Justice Committee on Sept. 28th, 2009

[Serge Ménard, Bloc, Marc-Aurèle-Fortin, QC]

The next time, I won't give out these numbers. Then I'll see what type of questions I'm asked.

I have a question for the RCMP. These challenges have made you realize, as others have, that a modern police force requires considerable expertise, particular in the area of information technology. Although universities sometime offer IT courses, we have discovered that people are often self-taught and that it is these individuals who are the most adept at hacking into systems.

Briefly, how many RCMP officers are experts in information technology, and what kind of training do they have?

[C/Supt Stephen White]

Unfortunately, I'm not in a position to give you a specific figure in terms of the number of experts we have in informatics and technological-crime-type issues.

What I can say is that we have a well-established technological crime unit within the RCMP. We have a very significant informatics component to our national organization. They have significant numbers in them. I don't have the exact numbers for you here today, but I would be happy to get you those numbers.

[Serge Ménard, Bloc, Marc-Aurèle-Fortin, QC]

I would be very happy if you would follow up on this for me. I'm not asking you to reveal any confidential information. RCMP operations will not be affected. I would greatly appreciate it if you could let me know how many people are employed in your largest unit and in your specialized informatics unit.

I would like to read the Canadian Bar Association's submission. However, as I recall, the changes that you are proposing are few and relatively minor. Basically, as I understand it, you, the experts, are satisfied with the proposed legislation and believe that we should move to adopt it as quickly as possible. Is that right?

I have one final comment. Back in 2000, I was struck by a television program that I saw. It showed the CBC interviewing some people back in 1950. They were asked to give their predictions for the year 2000. Many predicted that people would be travelling to the moon and into space. They predicted honeymoons spent in zero gravity conditions, video phones and all kinds of things. A lieutenant in the French navy was also interviewed. I really don't know why he was, but he gave the best prediction of all. He predicted that computers would transform our lives by the year 2000. He was spot on with his prediction.

I still bragged about being computer illiterate in 1996. Since then, I have made an effort to improve my skills and I will admit that I couldn't do without my computer today. However, I do get the impression that some of the information that I transmit via my computer could become public knowledge. My banking transactions are conducted strictly with my bank. I feel that if I start to transfer sums of money from one bank to another, I could be a victim of theft. Am I cautious enough? I agree that it's a marvellous tool for paying bills. So far, I have not had any unpleasant experiences. However, I think that if I were to start transferring funds from one bank to another, then I would be putting myself at risk. I've just read an excellent novel by the name of Millénium that deals with this very subject. Has anyone else read it?

[The Chair, Conservative, Ed Fast]

Monsieur Ménard, you're out of time. Thank you.

To be fair to our witnesses, I have checked with the clerk, and it is our common practice to let them know that they can present a brief in advance, but it's certainly not compulsory.

As you know, Monsieur Ménard, many of our witnesses appear here on relatively short notice. Any briefs that have to be circulated also have to be in both official languages, and sometimes that becomes very difficult.

We'll move on to Mr. Comartin, for seven minutes.

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Thank you, Mr. Chair.

I'd like to thank you all for being here.

Mr. MacRury, the point you raised with regard to clauses 7 and 9 is the same point that I had raised with the minister and the officials when they were here. The justification we got, particularly with regard to proposed section 368.2, was that they specifically wanted to exclude it from section 25 of the code because they would be using it so often. The paperwork of having to report it would become so difficult that they may in fact not use the technique, one of the tools.

I must admit that I didn't catch it at the time, but I wasn't sure, after I thought about the answers later--this was one of those bright thoughts you have after the fact rather than at the time--how they would know that in terms of how often they would use it. Superintendent White or Inspector Petryshyn, you might be able to make some comment on that. From your experience with prosecutions, perhaps, does that make sense?

Finally, on the same point, Ms. Stoddart, again I think I missed the significance of what's in clause 7. It's not just police forces who would be asking this; it's also the Canadian Forces, along with the department or agency of a federal or provincial government. Any one of those agencies can now ask for a forged document, in effect, to be created. I'm just wondering if you would have any concerns about the potential for abuse there, given that you have such a broad scope of agencies who might in fact be asking for that.

Mr. MacRury, perhaps I can start with you, please.

[Daniel MacRury]

Of course, one is that the CBA's position is very clear that it shouldn't be changed. That's still our position.

To answer your question in terms of the paperwork, from my personal perspective and experience I can tell you that whether it's more paperwork or not, the rule of law is very important. When you're making exceptions to the rule of law, quite frankly, more paperwork and those protections and safeguards in section 25 are essential. It may slow things down, but at the same time, you have to balance out why you're slowing it down. You're slowing it down because it's an exception. When you're dealing with exceptions you have to take exceptional measures. From my experience, an analogy, Mr. Comartin, is that part VIs and wiretaps are very lengthy. I've had the opportunity to deal with part VIs. But they're lengthy for a reason, because of what you're dealing with and the balancing of rights. That's why the CBA position is quite clear that this exemption is not needed; the law shouldn't change.

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Superintendent White, the impression we were left with by the minister and the officials is that it was going to be used quite extensively. I don't want you to put yourself in their shoes, but have the RCMP done any analysis of how often clause 9 in particular would be used, the proposed section 368.2?

[C/Supt Stephen White]

I'm not sure we've actually done any analysis and I don't think I'm in a position to say exactly how many times it gets used. I think what I can say is that it would be used on an extremely regular basis. I think the use of identification by undercover officers is actually the foundation of having an undercover program--being able to use on a daily basis covert identification. Undercover operations take place extremely often in a very fast and robust fashion, with short timeframes, on a daily basis. I think the way we would look at it is that this is a tool that our undercover officers would use like many other law enforcement tools that they have in their possession. It would be a daily tool as opposed to section 25.1, which is crafted for when police officers are going to take part in a specific criminal activity with regards to an ongoing specific investigation. I think that's the big difference, and that's why we would be strong supporters of leaving the exemption in the act for law enforcement.

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Let me tell you the problem I'm having with this.

I sat on the committee when we did the review of Public Safety and section 25 when it came up for its mandatory five-year review. We were told at that time very clearly that it had hardly ever been used. I think we had five reports a year. We're undercover now. So are police forces breaking the law now and not reporting it?

I'm having some real difficulty understanding how prevalent this is, because if it is so prevalent right now before this comes into effect, how come it's not being reported?

[C/Supt Stephen White]

The use of identification?

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Under section 25, why is it not being reported?

[C/Supt Stephen White]

Because it is not being used to facilitate a criminal activity; it's being used for the purpose of law enforcement investigations, the use of identification by an undercover police officer.

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

And that does not extend into criminal activity?

[C/Supt Stephen White]

There's nothing that prevents us from using it as a piece of identification, as a tool for law enforcement to pursue criminal investigation.

[Joe Comartin, NDP, Windsor—Tecumseh, ON]

Ms. Stoddart, on clause 7.

[Jennifer Stoddart]

Very briefly, I don't have problems with clause 7. I'm not a criminal lawyer, but this opinion is based on a few things.

One is that in the years in which I've been Privacy Commissioner I have been continually amazed by the sophistication of the privacy breaches that we see. There are links to organized crime, to international organizations, and the difficulty for all our societies to come to grips with them. We've been involved in one of these international cases ourselves, and so on.

Secondly, I read that this paragraph is limited to those who act in good faith, which seems to me to put an important qualifier on it.

Thirdly, my understanding is that in many areas of the law it is necessary to use, let's say, forged documents, or what others say are forged documents, in order to set up a situation to prove a misdemeanour or an infraction of civil law. Certainly in the years I worked in human rights legislation it was a well-known fact that you could use testing to prove that, for example, certain types of housing are not rented to certain types of citizens, whether it be on the basis of their race or the fact that they have children, and so on. So it does not seem to me inherently offensive that we use to further the public good a document that was produced specially and would otherwise fall afoul of the other provisions of the act.

[The Chair, Conservative, Ed Fast]

Thank you.

We'll move on to Mr. Norlock, for seven minutes.

[Rick Norlock, Conservative, Northumberland—Quinte West, ON]

Thank you very much, Mr. Chair; and thank you to the witnesses for being here today.

I'm usually, and in this instance, particularly concerned about victims. They are the people who seem to be least considered when legislation is being formed. But in Bill S-4, as far as I'm concerned, the victim seems to be the primary concern, and that's a refreshing change.

This question is primarily for the RCMP, but Ms. Stoddart, please feel free to interject should you have something to add that you feel is pertinent.

What I particularly like about this bill is that it contains a provision where offenders will be required to pay restitution to the victims of identity theft and fraud when it comes to the costs of reclaiming their own identity. As I've mentioned, this is a welcome provision.

Having been recently a victim with one of my credit cards being cloned, I can say it didn't cost me anything directly, but we all have to be adult enough to know that when the credit card companies suffer a loss, guess who ends up paying for that loss: it is each and every one of us. So as we attempt to mine out these organizations, these criminal enterprises, and go after them, I believe this is a welcome provision.

By the way, I recently saw some numbers on the cost of identity theft, and I think it was conservatively estimated, just for Canada alone, at about $2 billion a year. Again, because of its nature, we don't know, but $2 billion as a conservative estimate means it's probably closer to $4 million or $5 million, I suspect.

Chief Superintendent and Inspector, in your experience, what kinds of hardship will a person who is victimized by identity theft face, and how likely are they to recoup anything? I ask that not to be facetious or anything. I know much of it will be anecdotal, when you speak to members who are in the field, etc.

Perhaps Ms. Stoddart can then also comment from her perspective.

[Inspector Kerry Petryshyn, Officer in Charge, Major Fraud and Bankruptcy, Commercial Crime Section, Royal Canadian Mounted Police]

It certainly varies from victim to victim. As you said yourself, having a credit card compromised may not cost you specifically. I suppose it would depend on to what extent the data is being used. We have some criminal organizations that will use your data to develop an entire persona and, through that, get perhaps government services, bank loans, mortgages, etc. The greater the identity that has been duplicated from you, the greater the cost. So trying to re-establish your identity after it has been compromised to the point where you have 20 or 30 creditors calling you weekly to say you owe them a considerable amount of money can take a long time, sometimes two or three years. Beyond dollar value for cost, there can also be an emotional cost, with the pain and suffering and the grief for those two or three years.

[Rick Norlock, Conservative, Northumberland—Quinte West, ON]

In your experience has there been any attempt at restitution when there is an accused finally convicted? Obviously if someone has been defrauded out of millions of dollars, or even thousands of dollars, one would assume an ability. Is there an ability? Have you seen a way of tracking that money and then coming upon a bank account of the accused or that organization and the crown going after restitution so that at least the victim is somewhat compensated for the crime that has been perpetrated against them? Have you seen it personally or from any reports?

[Insp Kerry Petryshyn]

Certainly in some cases I have personally witnessed examples where restitution was asked for. But as you mentioned earlier, quite often it is the case that there simply isn't anything to obtain from the accused. Either the money has been consumed or passed on somewhere up the chain in the organization or hidden in an offshore bank account somewhere, never to be found again. Unfortunately, the victims themselves are left with problems, and the problem of being able to hire their own legal representation, if necessary, to try to pursue it civilly.

There have been a few cases. I will use a credit card example. Often the credit card company itself is the victim per se. Therefore, they are usually the first to receive any recouped funds, if there happen to be any. I've had a few cases where we did manage to recover some money, but the credit card companies reclaimed that first.

[The Chair, Conservative, Ed Fast]

Ms. Stoddart.

[Jennifer Stoddart]

Thank you for your questions, honourable member, I think they go to the heart of why I'm supporting this bill. We do see provisions, unusually--this is a growing trend in Canadian law--for compensation to the victim and not just to the crown.

The issue of damages in the work we do, which is not criminal work, as the RCMP have explained, does vary widely and depends on the harm. Some people may have misuse of their personal information, but it's very hard for them to prove what harm they suffered, even emotional harm in some cases. It's a very broad range. Usually, in our experience, in that case the organization that mishandled the personal information--remember we are dealing with privacy matters, not with criminal issues--will restitute the amount of the loss and usually a bit more in terms of a moral compensation to the victim once this is proved by our investigation process.

The issue you raised that all Canadians indirectly bear the costs of credit card fraud is one I'm very happy to see you raise. I have spoken about this very much in the past few years. I thought that I'd just add to your deliberations today.

I mentioned one of the world's greatest computer fraud artists who has just been convicted. He was involved in the data theft at TJX, which my office investigated with the Alberta commissioner's office two years ago. We were the first body in the world to make our investigations known. He has been charged in the United States with a 19-count indictment that includes conspiracy, wire fraud, and aggravated identity theft charges under an agreement with the prosecutors. This was in late August. He'll face a maximum of 25 years in prison and will forfeit more than $2.8 million in cash. Unlike in some of the other examples that Inspector Petryshyn gave us, it seems that he had quite a few assets that could be liquidated in order to restitute his victims.

[The Chair, Conservative, Ed Fast]

Thank you.

As the Liberals don't have any more questions, we'll move on to Madam Brunelle. You have five minutes.

[Paule Brunelle, Bloc, Trois-Rivières, QC]

Good day.

Ms. Stoddart, you said something that I found quite interesting, namely that victims of identity theft are likely to feel that their privacy has been invaded. How many times have we seen where people's homes are broken into and their concern is not for the material possessions they may have lost, but for the fact that their privacy has been invaded. This is a major worry, especially for seniors.

You claim that while Bill S-4 is a significant step, it should form part of a broader-based strategy to address identity theft and identity fraud. Briefly, what type of strategy do you foresee?