Public Safety Committee on July 15th, 2019

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Okay, so that's one question. The other question is for Ms. Ryan, or whoever might....

I'm just going to read the summary that you gave. You said that “cybersecurity is an area of critical importance for the Department of Finance. We are actively working with partners across government and the private sector to ensure that Canadians are well-protected from cybe -incidents and that when incidents do occur, they're managed in a way that mitigates the impact on consumers and the financial sector as a whole.”

What does that actually look like to impacted consumers, to consumers at large, to the financial institution, to the banking industry, to various government departments? You can say that, but what does it actually look like?

[Annette Ryan]

I think that the number of federal partners you have had as witnesses today speaks to that.

The investments in the cyber centre were part of the first line of defence in strengthening the ability to prevent cyber incidents, and they are focused, as André Boucher spoke to, on the appropriate response to a cyber event. In this case there was a specific type of cyber event, a breach by an employee, so many of those defences that have been built by the cyber centre were not triggered in this case, but the resources of the cyber centre are complemented by new resources for the RCMP. You heard the RCMP speak about the national cybercrime centre and their efforts at the Canadian Anti-Fraud Centre.

We also realize that a cyber event or a data event does play out on the privacy side. Therefore, measures such as the new requirements for businesses to notify customers that there has been a breach are a key part of a citizen's ability to be vigilant about their own finances and to know that important information about them has been put into play. A monitoring service like Equifax is important because it helps put that person into the mix to know when something that's being done in their name is not right.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I have just one quick follow-up question to that. If I were one of the 2.9 million Canadians impacted by this circumstance, or one of the millions in this country who have already been impacted by data breaches of various varieties, I would want assistance in getting my life back, like them. Right now there is a lot of talk about what that looks like, but in practical terms, Canadians want to know how to get their lives back. They want to mitigate the risks and the impacts that a breach like this has on their personal lives, on their financial futures and on those of their families.

I'm curious; it seems that the Department of Finance has a role to play in having a location from which Canadians can find the information they need, follow a template, call numbers, or whatever it may be to help get their lives in order, because this is, and will be, devastating to those whom these criminals are going to take advantage of.

As government, we have a responsibility to ensure that we protect Canadians as well as we can. This is not going to go away.

[The Chair, Liberal, John McKay]

I'm going to have to leave it there. I thank you for your witness.

Colleagues, I need some guidance here. Our next witnesses are outside, and, as you know, are under some time constraints. I propose suspending. The question, colleagues, is do you want to suspend and release these witnesses, or do you want to suspend and ask these witnesses to remain so that we can have our final rounds of questioning?

[David Graham, Liberal, Laurentides—Labelle, QC]

If they're willing to stay, I'd like to ask my questions.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

I would like to intervene with these witnesses, please.

[The Chair, Liberal, John McKay]

With that, I'm going to suspend. I'm going to ask the witnesses to leave the room, but to stay nearby, and after we finish with the next witness to come back—

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Mr. Chair, I have some questions for the witnesses, but I will leave it up to you to decide on a good time for me to ask them.

[The Chair, Liberal, John McKay]

We'll look forward to that, Mr. Fortin.

With that, we'll suspend for a couple of minutes while we bring in our next panel. Thank you.

[The Chair, Liberal, John McKay]

Colleagues, I'd ask you to take your seats.

I ask the next set of witnesses to come forward—Mr. Brun, Mr. Cormier, and Monsieur Berthiaume.

I would ask that the cameras leave, please. That's all of the cameras, including the CBC camera. Thank you.

I want to thank you and your colleagues for coming, Mr. Cormier. Apparently you're fairly popular these days.

We have encouraged witnesses to make brief statements, with the emphasis on their being brief, because there is an appetite on the part of members to ask questions. I'm informed of various times by which, I believe, you, Mr. Cormier, have to leave—and what time is that?

[Guy Cormier, President and Chief Executive Officer, Desjardins Group]

We're supposed to leave around 4:30, but maybe we can add—

[The Chair, Liberal, John McKay]

I'd encourage you to stretch that if you would.

[Guy Cormier]

Probably an hour would be okay.

[The Chair, Liberal, John McKay]

Okay. I think we can live with an hour. Possibly your colleagues can stay after you leave.

The issue is that this has been an emergency meeting and people have literally come from all over Canada to hear what you have to say.

With that, I'll ask you to make whatever remarks you have and then we'll turn it over to questions.

[Guy Cormier]

Thank you very much.

Good afternoon, Mr. Chair and members of the Standing Committee on Public Safety and National Security. I'm joined this afternoon by Denis Berthiaume, Senior Executive Vice-President and Chief Operating Officer, and Bernard Brun, Vice-President, Government Relations, Desjardins Group.

First, I want to say that, at Desjardins, we were ambivalent about this exceptional committee meeting.

On the one hand, this meeting may seem premature, since we're in the process of managing this situation and the police investigations are ongoing. It's far too early to assess the situation. As such, we intend to tell you everything that we know, but in a way that won't interfere with the ongoing investigations.

On the other hand, we see this special meeting as an opportunity to inform legislators and the public about the security of personal information and the need to rethink the concept of digital identity in Canada. In my reflection process, this point prevailed.

First, I'll state the obvious. What happened at Desjardins has happened elsewhere and could happen again in any private company or public organization whose mission involves personal information management. We can think of several banks around the world, such as the American bank Chase, Sun Trust, the Korea Credit Bureau, or a number of government entities in Canada and the United States, to name a few, that have been the victims of malicious employees.

Desjardins is a leading financial institution and one of the largest cooperative financial groups in the world, with more than $300 billion in assets. In 2015, Bloomberg ranked the Desjardins Group as the strongest financial institution in North America, ahead of all Canadian banks. In other words, even the best aren't immune, and we believe that this message must be heard.

Personally, I've been working at the Desjardins Group for 27 years. I chose this organization at the start of my career because the financial institution has managed, after nearly 120 years, to successfully combine the economic and social aspects of our society.

The malicious actions of one employee led to this deplorable situation. That employee has now been dismissed. He violated all the rules of our cooperative. In this situation, we acted as quickly as possible and as transparently as possible, with the sole objective of protecting the interests of our members. That was our priority.

On June 20, a few days after learning of the extent of the situation, we went public and shared all the information available, in conjunction with the police forces. At that time, we also announced the measures implemented to address the privacy breach.

We've taken all the necessary measures to address the situation. We quickly implemented additional monitoring and protection measures to protect the personal and financial information of our members and clients. We informed all the relevant authorities, including the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Autorité des marchés financiers, the Office of the Superintendent of Financial Institutions, and the Quebec and federal departments of finance.

We've implemented additional measures to confirm the identity of individuals when they contact us. We're constantly monitoring all our members' accounts. The procedures for confirming the identity of our members and clients when they call the Desjardins caisses, Desjardins Business centres and our AccèsD call centre have also been the focus of additional measures.

We contacted the affected members through the AccèsD private messaging system and by personalized letter, to inform them of the situation and of the steps that they needed to take.

We've also added extra measures to help with the activation of the Equifax monitoring package. The affected members can now register in four ways. They can register on the Equifax website, through the AccèsD telephone service, through the AccèsD web and mobile application, and directly in our Desjardins caisses by speaking with their advisor.

We're actively working with the different police forces. Lastly, we're working with external experts to continue to protect our members' personal information.

I can confirm that we acted diligently. After we received information from the Laval police service, we conducted an internal investigation and quickly traced the source of the breach to a single employee. The employee was suspended and then dismissed.

At this time, our main priority is to reassure, assist, support and protect each and every member affected by the situation.

Again this morning, we announced new protection measures for all our members. In this digital age, we at Desjardins believe that all our members must be protected.

As I was saying, Desjardins announced this morning that, from now on, all members of our cooperative will be protected from unauthorized financial transactions and identity theft. Membership is automatic and free of charge, regardless of whether they've been affected by the data breach. Since this morning, Desjardins has been protecting all its individual and corporate members. This sets a precedent in the financial services world in Canada. We're the first institution to take this step. In this situation, Desjardins is acting with rigour, a sense of duty and the willingness to honour its special relationship with its members.

We've entered an age where data is a resource on par with water, wood and the raw material needed to run entire sectors of our economy. Data is now the raw material for a whole innovative economy that will lead to tremendous productivity gains and make life easier for Canadians.

Canada is a few months away from the implementation of 5G mobile connectivity, which will increase the flow of data tenfold. According to experts, this ultra-fast connectivity will lead to futuristic applications related to artificial intelligence. Canada is already among the world leaders in this area with its three hubs, Montreal, Toronto and Edmonton. In addition, as we speak, the Department of Finance Canada is in the process of conducting a consultation on open banking, which would help open up the transactional sector. Several European countries have already made the shift.

I'll humbly ask you, the legislators, the following questions.

Is Canada currently well equipped to manage these promising technological developments, which also involve new risks? Should our identification systems be adapted to the digital age to ensure the protection of privacy and to better deal with cybercriminals? This issue is the whole notion of digital identity, which I referred to a few minutes ago.

I want to respectfully point out that these are real issues raised by the situation at Desjardins.

In closing, I want to make a proposal. I'd like to invite the committee to recommend to the Government of Canada the creation of an ad hoc multi-stakeholder working group to advise the government on how to regulate the management of personal data and digital identities. We believe that a group that listens to Canadians' concerns should at least include representatives of governments, the financial services and insurance sector, and the telecommunications sector, along with jurists and experts, or any other group that the government deems it appropriate to involve in the reflection process.

The mandate of this committee should consist of advising the government on legislation and regulations; ensuring the protection of the public; encouraging innovative technological development for the benefit of Canadians and communities; and ensuring the strategic monitoring of best practices around the world, so that Canada is always up to date.

I personally believe that Canada can't pursue excellence in digital technology and artificial intelligence without having the same ambition for data and personal information management. We must all learn from the current situation at the Desjardins Group.

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Cormier.

Mr. Picard, you have seven minutes.

[Michel Picard, Liberal, Montarville, QC]

Welcome, Mr. Brun, Mr. Cormier and Mr. Berthiaume. Thank you for participating in this exercise. Your presence is greatly appreciated.

Mr. Cormier, I'll start by reassuring you that, last January or even earlier, the Standing Committee on Public Safety and National Security and the Standing Committee on Access to Information, Privacy and Ethics began to address issues related to the unique identifier. We looked at models from abroad, including Estonia's model, which raises a number of other issues.

Before I ask you some more practical questions, I want to point out that the unique identifier is one of the cybersecurity issues. When someone gets their hands on the unique identifier, we'll be faced with the same issue.

I'm pleased to hear that you're offering protection to all your members. However, financial institutions tend to charge their clients to protect the clients' data from identity theft. The financial institutions themselves make the offer. Do you have the same philosophy?

To have my salary deposited into my bank account and to make transactions, automatic withdrawals and Interac payments, I must give my name, address and social insurance number to the institution that I'm dealing with. However, I must use a third party to protect this information. Why do I need to rely on someone other than the entity to which I give the information?

[Guy Cormier]

To answer the first part of your question, we made the decision this morning to set up a protection program for all our individual and corporate members. The corporate component sometimes isn't covered by other institutions or even by Equifax. We've decided to offer this service free of charge to our members as long as they stay at Desjardins. We won't charge them anything. I want to quickly reiterate that the program covers all unauthorized financial transactions involving a person's account, deposits and money. If a transaction hasn't been authorized, we'll reimburse the person. That's one thing.

Second, if a person is unfortunately a victim of identity theft, we'll provide assistance, not a list of the steps to take. We'll call on our experts to provide assistance, and the experts may even participate in conference calls to help the person recover their identity.

Third, we'll provide coverage of up to $50,000 to reimburse members for expenses that they may have incurred, such as lost wages, child care costs or the cost of obtaining documents.

This concept of free service is extremely important to us. If you're a member of the cooperative, you have access to the program.

We humbly propose that a committee be established to, among other things, address the issue of whether privacy should be managed by third party companies. I think that the status quo isn't an option.

[Michel Picard, Liberal, Montarville, QC]

There are two issues involved in what I consider the temporary solution of dealing with a third party. You're asking people to deal with a third party to protect their personal information. Two years ago, this third party was also the victim of hacking. We conducted a study on the matter here.

How liable would you be if your clients' personal information were hacked from the entity that you trust, such as Equifax?

[Guy Cormier]

That's a relevant question. In Canada, Equifax is the firm with a market share of over 70% in data and information protection and management.

When the incident occurred, we decided to turn to the Canadian company that offered this service to Canadians. We worked with the company. However, in the days that followed, we noticed some issues. We quickly took our own steps to resolve the issues concerning member registration on the Equifax website. We went through this. We saw the need to improve the procedures and methods, and we took charge of the matter.

Now, should one, two or three private companies in Canada manage all this? We must think about it.

[Michel Picard, Liberal, Montarville, QC]

Identity theft is unique in that the data is active and will always remain on the market, unless the person using it dies. The data is virtually present all over the world. It can be used on the black market after 24 hours, as in cases of debit or credit card fraud.

The identity theft issue isn't about the security of the client's data at their own financial institution. I'm sure that your systems are up to date in terms of protection from external hacking and that you're fulfilling your responsibility to your clients by meeting the expectations of Quebecers and Canadians. If an issue arises in the account, you'll reimburse the criminally misappropriated money.

The identity theft issue is as follows. Let's say that a person goes to a bank tomorrow morning. The person says that his name is Guy Cormier and that he needs a mortgage to purchase a house. The mortgage would be at the other bank and not at Desjardins.

Identity theft causes damage in other areas. One example is the real estate flips in Saint-Lambert, in the South Shore, where people took out fake mortgages under fake identities. There were a baker's dozen, and that was only in Quebec. After that, it will be Canada and Europe. Identity theft has an impact, and it isn't limited to the Desjardins Group financial system.

The protection that you're offering is appreciated and necessary. However, if I may say so, the protection is limited to the client's financial situation within their institution.

[Guy Cormier]

Basically, the thought process behind the new measure announced this morning is that we're in the digital age. There will be fewer and fewer paper transactions in the coming years. This data becomes raw material for our economy. Given the importance of the data, at Desjardins, we've taken on the responsibility of offering protection to all our members.

I said that there were three pillars. The first pillar is the financial aspect that you're referring to. If Desjardins members see an unauthorized transaction in their transactions accounts, Desjardins will fully reimburse them. This answers the first part of your question on the financial transactions aspect.

In terms of other types of identity theft involving credit card transactions made elsewhere, such as cellphone purchases or car rentals, people can contact Desjardins and they'll be taken care of. Second, if they need help with recovering their identity, not from a financial perspective, but in relation to other aspects of their private lives, Desjardins will support them. If we need to call government agencies or private firms, or help them prepare notarized documents or a presentation, we'll do so. We're no longer talking about the financial aspect. We'll help the people with the other steps that they may need to take.

[The Chair, Liberal, John McKay]

Thank you, Monsieur Picard.

Mr. Paul-Hus, you have seven minutes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

Thank you for joining us, Mr. Cormier.

We fully understand that this situation is very emotional and complicated for Desjardins. Mr. Cormier, you said that it was premature to hold a committee meeting. I want to point out to everyone again that the Conservatives requested this meeting, with the NDP's support, to see how the federal government could help Desjardins and the nearly three million affected members.

The objective isn't to investigate the situation or to find out how the data was stolen. The police are in charge of that aspect. For my part, I hope that the individual will be punished to the full extent of the law. I hope that the law is strong enough to send him to prison for a long time, but that's another matter.

We've met with officials from various departments, including the Department of Finance and the Canada Revenue Agency. These are large departments. However, it's difficult to know whether the Government of Canada can be useful in this situation.

I want to know whether you've received effective support from the government. If not, what could the government do to help you?

[Guy Cormier]

There are two or three parts to my response. When this incident occurred, we contacted several federal and provincial government agencies. We spoke with the different departments of finance. I want to tell you that the departments were very helpful and supportive. Bernard Brun can confirm that very clear and open discussions were held.

I've noticed that both the federal and provincial government authorities want to reassure the public. You have no idea how important this is to us. Sometimes, we see what's being written and said. I understand that people have concerns and questions. As MPs, you must hear about many of them from the people in your constituencies.

I can see that the federal and provincial government officials want to reassure people and give them the proper information. This is very helpful to Desjardins. People must be told to contact us so that we can introduce them to the programs that we announced this morning. Whenever we meet with people in our caisses or client contact centres, we're in direct contact with them and we reassure them.

We don't want to trivialize the situation. However, according to several studies and several experts who are currently assisting us, there's a clear difference between a data breach and what happens in a real data theft. This isn't a “one-to-one” case. The proportions are very small.

By adding the protection that we announced this morning, we're telling all our members, including businesses, not to worry. If any issues arise, they should call Desjardins. We'll assist them.