Industry Committee on March 10th, 2020

[Jonathan Daniels]

We actually proposed to the CRTC that there be a firm deadline of June 2022. We think it will be worked out before then.

Just to be clear, we're still planning on launching it in September. I guess what we're trying to say is that in the rush.... There's lots of talk, as you've heard from everyone, about STIR/SHAKEN. There's a lot to be figured out. But most importantly, with the phones right now, if you turned on STIR/SHAKEN today or tomorrow on our network, very, very few people would have phones that could actually benefit from it. The whole point of it is that the phone end-user would see it and say, “Oh, the number that's coming is verified. It's accurate. It's okay.” If you don't have a phone that can do that, as most of our phones can't—we have to wait for the manufacturers, the Apples and the Samsungs, to create phones to do that—then there's no rush to put it out. Very few people could actually use it.

I just want to make it clear that when we say “delay”, and it sounds.... There is a lot to be worked out, but even if we all turned it on tomorrow, very few customers could actually benefit from it. So we're going to take the time to get it right. I think what you're hearing is that we're all supportive. We're in fact turning it on in September.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Thank you.

I have another question for you, Mr. Daniels.

Do you have the telecommunications fraud website in other languages? I'm especially thinking of new Canadians and vulnerable people in our society. Do you have that in other languages?

[Jonathan Daniels]

Are you talking about in terms of a Bell website? I honestly don't know the answer. I'm sure we have it in both official languages, but I don't know, so I'll have to take that one away and get back to you on that.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Okay. Thank you.

The prevalence of unauthorized porting and SIM swapping has recently been brought to my attention as a scam rising in proportion in Canada, which is locking individuals out of their phones and giving scammers access to their phone apps and personal data. What are you doing to ensure call centre employees and staff employed by your corporations properly verify your clients?

I open it up to anyone who might want to address that.

[Deborah Evans, Chief Privacy Officer, Rogers Communications Inc.]

Thank you for your question.

As an industry collectively, first of all, I'd like to say we've come together to put some solutions in place to help consumers not be subject to porting fraud. There are things that we're rolling out. Obviously, we don't talk about them publicly because we don't want the fraudsters to know what they are.

With regard to porting fraud, just porting in general is meant to be as easy as possible. You're meant to go in and get your port done without having an interaction with your existing telephone provider. It's really to enable the port to go as quickly as possible. Most of the ports are done over the phone or online, so from that perspective you go into your new service provider and you request your port, and then it goes back to your old service provider.

The way the porting rules have been established by the CRTC and the porting guidelines from the industry that came together collectively, you're required to have a phone number, a postal code, and then either an IMEI or an account number. Unfortunately, it's pretty simple for fraudsters to gain some of that information from various sources around the world. This isn't an issue that's common to Canada. It's a global issue and all carriers are facing it around the world, so it's challenging. Fraudsters are constantly evolving and changing their techniques and we're trying to stay ahead of it and put things in place. As my colleague mentioned earlier, fraud is an arms race. We put things in place and then the fraudsters come and circumvent them. We're continuously evolving and working collectively as an industry to address the problem.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

We haven't seen a lot of statistics on that. Do you know how many cases of unauthorized phone porting have been logged by your organization or as an industry?

[Deborah Evans]

I do not.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Okay.

One other question I had was with regard to communicating to at-risk groups such as seniors and new Canadians around potential phone scams and fraud calls. I'm wondering if you can let us know what outreach you're doing to those communities.

[Deborah Evans]

For our company what we do is if we notice a particular scam targeting a particular community group, we will put ads in local newspapers in their language of choice. For example, we had a scam recently targeting immigrant communities from mainland China, so we had our IVR updated in their language so it could alert them.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

Unfortunately, that's the end of the first round.

The next six-minute question goes to MP Jowhari.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you, Madam Chair, and thank you to all of you for coming in and shedding some light on something that everyone is concerned about.

All three of you spent a fair amount of time talking about STIR/SHAKEN as the tool, the method, that's being looked at in helping us. Also, there seems to be a commitment that this thing will go forward in September 2020 in some shape or form. However, you also all highlighted that there are many dimensions to this, and this is not going to be the be-all and end-all tool. As well, we're not ready at our end from a device point of view, from an education point of view, and all of that, to be able to roll this out.

Each one of you individually touched on, whether it's the education piece, whether it's the technology piece, whether it's the device model, is there a set of well-defined criteria that is needed for this thing to be fully rolled out? Do we have an idea of the timing for each one of those criteria to be completed so we'll have a wholesome solution?

Any one of you can answer.

[Jérôme Birot]

I can take this one as the only technical guy on the panel.

It is complex. First, any legacy network, normal IP network, will not work with this technology. That's a big challenge for all the carriers within Canada to upgrade every part of our network, or work with the carriers we interconnect with to upgrade our networks. That's one challenge, and obviously we can't mandate another carrier to do it faster for us so we can have better service for our customer. We don't have that reach or that jurisdiction.

Second, the devices are not the carriers' devices. They are the manufacturers' devices. They choose when they need to implement a certain feature within their devices. It's very hard for any of us to tell when the smart phone manufacturers will decide to implement this. Then what do we do with the wireline part? How do we handle home phones and provide similar service for home phone users?

As an industry we need to come together. We already set together the CSTGA. That's the governance of it. There's the policy administrator. There is the token administrator for all these parties to exchange and make sure there is an authority that will validate these calling numbers.

I'm afraid I can't answer your question in a straight fashion because many components are outside our control in all our cases.

[Majid Jowhari, Liberal, Richmond Hill, ON]

I get it that the main issue you are highlighting is the back-end network and also the customer facing, which is the device.

[Jérôme Birot]

That's correct.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Okay.

[Jonathan Daniels]

I totally agree with everything that was just said. I realize it's dangerous here because we're getting technical and so on. All three of us did an excellent job of explaining that for a non-technical person.

I think the message you're hearing from all three of us today is that there's no one solution. Even if we had STIR/SHAKEN and every phone was capable of doing it and we all had the technology, all STIR/SHAKEN does is tell you that the number that's calling has been authenticated as truly the number that's calling. That's all it does. That doesn't necessarily mean that a fraudster can't be calling, that you pick up the phone and can't start doing fraud.

That's why we have to look at more than one solution. In our case we're saying that the quickest one is.... We know we have 120 million fraudulent calls a month. We could block them today as soon as we get permission—

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you.

I was hoping you'd go there because you highlighted the fact that it takes some time to work with the CRTC to get permission. What do you suggest? I think I heard that the CRTC automatically blocks or allows you guys or the big carriers to block those calls immediately. What are the challenges facing the CRTC or facing you that that permission isn't allowed? ?

[Jonathan Daniels]

The CRTC has to do a public process. I don't want to be laying this as criticism.

We applied. We're going through the process and we're waiting for the decision. Comments just closed. The reason they have to do all that is we are making decisions based on the content of the call. We're saying these are fraudulent calls. As people know, we have to be very careful. We shouldn't be making decisions based on the content of calls. I'm sure this committee has had other issues about that. For that reason we have to ask for permission.

We've asked to do a trial so we can learn the lessons. We will be happy to share that information from the trial with both the CRTC and our competitors as well.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Thank you.

I think my time is over.

[The Chair, Liberal, Sherry Romanado]

Pretty much.

Mr. Lemire, you may go ahead.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Madam Chair.

I'd like to thank the witnesses for being here today and contributing to our study.

It's tough to ask pointed questions with this panel. I know that you're all in competition with one another.

I would ask you to keep your answers brief.

About how much would you say all the measures you need to put in place cost?

Does the war on fraud affect your service providers? Will the cost ultimately be passed down to customers?

What can you do to help small providers, who have more trouble offering these services for financial reasons?

[Jérôme Birot]

I can start.

We are investing in technology to help prevent nuisance calling. Call control is there. It's offered free of charge to our customers who subscribe to it.

Would we offer this to other carriers? We would absolutely consider wholesaling this as a service for smaller carriers that wish to adopt this service.

[Howard Slawner]

I agree, to put all of it in place.... As Jon said before, it's not one single solution, so I think it's incumbent on all the carriers to actually keep looking at all of the various technologies that are out there right now. We are implementing STIR/SHAKEN. We have implemented UCB and we're actually currently evaluating other technologies that we can bolt on to these things.

There is no one quick solution that will do it, so for everything to happen, we have to keep looking at the broad selection. I do think that the smaller carriers will be able to benefit from the experience of the bigger carriers going forward, because the technology will then be applicable to them as well. It's in everybody's best interests that the entire industry is protected, so it's in our interests as well to have the small carriers included.

[Jonathan Daniels]

I agree with that.

From our perspective, when we look at our trial, our intention is to sign agreements to share the details with big players and small players. It is very clear that, if we get permission, we will be blocking calls, regardless of where they're going on our network, for no charge. I don't think any of us is looking for any money to be made. This is about a service to our customers and to Canadians.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

I'm very glad to hear that. Thank you.

It is often said that you have to fix problems at the root. Tangibly speaking, are you adopting any specific strategies in light of the techniques being used?

Is it an option to block calls from identified countries such as India, which we were talking about earlier?

Can we bring more pressure to bear on countries where fraud calls originate?