Evidence of meeting #156 for Public Safety and National Security in the 42nd Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was payments.
A video is available from Parliament.
Liberal
David Graham Liberal Laurentides—Labelle, QC
Just to build on that a little, the intent of a state actor in the financial system would not be to take the money. That's not their purpose. It's to see who is trading money with whom, to get the metadata, as we like to talk about, and be in a position to undermine the system when they push a button if they need to.
Would that be an accurate assessment of state actors in the system?
Chief Information Security Officer, Payments Canada
There are a number of motivations for various state actors. We've seen in the past that some state actors use financial systems to get around sanctions. Some state actors are motivated for other reasons. There are a myriad reasons for any threat against the financial system, and we need to be aware of all those reasons and take proactive countermeasures against those threats.
Liberal
David Graham Liberal Laurentides—Labelle, QC
If a foreign country wanted to undermine our financial structure, its intention would not be to take data; it would be to shut down our system. I assume we are doing our utmost to prevent that from happening as well.
Chief Operating Officer, Payments Canada
We would not be specific on any incident we are aware of. We assure you that we think about that and take action to prevent that, and that our colleagues in other organizations around us do the same. This is not an unknown for us, or something we're not aware of. We're very clearly focused on that.
Chief Risk Officer, Interac Corp.
Yes, and our respective resiliency programs.... I can speak only for Interac, but we're at 99.9% uptime. You can achieve that uptime only if you have a resiliency strategy that includes very robust infrastructure to deliver on that, even during times of degradation of service or any attack that may attempt to disrupt the service.
Liberal
David Graham Liberal Laurentides—Labelle, QC
On another topic, in the EMV technology, what does EMV stand for? I forget what the “E” is, but “M” is Mastercard and “V” is Visa. Is that correct?
Chief Risk Officer, Interac Corp.
You know, the acronym's been around for a decade or so now, so—
Liberal
David Graham Liberal Laurentides—Labelle, QC
HMV, that's a different thing.
Is there a qualitative difference between the credit card and debit card systems in anything we're talking about? What are the differences between the two networks and systems? Not that you have a biased position, but does one have an advantage over the other?
Chief Risk Officer, Interac Corp.
I spoke to this a bit earlier. I can only speak to the closed-loop network that we have, but we really have a layered security strategy in fraud monitoring and a robust security and risk strategy. It's multiple different controls and security standards that we have on our network.
The Mastercard and Visa networks are largely based out of the U.S., and then operate on a global basis, so they have a different set of standards that they're going to meet, a differently layered security structure that they're required to meet and a different risk appetite. I can't speak as much to theirs. I can only speak to the safety and soundness that ours provides to Canadians.
Liberal
The Chair Liberal John McKay
Thank you, Mr. Graham.
Just before I let you go, Wayne Gretzky famously said that you don't talk about where the puck is; you talk about where the puck is going. Some of the big developments in your industry are Apple, Amazon and various others. Would either one of you allow Apple into your systems?
Chief Risk Officer, Interac Corp.
I can share from an Interac perspective that we were the first to market with Apple in putting the Interac debit card in the Apple wallet. That was the TSP technology that we spoke about earlier. We also have the same Interac debit card in the Google wallet, in the Samsung wallet. Canadians do want to be able to tap their phones in the same way they tap their cards. We have found the abstraction and tokenization of that data to be extremely secure and to be a really good security protocol. Leveraging the EMV technology has created a really secure product that has very little fraud associated with it.
Liberal
The Chair Liberal John McKay
Canadian consumers using any one of those lines can be as secure as with a direct use of a Canadian bank product, then.
Chief Risk Officer, Interac Corp.
It's akin to direct use of your Interac debit card.
Chief Operating Officer, Payments Canada
We don't interact at the point of sale and would have no reason to interact with Apple as a payment provider. Our staff would likely use it, but it's not something that's in our systems or anything. It's not a point of interaction for us.
Liberal
The Chair Liberal John McKay
Okay.
Thank you for that, and again I want to thank you for your patience. We have stressed your patience, but it is what it is. Thank you for a very interesting and useful testimony.
