Evidence of meeting #155 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A video is available from Parliament.
Liberal
David Graham Liberal Laurentides—Labelle, QC
Thank you.
It's not directly related to you, but I want to use this opportunity to clear up some questions that keep coming up.
Black hat hackers and white hat hackers are long-held terms in the technology community. I just want to put that out there since there's confusion about it. There are also grey hats, and we can get into a whole discussion about that.
Another point I want to make sure everyone is aware of is cracking versus hacking. If you put duct tape on a bottle of WD-40 to make it go to space, that's a hack. If you use that to break into a bank, that's a crack. I want to make sure we have that distinction very clear out there.
Liberal
Liberal
David Graham Liberal Laurentides—Labelle, QC
Yes, I hope you do.
I want to come back to you for a second. You said you had a technical research division of six people. What kind of expertise do they have? Are they looking at servers, networks and routers and taking phones apart? What kind of people are they and what kind of things are they doing?
Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada
We have a small group of technologists, scientists and engineers. They look at things, from particular devices to larger systems such as the Internet of things. They participate in the development of guidance, for instance, on biometrics, on de-identification, on the Internet of things itself and on the risks and vulnerabilities to privacy associated with new technologies. They support our investigations with forensic analysis, and we're developing a capability for the custodianship of evidence, etc. It's part of our investigative program.
It's a wide range of activities and tasks that absolutely exceed the capacity of the small team, which is very capable in its own right, but there are only six people with a small lab.
Liberal
Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada
We have a small lab to conduct experiments offline to protect our networks and government networks.
Liberal
David Graham Liberal Laurentides—Labelle, QC
If these experts take apart a phone, for example, and find a significant privacy vulnerability in it, what would be the course of action?
Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada
It depends on the context in which it is happening. If it's in the context of an investigation, which is often the case, as we do a lot of support for investigations, that information—evidence, so to speak—would become part of the report of findings of our investigation.
Liberal
David Graham Liberal Laurentides—Labelle, QC
You work with outside organizations such as the Electronic Frontier Foundation, which is one of my favourite examples. They are constantly doing this type of work, putting that work out there, validating it and vice-versa.
Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada
Yes, we have networks of external partners, not the least of which are our international data protection authority partners, our provincial data protection authority partners, as well as privacy commissioners across Canada and around the world.
Liberal
David Graham Liberal Laurentides—Labelle, QC
We've heard a lot in the past in this committee and other committees about anonymization of data. At the industry committee, there was a very brief discussion of a StatsCan study on banking data, for example. It's very possible to anonymize this type of data. Is it possible to “de-anonymize” this type of data?
Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada
Yes. One of the things we're looking at is standards. In fact, as we speak, the acting director of our technology analysis directorate is in Israel for a meeting of the International Standards Organization on de-identification. The problem, however, is that data sets can be combined to reidentify individuals. So it's a very complex area.
Liberal
The Chair Liberal John McKay
With that, we'll have to close this session. I want to thank both of you on behalf of the committee for your testimony. We are now suspended.
Liberal
The Chair Liberal John McKay
Colleagues, we're back on. Mr. Foster has been very generous and waited patiently for us. Can I get some guidance from you as to how much time we can have with this panel? If we end at 5:30, that will be 35 minutes.
Liberal
The Chair Liberal John McKay
Half-hour bells, so the bells are going to start ringing at 5:30. Do I have a general consensus that we push it past 5:30 . for at least 10 minutes?
Conservative
Glenn Foster Chief Information Security Officer, Toronto Dominion Bank
I can stay. No problem.
