43rd PARLIAMENT, 1st SESSION Standing Committee on Industry, Science and Technology EVIDENCE NUMBER 017 Thursday, May 21, 2020 Chair: Mrs. Sherry Romanado 1 Standing Committee on Industry, Science and Technology Thursday, May 21, 2020 ● (1700) Cégep de l'Outaouais. This CCTT consists of a team of cybersecu‐ [English] rity researchers. It's one of 59 other centres in a network that cur‐ The Chair (Mrs. Sherry Romanado (Longueuil—Charles- rently involves over 1,400 researchers. I'm also a technology en‐ LeMoyne, Lib.)): Good afternoon. I now call this meeting to order. trepreneur, a teacher and a researcher. I've worked on telecommuni‐ cations, transportation and renewable energy projects. Welcome to meeting number 17 of the House of Commons Standing Committee on Industry, Science and Technology. Pursuant to the order of reference of Saturday, April 11, the committee is My remarks will be divided into three main parts. First, I'll pro‐ meeting for the purpose of receiving evidence concerning matters vide some context. I'll then give three impressions. Lastly, I'll give related to the government's response to the COVID-19 pandemic. a short introduction to the principles that I believe are important for discussing geolocation solutions. Today's meeting is taking place by video conference. The pro‐ ceedings are being made available via the House of Commons web‐ site. First, regarding the context, the needs are currently exacerbated. We're all going through a much-needed lockdown in response to a I would like to remind the members and the witnesses to please pandemic that's pushing all Canadians online. Our needs are uni‐ wait before speaking until I recognize them by name. When you are versal. We know that the Internet must be accessible to everyone. ready to speak, please unmute your microphone and then return to Right now, I'm thinking a great deal about the most vulnerable peo‐ mute when you are finished speaking. When speaking, please speak ple. It's not necessarily a matter of age. Isolation can also be a fac‐ clearly and slowly so that the translators can do their work. tor, along with, perhaps, the ability to use technology. Clearly, be‐ As is my normal practice, I will hold up a yellow card when you cause of the current physical distancing and voluntary isolation, we have 30 seconds left in your intervention, and I will hold up a red have greater needs. All areas of our lives are affected. Basically, card when your time for questions has expired. we're in an acceleration phase, where the expected transition to dig‐ ital services has been catapulted at high speed. I'd now like to welcome our witnesses. [Translation] In my view, for all this to work, the concept of online trust is We're joined by François Perron, director of CyberQuébec. very important. The quality and security of the digital services that we use revolve around a few key principles, including the ability to [English] create trust during a transaction. The foundations of online trust de‐ From Google Canada, we have Colin McKay, head of govern‐ pend on our ability to confirm the identity of those whom we're ment affairs and public policy. From IBM Canada, we have Eric speaking to during a transaction and to leave non-refutable traces Johnson, partner, British Columbia public sector, global business that can't be erased or falsified for the purpose of entering into con‐ services. From Mimik, we have Fay Arjomandi, founder, president tracts. That's the current context. and chief executive officer; and Michel Burger, chief technology officer. Three impressions emerge when we start talking about geoloca‐ Each witness will present for seven minutes, followed by a round tion, particularly with regard to recent identity theft. I don't think of questions. that we need to go over what has happened in the industry in recent months. Clearly, the government's use of a unique identifier—I'm With that, I will start with CyberQuébec, Monsieur Perron. talking about the social insurance number—is completely outdated. [Translation] Once this secret source that identifies us is revealed, there's no way to replace it. Mr. Perron, you have seven minutes. Mr. François Perron (Director, CyberQuébec): Good after‐ noon, everyone. Thank you for inviting me to this meeting. I believe that, to interact properly on the Internet, we now need a digital identity system. I think that this system should be out‐ My name is François Perron, and I'm the director of Cy‐ sourced, in multiple parts, perhaps even in open source software, to berQuébec. I run the college centre for technology transfer at the ensure that it includes three key components. 2 INDU-17 May 21, 2020 First, if a government chooses to provide verifiable information, value of their own data and their privacy. We likely have some it must be able to do so. However, other verifiable sources must al‐ work to do in this area. so be available online. Second, I'd like the individual to be responsible for collecting Businesses must follow suit. As we find the right rules to regu‐ this verified information and for choosing whether to submit it. I'll late the sharing of information, we can improve the situation. Some address this concept of choice a little later in my presentation. countries have started to do this. For example, in Europe, the gener‐ al data protection regulation, or GDPR, sets out stiff penalties. If Third, we need an identifiable and fully functional system that we don't deal with this, people will move here hoping to take ad‐ will make it possible to confirm ownership or a claim that someone vantage of laws that may be less stringent. We have some work to could make, so that, ultimately, a minimal response can be provided do to make the rink good for everyone. to formal questions. The word “minimal” is very useful— ● (1705) In conclusion, I just want to tell you what role I think that the [English] government should play. It must manage its own rink. People will Mr. Brian Masse (Windsor West, NDP): I have a point of or‐ play hockey if they want to play hockey. However, on the privacy der, Madam Chair. rink, we must have the right to be forgotten. Businesses must be re‐ quired to disclose incidents in which information has been compro‐ The Chair: Yes, MP Masse. mised. We must work together to create an ecosystem where our Mr. Brian Masse: I'm getting both translations at once. I'm on digital identity can be monitored by the individual. the English channel, as normal, so it could just be me. The Chair: Thank you. We'll double-check that. ● (1710) Ms. Fay Arjomandi (Founder, President and Chief Executive Officer, Mimik): It's the same for me. The Chair: Thank you. The Chair: Okay. Thank you. We'll check that. [English] [Translation] Mr. Perron, I stopped the clock. Our next witness is Mr. McKay from Google Canada. Mr. François Perron: Okay. I just chose French as the language spoken. I think that the issue was related to this. Sorry about that. You have seven minutes. Just to remind you, when you see the Let me know when I can start again. yellow card, you still have 30 seconds. The Chair: I think that this was indeed the issue. Thank you. You can continue. Mr. Colin McKay (Head, Government Affairs and Public Policy, Google Canada): Thank you, Madam Chair. Mr. François Perron: I had reached the third part. I was saying that it could be very useful to have the ability to provide responses with a minimal amount of information and that the individual It's a pleasure to be with you in such unusual circumstances. It would be responsible for choosing which information to submit looks like you've started to adjust, but this is my first experience during a transaction. This would be a paradigm shift towards a new like this, so please forgive any interruptions. system. Instead of having a single secret, such as the social insur‐ ance number or a fixed digital identity, we could enter into several I want to thank you for the time to speak about Google's efforts contracts with several people. This would make it possible to share to help our users and communities during this time of crisis. Since information. the first appearance of COVID-19, we've been through an excep‐ This would also enable us to share information by choosing what tional transition at Google. Teams across the company have we want to disclose. Perhaps we could also avoid making our iden‐ launched 200 new products, features and initiatives in response to tity known in this context by providing an authentication token that the crisis and needs of our users and our communities. We have would make it possible to remain completely anonymous. made $1 billion in grants and additional resources available to users, communities and countries to help them through this crisis, If we consider this type of system—and this is my second strong through the transition. impression—we'll also need to look at biometrics. We'll need to have sources of biometrics that we won't be required to fully dis‐ close and to maintain the ability to regenerate other biometric infor‐ Our major efforts are focused around keeping people informed mation about ourselves. We'll need to have a biometric data reserve with trusted information, supporting them as they adapt to a chang‐ so that we can create new secrets of our own to prevent a complete ing world, and making our contribution to recovery efforts across theft of our biometric identity.