Public Safety Committee on Feb. 4th, 2019

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Just before I go to Mr. Waterhouse to hear his take on this, I'll ask if you believe that planned obsolescence has any role to play in that. We see, for example, devices no longer being compatible with new firmware.

I just wonder if we're incentivizing consumers to upgrade devices perhaps at the expense of the security of the networks they're operating on, and things such as that. You would think that updating firmware is a good thing, but on the other hand, while someone might not want to be completely disconnected, they may want to keep using older technology. It might in some ways be safer.

I don't know if I'm quite right on that or if there's concern about that.

[Deborah Chang]

There is a concern, and I think that the United States as well as the U.K. have adapted standards in the area of IoT, like a list. The U.K. has a standard of 10 things that it recommends in the IoT area, and vulnerability disclosure policies are number two.

In the U.S., the FTC, the Federal Trade Commission, has taken a very active stance in requiring certain things it sees in the development of this area, as well as the FDA with medical devices. The FDA issued a medical device safety action plan last year requiring a bunch of things, even the development life cycle or the launching of a medical device.

I think the unifying theme across all of these laws and standards is that, because everything is interoperable and connected, everyone has to be doing the same thing. I think that's the purpose of all of these policies and standards, unifying standards like NIST, in these different areas.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you very much.

Mr. Waterhouse, do you have any closing comments?

[Steve Waterhouse]

We're kind of doomed, as you put it, because there are so many devices that have literally been swamping or invading the market without any such verification that they are....

I mean, these thinks put into the hands of people in the sense that they will facilitate their lives and enhance their environment. They're selling, let's take the example of a $250 thermostat that will document your way of life nowadays, and they give that information to the company that is now Google, who owns these devices. So yes, you'll be able to remotely activate your heating in your house when you come home and program it, while at the same time it will document when you're there and when you're not.

That, for me, is something that should have been taken into consideration before authorizing these kinds of devices in the market. Most people don't even realize that this kind of device is documenting their lives as they go on. Even for the other devices that we find in cars, as an example—more and more you'll have devices running the cars—they will also be hackable at the same time, because there will still be software that's incomplete.

[The Chair, Liberal, John McKay]

Formally we are at the end of our questions, but I see that my colleagues are very keen. I hope that the witnesses will have a little bit of flexibility with respect to their times. My intention is to run to about 5 o'clock, but I'm going to take the chair's prerogative here and ask a question about cryptocurrency.

In this morning's news there was a story about a company called QuadrigaCX. It was a cryptocurrency company apparently worth about $250 million. The owner was about the same age as Mr. Abma, and he died. He had all of the passwords on his laptop. It strikes me as passingly bizarre that a $250 million company is completely locked up because nobody can open up the passwords on his laptop.

My first question is whether this is a challenge for HackerOne.

[Some hon. members]

Oh, oh!

[The Chair, Liberal, John McKay]

Is this, on the face of it, a massive disregard of people's security?

The second question has to do with blockchain. Even if you were able to get to the passwords, is blockchain technology such that even the skills of HackerOne or HackerOne on steroids couldn't play with the security of that technology?

I apologize for these being ill-formed questions, but this does strike me as a situation where what we're supposed to be studying, financial security, comes together with a massive technological failure. It may not turn out so badly in that no ill can come from a blockchain technology that, I think, can't be cracked. Am I right or am I wrong?

[Jobert Abma]

I am familiar with the situation. There are two problems with blockchain technology that I would like to point out.

The first is that current computers are simply not fast enough, so even if we wanted to crack some of the encryptions that are being used in blockchain technology, we simply don't have the computing power to do so. It will take many years for computing power to catch up on that.

The second problem is that I think, especially with blockchain technology, because it technology is so new, consumers have put a lot of trust in these organizations that are worth hundreds of millions of dollars, but they have no idea what kind of defences have been put in place, or if too many defences have been put in place, in which case they rely on a single person.

In a way, the technologies are great and I think that experimenting with them is the right way to explore what their applications are. However, I am not of the belief that financial implementation that has taken place to date—like Bitcoin and some of the other cryptocurrencies—is the right application of the blockchain itself.

The technology itself is very powerful and should and can be used to solve some of the problems we've seen, similar to the case in which a single person has the responsibility for $250 million of other people's money and assets.

[The Chair, Liberal, John McKay]

Does it strike you as passingly absurd that the entire access to the system should be contained in one laptop?

[Jobert Abma]

Yes. That should never be the case.

[The Chair, Liberal, John McKay]

Okay.

For people who trade in cryptocurrencies, if one of the cryptocurrencies is locked out—and correct me if I'm wrong—am I to assume that all of the people who trade in cryptocurrencies and who have this particular kind of cryptocurrency in their portfolio are going to be affected? So it would be much larger than simply the clients of Quadriga. Is that a correct assumption or not?

[Jobert Abma]

One of the fortunate and unfortunate effects of blockchain or cryptocurrencies is that there exists only one copy of one particular block or a coin, depending on the cryptocurrency, which means that if an organization like this does not have access to what they call “wallets” anymore, the money is essentially lost and there is no way to mathematically retrieve those wallets, let alone access them.

[The Chair, Liberal, John McKay]

Really?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

We should ask them to speak to the people who deal in Bitcoin.

[The Chair, Liberal, John McKay]

Finally, I have a question on a secondary issue. Much as what Ms. Sahota said, your organization strikes me as only as strong as its weakest link. You may have 20,000 or 30,000 hackers apparently working for HackerOne, but an individual in your organization may come across a vulnerability that is actually financially more lucrative not to disclose. How, therefore, do you protect your client base from the people you have vetted and who work for you and you trust, etc.?

[Jobert Abma]

That is a great question.

This is why I believe hacker-powered security is so powerful. If there are a lot of people who have the same incentives, we believe that there are always more people who will be able to find the same vulnerability. If one of those people, whether they're a criminal or not, decides not to disclose that security vulnerability, they run the risk of other people identifying the exact same vulnerability and disclosing it to the organization.

We've never set out to compete against the black market where, essentially, zero-day vulnerabilities have been traded, either with governments or private organizations. The bug bounty programs have definitely created a reverse incentive for these black hat hackers to go after these vulnerabilities, because the prices are essentially going up simply because the chances of people with good intentions finding the same vulnerability are skyrocketing today.

[The Chair, Liberal, John McKay]

I'd like to follow up on that, but my colleagues also have questions and we have just a few minutes left.

Is it Mr. Spengemann, or Mr. Picard?

[Michel Picard, Liberal, Montarville, QC]

Yes, I have just one quick question.

I will turn to Mr. Waterhouse first.

If the Canadian government wants to use the services of hackers, or security researchers, to describe them more positively, does it have to go through a process to recognize and legitimize those services? Do people have to have legitimate courses on legitimate subjects in order to have the same expertise that hackers have by definition?

[Steve Waterhouse]

If I understand your question correctly. Mr. Picard, you are asking me whether or not the government could use the services of recognized hackers.

[Michel Picard, Liberal, Montarville, QC]

Right.

[Steve Waterhouse]

The contracts that Public Services and Procurement Canada enter into have to be properly done. They have to contain a section on security. A security check has to be done. If an individual, or group of individuals, works on the government's information systems, they have to have received the appropriate legal authorization to be able to do the work.

[Michel Picard, Liberal, Montarville, QC]

There is another important factor.

I'll switch to HackerOne.

I understand that you started hacking at quite a young age. At that time it might not have been as legal as it should have been, but you managed to put together a pretty good legal company, and now you are a legitimate, well-recognized company. What kind of process did you go through to be recognized and to work with government?

[The Chair, Liberal, John McKay]

Are you asking for business advice?

[Michel Picard, Liberal, Montarville, QC]

No, I want them to open a branch in Canada.

[Jobert Abma]

Do you want an answer from a personal perspective, or from a company perspective?