Public Safety Committee on Feb. 8th, 2018

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I see.

You talk about the influence of the Government of Canada, but you issued a call to action on your website. The message reads as follows: “Not in the U.S.? You can still help save Net Neutrality. This is how.”

In Canada, you don't want to give CSE the power to intervene abroad, but your organization is intervening in the U.S. through a call to action. That's hypocritical; you are encouraging action abroad, and yet you are telling the Canadian government not to acquire certain tools because you fear they could be used for intervention abroad. Don't you think that's a bit hypocritical?

[Laura Tribe]

Just to make sure I'm clear, are you asking about our campaigns that we run in the United States?

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Yes.

[Laura Tribe]

We have a community of supporters of almost 200,000 people within the United States who are active in their own government's activities. It is those supporters—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Your organization is based in Canada but is exerting influence in the U.S., meaning that it has influence abroad. You want the Canadian government to have fewer tools to achieve its objective of protecting Canadians. Don't you think that's contradictory?

[Laura Tribe]

I don't believe that OpenMedia has the same power and influence as the Canadian government.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

It is nevertheless a position—

[Laura Tribe]

Although I appreciate that.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you.

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus.

Possibly you'll want to respond after Mr. Dubé's questions.

For seven minutes, Mr. Dubé.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you.

I think we've confused citizen activism with state surveillance, but that's a whole other discussion.

I want to ask about this notion in the bill of publicly available information. When the Canadian Bar Association was here, there was a discussion about how there isn't really any kind of jurisprudence or legal definition in Canadian law about what publicly available information is. I think a lot of people have assumed, perhaps wrongly, that this basically means that if I Google something right now, that's publicly available information. What some witnesses brought up was that it could mean information being sold for advertising purposes by social media or search engines like Google, and it could perhaps even go further than that. I know that at OpenMedia you've been very active on some of these “digital clauses”, for lack of a better term, in trade agreements and things like that, which, arguably, from this very broad discussion that's happened over publicly available information, could potentially be what that means when companies start being able to freely exchange information across borders in that way.

First of all, I'm just wondering what you think publicly available information means. Secondly, why would that be a cause for concern in the context of what's being presented here, both with the datasets for CSIS but also with the capabilities of CSE?

[Laura Tribe]

I think one of our concerns is that it's unclear what publicly available means. We would love to have that addressed through the amendments to Bill C-59, so that it is really clear on exactly what these things do or don't mean so they aren't left to law enforcement to interpret themselves. With publicly available information, unless it explicitly says that people are not allowed to purchase commercially available information, to purchase huge datasets, then, as far as we're concerned, that's still a possibility and a real concern for us.

We would put forward the idea that the ability to Google everything and start recording all of those datasets is problematic. Collecting that mass amount of information, in general, is of concern. Additionally, proactively purchasing and growing those datasets without any direct targets, without any clear suspicion or motivation is really concerning as citizens who are trying to live our lives, who are feeling like we are victims or targets or suspicious actors in our own state. The ability to engage as a citizen is really hard to do without putting a lot of information on the Internet right now. Feeling like anything you put out there is now also being proactively collected and stored by your own government is quite terrifying.

[Timothy McSorley]

We would share those concerns. I would also like to highlight that publicly available information is with regard to both CSE and CSIS, as well as the collection of new datasets. Any concern regarding the CSE's collection of publicly available information, we believe, is reflected also in the new powers that will be granted to CSIS. We share OpenMedia's concerns that it needs to be further defined. It needs to follow the same authorization process as other information that will be collected, either through datasets for CSIS or through authorizations for the CSE.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

The natural follow-up to that is what's collected incidentally, which is also brought up in the legislation. The counter-argument could be made that when they do collect incidental information, keeping it requires authorization, but it feels as though the way the thresholds are defined is not sufficient and that it would be relatively easy to justify the collection of incidental information while going after someone else. What are the concerns about incidental information being collected?

I think to some people in the digital world incidental information means something very different from what it would have meant for a more old-fashioned police or national security investigation from 25 or 30 years ago, for example.

[Laura Tribe]

I think the concern with incidental information is that the non-incidental, the critical information, in a lot of cases already feels too broad. The ability to keep that incidental information—to first define it, and then also retain it—is quite challenging for us as citizens, for our community to really understand what that means to them. How do they know it's incidental? How do we as regular people understand what information is being collected about us, in addition to how hard it is to keep that incidental information? I think we're hearing a lot of arguments from law enforcement about how incidental information is not actually incidental, which is our first concern, and that, even when it is, it could be useful in the future. I think if you're looking at 25 or 30 years ago, that might be a notepad that's stored somewhere in a filling cabinet. I think right now it's these datasets from which that information is being cross-referenced against multiple other datasets that can potentially provide a lot of either false positives or misleading information, which actually take away from the very purpose of trying to collect this information in the first place.

[Timothy McSorley]

Our concern would be that the inclusion of incidental information will in fact lead to what others have described as “mass surveillance” and collection of too much information. Concerns have also been raised about metadata not being properly defined and included. By combining that with incidental information...which often could be very important information. Incidental doesn't mean it's just minor information about somebody, but that something is collected outside of the scope of what the targeted investigation is. In that respect, we don't have a clear idea of what that incidental information would be. If it is to be retained, it would have to meet the same authorizations and thresholds for collection and retention and querying. As Ms. Tribe mentioned, we already have concerns about whether those thresholds are at the appropriate level to ensure adequate oversight and adequate sorting of that information.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

As my time wraps up here I'll try to make this as much of a yes-or-no question as possible, which is always precarious in this line of work.

There has been the notion that things have changed at the border when it comes to cellphones. There is the suitcase rule, or however it's referred to, where you have this expectation of sacrificing some privacy when you cross the border, whereas now, with the increasing ability to look at cellphones, that's different. Do you feel with legislation like this that the same kind of principle applies, that in a traditional investigation there would have been an expectation of people to hand things over, whereas now, given how much information is on cellphones, the expectation has shifted about what people are giving up to investigators?

[Laura Tribe]

Yes. We're actively campaigning on both sides of the border to increase privacy at the border for cellphones, because so much information is available on them.

[The Chair, Liberal, John McKay]

Mr. Picard, you may go ahead for seven minutes.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

You mentioned that we have laws and regulations indicating that we don't spy on Canadians. The CSE commissioner came before us and confirmed that there's no spying on Canadians. Even so, you mentioned at the beginning of your speech that there's no guarantee that Canadians will not be spied upon and that we cannot trust the simple fact that it is written somewhere, that we are not sure whether the CSE will or will not spy on Canadians. What does it take then to make sure that we can be assure of that?

[Laura Tribe]

I think that one of the things that are important to address is that they cannot be sure and that there will be some spying on Canadians. When that information is identified as being Canadians' data or information being collected, it's immediately treated otherwise, but those protections must also be actively put in to ensure that Canadians are not included. I think that in some cases, some of the provisions that are being put forward in the proposed CSE act will inevitably target Canadians. That's one of the things that we are raising concerns about. I think there are a number of recommendations in the Citizen Lab CIPPIC report that would also help address that. I think the biggest thing is to recognize that it just doesn't work that way. We have to put provisions in place to try to proactively identify Canadian information, and then also make sure that it's treated as such once it's identified and recognize that it might also just be that Canadians are going to be caught up in this, so let's not build systems that we don't want Canadians to be a part of.

[Michel Picard, Liberal, Montarville, QC]

When you talk to a stranger, do you ask whether the stranger can be under surveillance by another country, so you don't get caught in what may be a monitored call?

[Timothy McSorley]

Do I personally ask people?

[Michel Picard, Liberal, Montarville, QC]

If you talk to a stranger, how do you make sure you will not be caught in a monitored call, because that person might be a target?

[Timothy McSorley]

It's true, we don't know if in our communications, they could be targeted or surveilled. That's why we believe we need the strongest possible authorizations and restrictions on how the surveillance tools are used, both in Canada and....

Part of what we do at the ICLMG is argue that Canada also has an obligation to set a standard and to work internationally, to ensure there is a standard for what other countries do as well, on an international level. We know that's difficult to achieve. We're not dreaming that every country is going to be friendly and not spy. Canada states it plays a proactive role in protecting civil liberties and human rights on the international level, and we believe we need to set those policies domestically in order to set an example internationally.