[The Chair, Liberal, Sherry Romanado]

You have 10 seconds to answer.

[A/Commr Eric Slinn]

Ten seconds.

We are always trying to keep up with different models, different intelligence, how people are working. It's hard to keep up.

[The Chair, Liberal, Sherry Romanado]

Thank you very much. That is your time.

The next round of six-minute questions goes to Helena Jaczek.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Thank you very much.

Witnesses, thank you so much for coming in.

My questions are going to relate mostly to the CRTC. A lot of them are being asked on behalf of my very elderly spouse who is incredibly frustrated with the nuisance calls that are clearly fraudulent in nature.

He is certainly able to use the Internet, and his first complaint is that he looked at the CRTC website and found it incredibly hard to navigate. In other words it is not a telemarketer call and he has not been subject to fraud, but he wants to tell you about a call he's received and what the number on the call display has shown. He wants to simply tell somebody about it because he doesn't want someone to be scammed in the future.

Have you looked at trying to simplify your directions?

I know you mentioned 84,000 complaints and that many relate to legitimate organizations.

Have you looked at in some way clarifying this for vulnerable seniors who wish to do their duty and report to you, but frankly give up trying to navigate your web page?

[Ian Scott]

That's a very fair question.

In a second I'm going to ask my colleagues to answer about the improvements.

The challenge is it's not easy to explain. There isn't a single button because we want them to add information when reporting to us because the more information we get, the better the information we share with enforcement and other colleagues. It's this balance between having a button that says to forward an email as opposed to adding additional levels of detail that will give us more information in the process of intelligence gathering.

I acknowledge it's probably not the simplest thing to navigate through sites. Part of it is also Government of Canada format requirements, accessibility requirements and the like. We don't have total flexibility in what we can do with our site.

Steven, do you want to add on the information itself?

[Steven Harroun]

Absolutely.

Definitely, keeping our websites up to date is a constant battle. We certainly have taken measures on the anti-spam side, which is my wheelhouse, as well as the email side. We're revamping our telemarketing website as well so if someone types in “telemarketing call” it will pop up to a page where all the relevant information will be.

The one thing I would tell your husband and all your constituents is that you can always call the client services number on the front page of the CRTC website.They will direct you to the DNCL operator whom you can make your complaint to. We have a really cracker jack client services team. They will make sure you get to the right place.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Okay. I'll make sure he knows about that number.

In your presentation, Mr. Slinn, you talked about STIR/SHAKEN. I think we're all aware that there has been a delay. A delay was requested. Originally I think it was supposed to be instituted in March 2019, and now it's September 2020. From some materials I've received, I understand that some of the telecoms want to delay further.

Could you explain the delay?

[Ian Scott]

I don't think it's a question of their wanting to delay. It's a question of getting the systems completely interoperable and working.

Even in the United States, and we are in a fast follow mode, the United States had an edict. The FCC said they had to be in place by the end of last year. By and large they have been put in place but they are not fully operational. They are still working to perfect the system. At the moment we have a deadline of September of this year. We have not extended that. We expect the carriers will meet that but we have to be open and understand there may be technical challenges. If there are, they will present them to us and only if necessary add additional time.