Proceedings of the Standing Senate Committee on
Transport and Communications
Issue 10 - Evidence
OTTAWA, Thursday, May 6, 2004
The Standing Senate Committee on Transport and Communications met this day at 10:55 a.m. to examine Bill S-2, an Act to prevent unsolicited messages on the Internet.
Senator Joan Fraser (Chairman) in the Chair.
[Translation]
The Chairman: I see we have a quorum. Welcome to all of you. We are resuming consideration of Bill S-2, the anti- spam bill.
[English]
Today we are fortunate to welcome representatives of the Canadian Association of Internet Providers, CAIP. They are Mr. Jay Thomson, former president of the association; and Suzanne Morin, who is a member of the association's spam committee.
I think you understand our normal procedure. We ask you to make an opening statement of maybe 15 minutes and then we go to a question period. If that is agreeable, I will give you the floor.
Mr. Jay Thomson, Former President, Canadian Association of Internet Providers: With me today is a member of CAIP's spam committee, Suzanne Morin. She is Assistant General Counsel, Regulatory Law, with Bell Canada. Ms. Morin has been very active in the policy area regarding spam. She has organized expert-level spam workshops through the Internet Law and Policy Forum, ILPF, as well as through the Global Business Dialogue On Electronic Commerce, GBDe. She was the key drafter for BCE of the GBDe's 2003 multilateral framework for addressing spam. As for me, although I am currently employed as Assistant Vice President, Broadband Policy, with TELUS Communications Inc., I was until February this year, president of CAIP.
CAIP represents all sectors of the Canadian Internet service provider industry. Our membership is made up of a broad and diverse group of Canadian Internet service providers, ISPs, including large, medium and small independent access providers, those who connect you to the Internet; incumbent and competitive telephone companies; backbone providers; wireless providers; and those companies who host Web sites, Web hosters. We appreciate the invitation to appear today to discuss spam and what Canada should be doing to address the problem. I read with great interest the transcript of Senator Oliver's appearance before the committee last week. I must commend him on the breadth and detail of his testimony, and members of this committee for their knowledge of the issue, which was clearly demonstrated in the questions posed to their colleague.
Senator Oliver has obviously done his homework. Based on his extensive research, he was able to offer you a host of statistics from numerous sources regarding the extent of the problem posed by spam and the impact it is having on Internet users in Canada and the world and on ISPs. Frankly, there is very little I can add to these data.
We all now know that spam is a problem, and a growing one. The question to be answered then is what do we do about it? To this end, it is important for the committee members to fully understand and appreciate that there is only one villain when it comes to spam, and that is the spammer. Everyone else in the Internet communications chain, in particular ISPs and end-users, are victims. Managing spam is extremely expensive for ISPs. Beyond the network bandwidth and storage costs it triggers, significant resources are applied to software and best-practice-development matters and customer-care activities. Many smaller CAIP members are seeing profits diminish to near zero as they attempt to deal with spam. ISPs have a vested interest in reducing spam and continue to invest in ways to address the problem. For this reason, we thank Senator Oliver for his efforts to increase public and political awareness of spam issues, and of the battle against spam the ISP industry has been fighting for years now. This battle requires engagement by many, and the attention of key policy-makers is critical. This committee has been asked to study Bill S-2, and presumably to come to some understanding of whether the proposed legislation would be an effective mechanism to achieve the laudable goal of reducing spam.
With all due respect, it is CAIP's position that a new, targeted anti-spam law is not the answer and could, we fear, detract from existing technological, commercial and legal mechanisms that are or could be put to use in the battle against spam.
We at CAIP favour a multi-faceted approach to addressing spam, which includes technology, industry self- regulation, consumer education, international cooperation and, on the legal front, the enforcement of existing domestic legislation. On this last point, several Internet experts, including Mr. Michael Geist of the University of Ottawa, whom you spoke of last week, have noted that the elements of most anti-spam legislation found in other jurisdictions can already be found in existing Canadian laws.
Specifically, existing domestic laws dealing with privacy, criminal matters and competition are capable of getting at the worst aspects of spam, those aspects that go beyond annoyance and drains on productivity.
These laws are capable of addressing the improper acquisition and use of personal e-mail addresses, criminally fraudulent conduct, dissemination of child pornography and deceptive marketing practices. Canada is not missing anti-spam laws. We are missing the targeted and aggressive enforcement of the laws we have.
Senators are aware that Industry Canada intends to soon issue a spam action plan. We understand that this action plan will also promote a multi-faceted approach to dealing with the spam problem, including the enforcement of existing laws. This is not idle talk. Both the public and private sectors are moving forward to formally explore how we can work together to enforce existing laws to fight spam.
A few years ago, the Government of Canada published its Cyberwise strategy for dealing with illegal and offensive content on the Internet. This strategy recognized that promoting the safe, wise and responsible use of the Internet is the responsibility of all interested and affected parties, including the Internet industries, other businesses, government and consumers. The same holds true for spam. Fighting it effectively will require multiple parties working together to deploy a combination of both existing and new strategies.
We are concerned that targeted anti-spam legislation represents a ``silver bullet'' approach that risks raising unrealistic consumer expectations. Spam is not something we can magically legislate away; and we have proof of this. As the committee knows, a number of jurisdictions have passed their own, new anti-spam laws and yet the volume of spam continues to increase. It is clear that simply making spam illegal will not make it disappear.
We are concerned that targeted anti-spam legislation in Canada could impede rather than assist in the battle against spam, should it serve to prejudge or direct efforts away from assessment of and experimentation with broadly based anti-spam tactics. Perhaps more importantly, today's perceived solutions will likely be ineffective in addressing tomorrow's problems. We all know how fast technology is changing. The nature of spam and the tactics spammers employ are changing just as quickly. By the time specific, targeted anti-spam legislation was passed, it would likely be outdated. This is another reason why we favour the application and enforcement of more generally applicable laws as one of the items on the anti-spam menu that Canada should adopt.
In respect of other items on this menu, there are myriad technical and commercial anti-spam activities currently underway. For example, network- or server-based filtering technology and techniques continue to improve. At the same time, consumer awareness and understanding of user-controlled filters are also improving. These efforts are resulting in extremely large proportions of spam being blocked before they ever hit a user's inbox. Numerous industry and international working groups exist to share strategies and information — for example, who the spammers are — and work toward common standards. Many CAIP members are active in these groups.
Industry and international activities, such as the ``secure your server'' initiative, are geared toward service providers and others whose systems might be susceptible to remote hijacking for purposes of sending spam. Similarly, increased user education and adoption of firewalls and anti-virus programs are geared toward protecting end-user computers from being hijacked for similar purposes. Almost all ISPs actively promote firewall and anti-virus services; some even include the services at no charge to their high-speed Internet customers.
Many ISPs, for economic reasons and to ensure continued receipt of their transmissions by other ISPs in the communication chain, actively explore opportunities to block spam before it leaves their network. That is to say, they are blocking the spammer at the source.
In closing, allow me to assure the committee that ISPs, on behalf of their customers and out of clear self-interest, are and will remain the most aggressive of spam fighters. Our contribution to the battle need not be compelled by targeted legislation, regulation or licensing. Canada's laws of general application, most notably those dealing with privacy and criminal and deceptive practices, are capable, with enhanced enforcement, of addressing the worst aspects of spam. Canada's domestic anti-spam efforts should be focused on enforcing existing laws and not on making new laws. The fruits of Senator Oliver's efforts will no doubt be at the heart of Industry Canada's anticipated anti-spam program. We urge you to wait for that process to unfold before pursuing new legislation in this area.
We would be pleased to respond to your questions.
Senator Corbin: Mr. Thomson, do you remain in contact on an ongoing basis with Industry Canada parties interested in this issue?
Mr. Thomson: Yes, we certainly do that. We have been active at CAIP in consultations with Industry Canada. Industry Canada issued a discussion paper a little over one year ago. We were active participants in responding to that paper. We have been in contact with their officials since the process was undertaken. We have talked to them about their spam action plan. We look forward to continuing to work with them when that action plan is rolled out.
Senator Corbin: Is there a document available on the outcome of those discussions between Industry Canada and your industry?
Mr. Thomson: There is no —
Senator Corbin: In other words, has there been progress in terms of the industry's and government's efforts to deal with this issue?
Mr. Thomson: I think it is safe to say that the spam action plan will be the result of the discussions that have taken place to date. It will outline the various positions presented and will propose a plan to deal with spam based on the consultations that government had with numerous parties, including CAIP.
Senator Corbin: I have the impression from you, and from Senator Oliver's comments last week on the apparent reticence of Industry Canada, that there is a considered effort to kill Senator Oliver's attempt to deal with this. Is that a correct assessment? You used quite strong words this morning in that respect. You quoted Dr. Michael Geist, for example, who said that existing domestic legislation covers the waterfront and so we do not need anything else.
Mr. Thomson: I think it is safe to say, as I indicated in my remarks, that we do not support new legislation in this area and that we feel quite strongly that the existing laws should be enforced aggressively. We could then assess how well that works before we introduce new legislation, whether it is Senator Oliver's bill or any other bill.
Senator Corbin: However, the Internet users among the consumer public are becoming rather impatient with the perceived inability of industry to put a stop to spam. You invoked complicated technical matters, agreements with providers in other arenas and so on, but how much longer will the user, who pays for this service and expects a clean signal, have to wait before there is a resolution of the problem? Is that not what Senator Oliver is attempting to do with this bill — push things forward?
Ms. Suzanne Morin, Member of the Spam Committee, Canadian Association of Internet Providers: I absolutely agree that Senator Oliver's bill has pushed things forward and helped encourage Industry Canada to move forward with their action plan.
We have also been waiting for Industry Canada's action plan. It has taken a little time to come out, maybe longer than we would have liked. I do not think it is a secret that industry players have been encouraging Industry Canada to issue their action plan, which we hope will come out soon. The multi-faceted approach that we think will be in that action plan is something that we have been advocating for a couple of years now, both domestically and internationally.
A few years ago, some ISPs thought we needed new legislation to beat this problem. It is killing us — it is affecting our business and our customers. We went through an exercise to look at the different pieces of legislation that countries have introduced and saw that the kinds of things they were making illegal were actually covered in our legislation as well. I think Canada was also under some pressure in the last year to be seen to be doing something on the legislative front.
Obviously things do not happen that quickly, which is why we have taken a very strong position that we would like to begin, and continue to push, the dialogue on this issue, speak with various law enforcement agencies that have a role to play, and cooperate with them to the extent that ISPs can. At the same time, we want to continue our other efforts on the technology side, including cooperating with other ISPs to keep spam from leaving our networks, but also from entering our networks. Because it is such an international problem, it has taken an international pace to get some of these things in place.
Senator Corbin: I know that we will hear from Industry Canada eventually, but are you suggesting that they could speed things up? Are they dragging their feet? Let us be open about it.
Ms. Morin: It would be nice to have it out today, yes.
The Chairman: Are you suggesting that for some reason, they have been dragging their feet, to use Senator Corbin's phrase, or is this the normal slow working of bureaucracy?
Ms. Morin: I would put it more in the latter category, because our discussions with them have been ongoing. I would not want to cast any aspersions on what Industry Canada may or may not be doing. However, we would definitely like to have it out sooner rather than later.
Mr. Thomson: It may be a matter of bureaucracy in the face of a pending election call.
Senator Corbin: I have one last comment. What is it about Senator Oliver's bill specifically that you resent?
Mr. Thomson: The starting point is that we think any new legislation is unnecessary at this time. With respect to Senator Oliver's bill, we have a number of concerns about how it is drafted. For example, the preamble outlines the premise on which the bill is based — that is, that the regulation and licensing of Internet service providers will actually help to solve the problem of spam. We think that is the wrong approach and the wrong beginning.
There are concerns about the concept of a no-spam list. We do not think it would be effective. It would impact on legitimate e-mail marketers, but the hard-core spammers will ignore it, as they have other laws in other jurisdictions. There is a concern that the list may ultimately become available to spammers through security leaks, thus giving them a great list to use.
Senator Corbin: What is the line between legitimate and illegitimate e-mail sources?
Ms. Morin: It depends on the context. Some of the spammers think their spam is legitimate. If you look at the different characteristics, what people usually think of when they refer to spam is what we would call the nasty and annoying stuff — the fraudulent matter, the get-rich-quick schemes, the pornography, body part enlargements, all of those types of things.
Senator Corbin: You are getting into the field of morality.
Ms. Morin: It is things people have not asked for but are receiving. There is another layer of legitimate marketing, in the sense that what they are trying to sell you are legitimate products and services, but how did they obtain your e-mail address? That gets more into privacy considerations.
You did speak last week about opt-in versus opt-out approaches — and why the U.S. chose the approach of opting out versus the European approach of opting in. In Canada, we have an opt-in approach when it comes to sending unsolicited commercial e-mail. If there is no pre-existing customer relationship, then the expectation is that the marketing association will wait until they have consent from the individual — until that individual opts in to receiving e-mail from them. Therefore, in essence, we have an opt-in approach.
Furthermore, many marketers in Canada will only send electronically — telemarketing is different because e-mail has a different sensitivity to it — commercial e-mail to you if you have opted into their distribution list. There again, the medium has required more active participation on the part of the person receiving the e-mail.
In the U.S., they have an opt-out approach. There is a small component of that in Senator Oliver's bill as well, in that the approach they have taken in the U.S. is to tell you what you need to do in order to make your spam legitimate. It may still be unwanted. It actually allows every company in the U.S. to send you one e-mail until you tell them to stop. I do not know the numbers; but if every company in the U.S. sent every individual in the U.S. an e-mail in accordance with the CAN-SPAM Act — which says, ``I will not hide who I am, I will allow you to opt out,'' has the appropriate headers, all of those things — you would get hundreds of e-mails a day anyway, and each individual would have to tell each one of those companies to stop. That is not what we think the approach should be.
That is an exaggeration, because not every company in the U.S. would do that. However, if taken to the extreme, that is what would happen. There is a little of that in Senator Oliver's bill as well.
One of the bill's other aspects is the notion of putting in a header that this is an advertisement. If I am sending an e- mail on behalf of a company to my customers, I would like to have flexibility in how I will market. Some days, I might use something in the header to let them to know what this is about — it might be a contest or something else — but this, again, is for unsolicited commercial e-mail. Putting in ``ADV'' as short for advertisement, for example, will not stop the spammers, but it will force legitimate commercial e-mailers to add additional words in their marketing campaigns to their customers. Again, it adds an onus on legitimate marketers and does not actually help stop the spam.
Senator Corbin: Thank you very much.
Senator Graham: I have a supplementary housekeeping-type question to put things in focus so we have an idea of what organizations you represent. I know that, in broad terms, CAIP represents TELUS and Bell. Could you give me an idea of the number of companies, and then send us a list of them, so we have it for our records? We represent five different provinces as senators around the table, and I am sure we would all be interested to know if we have any members in our own backyards, apart from the national perspective that we get from both TELUS and Bell.
Mr. Thomson: CAIP has approximately 100 members, including Bell, TELUS, AOL Canada, Sprint, Allstream and MCI Canada as the largest members, and IBM, Yahoo Canada and some 90-odd smaller ISPs spread across the country. CAIP members provide approximately 80 per cent of the Internet connections in Canada.
The Chairman: Please send us a list of your members.
Senator Phalen: I would like to ask a supplementary to Senator Corbin's questions and make sure that I understand this. If there were what I would call legitimate spam from a community organization or church that included the words ``sex,'' ``drugs'' or ``pornography,'' is that filtered out?
Ms. Morin: Today, service providers use many different spam filters. ISPs use their own filters. They will create their own and try to weed out words such as those you cited.
Senator Phalen: I wonder where you can draw the line?
Ms. Morin: Actually, there is nowhere that you can draw the line. The whole intent is to try to allow mail that is supposed to get through to get through and stop unwanted mail from getting through. I cannot guarantee that we will be 100-per-cent successful. I can also tell you that sometimes, depending on the filtering technology and software being used, unfortunately, e-mail that is intended to get through also gets blocked, because humans created the software but the software is making the decisions. We call these false positives. It could be, for example, an e-mail about breast cancer. Depending on the filtering technology you use, if you filtered all the e-mails with the word ``breast'' included, it would filter that out. I think that the software is becoming much more intelligent. Spammers will introduce ways to try to fool the filters. They will write ``breast'' with ``b'' and an asterisk, et cetera, to try to make it look like it is not the word that is being filtered out. Unfortunately, the technology today cannot solve 100 per cent of the problem. Filters are being improved and other techniques are being developed.
Mr. Thomson: Certain spam filters can be combined with the white-list approach, which allows the end-users to identify the sources from which they are willing to accept messages. If users put their church on the white list, then those messages will come through, notwithstanding that they might include some words that would otherwise cause them to be filtered out.
Senator Phalen: As senators, we would like to get rid of spam in one sense, but the other side of the coin is that we have to listen to the message that are coming. Where do you draw the line? Can you draw the line? I guess that is my line of thinking.
We hear about the high cost of spam in terms of lost productivity and increasing the bandwidth. Who pays for blocking spam? Is it the Internet user? If so, what is the cost?
Mr. Thomson: Ultimately, as in any other business, costs incurred by an Internet service provider are passed on to its customers in one way or another. That being said, Canada is known for having some of the lowest prices for Internet services in the world, and it is a very competitive marketplace. There is a strong expectation amongst Canadians that they will get their Internet service for a certain price. For a dial-up connection it has to be $20 or less. That is what they have become used to, and that is what they expect. In many cases, because it is a competitive environment, the ISP will absorb the costs and not pass them on directly to its customers. The ISP will instead have a lower margin, but that way it keeps the customers and keeps the business in a competitive marketplace.
Senator Merchant: You said that the U.S. is using the opt-out approach. Is that because the U.S. is the ultimate capitalist society? Do you have a preference for one system or the other?
Ms. Morin: We do have a preference in Canada. We have privacy legislation — it was referred to last week — the Personal Information Protection and Electronic Documents Act. It requires consent for the use of an individual's personal information. An e-mail address falls into that category in most instances. The form of consent you use will depend on the sensitivity of the information and the context. It is fair to say that people would agree that the use of their e-mail address is fairly sensitive because of the problem of spam. Ten years ago, when e-mail first came out, it might not have been, because if I was only getting five e-mails, I might not mind getting just one more. Expectations are very different today, not only for the use of e-mail but also instant messaging or receiving messages on your cell phone. People want to give permission before they start to get those, hence the opt-in approach. Essentially, that is what those who are serious about complying with these requests use here in Canada. In the U.S., the opt-out approach has been their way for many years, not just as it relates to spam and e-mail, but to privacy generally. Their preference for the opt-out approach goes back to privacy principles generally, where they prefer to assume they have your consent until you tell them otherwise, and so they have extended that same approach to the e-mail context.
They also generate over 50 per cent of the spam in the world. There is money to be made there. Obviously these people are paying someone. There are more targets and also more people to e-mail. It is a different approach. Their federal law was passed to take precedence over stricter state laws. In California, they had a bill that came into force on January 1, but the federal law has usurped that provision, which was an opt-in approach to e-mail. We have privacy legislation that, in essence, has brought us to an opt-in approach when it comes to the use of e-mails. I think we prefer that approach.
Senator Merchant: Who owns the right to access the electronic media market? Can you buy the airwaves? Do you know what I am trying to say?
Mr. Thomson: It is a very interesting question, particularly as it relates to the Internet, which is a worldwide medium developed for the free exchange of information, without borders or controls in most cases, unless you as an end-user want to put controls on what you receive. I would suggest that Internet experts and those who are interested in Internet policy would say that everybody owns the Internet.
Senator Merchant: I have a question. To what extent should regulations protect people from unwanted messages and advertising, although they may have validity? How do we distinguish those ads and messages from those for which you are paid but which are also unwanted? Is it not accurate to say that almost all advertisements and messages in electronic media are unwanted, although we benefit from some advertisements? What is the qualitative difference between those advertisements that hosted under your organization and those that are not? You may set standards, but is not the greatest concern about who profits from these standards?
Ms. Morin: To begin with, there is a great difference in the kinds of advertising messages you receive via e-mail. In the case of Bell Canada's marketing messages to customers, we sought and received their okay because they opted in on-line by ticking a box that says, ``Please send me more information on new products and services.'' That question is being asked and positive replies are added to your distribution list. Every e-mail containing marketing material sent to customers has an unsubscribe box at the bottom, which is respected. Some customers may unsubscribe or may re- subscribe. That is a specific incidence of a customer requesting material. Air Canada's Web site is used as a very good Canadian example of a success story when it comes to marketing. They e-mail marketing materials only to those who have opted in. Every Wednesday, the customer will receive the promotional material from Air Canada on the specials for the weekend. It has been a highly successful campaign.
Then there are the truly unwanted ads, for items such as medications, get-rich schemes and other fraudulent schemes. In the middle is the grey zone, of individuals who might receive an e-mail from an organization with which they do not have an existing relationship but in which they might be interested. In such a case, it results in a positive ad message.
That kind of activity keeps the spammers in business, in a way. I think Senator Oliver alluded to the figure of 0.0001 per cent, because the spammers do not have to pay to send their e-mail out — they pay for their Internet connection only — and so they are banking on getting a handful of people, out of millions, who will actually click through to the ad.
One of the campaigns started last fall was, ``Do not reply and do not buy.'' If it is something that you have not asked for, just delete it to eliminate the business model. That sends a message back to the spammers and they may have to move to a different business model as a result. It is because there is no cost to send the e-mail that they can take the chance of sending it to everyone.
There is a difference in the kind of advertising material that people receive: requested, non-requested and unwanted, and non-requested and wanted.
Mr. Thomson: With respect to spam, the only one who profits is the spammer. Everyone else pays the cost, including the ISPs and end-users. There is no profit motive for ISPs or end-users with respect to spam and it is a cost that they wish to avoid.
Senator LaPierre: I do not know what all the fuss is about, because life is full of risks. My newspaper — the Ottawa Citizen — comes every day and is full of junk that I do not want. It sells me everything from the bathtub to the kitchen sink. I do not need it and I do not want it. No one is appearing before this committee to say that we must control the Ottawa Citizen so they do not send junk messages to people.
The Web is the last area of freedom in the world into which the bureaucrats and politicians have not put their filthy noses. We are now in the process of attempting to control the Web. In controlling the Web, we will destroy it as an instrument of communication. Consequently, I thank you for appearing before us to bring some sanity to this discussion. That is all I have to say.
Mr. Thomson: Thank you, senator.
Senator Day: I do not know if I dare say that I find some of the proposed legislation from Senator Oliver rather interesting.
In respect of the statistics, I would like to get my mind around this issue a little better. We talked last time with Senator Oliver about this. According to the statistics that I read, about 90 per cent of what we describe as unsolicited spam originates outside Canada. Could you confirm that figure?
Mr. Thomson: That is our understanding as well.
Senator Day: About 50 per cent of everything end-users receive is unsolicited and unwanted material. Is the figure that high?
Mr. Thomson: It is that and more — up to 60 per cent and more. Over the Christmas season it can be as high as 75 per cent.
Senator Day: Senator LaPierre's newspaper would have to be 75 per cent advertising for fridges and stoves to be comparable.
Ms. Morin: He would have to receive, with his daily paper, a truckload of unwanted advertising.
Senator LaPierre: The principle is that we consider spam to be someone else's information, and therefore someone else's cross to bear. We are talking about unsolicited and unwanted information of any kind. Whether or not I receive three pages in the daily paper that tell me what I should buy and how to buy it, there is always a supplement in magnificent colour. The same thing occurs on the Web. Whether it is 10,000 pages or one page, it is too many. However, if I were to control the Web, then I would have to control the newspaper as well, through legislation. That is my point, and the Web continues to be the only area of freedom that we have and we must not endanger that.
Senator Day: Following along with my line of questioning, you indicated that one of the approaches to control is through existing legislation, which would be the Competition Act. We reviewed these before, and Mr. Thomson mentioned privacy legislation, personal information legislation and the Criminal Code in certain instances. If that were a feasible approach to this issue, or part of this multi-faceted approach, what would you see as commencing these legal actions?
Ms. Morin: If it fell under the Criminal Code, we would expect to see the RCMP and other police agencies involved. Depending on the different provisions and offences, there could injunctions issued and fines paid.
If you turn to the provisions of the Competition Act on fraudulent and misleading advertising, it would be the Competition Bureau that could launch these prosecutions, whether on the criminal or civil side.
Under privacy legislation, it can be through several different ways. It could be an individual who files a complaint with the Office of the Privacy Commissioner, saying, ``I am receiving this information. I have asked them to take my e- mail address off their list and I continue to receive information from them.'' That would be a privacy complaint, just as in any other context.
Something that is not well understood about the privacy legislation that now applies across the country — except B.C., Alberta and Quebec have their own legislation, but it is similar — is once you have a finding from the Privacy Commissioner, you can go to the Federal Court for a new trial. If in fact there is breach of the act, you can have the Federal Court judge issue just about anything — whether it is an injunction prohibiting them from engaging in these activities or from even having an Internet access, whatever the judge might find suitable, including punitive damages. It is explicit in the legislation that you can seek punitive damages. Many of the spammers — and this would apply to Canadian spammers who engage in this activity — could be required to pay hefty fines.
Senator Day: Who brings that private action? Is it the Internet service provider or the homeowner, the end-receiver of this information?
Ms. Morin: In this case, it would be the individual who is receiving the unwanted e-mail at home, or it could be an employee in an organization receiving unwanted e-mail. I know that ISPs would also be involved, because they would have to be able to prove to the Privacy Commissioner's office that the spammer was collecting the e-mail address through deceptive means. For example, had they asked to opt out? Therefore, an ISP might have a role to play. The Privacy Commissioner has the tools to consult different stakeholders in the chain to see if there are particular practices in place, or if there is evidence that they can provide.
The three pieces of legislation together will come very close, if enforced, to sending a signal to spammers that this will not be tolerated.
Senator Day: As Internet service providers, although you might be indirectly involved in one of these actions, when you say Canada is not missing anti-spam laws and what we are missing is the targeted and aggressive enforcement of those laws — and that was your comment, Mr. Thomson — you are really saying that somebody else is not enforcing existing laws. The government is not enforcing them.
Mr. Thomson: That is correct.
Senator Day: Ms. Morin outlined another issue that is important for us to keep in mind. National laws do not reach outside the country, and 90 per cent of the spam is coming from somewhere else. It makes it very difficult for Canadian laws to deal with the people outside the country who are sending this material on the Internet — because it is an international business. Do you agree with that?
Mr. Thomson: Very much so.
Senator Day: What are you doing in your discussions with other associations in other countries around the world? Can you explain what is going on in terms of international cooperation? Are you leaving that to the same government department that has not come forward with an action plan?
Mr. Thomson: As an ISP association, CAIP has membership in a loose group of other ISP associations around the world. It regularly exchanges information, ideas and so on with the staff of other ISP associations. There are existing relationships.
In fact, a year ago, CAIP worked with the Australian Internet service provider industry on this public awareness campaign that Ms. Morin mentioned before — the ``Don't buy, don't reply, don't try'' regime. There is cooperation and communication on the ISP association-to-association level, and there is also increasing cooperation among ISPs themselves, both domestically and internationally. Perhaps Ms. Morin can talk about that.
Ms. Morin: It has taken some time, but Mr. Thomson is correct, ISPs have sought each other out. Not just through the association, but also for self-preservation, they have sought out ISPs from which, for example, spam is coming, or to which perhaps some of their customers are spamming. We are trying to keep spam from leaving our network, and vice versa. I know Bell Canada, TELUS and other Canadian ISPs are now part of this group of North American ISPs that deal with each other. We have contact information; we are sharing best practices, filtering techniques and different benchmarks for what we will or will not allow on our networks. We are seeing a new rise in spam, using viruses to propagate it. How do we help our customers out? We are using that kind of association, at a loose level, to make that happen.
At the international level, you need to get the players speaking to each other, but you also need to get ISPs speaking with other government agencies from around the world. Then you need to get the agencies from around the world speaking to each other. You need international cooperation at multiple levels. We need agencies in Canada speaking to each other, and that is why we have this new campaign on enforcement of existing laws — trying to get the various agencies together with the industry players that can help; we need to get them speaking to their counterparts, and that is happening. Industry Canada has been active internationally, at the OECD and other places. Whether through private sector organizations like the Global Business Dialogue on Electronic Commerce that was referred to before — the GBDe — we have brought industry players and government together to educate people. It has taken a long time to have people understand the impact it is having on the different players.
Many people allude to the cyber-crime treaty that different countries are moving to implement. That is another tool available to countries to pursue the illegal and fraudulent nature of spam.
Senator Day: That is helpful. Just so I understand the information you are giving us here, your recommended approach is one of international cooperation. You talk about new technologies, about enforcement of existing laws; and you do not see the necessity, at this stage, for any new laws in relation to this problem.
Ms. Morin: Not at this stage.
Senator Day: You also talked about self-regulation. That is the multi-faceted approach. Can you talk a little about what you are doing from a self-regulatory point of view? Are you setting standards for all your members? What else are you doing?
Mr. Thomson: The starting point is that there is dialogue amongst CAIP members, which was initiated primarily by the Industry Canada paper that was issued a year ago. As a result, we created a task force within the association to look at how we would respond to that particular paper. Flowing from that was movement toward developing a code of conduct or a best-practices approach within the association, among its members, to deal with issues like open relays, how to respond to customer complaints and so on.
That was taking place before I left the association in February. The association has been in a transition stage since that time, so there has been a bit of a hiatus with respect to those activities. However, I am confident they will be starting up again in the near future as the organization is ready to move forward again under new leadership.
Senator Day: Do you have full-time people? Would this have been a part-time volunteer position that you held?
Mr. Thomson: I was a full-time employee. Currently, there is no person in my role, but there will be in due course.
Senator Day: Do you wish to add anything, Ms. Morin?
Ms. Morin: There is a fifth tool, and that is awareness and education.
Again, we need user awareness and education on how to protect their systems, because the spammers are beginning to use their computers to send out spam to others; how to not give out your e-mail address at just any Web site, as you would not give out your name and address to somebody you met on the street.
There is education of ISPs. The ISPs in Canada — and we are working with the cable ISPs — are coming together because, for example, it is in my corporate best interests that other ISPs do not allow spam from their networks to enter my network, just as it is in their best interests that I control the customers on my network who may want to send spam. We are helping to raise the bar and develop best practices there.
There is also education of government and different government agencies about the role they can play, the impact on ISPs, and the value of filtering technologies, for example. We referred earlier to the expert workshop held here in Ottawa in June. We had in attendance the Organization for Economic Cooperation and Development, OECD; Industry Canada; different ISP associations and ISPs; and marketing associations. Some marketers are finding that their e-mail is not getting through. The filters are blocking it, what is called the false positives. They were pushing hard for the ISPs to stop filtering, saying that the filter should only be active further into the network, at the user level. We can understand their frustration, but given the small margin of error, if ISPs were to stop filtering tomorrow, you would not get any e-mail. The Internet would grind to a halt because of the volume of e-mail out there. No e-mail would get through to anybody. The filtering has to continue. It has to become better. We need the white list. We need different tools, like sender authentication, so I can prove the e-mail is coming from Senator Day, for example, and I will let that one in, but if someone is faking where the e-mail is coming from, I will put it to the side and not let it in. These are the standards the ISPs are working on. It is truly an international issue, so that we, as an ISP, cannot just say, ``This is what I am going to do.'' We need to work together, and by default, that will take some time. People are talking to each other and we have made great strides; mind you, so have the spammers.
Senator Day: If all the ISPs were not cooperating on this, when one gets blocked, it would find another way to get to where it is going.
Ms. Morin: That may happen.
Senator Day: Everyone has to be into this, on an international level.
Ms. Morin: Yes.
The Chairman: My questions come from a state of near-perfect ignorance. I am a technological klutz, but the questions have to do with money. You were outlining citizens' possible recourse to the courts, but it is an enormously expensive process for the individual to undertake. It is more likely to be an individual than a corporation having terrible problems, because if worst comes to worst, the corporation can employ somebody full time to delete the spam. It is the individual whose whole day can be absorbed by removing this.
Why should the onus be on individuals to protect themselves from spam, perhaps at great cost? This is something of a devil's advocate question, but it is a real one. Why should there not be a role for the state in saying there are limits beyond which you cannot go in abusing the privacy of individuals, and then act on it?
Ms. Morin: In a sense, that is exactly the point. The privacy legislation allows an individual to complain to the Privacy Commissioner, whether at the provincial or federal level. We are not hoping there will be thousands of people complaining to the Office of the Privacy Commissioner about spam because they will not be able to deal with the flood of investigations they will have to conduct. Just as in any litigation model, whether under the Criminal Code, the Competition Act or the privacy legislation, you would like to see one or two examples of enforcement. Someone has either gone to jail, had to pay a hefty fine or has been precluded from continuing activities; and the federal Privacy Commissioner has the ability, with the consent of the individual, to take the action to the Federal Court.
The Chairman: I understood you to say that the individual had to do it. The commissioner can do it?
Ms. Morin: The individual must be the one who complains, but after that, it is the commissioner.
The Chairman: I have a second money question, again based on complete technological illiteracy, and it concerns your statement that spammers have no cost, apart from the basic subscription fee. The reason Senator LaPierre does not get a truckload of flyers with his newspaper every day is that the advertiser has to pay to include the material with the newspaper. There is quite an efficient self-regulating market system there, if you will, that keeps the volume down to manageable proportions. Nothing is perfect, because if the computer is in Fiji it is harder to control, but let us talk about Canadian spammers — why cannot Canadian ISPs start levying charges on people who are clearly sending out these huge volumes of unwanted messages?
Mr. Thomson: The starting point would be, rather than charging that customer, the ISP will in fact enforce their contract, which says ``You shall not use our network to spam,'' and cut that customer off.
The money issue has been debated for some time now within the Internet community. The question is how can one equate, in an economic sense, e-mail messaging with the postal service? Is there a way, within this medium that has developed over the years as a free exchange of information, to introduce an obligation to pay a ``stamp'' charge on an e-mail message? It would be a fundamental rewrite of the whole Internet system. I think it is beyond any of our capabilities at this point. Nevertheless, there are ongoing studies and research into how one can change the economics of e-mail.
The Chairman: I am talking about the bulk material, not me dealing with Aunt Minnie.
Ms. Morin: To begin with, even though ISPs are trying to filter out the bulk spam, the spammers are also becoming smarter. They know that ISPs are setting different benchmarks at which they will terminate their service. A year ago, that benchmark might have been 100,000 e-mails. If there were 100,000 e-mails coming out of somewhere, we knew something was wrong so we either suspended or terminated the service. That individual might have gone somewhere else or tried to open another account, so we try to make sure we know with whom we are dealing.
They are smarter. They send them out 1,000 at a time. Or they hijack your computers while they are on-line; it will spit out 10, 100, 1,000 e-mails and then it will stop.
While the notion of putting a charge on the spammer has a lot of appeal, trying to come up with that kind of mechanism in today's framework is not easy; people are not used to having to pay to receive or send e-mail.
We find ourselves in a difficult situation because of these viruses. We know we have residential customers whose computers are sending out nasty spam to AOL customers elsewhere. We know that they do not know it is happening. We are wondering, as a business, how do deal with these customers. Should we get in touch with the customers and hand-hold them through this? If we turn it around and say we would have to charge that individual customer the two cents per e-mail message sent, the model breaks down quickly because of how they do it. It is still discussed and batted around in technology industry circles. Some ISPs turn a blind eye to the fact that some of their customers are spamming because they are receiving their monthly fees. Eventually, the other ISPs receiving the spam will stop all mail from that one ISP. That is one way to exert pressure on ISPs to adopt best practices.
The Chairman: Go straight to the profit motive. I am a little less illiterate on that; and I thank you.
Senator Phalen: I take it from what I am hearing that you do not approve of Senator Oliver's bill?
Ms. Morin: Our position today is that we do not think Senator Oliver's bill is necessary at this time.
Senator Phalen: Other jurisdictions have addressed the problem of spam. Do they have legislation to cover that area?
Mr. Thomson: A number of jurisdictions have anti-spam legislation. We have talked about U.S. legislation, but there is also legislation in Korea and in a number of European countries; however, they are all different.
Senator Phalen: Is it effective?
Mr. Thomson: The amount of spam continues to increase, notwithstanding the anti-spam legislation in those jurisdictions. I would say that it has not proven effective yet.
Ms. Morin: We have noticed in the ongoing discussions and consultations that the expectation of a new law has caused some individual citizens to think that government will be able to legislate the problem away. That could have a backlash effect after raising individuals' expectations that a new law will make it go away.
Senator Phalen: We have laws, but we still have criminals. The question for me is, is the law necessary? Is it a fall- back position? Do you need a law to cover this area?
Ms. Morin: At this time, I do not think we do. We have not tried using the fraud provisions in the Criminal Code to see whether the RCMP could pursue those individuals, or the computer mischief provisions, whereby if someone tampers with your computer such that it hampers your enjoyment of the computer, or misleading advertising. It is definitely possible to capture some of the people who pay the spammers to get their marketing materials out. There is no doubt that those provisions could be used to go after that activity. The privacy legislation definitely has a role to play, to the extent that those activities are happening in Canada.
In a few years, we might say that we have tried the existing legislation route but it simply is not tight enough to cover this kind of activity. Spam is a tool being used to engage in criminal activity that is caught somewhere else. We might be back at it one day, but we have to try what is in place. When you compare the different legislation of other countries, short of adding new obligations for ISPs and legitimate commercial e-mails, you see that we have all the different pieces in place.
Senator Corbin: Senator Oliver told us that there were 15 principal sources of spammers. There may be many more, but of lesser importance. Are those 15 sources known?
Mr. Thomson: For the most part, yes they are known.
Senator Corbin: Why do you not hire them to get rid of them?
Mr. Thomson: I do not think we could afford to do that. They make much more money spamming than we could ever pay them to not spam.
Senator Corbin: You could not buy them out; that is interesting.
I would like to know about the next generation of aggressive and annoying Internet monsters that are beginning to raise their ugly heads and claw at our computers in the name of liberty and freedom of expression. Surely, once you solve the anti-spam problem, the industry will have to face other situations that are evolving only now. You are probably aware of those challenges. Could you take us into your confidence?
Mr. Thomson: It is fair to say that we know of some of the challenges we will have to face in the near future. At the same time, the way in which the Internet is developing, there will be applications, products and services that we just cannot imagine right now.
With respect to the ones that challenge us now, and will challenge us increasingly, viruses are clearly the main problem. That entails dealing with the hijacking of computers for either illegal purposes, through viruses, or just because someone wants to prove that they are able to do it. A phenomenon known as ``phishing'' is the fraudulent sending of messages by someone disguised as a legitimate source, such as a bank or an Internet service provider or some other organization that collects your personal information so they can do business with you. They indicate that they need some of that information now in order to provide you with further services or to correct a problem within their system, thereby getting you to hand over personal information, credit card information, et cetera, which is then used for criminal purposes. That problem is increasing. It is somewhat associated with the spam problem because much of the phishing activity occurs in bulk and is unsolicited. The police will certainly get involved in that area, which will be of great concern not only to ISPs, but also to end-users.
Ms. Morin: I was going to mention phishing as a problem as well. It has raised the interest of the law enforcement agencies because of the kind of personal information being asked for in that context, such as credit card number, social insurance number and bank password. As these new horrors come on board, it emphasizes the fact that awareness and education campaigns must take place, teaching users how to be Web savvy. For example, an ISP might say that you would never receive such an e-mail request for information from them, because if they needed the information, they would ask for it in a different way; so it is necessary to educate your users.
Sympatico was phished last year through a server in the U.S. People automatically asked whom they should be telling. Call the company being replicated and ask if it is really their Web site. We can take steps to change it quickly. There will always be something else, but now that we have these connections amongst ISPs and they talking to each other, rather than doing something drastic, we will call them and ask if they knew about this — do something about this. Other than the phishing, the worms and the viruses, those are the flavour of the day, as it were.
Senator Corbin: Finally, could you give us a sampling of the numbers of people in the ISPs whose work is totally dedicated to fighting these annoyances? Is it 1 per cent overall, or more?
Mr. Thomson: In a small ISP operation, where they have an average of six employees, one person is typically dedicated to dealing with spam.
A larger organization such as ours, TELUS, has 25,000 employees. I cannot tell you the number, because people share responsibilities. However, we certainly have departments that deal with abuse and consumer issues, which obviously include spam problems.
Senator Corbin: Could that be in the hundreds, less or more?
Mr. Thomson: I am hazarding a guess, but it is probably a couple of dozen.
Ms. Morin: They would be involved on the technology side and network operations to keep servers up and running when a new form of spam or virus comes out. Many of them share responsibilities, so they are responsible for technology for the entire service and other different bits and pieces. We have created internal task forces of a dozen people who get together once a week to discuss what they are doing to deal with matters.
All organizations are working to keep spam from coming in to their own employees because of the lost productivity factor in having to weed through 50 or 60 e-mails a day. Organizations must deal with matters from their own business operation side as well as their own employees. I cannot tell you exactly how many, but it is increasing.
Senator Corbin: In the end, it adds up to a negative production cost.
Ms. Morin: Absolutely.
Senator Corbin: That cost represents hundreds of thousands of dollars, or more?
Mr. Thomson: It is certainly a case of money going out without any money coming in.
The Chairman: On a point of clarification, TELUS's 25,000 employees are not all involved in providing Internet service?
Mr. Thomson: That is correct.
The Chairman: How many would you have in the ISP portion?
Mr. Thomson: I do not have that number.
Senator Day: Bell Canada and TELUS both went into the Internet business from another business, or added it on to another business. The telephone has been used and continues to be used for unsolicited calls. That does not seem to have become the same kind of problem as on the Internet. Why is that?
Ms. Morin: There are rules about unwanted telemarketing. However, unsolicited faxes are a real thorn in some people's side. There is a cost to the individual sending the fax, but the bulk of the cost is to the individuals at the other end, who are seeing their paper and ink cartridges being used up, and at the same time, are unable to receive legitimate faxes.
While inroads have been made in dealing with those issues, it is still a problem. However, there is not the same volume and there is a real cost for the telemarketers. They would like to be calling only people they think might actually be interested in what they are selling, to cut down their costs. That is why the problem on the telephone side is not as great.
Senator Day: That brings us back to Madam Chairman's questions about market forces controlling this somewhat.
According to the business model for creating an Internet service provider, you must go out and get customers who wish to use ISPs as a portal. Is there any exchange of money? When you sign up to TELUS or Bell Canada's system, once you have an Internet service system set up, is there any exchange of money between you and the other Internet service providers on the Web, or is all your revenue coming from your customer base?
Mr. Thomson: Once a smaller ISP has set up their system, bought their hardware and spent their marketing money to acquire customers, they have ongoing payments to some larger ISPs like Bell or TELUS because they rely on us for network connections to the broader Internet and access to our telecommunications facilities and infrastructure. They can then connect with other ISPs around the world.
Companies of our size have revenue coming in from end-users and from other ISPs. Smaller companies have revenue coming in from their customers and expenses going out to everyone else.
Senator Day: As a large Internet service provider, do you pay to connect to the World Wide Web? Do you have money going out in that regard?
Mr. Thomson: We have expenses as well. We must enter into relationships with other providers.
Ms. Morin: Those providers will carry our e-mail traffic, just as we will carry theirs.
Senator Day: Would that not provide for some financial incentive? Would that not control the volume? Is that the reason that you would want to ensure that you do not send material along the line that you do not want on there? Would that not be the same coming the other way? Is there not a market force in there that would help achieve some control?
Mr. Thomson: There is a huge financial incentive to try to control this. However, we do not have the financial tools to do so. We need these other pieces of the pie, parts of the menu, to help us.
Senator Day: Have you told us about all of the other financial tools that you need? Have we talked about that today? Is there something more you wish to tell us?
Ms. Morin: I think Mr. Thomson was alluding to the other pieces of the multi-faceted approach that we have talked about already.
Senator Day: I just wish to ensure that we know who is dealing with you in relation to Industry Canada. We talked earlier about their action plan. You have participated with Industry Canada in the action plan; is that correct?
Mr. Thomson: Yes.
Senator Day: You talk back and forth.
Mr. Thomson: We have consulted frequently.
Senator Day: Can you tell us a few names of people so that we could bring them here to tell us where they are? You may wish to send us those contact names to ensure that we go to the right people.
Ms. Morin: We have been dealing with Michael Binder and the individuals who work with him.
The Chairman: We already have that information.
Ms. Morin and Mr. Thomson, thank you for an interesting session. We are learning. We are very grateful to you for taking the time to be with us. It was obviously very important for us to hear from you, and rest assured, it matters.
The committee adjourned.