Public Safety Committee on May 29th, 2019

[The Vice-Chair, NDP, Matthew Dubé]

Good afternoon, everyone. We will begin the meeting, now that we finally have enough government and opposition members here.

Before I give the floor to our witness, who will be joining us by videoconference, I would like to take a moment to discuss today's proceedings.

Given the time we have already lost, and the uncertainty about this afternoon's schedule due, in part, to the possibility of further votes following the procedural manoeuvres in the House, I would like to make a suggestion.

What I would suggest is, given the fact that we still do have time in the remaining meetings to accommodate Mr. Amos, and given the uncertainty.... He is a member of Parliament, and he is around these parts more often than not, so it's easier to reaccommodate him. We would hear from the witness, do questioning and then, depending on how time is going, move on from there, and put Mr. Amos' testimony to another day.

I would like to hear what committee members think.

Let us start with Mr. Graham.

[David Graham, Liberal, Laurentides—Labelle, QC]

Mr. Amos plans to attend the meeting in any case. He has arranged to be replaced in his duties in order to be here.

I suggest that we do all the work we can until there are no further questions. If there is no vote in the House, the PayPal representative could appear for 45 to 60 minutes, depending on the number of questions. Then Mr. Amos could have the time to give his presentation at the end.

[The Vice-Chair, NDP, Matthew Dubé]

It is a possibility, but the problem—and this is what concerns me—is that Mr. Amos is sponsoring the motion. We may not have an opportunity to question him if it is nearly 5:30 p.m. or if the bells call us to vote.

The clerk informs me that this would have little effect on our schedule in the next weeks before the end of the session.

That is my personal, very sincere opinion. I am replacing Mr. McKay, but I do not want to impose my point of view. Even so, because of the number of days we have left, we may well not be able to move forward the study that Mr. Amos is asking for in a meaningful way.

I am still open to your suggestion, Mr. Graham.

What do you think, Mr. Paul-Hus?

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I agree with you, Mr. Chair.

Mr. Johnson from PayPal has been waiting for an hour. Let us hear his presentation and take the time to ask our questions properly. Then we can adjourn.

Mr. Amos can appear at another time.

[The Vice-Chair, NDP, Matthew Dubé]

Does anyone object to proceeding in that way?

It seems unnecessary to do otherwise.

[David Graham, Liberal, Laurentides—Labelle, QC]

It depends when we will be able to come back.

A motion has been unanimously adopted by the House recommending that we undertake this study. I want to ensure that we come to grips with it as quickly as possible. This must not drag on for another month. We have already lost our time today.

That is why I suggest that Mr. Amos introduce his motion. That way, we can move on with the study.

[The Vice-Chair, NDP, Matthew Dubé]

Once again, the clerk has informed me that there is no problem with the schedule. I have checked the information. Mr. Graham, that may reassure you about our ability to hear from Mr. Amos at another time. As Mr. Paul-Hus said, we have already kept our witness waiting.

We have an hour and a quarter, but, even if this witness's testimony takes only 45 minutes and Mr. Amos then appears, we still may run out of time or be called to vote. So I prefer to avoid that uncertainty, especially considering the ease with which we can invite an MP to another meeting. With most witnesses, we can rarely do that.

So let us continue the meeting.

[David Graham, Liberal, Laurentides—Labelle, QC]

Okay.

Let us begin; let us not waste any more time.

[The Vice-Chair, NDP, Matthew Dubé]

Thank you, colleagues.

I will now move to our witness. I want to thank Mr. Johnson for his patience. The procedural wrangling that goes on in this place does have that impact sometimes. Joining us by video conference, we have Brian Johnson, who is Senior Director for Information Security at PayPal.

You have 10 minutes, Mr. Johnson, for your opening statement. We'll take questions from the members, and we thank you for taking the time this afternoon.

[Brian Johnson, Senior Director, Information Security, PayPal, Inc.]

Thank you very much. Good afternoon, Mr. Chairman and members of the committee.

Again, my name is Brian Johnson and I do serve as the Senior Director of Information Security at PayPal. I appreciate your giving us the opportunity to speak with you today and for making the time in your busy schedule.

I suspect you all know a bit about PayPal generally speaking, but allow me to add a bit of detail.

Founded in 1998, PayPal is a leading technology platform company that enables digital and mobile payments on behalf of more than 277 million consumers and merchants in more than 200 markets worldwide. We offer online and mobile merchant acquiring and money transfer services. PayPal is the most popular digital wallet in Canada.

We are based in San Jose, California, and our Canadian headquarters is in Toronto with offices in Vancouver. PayPal Canada was incorporated in 2006. We have more that 7.1 million customers including more than 250,000 small business customers in Canada.

Fuelled by a fundamental belief that having access to financial services creates opportunity, PayPal is committed to democratizing financial services and empowering people and businesses to join and thrive in the global economy. Our open digital payments platform gives PayPal's 277 million active account holders the confidence to connect and transact in new and powerful ways, whether they are online or on a mobile device. Through a combination of technological innovation and strategic partnerships, PayPal creates better ways to manage and move money, and offers choice and flexibility when sending payments, paying or getting paid.

We believe now is the time to reimagine money and to democratize financial services so that managing and moving money is a right for all citizens, not just the affluent. We believe that every person has a right to participate fully in the global economy. We have an obligation to empower people to exercise this right and improve their financial health. As a fintech pioneer and an established leader, we believe in providing simple, affordable, secure and reliable financial services and digital payments that enable the hopes, dreams and ambitions of millions of people around the world. We have a fundamental commitment to put our customers at the centre of everything we do.

Securing our customers and their data is central to our mission. For financial companies, data security is the main pillar. Through strong partnerships, strategic investments and a tireless commitment to protecting consumers, PayPal has resolved to be an industry leader in cybersecurity capabilities and to help make the Internet safer.

We have in our favour more than 20 years of experience in processing electronic transactions safely. PayPal has one of the most sophisticated fraud prevention engines in the world, which gets smarter with every transaction that goes through our system. With our advanced fraud monitoring technology, we detect and prevent attacks before they happen.

Security is in our DNA, and it's at the epicentre of all that we do at PayPal. We are the number one trusted brand of e-commerce and mobile commerce around the world. People trust PayPal because they know that we don't share customers' financial information with merchants, retailers or online sellers. Our robust security standards ensure that every part of a transaction is safe and secure.

At PayPal we believe we have a responsibility to help protect our users against harm. Privacy has always been one of our main concerns. Our customers trust us with their data. We take that trust very seriously. We collect only the data that's necessary to fulfill services that a customer requests, to improve product experiences and deliver relevant PayPal advertisements and to prevent fraud. We never sell or rent customer information.

It's commonly held among global law enforcement agencies that cybercrime and online methods of fraud are now more common than crimes committed in the offline and physical world. As the committee is certainly aware, over the last five years, the RCMP alone has observed an almost 50% increase in cybercrime reports from Canadians. I applaud the committee for aggressive action and for its support of Canada's national security strategy, by including significant funding for investments in cybersecurity as part of your commitment to safety and security. Building an innovative and adaptive cyber-ecosystem is a crucial step to being able to quickly scale and combat emerging threats to critical infrastructure, government, business and individuals' digital information.

To conclude, I would like to emphasize PayPal's commitment to cybersecurity and our willingness to work together with the Canadian government and industry.

Thank you again for the invitation to discuss these very relevant topics and to represent PayPay's strong position in support of consumer data protection and privacy.

I'd be happy to answer any questions you may have.

[The Vice-Chair, NDP, Matthew Dubé]

Great. Thank you so much, Mr. Johnson.

We will proceed to our question period. We will begin with Ms. Sahota, please, for seven minutes.

[Ruby Sahota, Liberal, Brampton North, ON]

Thank you, Mr. Johnson, for being here today.

Are there any differences in how you operate in Canada versus the U.S., or are you mainly based out of the U.S. and that's where all the information ends up when Canadians are using your service?

[Brian Johnson]

[Inaudible—Editor] by PayPal customers are stored within U.S. data centres and localized data housing, so localization of data of Canadian customers is also contained within the U.S.-hosted facilities.

[Ruby Sahota, Liberal, Brampton North, ON]

To clarify, there's no difference in how you operate when it comes to Canadian customers versus the American customers, right?

[Brian Johnson]

Other than localization for currency or for other preferences that are localized, the data and information is stored the same as that of U.S.-based customers.

[Ruby Sahota, Liberal, Brampton North, ON]

I'm very glad to hear that, because I would figure after operating for two decades—longer than other competitors in this realm have existed—you must have a lot of data stored up. It is good to hear that you don't sell the data that you have received. Thank you for providing us with that information.

However, I have seen that there have been several articles in just this recent month about PayPal. One is about paying hackers—I would assume they are white hat hackers—to try to protect the security of your system. Could I hear a little more about that, and how that's been working? Have you been doing that for a long period? Is this a recent trend, that you're paying hackers to hack your system? What advantages are you getting out of that?

[Brian Johnson]

That's an excellent question, Ms. Sahota.

Our program is called bug bounty, and it's an industry-wide accepted method of using contracted support, basically using the industry of white hat hackers through a managed program. They're vetted so they're not allowed to just go rogue or attack systems without request and without knowledge. They're considered professional security researchers across industry, and many of them are professionals in other areas and use freelance time or side jobs at times to provide what's called bug bounty ethical hacking. It helps us to expose any concerns or vulnerabilities in systems that are not caught with internal tools and to instead catch those through bug bounty programs, which again are commonly used by many companies for the security researcher community to collaborate with us on those vulnerabilities.

[Ruby Sahota, Liberal, Brampton North, ON]

Do you have contracts with these hackers?

[Brian Johnson]

We contract with a group called Hackerone that provides the vetting process with them, and then through responsible disclosures, those vulnerabilities are reported to us to fix them before they're disclosed publicly, so we can resolve any of those vulnerabilities that they find.

[Ruby Sahota, Liberal, Brampton North, ON]

If an issue was to occur where somebody was to breach the system or someone's privacy, where would the liability lie? Would it lie with PayPal?

[Brian Johnson]

If there's a system breach, that's an unauthorized activity and it would be treated as malicious and illegitimate access as with any mal-intended attacker. We don't have bug bounty researchers perform attacks or breaches, and as part of the program policy, they're not allowed to access customer data nor to make any manipulation or changes of information. They're allowed to disclose vulnerabilities that are detected in the system and report those to us through the responsible disclosure program.

[Ruby Sahota, Liberal, Brampton North, ON]

PayPal also uses an app for convenience for customers, correct?

[Brian Johnson]

An app for convenience? We do have a mobile app.

[Ruby Sahota, Liberal, Brampton North, ON]

A mobile app, that's right.

[Brian Johnson]

Correct, we do have mobile apps.