Industry Committee on March 12th, 2020

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Right. What other modes of two-factor would you...or would you like to see a whole other means that is different from what Australia is doing?

[Randall Baran-Chong]

There's something called soft-token authentication. There are things like Google Authenticator or Authy or things like that, which are available for quite a few different types of apps and things that we use. A lot of social media offers it. But often it's a secondary offered form of authentication. It's not widely known. It's accessible only to smart phone users unfortunately. But there are still a lot of things we use in which they promote two-factor authentication by SMS, and still banks often promote that only.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Thank you for that.

My next question will be for you, Kate.

During the last meeting, I raised the growing problem of scammers, which are increasingly targeting people through online social media or text messaging. We know that young Canadians are present on these platforms, but could you say something about how this issue might be particularly affecting seniors?

[Kate Schroeder]

It is not a misconception and definitely social media is extremely prevalent with our younger generation, but it is also extremely prevalent with senior Canadians. Facebook is a very, very hot popular thing for aging Canadians. It is unfortunately a breeding ground for fraud, romance scams and all of those types of things. It all stems from that need for connection, that want for a relationship, the need to feel connected. It's that social isolation piece we focus on that is stemming from those connections that our senior population are trying to build in that social network.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Yes, for sure.

For the education and even the awareness side of things as well, what more needs to be done? Are there already steps being taken by groups such as yours to get that education and awareness for seniors? Are there programs out there that they can understand, that can help them be aware of these things?

[Kate Schroeder]

I think there are certainly programs out there. I know the Canadian Competition Bureau has “The Little Black Book of Scams”. It's available. It talks about all of these things.

It's really about promoting these resources that are available and having them widely available in all sorts of different social services, banks and agencies. I think there is a need.

Again, because our senior demographic is so robust, one person may see it online and another may see it in print, so we really have to cover off all of those areas. I would say there is a need for a more robust promotion of those materials that are out there.

Also with regard to the new things that are coming out, to speak to what Mr. Baran-Chong just said, I think we're really good at promoting information about the CRA scams, romance scams and things like that, but there needs to be more robust communication from telecommunication companies and things of that nature, on the emerging scams and the things people need to be aware of.

[The Chair, Liberal, Sherry Romanado]

Thank you so much.

Our next round of questions will go to MP Jaczek.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Thank you, Madam Chair.

Ms. Schroeder, I really appreciate what you've had to say to us and I totally concur with all you've said.

One of the previous witnesses, Mr. Lawford, made reference to the fact that perhaps some seniors are actually giving up their land lines because they are so fed up with phone scams, nuisance calls and so on. Are you aware of any of that? Has that been an issue at all for your clients?

[Kate Schroeder]

Yes, it is happening. I think as our demographic continues to age, our world is moving to a more mobile cellular network type of environment certainly. I think we can all concur that this doesn't necessarily eliminate the problem.

I think it's twofold. If they're simply eliminating their land lines, there's obviously concern that only adds fuel to the fire of social isolation and to the concern that if something is wrong, how we will get in touch with these people to make sure they're safe and okay.

Again, with regard to the cellular network piece of it, we get just as many fraud calls on our cellular devices as we do on our land lines. I definitely think we're seeing that. I think it's concerning, because it only adds more concern regarding the potential risks to those individuals.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Exactly. As Mr. Baran-Chong has alerted us, if they give up their land line, they're obviously going to start relying on cellular phones and presumably they will be just as vulnerable to this SIM-swap scam that we've just heard about, which was totally new to me as of yesterday, so I'm extremely grateful to have heard a lot about this.

Mr. Baran-Chong, you weren't quite able to finish your presentation. You talked to us about Australia and how if somebody claims to have lost their phone, they have to personally attend and show their government ID, etc. Could you talk about what you feel the CRTC should be doing, given the facts?

[Randall Baran-Chong]

Absolutely. I think first codifying that within the regulations is important, because what we've often seen the carriers do is to fall back on saying they're complying with the regulations. However, the decision was made back in 2005, and obviously the kind of threat environment has changed quite significantly.

As Mr. Lawford alluded to earlier, the CRTC also needs to be much more transparent in asking the CWTA and the industry to be more transparent about the prevalence of this. Are they effectively dealing with this?

We appreciate that the CRTC issued the letter back on January 15 of this year, but the letter that came back from CWTA was highly redacted with regard to anything that was interesting to us, such as the measures being taken and the prevalence. As well, there was no sense from us of what the CRTC would assess as effective measures from the industry, the kinds of potential enforcement measures they'd take if they didn't act upon this or the implementation schedule, because the longer this persists, the greater the number of victims that will be racked up.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Would one recommendation be a public airing of the CWTA's response? How do you see this going forward practically?

[Randall Baran-Chong]

I think there at least needs to be recognition, especially for the customer-facing elements in terms of the protections that are introduced, that there should be more disclosure about that and participation of customers in that. I mentioned the issue with the texts that went through. People weren't aware that a new protection was introduced, so they were immediately skeptical of it. These kinds of measures need to be more publicly aired.

I can understand, though, that one part that needs to be addressed is around training their staff more. I can't tell you how many times I've called my telcos and had to teach these customer service reps about their porting policies—in fact, up until last night; I almost used social engineering to get my pin from someone who really didn't.... I provided information that's very easy to obtain.

There needs to be training of employees too. I can understand if that part is not necessarily publicly disclosed, but there needs to be two sides to this.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

We pulled up an article on SIM-scamming yesterday. Apparently, there's some advice from the OPP on how people can protect themselves.

You talked about the personal information—do not answer phishing emails and text messages—but using an off-line password manager is something that's completely new to me. Could you explain what that is?

[Randall Baran-Chong]

That's the soft-token authenticator I was alluding to earlier. It's like Google Authenticator. It generates a code on your phone and asks you to essentially replicate the number you're getting on your app and put it in. Instead of getting a text message, you're using that number. You can also use a hardware token. Some people might have seen those RSA keys that generate a number as well. A hardware or soft token could be used to authenticate. Essentially, you just don't want to tie it to your phone.

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Thank you so much.

[The Chair, Liberal, Sherry Romanado]

Thank you.

Mr. Lemire, you have the floor.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Madam Chair.

I will continue with Mr. Baran-Chong.

I'm sensitive to your reality and I appreciate your push to use your experience to help other people out in terms of prevention.

You have come up with several expectations of the CRTC. They are at the end of your document, and I thank Ms. Jaczek for pointing them out.

Do you have any other expectations of the CRTC? Also, do you have expectations of the RCMP and the telecommunications companies?

[Randall Baran-Chong]

I'll give you an example. There was recognition, I think, by the different law enforcement agencies that have been dealing with this that there needs to be more coordination. Even though maybe these criminals are working in teams that are close to each other, these victims span across the country. The RCMP is launching a national cybercrimes coordination unit, which will be launching this year, I believe at the end of April. They will be able to better coordinate these cases. When we as victims share our stories, we're often able to almost hear these common denominators between these crimes. We pass that off onto the law enforcement agents who are working on our cases.

As we said, we need codification of these new types of pre-porting notifications and verifications and more transparency around what's going on with the porting. We need to ensure that the telcos are implementing policies and doing it consistently. Finally, I think governments and industry should be studied, in terms of the ones that have sensitive data, on whether they're using SMS-based 2FA, and how we can transition away from that. Otherwise, we put ourselves at the peril of SIM-swapping.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In your situation as a victim, did you receive any support or assistance from anyone at all?

[Randall Baran-Chong]

I was offered $100.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Is that all?

[Randall Baran-Chong]

Yes, I think that speaks volumes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

This is appalling.

You talked about the illegal sale of data by employees. How can we help companies adopt better security measures to prevent them from selling client information so easily? I am thinking of Desjardins, which is receiving a lot of attention in Quebec. Should we increase searches of intranets or patrols by security guards, or take other measures? What do you suggest that we do at the source?

[Randall Baran-Chong]

Individuals are partly responsible as well in terms of their data, for example, what they put into things like the cloud. To some degree, I'm paying a top-bracket idiot tax for uploading almost everything. I actually wasn't even aware that all that stuff was being uploaded, because I didn't really use it.

I wanted to come forward with my story to let people know that you should be careful about what's being put on there. Cyber experts, ironically, are saying to go offline, don't use cloud, save on an external hard drive. They're even saying to not save passwords on your browsers; write it down on paper, and write with a marker, so that the pen doesn't imprint on the paper. We're making a 180° turn in terms of how we are becoming more careful about the stuff we store. On the consumer side, that's the most important part, to be aware of what we have there.