Public Safety Committee on April 8th, 2019

[Terri O'Brien]

It's much less of an issue with the chip and PIN. Skimming devices still exist, though they have to have cameras to try to capture the PIN, but it's not a very elegant fraudulent solution because your hand could be in the way. So the risk is really negligible in Canada. The skimming devices that take the mag stripe continue to be a risk in the U.S. The mag stripe is easily copied.

[Richard Cannings, NDP, South Okanagan—West Kootenay, BC]

That certainly does it for me.

Thank you.

[The Chair, Liberal, John McKay]

If you need any hacking help, Mr. Graham is here to help.

Ms. Dabrusin, you have five minutes, please.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

My first question is probably more for Payments Canada. I was looking at a letter I received from someone who lives in my community. We're in that hybrid moment where people still sometimes write paper cheques, and now they can deposit them by taking a picture and sending that in. But then that cheque stays floating around with that person. They have all this personal information with your signature that you're counting on someone to deal with properly, although they might be just a private individual who doesn't have a way of dealing with it.

Has this ever come up as an issue that's been raised with you, and if so, do you have any tips for people about that and what they can do to protect their personal information?

[Justin Ferrabee]

I can speak for Payments Canada. We're at the infrastructure layer. We would write the rules around how that works, and we run the systems that do the cheque imaging and enable the digital image. But all the security and all the services provided to a consumer would be through their bank. We would support the bank, support our members in that, but it's at the policy level of the bank.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Okay.

[Terri O'Brien]

To add from my many years in banking, the technology has come a long way and the cheque imaging is quite good now. Of course, consumers are encouraged to destroy the cheque afterwards. However, duplicate cheque detection has come a long way as well. If you ever try to deposit it twice, it won't allow you to do so.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

To Payments Canada, you talked about labelling within the digital supply chain and how to create proper labelling. Does anybody do any labelling in the world? Do you know of a standard out there?

[Martin Kyle]

No. In fact, that's why we put it—

[Terri O'Brien]

I know one.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Do you?

[Terri O'Brien]

I do, yes.

[Martin Kyle]

Go ahead, please.

[Terri O'Brien]

I've been looking at the model. It's actually quite good. SWIFT has adopted a model wherein they publish the security standings of all their counterparties, as they call them, not from a creditor's standpoint but just as a counterparty to the system. It's a good model that we quite like.

That allows each of the participants in the ecosystem.... If you're a financial institution or a caisse populaire and you see a lowered security level that's not quite at the standards, you can mitigate or limit your risk to that partnering financial institution. They've implemented some really interesting things in the past year.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Knowing that there's one standard out there, somebody who's doing it, what's the government's role in that? Is it that government adopts a form of labelling and then requires it for our financial institutions, or is it something that we leave to another sector?

[Martin Kyle]

I can respond to that.

The attestation program to which Terri referred has been a set-up by the SWIFT organization, to allow the counterparties to publish their attestations to other counterparties. If one organization feels like the other counterparty that they're doing business with is too risky, because of their attestation they have the opportunity as a business owner to de-risk themselves or to demand that certain requirements be met before they continue doing business with that organization.

[Justin Ferrabee]

I just want to come back to the labelling of ingredients. The attestation is a version of it, but it's an early version. There is no precedent for identifying all of the components in the value chain and disclosing and managing that. There are multiple parts to this. It's not actually being done anywhere else that we know of.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Part of what I'm thinking is that, from what we've heard, more and more of this is crossing borders. It's not something that lies entirely within Canada, as far as how it's being done is concerned. I'm trying to figure out which body, which organization is best set up so that we can co-operate with it as the Canadian government. We can encourage other international governments to participate, but where should that lie?

[Terri O'Brien]

It's a great question. SWIFT is a global organization that has started early days in that. I would absolutely suggest that Interac would be an appropriate place as well. We currently run our operating regulations and minimum standards, whether they're security standards or participant standards, for all the FIs in our ecosystem.

We have a very robust governance policy and operating regulations in market today. We're looking at how we can enhance those in-market regulations every day. The participants eagerly participate in the marketplace and adhere to those regulations because what it gets them is reciprocity of payments and access to the ecosystem.

[Julie Dabrusin, Liberal, Toronto—Danforth, ON]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Ms. Dabrusin.

Mr. Motz, you have five minutes.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Thank you, Chair.

One of the things I'm sure you heard or read about is that Canada is dealing with whether to accept Huawei as part of our critical infrastructure moving forward. With 5G on the horizon, the question I have for both of your organizations is whether your platforms are prepared to use servers that are built, in whole or in part, by foreign entities that are likely subject to extrajudicial directions from a foreign government.

[Terri O'Brien]

I can answer only for Interac, but I can firmly say that we are not. We are not prepared to allow data outside of our Canadian constitution and Canadian roots. Our incorporation—we became a corporation about a year ago—is quite strongly grounded in Canada. All of our data is to reside in Canada. We are also to use Canadian vendors and Canadian suppliers in the delivery of any of our services, but we build our own technologies. To your question about foreign service providers, we are quite anchored in our Canadian roots.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Before I get Payments Canada to respond to the question I asked previously, I just want to follow up with your comment. If you don't have a server from someone like this, what happens if the infrastructure on which you transfer your data has the ability to have switches that can be hacked by a foreign entity? How does that play into your security programs?

[Terri O'Brien]

All our infrastructure and data are resident in Canada and owned and operated by Interac.

To your question about a foreign entity as a hacker, our experience is that most hackers are foreign entities. We haven't seen a lot of domestic Canadian hackers.