Proceedings of the Subcommittee on
Communications

Issue 4 - Evidence

The subcommittee on Communications of the Standing Senate Committee on Transport and Communications met this day at 11:02 a..m. to examine the policy issues for the 21st century in communications technology, its consequence, competition and the outcome for consumers.

Senator Marie-P. Poulin (Chairman) in the Chair.

[English]

The Chairman: Good morning, honourable senators. I see a quorum. We are examining the policy issues for the 21st century in communications technology, its consequence, competition and the outcome for consumers. Our study will be done in three phases. We are currently in phase I of our examination.

We welcome this morning, Mr. Bruce Phillips, Privacy Commissioner of Canada.

In phase I, we are looking at the current state of the communications landscape, public and private programs, to ensure access, privacy and security of shared personal information, the trust that Canadians have in e-commerce and new technology, and public governance. In other words, we are looking at the impact of the new technology on private business and public governance.

Mr. Phillips, thank you for appearing before us. Would you please start by introducing your colleagues.

Mr. Bruce Phillips, Privacy Commissioner of Canada: With great pleasure, honourable senators. I have brought along a battery of people who know a good deal more about the intricacies of the telecommunications world than I do.

On my left is Mr. Carman Baggaley; on my right are Mr. Julien Delisle and Mr. Richard-Philippe Maurel.

Thank you very much for the opportunity to speak about this subject. I once described using the Internet as roughly akin to walking out to the corner of the Sparks Street Mall and Metcalfe Street and taking off all your clothes. Some people thought that was something of an exaggeration, and perhaps it is, but I think it conveys the essence of one aspect of modern communications technology.

Potentially at any rate, whenever we use the Internet, we are effectively under constant surveillance. Who you are, the type of system you are using, the Web sites you are visiting, the amount of time you spend at those sites, the information you download, and the purchases that you may make can all be tracked, recorded, and possibly sold.

When this click stream data is added to marketing information that can be acquired through other off-site sources, it is possible to create very powerful personal profiles on millions of people.

The difference is that in the conventional, non-electronic world, you can wander through a mall, you can go window shopping, you can compare prices, you can pause to try on some clothes, even make a cash purchase, and leave no trail, no record. In the electronic world, we leave a trail simply by looking, let alone any of the other activities.

It is not unlike being followed around by a market researcher with a clipboard and a stopwatch making notes on what you are doing. This is particularly troubling because it can happen frequently without our even knowing that we are being monitored.

It is possible, of course, to buy software so that you can surf the Web with anonymity. There are ways to block so-called "cookies." However, the question arises whether people should be forced to pay for anonymity that is already enjoyed, and has been, historically, from the beginning of time.

It is rather like asking ourselves whether we should have to wear a disguise so that when we go shopping, we can conceal our identity. Should we have to buy scramblers before we can make personal telephone calls? Should customers be forced to rely on these technological "opt-outs" to protect their privacy? Should we not address the fundamental question of whether businesses should be required to seek our consent before collecting information?

Even if we accept that giving up personal information is the price we have to pay for using the Internet -- and that is not an assumption with which I agree -- we must worry about the security of the information that is put into the system.

Judging by recent experiences, no site is safe from hacking. Discovering that your credit card, for example, has been posted on a Web site can be alarming. Finding out that someone has stolen your identity can be not only a deeply traumatic experience, but disastrous in a number of ways in terms of employment and reputation.

The Privacy Rights Clearing House, an American organization, says that identity theft cases in the United States have increased from 32,000 in 1992 to 523,000 in 1997. That is potentially more than half a million personal catastrophes. I cannot verify those numbers, but they are put out by an expert organization and I presume that they can justify them.

The Federal Trade Commission receives 400 calls every day about identity theft. The Internet contributes to identity theft in a couple of ways.

First, the uncontrolled and unsecured collection and storage of personal information, including credit card numbers, makes the opportunities for theft infinitely greater. Second, the Internet is based on faceless connections where an assumed identity cannot be challenged easily. This problem is not confined to the United States. Apparently the spouse of one of my office staff members was a victim.

Therefore we can no longer take the anonymity of our electronic communications for granted. You can destroy a letter by ripping it up and throwing it in the fireplace, but e-mails live on long after we have deleted them.

A harmless but thoughtless e-mail about a superior can now be retrieved and used as the basis for disciplinary action. Corporations have been able to force ISPs to turn over the names of "chat room" participants who have criticized them using pseudonyms. Surely such a practice can be banned by legislative action.

Thoughts that can be expressed freely in a conventional letter are expressed at our peril in the on-line world. One example that comes to mind is about an American university student who was taken into police custody. The student was sent to Bellevue Hospital in the city of New York for a mental examination and was held for three days after one of his roommates, who was searching his own computer, had discovered violent fantasies in the student's e-mail to a friend.

The Internet and e-mail have become an increasingly important part of the workplace. Employers have an understandable interest in ensuring that their workers are not using e-mail systems inappropriately or wasting time visiting non-work-related Web sites.

As is the case with many aspects of the on-line world, the technology has developed faster than the social and legal norms. The issue is not only whether employers have the right to satisfy themselves that their equipment and workers' time are being properly deployed, but whether employees must give up every vestige of the normal privacy rights that exist even in the workplace.

Even publicly available information is becoming a crisis issue in the on-line world. Property tax records, court records, and decisions of tribunals have certainly been traditionally considered as public records accessible to anyone. However, as far as we are concerned, there is a difference, not only in degree, but in kind, between putting all of the records of a municipal office on-line -- making them accessible to anyone -- and requiring someone who is in the midst of a real estate transaction to go down to the records office and present a good case for seeing the records before having them presented. There is a world of difference.

At present, for example, one government department is considering putting the entire disciplinary file for all of its many thousands of members on-line. That file would be accessible to anyone. This is taking the notion of public accessibility to new and previously unconsidered lengths, with unintended consequences down the road, I am sure. I can think of one example of an extremely well-known television personality in this country who went to great trouble to keep her address private because she had been the recipient -- the victim -- of many unwanted telephone calls and harassment. The entire tax roll was entered on-line and was published in a scandal magazine, including her address. Within days, all the troubles that she had previously gone to great lengths to avoid returned.

One of the virtues of the Internet is that it has democratized the distribution of information and has enhanced freedom of speech.

The dark side is that anyone can create a Web site and post personal information on it. An Ottawa site, for example, invites people to e-mail information describing vehicles that are stopping in Ottawa neighbourhoods apparently to solicit prostitutes. The Web site includes a partial licence plate, a description of the vehicle, the location, date and time of the alleged solicitation. Note that there is no proof involved in any of that. Nevertheless, that information then becomes publicly accessible.

Three aspects of this marketplace, its interactivity, its inherently borderless nature, and the lack of transparency -- that is to say, people not knowing what is being done with their information -- make protecting people's privacy rights an enormous challenge. The interactivity of the Internet allows companies to put cookies on the hard drives, hackers to attempt to hijack our computers, and marketers to attempt to fill up our mailboxes with e-mails. The borderless nature of the Internet makes the enforcement of rules very difficult.

Most individuals do not know where the Web sites that they visit are based. The lack of transparency means that most consumers do not know who has what information, how it is being used, or even that their on-line movements are being tracked. Even though this is a challenge, I am not prepared to accept the advice of a chief executive officer of one large technology company, who responded to concerns about on-line privacy by saying, "Well, you already have zero privacy, so get over it." I am not sure, honourable senators, whether you are familiar with that comment.

Is there any light in this otherwise fairly dark tunnel? There is a great deal of interest in this right now in the U.S., and I do not think that it is adequate to say, as many American corporations and special interest groups say, that self-regulation will do the job. Given the borderless nature of the Internet and the dominance of American technology companies, anything that the U.S. does to protect personal information will have an impact on the privacy of Canadians.

One interesting notion that has emerged recently is monetizing personal information -- turning it into a commodity that we can sell. If someone wants our information, the theory is that it is ours and we should be paid for it.

Some might like that, but I have a real problem with treating personal information as a commodity, and I think that most Canadians would share that view.

This Parliament recently passed Bill C-6, the Personal Information Protection and Electronic Documents Act. Is that an answer to these problems? It is only part of the answer. In the area of workplace privacy, for example, the legislation only applies to federally regulated workers, at least for the first three years. My office is still studying how, if at all, the legislation will apply to information collected by Web sites outside Canada.

At first glance, it appears that the legislation will not be helpful in that respect. It does, of course, give us some reach into companies that are collecting information in Canada and transmitting it over the border.

One of the problems is that most of the information on the Internet does not involve a commercial transaction. Thus it would escape Bill C-6 altogether. Therefore, the act is powerless to stop someone from posting personal information on a Web site -- for example, the information about people suspected of soliciting prostitutes that I cited a moment ago.

What can be done to protect privacy in these areas? One of the greatest needs is for a much more informed public. The uneasiness and reluctance of people to trade on the Internet, for example, is one concern that is now beginning to take root in Canada and elsewhere. There is a sense that more needs to be done legislatively to protect people's privacy rights.

Senator Finestone's charter, with which I am sure honourable senators are familiar, since it was introduced in the Senate in the last week or so, would be a helpful addition to the edifice of legislation on privacy. Certainly it would be helpful in upgrading Canadians' awareness of privacy rights and supplementing the protections provided by Bill C-6.

I briefly mentioned software that allows individuals to surf the Web or send e-mails anonymously. Consumers can take advantage of that technology. In a perfect world, we would not have to turn to these technologies, but in a borderless, digital world, anonymizing software encryption and firewalls can provide some measure of protection. It would be very helpful to everyone concerned if the United States would stop dragging its feet on this matter. Congress should get down to business and pass a generally applicable privacy law similar to, and perhaps even stronger than, Bill C-6.

The United States is the undoubted leader and the centre from which a great deal of the commercial traffic emanates.

In closing, we cannot turn this tide back, nor do I think we should even contemplate doing so, because the benefits of the Internet in terms of "democratizing" the world, if you wish to put it that way, are enormous. We must somehow reconcile the benefits of this technology with a recognition of and respect for privacy, whether it is on the Internet, in the streets, or in our neighbourhoods. It must be preserved if we are to maintain a decent civil society.

The Chairman: Mr. Phillips, thank you for your presentation. You have brought several issues to our attention that we would like to discuss with you and hear your recommendations. One of the issues that came out of the study tabled by the subcommittee in 1998 was that of privacy as a concern not only of individual Canadians, but also corporate Canada. As you pointed out so well, Bill C-6 is a very important first step in that direction.

The department informed us that Bill C-6 is definitely to be used as a model by the European Union. The Canadian Bankers Association spoke highly of Bill C-6 and look forward to it being implemented January 1, 2001.

You are saying that Canada must go a step further because of international implications. What do you feel would be the appropriate international venue for our country to discuss the issue of privacy, considering the border implications?

Mr. Phillips: I am not an expert in international law. Let me make that clear, in case anyone had any doubts.

An international covenant of some kind will be indispensable in the long run. Whether you could ever get all of the countries on this planet to sign up and adhere to it is another question. If not, there will always be countries that will be safe havens for abusive Internet practices. Certainly, a good place to start is with North America and the Pacific Rim countries that are becoming industrially potent.

Whether it should be a treaty, which I think is always best if you are dealing with international matters rather than a United Nations declaration, which seems not to have the same kind of impact, is a question for the lawyers and the diplomats to work out. Certainly, international covenants will be required somewhere down the line.

I am impressed by what you say about the European interest in Bill C-6. I was not aware of that. It makes me wonder what is wrong with Bill C-6 when you hear people who fought it pretty hard saying it is a good thing.

Certainly, the Bill C-6 approach is a good one. It is applicable to all commercial activities, or will be in due time. If we had such a piece of legislation in the United States, companies such as Double Click would have to conform to a standard that is not currently applicable to them. It would clear up many of the problems associated with that activity. Canada cannot do this alone, obviously.

The Chairman: You stated during your presentation that you feel that Canadians should not be forced to pay for anonymity. In other words, Canadians should not be forced to buy the programs necessary to build the firewalls, for instance. Is that correct?

Mr. Phillips: Basically, yes.

The Chairman: What would be the options? If individual citizens were not responsible for ensuring that their use of the Internet is totally protected, where would you place the responsibility?

Mr. Phillips: Let's turn to the principle of the matter here. If I am a telephone subscriber who does not want my number listed, I object to the notion that I must pay Bell good dollars not to put my name in the telephone book. I think that stands the process on its head, and I feel the same way about the Internet.

That principle has been at least partly accepted in wired communications in connection with such things as caller ID. You no longer have to pay Bell to block calls, and that sort of thing. I see no reason why you should have to pay good money to protect your anonymity when using the Internet if it was made unlawful to use, collect, store and disclose personal information put into the system without your knowledge and consent. That is exactly what Bill C-6 is saying. Did I miss something there?

[Translation]

Mr. Philippe Morel, Communications Technology Consultant: With respect to the Internet, the fact that a large number of companies are being created and are making available on the market products that will allow them to send you your mail anonymously is seen as a response by the market to a problem that was created by the market. The Internet is responsible for creating a whole series of problems affecting user privacy and companies have decided to exploit these problems by offering solutions that are unfortunately commercial at the present time. I imagine our commissioner would probably like a large number of solutions to be made available more quickly.

Senator Poulin: Could you give us an example of a technical means that could be used by various governments, municipal, provincial, or federal, in order to guarantee confidentiality?

Mr. Morel: The first answer that comes to mind involves subsidies. The government could decide to create technical solutions to the problems we are experiencing with the Internet. However, I do not think that is really the government's role. I do not think that the government has time to deal with those problems. However, the government could contribute funds for research, for example, and subsidize part of the activities undertaken by the companies that are making the product available to protect the identity of Internet users, which would be advantageous to users who wish to surf the net without having to pay to be protected. That is one solution.

Senator Poulin: Would other members of your group like to add any comments on this important issue and on the recommendations you have made concerning the role of various levels of government?

[English]

Mr. Phillips: I will offer this additional information -- Mr. Baggaley has reminded me that software of this kind is not particularly user friendly. Many people have difficulty understanding and working with it. Thus, its necessity would act as a further barrier to the use of the Internet. It is already complex for the ordinary people to introduce software into their systems.

One consequence of the present state of affairs is that many people no longer surf commercial sites at all.

In addition, according to our information, an increasing number of former Internet users have given up. They have cancelled their accounts. They are doing that because they do not trust the system to prevent abuse of their personal information. That is essentially an act of self-denial necessary to protect privacy, but it also deprives people of the great benefits of Internet commerce.

They do not use e-mail for the same reason. They do not include sensitive or personal information in their electronic messages. Those are all sensible things to do in the present state of the technology and in the absence of an appropriate or effective legal framework. It is happening. That alone, I think, speaks to the necessity for corrective action.

Senator DeWare: Mr. Phillips, much of the information before this committee study addresses an educational package of some kind. There would almost have to be two ways of doing that. You would probably have to do some on the Web site itself, informing people of the pros and cons and the possible harassment, and there would have to be other education by the other media, because there are many people who may be wanting to get on or to use the Internet.

A majority of the people I know who use the Internet, family and friends, use it to track their accounts, do their banking, pay their income tax, and so on -- although some of us older folks still do it the old way -- and they find it a very productive or simple method of looking after their household accounts.

Now we are essentially saying that this information is available to anyone who takes the trouble to find it.

How do we create this information package? Who develops it? Someone must. Would it come under the federal government? Then we would have to push and encourage our provincial legislatures to accept a bill similar to Bill C-6, would we not, for the jurisdiction to reach across Canada?

Mr. Phillips: There are a couple of questions there. I am not sure the particular examples you cite are the kind that would present the most hazard to a person's privacy. For example, the Canadian banking system has a set of well-developed privacy codes and I think they would be very careful. The same would apply to income tax.

Bill C-6 confers an educational mandate on our office. We will do what we can with the limited resources available to us. We will put out some fact sheets for general distribution, matters of that kind. Obviously, that will not be enough. Given the role that technology is now playing in life, both it and the associated ethics should become a matter for routine inclusion in school curricula, preferably at the secondary school level, if not earlier. Thus, provincial governments do have a role.

The use of the resources of the federal government in broader educational plans, by way of commonly accepted techniques, I think would be a useful expenditure of public money.

I am sure you are familiar with the operative mechanisms of Bill C-6. In the first three years of its operation, it will apply only to federal workers and undertakings. Then it will take effect in three years, in any province where there has not been companion legislation, assuming it survives the Charter challenges that appear to be looming -- and the legal people here seem to think it will.

Yes, that will be an enormous help down the line. All of those things taken together will be helpful in the Canadian realm, but they will not be of much effect or value if people continue to do a lot of their personal business on the Internet in international situations, in spite of the known hazards.

We will not really have a handle on that until we have some action elsewhere in the world as well.

Senator DeWare: Can you tell me what kind of personal information is being picked up widely on the Internet?

Mr. Phillips: Your name; your credit card numbers -- that is one of the most commonly sought-after pieces of information; your shopping habits. When you buy something on the Internet, the people from whom you are buying will frequently log that information. Simply surfing commercial sites can result in the collection of a good deal of information about you -- what you are interested in, what you have looked at, which sites you have visited: That can all be captured, retrieved, packaged, and sold. In fact there is a company in that business.

Senator DeWare: Is that why our mail is increasing lately, because people are trying to sell us everything?

Mr. Phillips: Yes, although I would not blame that exclusively on the Internet. That is a phenomenon of modern technology that is being put to use in another way by list marketing companies who use computers to assemble information from a wide variety of databases and from publicly available information such as StatsCan's census reporting, and so on. They pull that together through the use of computer technology, compile lists, and sell them. That is quite prevalent.

Senator Finestone: Madam Chair, I am delighted to see Mr. Phillips here. I will say publicly how much I have appreciated his help and direction.

Mr. Phillips, you have been supportive and complimentary of my privacy bill, which, much to my surprise, has taken me almost a year to draft. I had no idea how complicated drafting legislation could be, having to check every word, every adjective and adverb in that bill against our international and national commitments, through charters and international agreements.

We are only really beginning to recognize the incredible pervasiveness of the new technologies. Irrespective of what one can put in place to block the cookies and the lists, what your office must do in terms of education is probably more important than any legislation we put in place. Canada is a moral country in many ways. We are a trusting people. I sincerely hope that our trust will not be challenged or destroyed by the incredible collection of information about all of us.

If I wanted to write a history of my life, I would have to include all the tombstone data and all the other important facts, like my e-mail address, my fax number, my telephone numbers at home and in the office, when my children were born, and so on. This is all the stuff they are busy capturing. Information about me will be collected if I search the Internet for a present for my new granddaughter. I do not want someone else to collect my information. It is mine, and if I want to let them know, then I will let them know.

My anxiety -- perhaps it results from a lack of real understanding of this new, invasive world -- is that I cannot stop them from knowing. Do you think we can stop them from really knowing who we are, what we are, what we do, and then stealing little pieces of us?

Mr. Phillips: The easiest way to stop them from knowing is to stop telling them. One of the essentials of an educational plan is to produce a next generation of Canadians who understand how to use the Internet in an intelligent way and avoid putting themselves in situations where information that they do not wish to be picked up by someone else gets into the system. However, that is only a partial answer.

The real answer is to apply to all of the special commercial interests on the Internet the same kind of obligation that now applies to non-electronic communications, through such things as privacy statutes. That is not an insuperable task. We tend to become hypnotized by the technology itself, but it is only machinery when you get right down to it. How it is deployed and the uses that are permissible are matters for human decision- making. Humans invented it and also have the final determination on how it will be employed. It is no different in that respect from any other technology. It can be used for benign purposes, or it can be left totally unregulated and all of these problems will continue. If there are no standards applied and enforced, people will be left to make their own decisions about what risks they are prepared to take. Education is only a partial answer. The users of the Internet must live with the law. It is a traffic system, and we must have some traffic laws. That is the simplest way I can put it.

Senator Finestone: You raise some important issues. We do not live isolated behind walls and barricades. We live in this international world of "wireless" and "wired" and interconnecting sound waves. Whether it is dots and dashes, dots and zeros, analogue or otherwise, it is very important.

A conference is taking place next week that unfortunately I cannot attend because I must remain here to vote on the clarity bill. It will look at this totally unregulated Internet and will address questions concerning homophobia, anti-Semitism, pornography, and so on -- that is, issues that test the fibre of society and what it finds acceptable.

The Internet is totally unregulated now. People can steal your name and register it, or they can use a new name, or they can do any one of many things to entice your children or you into some of these unsavoury sites that include how to make bombs and how to be a very disreputable member of society and socially unacceptable. Will we ever be able to define what is legal -- that is, what is the law -- what is reasonable, and what is justifiable in a democratic society? Will the private bill that I have tabled in the Senate -- even if we are able to do something in Canada that reflects our value system -- be effective now with these waves that are absolutely invading my privacy in my home, whether I am able to stop them or not? Do you have a comment on that?

Mr. Phillips: You have touched on a number of topics.

Senator Finestone: I wish I could focus on one.

Mr. Phillips: You have touched on hate messages, for example. You must ask yourself, is it lawful in this country to publish a hate advertisement in the newspaper? The answer is no. We have rules against that sort of thing. There is no reason why that same kind of thinking cannot be applied to Canadian usage of the Internet.

I do not profess to be an expert on the panoply of laws governing that exercise. However, the notion that simply because it is being done on the Internet, somehow or other it can escape all scrutiny and not have to conform to acceptable social standards, is wrong. We can deal with this. Admittedly, we cannot do everything ourselves because of the borderless nature of the system. However, I cannot help but believe that although there are powerful interests, for example in the United States, arguing against any attempt to deal with these problems, they have not been entirely successful so far. There are statutes in the United States that make transmission of certain kinds of personal information over the Internet unlawful -- for example, issues dealing with children. There are hundreds of Internet bills now under consideration in various places among the 50 states and many in Congress.

What has been absent in the United States so far is an apparent willingness on the part of the administration to seek a comprehensive approach to this and propose something to Congress. Given the enormous level of interest that the subject is generating, I have no doubt that there will be many actions taken to deal with the problem in the not-too-distant future.

If I detected a note of despair in your voice, please do not despair. There are plenty of reasons for optimism. When society is seized of a problem, it usually finds an answer sooner or later. I hope that will be the case in this instance.

Senator Finestone: I remember the debate around Bill C-6. I certainly recall your presentation and your perception. The more I watch people struggling with how to apply Bill C-6, the more I recognize it was a good sectoral undertaking. It has value. Now the application will be very important -- that is, the how-to. The conference recently held in Toronto illustrates the serious questions people have about how they should apply this particular bill. I was glad your staff was there and I was glad to hear many of the concerns being expressed.

I look at this as a sectoral bill. It restrains and confines certain undertakings in certain aspects of business life. The kind of overarching template against which a society needs to determine its value system is the concept behind the privacy charter that I have tabled. If we had an undertaking by society to move in sectoral areas such as health that we've asked for under Bill C-6, that would complement what was happening on the private business side. Banks have indicated that they have strong privacy protection in their systems, although they are still doing bundling, which I do not like, but that is another matter. Is that a way to approach this, at the same time noting that the two candidates in the United States are starting to see the spectre of privacy rights becoming of serious import? Is the appropriate move an overarching template, then sectoral? Is that how you see we could perhaps go about this?

Mr. Phillips: We must agree on some definitions here. Our definition of "sectoral" applies to sectors of industry. Bill C-6 is not a sectoral bill because it applies to all commercial activity, whether it is a factory or a retailer.

I am not entirely certain what you mean by "sectoral."

Senator Finestone: I have become aware of the perceived absence of adequate coverage for the health sector -- that is to say, included under the Canadian Standards Act, or as a parallel to the rights and objectives of Canadian society -- and I saw this bill that way, as sectoral. Perhaps I am wrong, but that is the way I have looked at it.

Mr. Phillips: I have never been a great fan of setting up separate statutes dealing with privacy matters. We do not have a separate Charter of Rights and Freedoms for the health industry, the automotive industry, the retail industry, or the direct marketing industry. We have one Charter of Rights and Freedoms in Canada that is applicable and available to all.

I feel the same way about privacy. Privacy is a basic human right. It is the right to control what others know about us and it certifies our uniqueness and individuality. If it is taken away, a basic human right is lost.

In my view, creating a separate set of privacy laws for each particular sector essentially invites the establishment of different levels of observance of and respect for a basic human right. I think that is the wrong approach. It is why I think Bill C-6 is a good approach. It is why I was sorry that the Senate decided to give the health information world a one-year hoist.

I do not deny that health information is a complex field, because it has so many players in it with so many different interests: the medical practitioner and the historic Hippocratic Oath on doctor-patient confidentiality; the health bureaucrat who sits in an office and looks at invoices to determine if the doctors are charging too much; the insurance industry, which is interested in the insurability of a great many people; and the hospital world, which has a different set of interests. All of these people are involved in health information and seem to think that somehow or other they are entitled to some sort of special treatment.

I have been waiting for an opportunity to say this. I heard between the lines during the committee hearings on Bill C-6 the word "exemption." It kept creeping into my brain. Many of the health sector stakeholders do not feel comfortable with being required to comply with the standards of Bill C-6. In my view, that is utterly the wrong approach. If, as they say, medical and health information is among the most sensitive, then it should, certainly as a first instance, be required to comply with a general bill such as Bill C-6. I will follow with great interest what transpires when the Senate comes to grips with this issue later this year.

Senator Finestone: I do not think that thought was in my mind at all. From the hearings, it seemed to be a fact that the Canadian Standards Act needed some additional factors. If you think of the "book of life," which has not been read yet -- the entire human genome research -- you will think of DNA and what one should be allowed to do or not do with that. You think of the police and the bill that covered when, how, and where they were allowed to take DNA samples. Those are both sectoral undertakings; however, we are missing the underpinning for what could be, and how one could look at a piece of legislation that the Minister of Justice should be obliged to consider no matter its origins -- Industry Canada, Environment Canada, Health Canada. I do not care where it is coming from, it should be tested for the potential to invade my personal privacy. That invasion is not legal and should not be justifiable in a democratic society. We live in a democracy, but if we were living in an authoritarian country, then we would not have any rights as individuals -- only the state has rights. In this country, and in all of the western countries, we have rights as individuals in a society.

My concern is that I cannot envision Bill C-6 covering human genome and DNA research. I see that as sectoral, but still based on the solid foundation of our Constitution and a definition of where privacy should be applied and respected. That is what I meant.

Mr. Phillips: Senator Finestone, I never had any doubt where you would be on these issues, none at all. What you have to say on the subject of DNA, and some of these other interesting medical technologies, is perfectly correct. Bill C-6 is only a beginning in that sense. I hope that the majority of the members of the Senate committee exploring this will come to the same view -- that this is an opportunity to enhance the quality of protection in that particular field.

I rather feel that you will experience much heat from people coming from the other direction. I cannot do anything other than endorse and concur with every word that you have just put on the record.

Senator Finestone: Mr. Phillips, you have been involved in the evolution of the theories and the practice of democratic principles, particularly in the field of privacy. I know that you meet with privacy commissioners across Canada as well as internationally. Is there any way in which that group can become far more focused on how to move forward with the protection of individual privacy rights? I hear their voices because I am interested. However, I have found an incredible degree of naiveté, because everyone presumes that we have privacy rights when we do not.

When the debates are read -- whether in The Economist that privacy is dead, or in the New York Times that privacy will become the big subject of the 21st century -- I do not know where the voice of the privacy advocate is. You are well known in Canada, but how well known are your counterparts in the rest of the world -- England, France, Germany, and the Americas?

Where is the issue of privacy on the national agenda? If I want to ensure that my government, whether it is my political party or another, sees this as the burning issue, how do I raise it? How do you raise the question in the international sphere, where perhaps it would create a better resonance?

Mr. Phillips: That is a broad question. We are modest people who have much to be modest about in our office. Public awareness of the existence of the Office of the Privacy Commissioner is quite low, despite all our efforts. There are commissioners in Western Europe, Britain, Canada, Australia, and New Zealand.

Senator, the long-term answer to the question you pose is "emerging." The Economist was wrong in that piece of five or six months ago. Privacy may be under severe assault at the moment because of the impact of technology; however, it is right to believe that public awareness is rising quickly.

There is much evidence that people have serious concerns about the Internet as well as other forms of wireless communication, such as personal communications services, and so on.

I think it is important to keep an eye on the U.S. Congress, because that is the centre of this issue in terms of the legal responses. It is quite interesting. There are currently many bills in front of the Senate and House of Representatives seeking to address the very problems that you raise. While it is true that the administration has not yet put forward a comprehensive proposal to Congress, it is obvious that there is a great deal of constituent and ground-level concern beginning to surface at the political level in the United States. I find that a hopeful sign.

Commissioners meet once a year to discuss issues. There are 20-odd privacy commissioners around the world.

In most cases, particularly in Europe, privacy commissioners are government servants. They are not servants of their legislatures. This one is rather unusual. Consequently, any public statements must be run through the sieve of government policymakers.

Commissioners do have an impact. The European data protection standard, which has now become the law of the European Parliament, is to a significant extent the work of commissioners in Europe.

That has been a driving force behind such initiatives as Bill C-6, for example. We would not have complied with the European transport or data flow standards if we had not put Bill C-6 in place, which would consequently have posed a possible impediment to our transatlantic trade. Privacy commissioners are not without influence.

When it comes to the broader educational issues, I think it would be expecting too much for commissioners to undertake this role. Commissioners will not have much more than the pulpit that is provided when they take the job, and perhaps a few more dollars to do some educational work. However, much more than that is required. When I say that we have much about which to be modest, I use those words advisedly.

Senator Finestone: I hope that the test that I have incorporated into my bill will be effective in at least moving this issue forward.

These hearings are being shown or heard, correct? I wonder if people who are following the questions of "wired" and "wireless", the new technology and the complexity of the world in which we are living, will be able to access these discussions. I am sometimes glad I am not a youngster any more. Is there a Web site that you could recommend to people who are watching and who might want to go further into the subject of privacy rights?

Mr. Phillips: Priv.com.gc.ca is not a bad place to start. That is our Web site. We have posted much information on the subject. If there is a better Canadian one, I do not know where it is.

Senator Finestone: Would you please repeat your code call?

Mr. Phillips: It is Priv.com.gc.ca.

Senator Finestone: Does Priv.com lead us to other privacy links?

Mr. P. Julien Delisle, Executive Director, Office of the Privacy Commissioner: Yes.

Senator Finestone: Could I hook my charter into your privacy Web?

Mr. Delisle: Absolutely.

Senator Finestone: I will forward it to you today.

Mr. Phillips: I must admit to a certain amount of embarrassment if we have not already put it there.

Mr. Delisle: I believe it is already there.

Mr. Phillips: Do not shoot us if we have not.

The Chairman: Thank you for appearing before us. I must admit that we still have a thousand questions and will probably ask our researchers to return to you. Unfortunately, with the lack of time today, we cannot put all the questions on the table.

Honourable senators, our next witness needs some time to set up technically because we will be having a presentation. The RCMP are appearing before us on the issue of security.

Mr. Phillips, how about getting comfortable again.

Senator Finestone: In a democratic society, Mr. Phillips, it is important to recognize that there are rules of law that people sometimes try to break. I am curious as to how you would fit exemptions into an overarching privacy undertaking if it were reasonable and justifiable in a democratic society. Would it cover CSIS, the RCMP, and the police in some way?

Mr. Phillips: The police seem able to extract at will the widest possible exemptions from legislatures. In my opinion, legislatures have been altogether too willing to go along with the police in these matters.

I might as well make this statement, because it is my last chance. I will be retiring later this year, as you know.

I am dismayed at the ease with which law enforcement authorities can come to legislatures and obtain virtually unlimited access to people's information. The money-laundering bill, which has now been through the mill here, is an example.

I have never seen a piece of proposed legislation that confers upon the authorities such enormous, unlimited right to look into people's private lives as the money-laundering bill. I do not think it received the attention it deserved.

On the subject of the Internet, you should ask some relevant questions about the extent of Echelon activities in wireless communications around the world. Canada is a partner in Echelon, as are all the European countries and the United States. Echelon can monitor every single satellite transmission around the world, all the time, everywhere. Echelon can retrieve these transmissions at will without your knowledge or consent.

I ask you whether this is a sensible system, or whether we ought to start thinking hard about how far we will allow law enforcement authorities to put our societies under total, complete surveillance all the time. Is this a rationale approach?

The Chairman: Mr. Phillips, you will be happy to know that the committee as a whole requested certain commitments from the Minister of Finance on the money-laundering bill. The changes that you are suggesting should be made in the early fall.

Mr. Phillips: I am relieved to hear that.

The Chairman: We did an in-depth study of that. I sit on the Banking Committee as well. All of our members were concerned following your presentation, and we thank you for your input again.

Superintendent Jeggo, welcome to our subcommittee.

Mr. David Jeggo, Superintendent, Officer in charge, Economic Crime Branch, Royal Canadian Mounted Police: Honourable senators, before I begin my presentation, I should probably clarify my role. My expertise is not in security per se. As the officer in charge of the economic crime program for the force, my primary responsibility is in dealing with major fraud. We also have some responsibility for computer crimes such as hacking, and those types of operations. More recently, we have been involved in dealing with the onslaught of activity that has taken place on the Internet.

First, Madam Chairman, I thank you for the invitation to appear. Having heard some of the questions at the end of the last presentation, there are probably a couple that I will not be able to answer. However, we will see what happens. I hope I can meet at least some of your expectations today. I believe I have highlighted at least the principal areas of interest that will identify most of the important issues, and will surely help you identify some of the items for questions and discussions later.

I am quite sure that you have already seen a number of projections and statistics that identify how the wired world has been moving along recently. I received these particular numbers from Intel Corporation, which is a major, worldwide company that produces microprocessors and other items for the computer environment. In the Canadian context, one of the objectives of our government is to make this country the most connected in the world.

One of my colleagues from Industry Canada has provided me with some numbers that indicate that Canada has the second highest share of global e-commerce revenues after the United States.

In 1998, the Internet economy in Canada showed revenues of $28 billion, with more than 95,000 jobs. The corporate position of our organization is really quite straightforward. The growth of the Internet cannot be stopped or slowed. Therefore, we will do whatever we can to facilitate that growth, and at the same time, make it a safe place to do business, a safe place for recreation, without fear of having personal information stolen or altered, and without fear of our families becoming prey to nefarious or illegal activities.

I am showing you now some of the additional projections from the global perspective. It is interesting to note that just two years ago, some of our consultants and researchers in Canada were projecting the dollar amounts in 2002 at $236 billion. Recently, I heard projections that suggest that the growth will be in excess of $3 trillion by 2003. Whatever the numbers, they are very large and they bode well for our economy. However, they also bode well for those who choose to exploit the potential.

While the first quote in this slide from the bank robber might seem a little dated, it does support the notion that "threat follows value." In a more modern context, that of organized crime and money laundering, for example, the idea of robbing banks is completely out the window, since it is far easier to buy the bank instead.

Crimes using computer networks can, by their very nature, be committed at a distance. Moreover, computer communications and conduct generally lack physical clues to identity, and the electronic clues to source, if any, are easily faked, or in hacker terms, "spoofed."

Regardless of the order in which these particular items appear on the slide, they are all significant threats to business in the wired world. We have been witness to an increase in this type of activity in recent months. Customers who have little or no confidence in the ability, stability and integrity of the multiple infrastructures that comprise the many facets of connected business, and connected government for that matter, will not participate.

The level of activity on the Internet now includes pretty much all forms of traditional crimes. On the particular list at which you are now looking, I have included those that are probably the most commonly known. There is also activity relating to the smuggling and sale of contraband such as liquor, tobacco, and firearms.

The next slide deals with fraud, and the various forms that it takes are the most popular. It can be said that any form of fraud that has ever been perpetrated on paper can now be carried out electronically. Behind tab 2 of your handout, I have included a more detailed description of each of the headings that appear on the next two slides.

I have also included in your package, under tab 5, a copy of a traditional advance fee scheme that originated several years ago in another country. These letters were mailed in bulk from third-party countries to Canadian citizens. Even the postage stamps were counterfeit for the most part. The second document is pretty much the same confidential investment scheme, only now the distribution medium is the Internet. Currently, we receive probably half a dozen of these a week in our office.

Investment opportunities include the stock-related schemes that, for the most part, target low-value stocks and drive up the price through various means of electronic manipulation. At a certain predetermined point in value, and after the fraud artists have made significant gains, the stock is dumped, leading to a fast decline in the share value and significant losses for investors in some cases.

While we still experience problems with fraudulent telemarketing, particularly in three locations in Canada, some of the schemes listed here have graduated from the telephone to the Internet. I would also like to indicate that descriptions of some of the more popular schemes are included on our Web site. The address is on the last slide of this presentation.

What is shown here as old computer communication, i.e. GIGO, which means garbage in, garbage out, had primary application in the mainframe computer environment. In other words, lack of attention to the quality of the data entered or collected on a computer system usually resulted in less than impressive output. If the same principle were applied today, it would seem that if one finds the information on the Web, it must be true.

In the context of this presentation, I think this next slide is one of the more important ones. When I refer to a "challenge," it is in no way meant to be pejorative.

Some have claimed that privacy, in particular privacy protection, can be an obstacle to law enforcement. Indeed, I have been asked whether law enforcement and privacy advocates are at odds.

I would say that that may have been the case a number of years ago, but a significant maturation has taken place, not to mention the fact that there are laws that must be and are respected.

The discussion, however, should be considered and framed not as one of privacy versus law enforcement. I take no credit for the development of this argument, since it is the collective input of several of my Justice, Industry Canada, and law enforcement colleagues.

Basically, privacy is a social value cherished in democracies. Another key social value is safety of the public. This includes protection of the public from the harmful effects of distribution of child pornography and hate literature, theft and fraud, and environmental hazards. Another social value is the need to ensure public confidence in the integrity and security of the economic and telecommunications systems.

Law enforcement is merely one of the means by which social values are protected. Technology is likewise a possible means of achieving or protecting social values. The debate is therefore about competing social values and how they are to be balanced. It is not a debate between values and means.

As digital technology evolves -- and this includes both storage and communications -- we are already seeing the wireless technology that began with telephony applications. We have also seen computing power in a personal computer reach the one gigahertz speed.

It has been stated in some industry circles that the governments of the world must move their respective processes from the industrial age standard to the information age standard. That is easy to say, but I am not sure how easy it is to achieve. Straight business processing changes are possible, but I wonder whether it is either possible or even desirable to make policy decisions at the speed being suggested. That is a subject for further debate, I am sure.

A few comments about cryptography that show that technology is well understood and that there is firm scientific grounding. There are, I am told, over 400 products available and the science is taught at major universities worldwide. Encryption has presented some interesting challenges in our business.

All I can say at this point about steganography is in terms of the good, the bad and the ugly. The good would involve electronic watermarking, which will likely address illegal copying of copyrighted material and negotiable instruments. Currency is one example. The bad is plausible deniability for illicit information. The ugly? It is a new field and there are many unknowns.

This shows some examples of the changes in storage capacities. I have used the example of an average paperback, which usually costs about $11.95 these days. At 648,000 characters per book, we can put two and a half paperbacks on a straight floppy disk. Standard hard drives in personal computers these days have 17 gigabytes. There is room there for 78,600 paperbacks. That is a lot of information, and that capacity impacts on our work when we must do a digital, forensic analysis of the information on such machines.

I have already alluded to some of the trends that will pose challenges from our investigators' perspective. One of the several existing cybernets claims that there really is one Internet architecture. The fact is that there are many architectures. That is one of the underlying strengths of the Internet. However, with the multitude of architectures comes a multitude of places to store and hide data and evidence of activities on the networks. The physical locations relate to the actual machines, either service or standalone computers, but the geographic locations can be anywhere in the world.

I have presented an overview of various means of addressing some of the issues. There is a high rate of return on investing in public education and awareness. Some ideas are old and basic, but still apply today to e-business and e-commerce.

Ethical use of technology is primarily a matter of educating our youth as early as possible. As you probably know, youth are a priority of our organization. It will be argued that there is a risk in increasing their exposure to the darker side of the technology. That may be true, but I believe the risk is far higher if we do not guide them down the right path as early as possible in their educational cycle.

This is not just a job for educators. There is also parental responsibility. This is another opportunity to spend time with our kids.

The United Kingdom model that I have highlighted here was implemented in 1997 as a result of what could be considered as nothing more than a stand-off between law enforcement and the Internet service providers. Members of the forum include a cross-section of industry, government, law enforcement, and the legal legal profession, both private and public.

The use of subgroups expands the knowledge and expertise base and there has been a resolution of issues such as legislation, educational awareness, liability, best practices, and if I can use an example that we call the "Internet relay chat," a study that examined the habits of pedophiles and stalkers who practice victim-grooming, with the goal of Web-proofing Internet users, particularly youth.

The items in this slide are probably the basic underpinnings of a sound federal policy framework. Certainly included are the legal provisions, either in the Criminal Code or other applicable federal statutes, and the policies that support the Internet economy, such as the cryptography policy, and international co-operation, for example in the G8.

Many of the existing Criminal Code offences can be applied to high-tech crimes or crimes committed against the high-tech infrastructure. Some new offences have been introduced to ensure effective prosecution, such as section 430(1.1), which was amended to include mischief in relation to data, and section 342, which prescribes an offence of unauthorized use of a computer system.

I have included a description of all of the amendments contained in Bill C-17 in your package.

Senator Finestone: Has that bill gone through the House?

Mr. Jeggo: Yes, that bill was passed in 1997.

As I understand the cryptography policy in relation to e-commerce, Canadians are free to develop, import and use whatever cryptography products they wish. The government will not implement mandatory key requirements or licensing regimes. Also, the government encourages industry to establish responsible practices such as key back-up techniques for storage of information.

In relation to public safety, there are amendments being proposed to the Criminal Code and other statutes to criminalize the wrongful disclosure of keys, deter the use of encryption in the commission of a crime or to conceal evidence, and ensure that existing interception, search and seizure, and assistance procedures apply to cryptographic situations and circumstances.

In terms of making progress, this shows one of the most important initiatives and forums to address the issues surrounding high-tech; that is, the G8. In the Moscow communiqué of November 1999, respective ministers of justice and the interior articulated a number of priority items dealing with high tech. Tracking and identification of criminals and industry partnerships were two of the key messages and priorities.

The ministers directed that a selection of concrete options be developed, in consultation with industry, for tracing network communications across national borders in criminal investigations. The ministers also directed the convening of a conference where the G8 and industry could share ideas on Internet crime, with emphasis on issues relating to locating and identifying criminals who exploit the Internet. This conference took place in France last month under the theme of "Safety and Confidence in Cyberspace."

To conclude this part of the presentation and discussion, I hope that I have met at least some of your expectations. I look forward to your questions.

The Chairman: Superintendent Jeggo, not only is your presentation interesting, but so is the document that you presented to us. You include a copy of your presentation, examples of Internet fraud, and the sections of the Criminal Code that are there to protect Canadian citizens, along with the Uniform Law Conference from 1999, and then two examples of what I would call actual "scams" that have been going on. These will be extremely important to us, and I thank you for the additional information.

Senator Finestone: This has been a very interesting presentation. As it comes back to back with some observations from the Privacy Commissioner, I think it puts us in a position to really look at some of the issues.

In a democratic society, it is absolutely important that safety and security are assured by the police or by certain forces. I like your idea of the education of children. I certainly think that your expression of the social values in a democratic Canadian society is important, as is the security of the population.

With respect to the security of the population, you have used the words "forensic analysis." Could you explain to us exactly what that means?

Mr. Jeggo: It is a technical term that describes the analysis of digital evidence. For example, after we go out and seize electronic equipment, computers and the like, analyzing the material on the hard drive is called forensic analysis. It has the same connotation as in a pathological sense, only dealing directly with digital evidence.

Senator Finestone: As a TV viewer of many crime and punishment programs, I always thought forensic evidence was when the doctor does an examination and solves the case by determining if you were really the person who did the crime, whether through DNA, or something you ate at time of death. That was forensic. However, it also applies to hardware as well as to soft body tissue.

Mr. Jeggo: It is the analysis of the evidence contained on a hard drive in a computer system. Forensics has become a recognized science. It obviously really started in the United States, because that is where the problems started to manifest themselves, and it has become a recognized discipline within the laboratory functions in the U.S. That is where the term evolved. It describes the set of principles, the very high standards, and the meticulous processes required in order to take apart and establish whatever evidence you are looking for on these pieces of equipment.

Senator Finestone: Therefore you would have experts in cryptology and all its different forms?

Mr. Jeggo: As many as possible, yes.

Senator Finestone: They are evolving so quickly. How do you keep up?

Mr. Jeggo: We are running to catch up.

Senator Finestone: I read in the paper, either yesterday or today, that Canada is host to the international elements of crime. I do not know if they are the people who stop crime or who are involved in crime. You are training, I guess, the secret service, the ones who do the spying for us. That is what it called them. They are the foreign spy network. Could you tell us what is going on here? Are they involved in any aspect of cyberspace and cryptography and forensic research into crimes of all kinds that are of an international nature? Are they studying that with you?

Mr. Jeggo: I must apologize for not being familiar with what you are talking about.

Senator Finestone: It does not matter. It was an article in the paper. If you are in the economic crime branch, I would presume that the seek and search for the criminal offender is not just Canadian, but is international in this new world of cyberspace.

Mr. Jeggo: Yes.

Senator Finestone: How do you work internationally? Are you using the airwaves, wireless and wired? How do you communicate, and what do you look for internationally?

Mr. Jeggo: When cases are referred to us from other countries, we have to follow the mutual legal assistance treaty, provided such a treaty exists between the two countries. The same goes the other way. If we have activity that takes us to other countries, we must use that process to gather the evidence.

Senator Finestone: You talked about protection of youth, child pornography, and things of that nature. What kind of laws do we have to prevent the Internet use of child pornography or hate-mongering?

Mr. Jeggo: There are offences in the Criminal Code that deal with distribution of child pornography and also hate crimes.

Senator Finestone: Doe they apply to international space, both wireless technology and wired?

Mr. Jeggo: The Criminal Code applies to Canada, and we would hope that other countries recognize the gravity of those particular types of offences and have the same types of laws.

Senator Finestone: Can you find them?

Mr. Jeggo: The perpetrators?

Senator Finestone: Yes.

Mr. Jeggo: Yes, it is possible. It takes time. For electronic activity that occurs on the Internet, the information, depending on where it is housed, can be time sensitive. That simply means that the service provider may have a limitation on how long they keep the information. As I referenced in my slides, the quick freeze, slow thaw type of thing is very important. The faster we can get to the location where the data is stored and at least ask the service provider to preserve it, the better. The paperwork then comes, if it is in another country, through the mutual legal assistance treaty process. The law enforcement agency in the country where we are seeking information can have time to put together the search warrant based on our information. It is doable, but the problem is that it happens so fast. It is a matter of having to react quickly as well.

Senator Finestone: Do have you the staff to do that? To be more focused, we are extremely diligent when it comes to business and business fraud and illegal activity on the commercial side. How diligent are we on the social values side, whether it is pornography, Islamophobia, Negrophobia or homophobia? How diligent is our team, and if it is not, is it due to numbers and budgets?

Mr. Jeggo: To answer the diligence aspect, when those types of crimes are reported, we take them on. To address the resourcing issue, I am sure you are aware that the organization has gone through some very serious program cuts since 1994, my program in particular. In February this year, the government did release some money to augment our budget, and that will go some distance in helping us recover and react to the new type of criminality that is taking place because of the technology. However, we still have a lot to do, such as training our members and bringing investigators up to a certain skill level because the evolution of the technology has happened so quickly. We have been caught. We are really no different from most other countries that have been caught behind the same "wave," if you like.

Senator Finestone: Could you tell me about the Echelon system that was referred to earlier? We did a study on privacy, but where do you draw the line? Representatives from the RCMP, CSIS, and a few others gave presentations to the committee, and in demonstrating that technology to us, we spoke about the muff that reporters use. It looks very innocent. All the reporters come with their cameras and they have big muffs that hang over your head to pick up sound. It can pick up sound from a far distance. They also have cameras that can survey through brick walls with infrared light and figure out how many people are sitting around a table. It was amazing what we learned about surveillance and the invasion of our privacy based on this kind of equipment.

With respect to surveillance, what are you monitoring without our knowledge and consent and what is the Echelon system?

Mr. Jeggo: I do not have any information on Echelon. I cannot comment on that at all.

Senator Finestone: Would you be good enough to send back to the committee clerk an outline of what Echelon is, please?

Mr. Jeggo: Yes, I can find out what it is and what it does, but I cannot comment on it because I do not know anything about it.

Senator Finestone: That is fine. You answered the money laundering bill issue for our edification.

Senator DeWare: I wish to ask the superintendent about Bill C-17. This is an enforceable law, there is no doubt about that. You have stated that in sections 342.(1), 342.(2), and 430 of the Criminal Code, everyone who commits mischief, who wilfully obstructs, interrupts or interferes with lawful use or enjoyment of property or data, can be convicted if found guilty. The sentencing is severe enough. It is for either 10 years or 5 years. Since this came into force in 1997, how many convictions on average have been made under this section?

Mr. Jeggo: I cannot be exact, but there have been a number of convictions. In fact, not many months ago, an individual from Northern Ontario was convicted for the second time for activities related to destruction and hacking into systems in the United States, primarily U.S. defence, military research, that type of thing. This was the second time around and he was incarcerated for a short period of time. Recently, the conviction of a young offender in the Atlantic region led to the use of restorative justice in the hope of turning this particular person into a "white hat" hacker as opposed to a "black hat" hacker. In other words, we are hoping to put his talents to good use. Restorative justice will play a key role in some of these cases. Many of these individuals are young and must be dealt with differently.

Senator DeWare: Do you think it is a challenge for them to see if they can beat the system?

Mr. Jeggo: Part of it is the challenge; part is ego. Hacking is nothing new. It has been around for as long as computers. Recently, however, it has become easier to do because of the tools that are available, and because most of the modern systems are Windows based. It is quite possible for these script kiddies or young people to download the programs off the Internet and launch their attacks, or do whatever they want to do. It is much easier than it was even five years ago.

Senator DeWare: Regarding the international case this spring that affected data in the government and all across the world, how would they go about finding out who that person was? They did identify who they thought it was, but our government was quite seriously affected by someone internationally.

Mr. Jeggo: Are you talking about the virus?

Senator DeWare: Yes.

Mr. Jeggo: I am not sure how they actually determined that the individual came from the Pacific Rim. I have not had an opportunity to talk to anyone south of the border who has any knowledge of that. Many times, however, it is through good police work.

Senator DeWare: Would it come under Bill C-17 if someone were to introduce a virus into our system?

Mr. Jeggo: Yes, because you are interfering with a computer system and causing damage.

Senator DeWare: Serious and very expensive damage.

Mr. Jeggo: They are still trying to put together the numbers on the economic impact. For example, in Ottawa alone, six or seven departments were closed for at least one day, sometimes two. Some of us were still up and running, but viruses have a potential to do a lot of damage.

Senator DeWare: Bill C-17 is effective then?

Mr. Jeggo: Yes, it is.

Senator DeWare: Have you some amendment to it?

Mr. Jeggo: We have suggested some to the Uniform Law Conference. I am not exactly sure where they are. I know they were discussed and accepted, but they still have to go through the next consultation phase.

Senator DeWare: Thank you, sir.

The Chairman: Superintendent Jeggo, you referred at the beginning of your presentation to the fact that the government has publicly given an objective and a challenge to all the departments, all the ministers, and all the provinces, that there be a strong common will to make Canada one of the most connected countries in the world. Our previous study found that already, the different programs regarding connectivity with schools and public libraries from coast to coast to coast; our investments in innovation and in excellence have brought us to the forefront in the world.

One of the key issues we are discussing here is the trust of Canadians, so that they feel free to use this technology, be it in terms of clients or providers from B to B, from B to G, from G to G -- that is, governments to governments -- and from G to C. Bill C-6 is the first step in providing the necessary privacy.

We are talking today about security. You said that one of the key responsibilities is that of education. How do you balance that? I have two questions regarding education. First, what role is the RCMP playing in public education? Second, how do you balance the fact that there must be a strong public education program regarding the use of the Internet, but on the other hand, you want to encourage people to make good use of this access to information, people, business opportunities, personal opportunities. Could you answer those questions?

Mr. Jeggo: Can I answer the second one first?

The Chairman: Absolutely.

Mr. Jeggo: From the aspect of education and awareness, people are exposed to television and media that certainly describe in a fair amount of detail the type of technology that is evolving. However, what must be addressed -- and probably the classroom is the best place to start -- are the implications of using this technology. I think that has probably started to a large extent. In terms of a resource, the ability to find information anywhere in the world is the upside. However, it is paramount that we somehow find a way to explain where the dark sides are located.

There is software that controls children's access, where they can and cannot go. However, that has a tendency to prevent access to areas where there is legitimate research; in other words, because of certain trigger words they cannot get there. The parental role is essential in explaining that there are some dark places.

However, even if the parents try to prevent access, children will go there anyway. I have children of my own. Our family got the Internet in 1994. The children will go wherever they want to go and they will see what they will see. It is important that the parents are there, first and foremost, to tell them, "Yes, these things exist, but you should not go there and here are the reasons."

Senator DeWare: Does the school system have any responsibility in this area? Their responsibility should be emphasized.

Mr. Jeggo: The educators have a responsibility, but I do not think that the entire burden should be placed on them. There is a role at home as well.

Senator DeWare: I meant responsibility for the students, not the educators.

Mr. Jeggo: Absolutely, yes. Bright young people have the capacity to grasp this technology at an unbelievable rate. It is important that they be shown the many positive sides of the Internet, how to use it to do business and to be part of our lifestyle, but one must be aware of the pitfalls as well.

The Chairman: What would your response be to the first part of the question, the responsibility of the RCMP in terms of public education and awareness?

Mr. Jeggo: We play a role every day in the community. As part of our community policing principles, which have been around for over 10 years, it has become a way of doing business. Certainly, in the last year, one of the priorities of the organization is youth. My particular responsibilities are primarily in what are called the federal programs. On the federal side, we have a responsibility to make youth our priority in the things for which we are responsible. My program relates primarily to fraud, with aspects on the computer side as well. My colleagues in the federal programs, who are responsible for drug enforcement and customs and excise, have as much responsibility to address and make youth our priority as our front-line police officers in the detachments.

We do as many presentations as we can. Those projects are contingent, first, on people having the time and, second, the skill sets. The type of people we are bringing into the organization as new members are certainly older, on average, than they were 15 or 20 years ago. They are bringing many of those skill sets with them. They have work-life experience and they have had exposure to the technologies. We must share their knowledge, not only in terms of their everyday investigations, et cetera, but also in terms of the community.

The Chairman: We all remember how different police forces have played major roles in ensuring that Canadians were aware of different issues at the right time. That is why this country has always been regarded as extremely safe.

Mr. Bruce Phillips, the Privacy Commissioner of Canada, was a witness prior to you. I believe you were here when he referred to the enormous powers of the police vis-à-vis intruding upon individual privacy. Would you care to respond to Mr. Phillips' comments?

Mr. Jeggo: I believe he was speaking in relation to Bill C-6, was he not?

The Chairman: No, I believe he was speaking in general, to other legislation, for example, when Senator Finestone raised the question of exceptions regarding different police forces.

Mr. Jeggo: It depends on what exactly he meant by "intrusion." If we are speaking about electronic surveillance, there are provisions of the Criminal Code with which every law enforcement person who wishes to carry out an electronic surveillance must comply. That is a judicial process to which the standards are extremely high and must be met. I do not think we do any activities that are outside the legal framework.

The Chairman: Do you believe that those powers are necessary, therefore, to be able to do the investigative work, even in your department?

Mr. Jeggo: Law enforcement is the tool. I take no credit for developing that argument; it emanated from colleagues at Justice and other departments. There must be a balance between social values and where we fit. When we fall down or breach the privilege or statute, there is retribution in the courts.

The Chairman: Are there venues where the RCMP Commissioner, the Privacy Commissioner, the Information Commissioner and other senior officials can come together to discuss management?

Mr. Jeggo: I am not aware of any specific occasions where that happens on a regular basis. I would suggest that it is probably a good time to do that, because of the sensitivities, and now the interest in terms of the electronic aspects that are certainly at the forefront. There is probably a need to have much more public discussion on this subject.

The Chairman: The new media is forcing us to speak to each other in order to maintain that balance as a country; is that correct?

Mr. Jeggo: Yes, it is.

Senator Finestone: Mr. Jeggo, I would turn your attention to tab 4. Do I understand that, recognizing that criminals use a variety of different computer-oriented mechanisms to conceal data and information, we have no right under the law to seize their equipment? You recommend that the fraudulent concealment section of the Criminal Code should be amended to include a specific subsection relating to data concealment.

You recommend changes to sections 341, 603, 487.(2.1) and (2.2) of the Criminal Code. You also recommend an amendment to section 372.(1), relating to the question of false information and messaging, to include computer and electronic communications.

You say that there is an obligation placed on businesses to require a person in control of a computer system and/or data to maintain a list of passwords, encryption keys and other means to access data in a system.

You and I know that any time confidential information is collected, it is always leaked and, certainly, accessible to the police. First, how do you collect all of your information now, if you cannot seize those computers by right of law? I presume that, in a democratic society, we are governed by the rule of law. You ask for these amendments, but how do you proceed without the right of access -- the right to pick up and select the materials that you need for your forensic analysis? In respect of section 341 of the Criminal Code, the recommendation states:

The Fraudulent Concealment Section of the Criminal Code should be amended to include a specific sub-section relating to "Data Concealment." The amendment should be worded to make it a criminal offence to use encryption, passwords or other means to conceal data that is evidence of a criminal offence.

At the very beginning of our conversation, you and I talked about the definition of forensic, and you explained that it could be both soft and hard-copy information. Now, sensibly, you ask for this kind of an amendment. We need to determine how all of this forensic knowledge will be used to locate the venue of the crime or the potential venue of the crime, or criminal, if there is not the right to seize the equipment or the right of access to the password in order to bypass the encrypted message to access the information.

Mr. Jeggo: May I show you an example of an encrypted file?

Senator Finestone: Yes.

Mr. Jeggo: This is an encrypted file, although I do not recall the type of encryption used. The significance of this particular slide is that it was one of several computer files that were found during a drug investigation that involved the search of a lab in Vancouver a number of years ago. When this particular file was decrypted, it led the investigators to a safety deposit box that had about $1.5 million in it.

The first challenge that we face, in terms of encryption, is that the "bad guy" will not give us the keys, so we have to find ways to break that ourselves. A number of years ago, when the first series of encryption software came out for use on the Internet, they were not that easy to break, but it was possible. However, the software has become much more complicated, therefore the ability to decrypt, as part of the forensic examination or the investigation itself, becomes increasingly difficult.

The purpose of this particular amendment was to introduce the notion of making it an offence to conceal information through the use of encryption, particularly where that information was part of a criminal offence or evidence of a criminal activity.

Senator Finestone: I think it is important and germane to have such access. Do you, at this time, have the legal right to decipher and decrypt under the Criminal Code, or do you need -- and I hope you do -- this amendment to the Fraudulent Concealment Section of the Criminal Code? Frankly, sir, I have three private member's bills entered now, and I don't want a fourth.

Perhaps our committee could put forward this amendment, to ensure that such an amendment is brought forward, so that criminals, who are committing fraud against Canadians, do not escape scrutiny, because we do not have the right under the law. Everything should be right under the law, right?

Mr. Jeggo: Yes. That previous example showed evidence of a criminal activity, because it led to a safety deposit box containing large sums of money, which, in turn, was evidence of money laundering that was then linked back to the drug operation activity. That is what $1.4 million looks like in a briefcase.

Senator Finestone: Where is that briefcase?

Mr. Jeggo: Not everyone gets a chance to see that much cash in one spot.

Senator Finestone: That, however, does not answer my question. Do we need an amendment? In this very interesting document, at tab 4, you have given us four areas where you would like to see amendments to the Criminal Code so that your activities would be legal, or is that passé?

Mr. Jeggo: The method used to obtain this information and access the safety deposit box was lawful. There were charges laid, of course, that surrounded the money laundering issue.

It is not an offence to conceal evidence of a criminal offence through the use of encryption. That is the purpose of that one amendment -- if you use encryption and engage in criminal activity, then the use of that encryption, in terms of hiding information or data that is evidence of a criminal offence, will, in itself, be a crime as well.

The Chairman: In other words, you want to ensure that the use of encryption be for legal uses only.

Mr. Jeggo: Yes.

The Chairman: Or, it can be for romantic uses.

Mr. Jeggo: Yes. There are millions of legitimate uses for encryption, but there is also the challenge of some of the challenges we have on our side.

The Chairman: Thank you very much, Mr. Jeggo. We appreciated your presentation and information, as well as your answers to our questions.

Mr. Jeggo: If I can further help the committee, I would be more than happy to return.

The committee adjourned.