Evidence of meeting #41 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.
A video is available from Parliament.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
I'm sorry. I'm just trying to wrap my head around.... Does removing pseudonyms from the definition then strengthen the principle of data minimization by ensuring that only necessary and clear attributable information is included? That's how I'm seeing this.
Acting General Counsel, Policy Sector, Department of Justice
I think the reason it was included is that there is a need for it, sometimes, depending on how someone has set up their account. If you set up your Instagram account and you characterize yourself as “Daffy Duck”, and Instagram had information on Daffy Duck, they'd be able to provide that. This is why it was added. Whether or not that leads to data precision in terms of privacy safeguards, I think is debatable. What the tool is trying to provide is information so that police can identify suspects.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
In a nutshell, you're saying that this amendment doesn't reflect a balance between.... I'm trying to get to the point at which we're looking at balance—a balance between effective investigative capability and also stronger privacy protections for individuals using telecommunications services. With that balance in mind, if it doesn't matter one way or the other, then we might as well preserve as much privacy as we can. Is that not right? Am I completely misunderstanding where you're going with this?
Acting General Counsel, Policy Sector, Department of Justice
Perhaps...or I'm misunderstanding.
I think, again, that the elements in the subscriber information definition were there to give examples of the types of information police need during an investigation in order to identify criminals. The reason they're included is that there are real-life examples in which they might have to go after a pseudonym or they have a suspect and they know this person via an IP address, and that's why they've gone to Rogers, for example, and asked for the subscriber information. If Rogers has on hand any pseudonyms that the client used on their services that are registered with them—for example, email addresses they might have registered with them—then it could provide those.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
Mr. Gilkes, let's talk about concrete, real-world examples. Can you give us a couple of different examples, so that we can really wrap our heads around this?
Acting Officer-in-Charge, RCMP Lawful Access, Royal Canadian Mounted Police
Absolutely. We have to keep in mind that we're police, so we're investigating criminals most of the time. We do also investigate missing people and things like that. If we are investigating criminals, then likely they're not going to want to use their real identities when they're registering for various services, especially if they're going to be committing crimes online.
As this is the case, some of the time we have to use other ways to identify the people who could potentially be behind whatever crime we're investigating. We may be asking for information that very much differs from service provider to service provider. We don't know exactly what is required to create each account or whether there are monikers that can be created and associated with a name that has been associated with the creation of the account. Somebody may have multiple accounts associated with a particular name, whether they're called handles or whether they're temporary or permanent and things like that.
This is information that can be provided to police, which can help them link these individuals to other platforms and to previous registrations in other places. Those police officers can then continue with additional judicial authorizations to obtain additional information.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
I think so. I don't feel at all confident in all of the answers. I'm getting there. Do you have any other examples you want to give?
Maybe Frank can help me clarify my thoughts.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
I think what this comes down to—if I have it right, and maybe I don't—is that if the Privacy Commissioner says you shouldn't include pseudonyms, that's the recommendation, but the police are saying that including pseudonyms will help them catch criminals.
Perhaps I could ask this. Could someone finish the following sentence? Including pseudonyms will help us catch criminals because....
Please, go ahead.
Deputy Assistant Deputy Minister, Policy Sector, Department of Justice
Criminals use pseudonyms.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
Okay. I think we need to go one step further. I have a great deal of respect for you, Ms. Gibner, and I know you really know your stuff. I understand that criminals use pseudonyms. I don't have a burner account. I'm very proud of that. A lot of politicians do. I do not have any burner accounts with which I attack political opponents.
Why are you laughing, Mr. Housefather? Do you?
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
You didn't know you could have a burner account, Mr. Ramsay. Good grief—I don't know if I buy that.
People use burner accounts, obviously, or pseudonyms. Pseudonyms are used in order to not identify yourself, if we're being candid. Is your point that we want pseudonyms simply because that might be akin to a username? “Frank Caputo, MP” is my username, but somebody else might use “Daffy Duck” as their main thing.
Why is that necessary? Why can't we get the person's information without the pseudonym? That would be the logical point. I think I know the answer, but I think we need to flesh that out based on what Ms. Kirkland was getting at. I think that was the point she was trying to get to.
Deputy Assistant Deputy Minister, Policy Sector, Department of Justice
I'm going to go back to the point I made earlier. This is a judicially authorized warrant. Police are going to go with the evidence. Either they're going to go with Daffy Duck or they're going to go with an IP address and say, “I need it associated.” The purpose of the tool is to connect the first initial dot at the beginnings of an investigation. The police don't know what they don't know. The definition is set out for the various things they've come across in real life, and we've articulated that in law to be as clear as possible. First principles are that they're going to have to go to a judge with some evidence in order to get it authorized.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
The evidence would be predicated on connecting the dots. If I take your point correctly, the dots don't get connected if we don't have the information, and the information we need is sometimes in the form of a pseudonym. Is that the point?
Deputy Assistant Deputy Minister, Policy Sector, Department of Justice
My point, again, is that I think it's really helpful to the committee to hear examples. If Mr. Gilkes has an example of a pseudonym that sort of connects the dots for us all here, maybe that would be helpful to the committee.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
“Muscleman Frank” or something like that is a very good place to start, Sergeant. I'm being facetious here.
Let's ask this. What percentage of people in your investigation use it for child luring and things like that? In my experience, a lot of people use pseudonyms, but a lot of people don't. A lot of the time, when you get a report, for instance, that says this is the person, they will have often logged in with their real name or their Facebook is tied to their actual email address that might be frankcaputo@rogers.ca or something like that.
Do you get what I'm saying, Sergeant?
No, that is not my real email address. You're going to get bounced if you try to email that.
Liberal
Anthony Housefather Liberal Mount Royal, QC
Millions of Canadians are sending you emails right now, Frank.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
That includes Mr. Housefather's burner account.
Sergeant Gilkes, can you elaborate on what I've said? How often does it happen that the pseudonym is so important to an investigation that it's absolutely necessary?
Acting Officer-in-Charge, RCMP Lawful Access, Royal Canadian Mounted Police
I don't have exact numbers.
Conservative
Acting Officer-in-Charge, RCMP Lawful Access, Royal Canadian Mounted Police
Anecdotally, I've investigated many different types of crimes, whether they be financial or cybercrime investigations. Depending on the type of crime being committed and depending on how widespread the crime is, that's when it comes more into play.
I'll give an example. In cybercrime investigations, there's something called pride. A lot of the time, cybercriminals start off as gamers, and they are particularly good at a particular game. This is something that may come back later on. They may use a moniker that they used many years ago, because they're proud of what they've accomplished in a certain game. That name may be used sometime later when committing an offence, and you're able to link the name that's being used sometime later to an account that was created years before in a particular game. That gives us some insight as to who might be behind the offence.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
That I can understand.
In your experience, is this a frequent thing? People might use a moniker or a name from the past, a reference to gaming, high school, being a good skateboarder or something like that.
The question I'm trying to get at is this: In your experience, is that very frequent, sometimes occurring or seldom occurring? That's what I'm trying to get at. Again, you can only speak to your experience. I'm not trying to qualify you as an expert here. What I think the committee is asking for you to explain is how often this happens.
