Legislative Assembly of Ontario

The committee met at 0845 in room 151.

MEMBERS’ PRIVILEGES

The Chair (Mr. Shafiq Qaadri): Colleagues, I call the Standing Committee on Justice Policy to order. Regrettably, our 8:30 a.m. witness, Mr. Michael Ivanco, president of the Society of Professional Engineers and Associates, has yet to materialize. Therefore, we will be in recess until this afternoon—no further committee business.

Ms. Lisa MacLeod: Point of order.

The Chair (Mr. Shafiq Qaadri): Ms. MacLeod, a point of order.

Ms. Lisa MacLeod: I’m just channelling Mr. Delaney. Just a quick question: What happens with the witness who did not show up?

The Chair (Mr. Shafiq Qaadri): We have various options. We can continue to wait, as here. We can perhaps try to reschedule for another day if the committee thinks it urgent or imperative that we be here. We can issue a Speaker’s warrant, can we not? And we can send out some chains, probably. But in any case, if it’s absolutely necessary to have this witness here, there are some recourses, and I guess we can deliberate that.

Ms. Lisa MacLeod: Okay. Thank you, Chair.

Mr. Peter Tabuns: Thank you.

The Chair (Mr. Shafiq Qaadri): The committee is in recess.

The committee recessed from 0846 to 1501.

MR. CHUCK ROTHMAN

Le Président (M. Shafiq Qaadri): Chers collègues, j’appelle à l’ordre cette séance du Comité permanent de la justice. J’invite notre prochain présentateur, Mr. Chuck Rothman, representing Wortzmans—Charles Rothman—to please come forward, be seated and be affirmed ably by our Clerk.

The Clerk of the Committee (Ms. Tamara Pomanski): Do you solemnly affirm that the evidence you shall give to this committee touching the subject of the present inquiry shall be the truth, the whole truth and nothing but the truth?

Mr. Chuck Rothman: I do.

The Chair (Mr. Shafiq Qaadri): Thank you. Mr. Rothman, you have a five-minute opening address, beginning then with the PC side for questions in rotation. Thank you, beginning now.

Mr. Chuck Rothman: I don’t have any opening address.

The Chair (Mr. Shafiq Qaadri): That, sir, must be a record. So we will now pass it to the PC side. That was 3.5 seconds. I congratulate you. Ms. Thompson?

Ms. Lisa M. Thompson: Very good. Thank you very much, Mr. Rothman, for being here this afternoon. I understand that you’ve been here before and testified before this committee. In your previous testimony you gave an explanation of your working relationship with the Ministry of Government Services as well as the Ontario privacy commissioner. I was wondering if you could kindly remind us of that working relationship with both.

Mr. Chuck Rothman: Well, I didn’t work with the Ministry of Government Services.

Ms. Lisa M. Thompson: Oh, okay.

Mr. Chuck Rothman: I worked with the Information and Privacy Commissioner. I was asked to review a report that the Ministry of Government Services provided to the Information and Privacy Commissioner concerning the potential recovery of deleted emails. I read the report. I discussed it with them. I explained certain technical aspects that were in the report. I gave them a list of follow-up questions to pose to the Ministry of Government Services. Subsequent to that, I was given the answers to those questions. Then, I assisted the Information and Privacy Commissioner in preparing her report.

Ms. Lisa M. Thompson: Okay, very good. So you would say you would have a comfortable knowledge now of how government stores and retrieves backup emails?

Mr. Chuck Rothman: I have cursory knowledge.

Ms. Lisa M. Thompson: Cursory knowledge?

Mr. Chuck Rothman: I wouldn’t say I have a very comfortable knowledge.

Ms. Lisa M. Thompson: Thank you. In your experience, Mr. Rothman, have you ever come across a situation in your career where an inquirer knew there was deleted information, like we do with regard to the gas plants, on an electronic source of many different kinds, and that inquirer told you specifically what to look for and your search came up fruitless? Did that ever happen to you?

Mr. Chuck Rothman: Yes.

Ms. Lisa M. Thompson: Okay. How? Can you explain how specific searches may come up empty-handed, so to speak?

Mr. Chuck Rothman: If emails are no longer there, if the emails are no longer on the system and you try to search for them and they’re not there, you’re not going to find them.

Ms. Lisa M. Thompson: All right.

Mr. Chuck Rothman: Maybe I don’t understand what you’re asking.

Ms. Lisa M. Thompson: In terms of what we’re looking for and where we need to look for it, based on the reading I did in preparation for today, you have your backup tapes and you have your hard drives and whatnot. Clearly you can find it somewhere if you look deep enough.

Mr. Chuck Rothman: Well, sometimes.

Ms. Lisa M. Thompson: Can you explain that, please?

Mr. Chuck Rothman: Sure. It all depends on how the systems are configured and what procedures are being followed. For instance, if I receive an email and the system is designed so that it automatically makes a copy of that email as soon as I receive it, then there are two copies of that email. So if I delete one copy, there’s another one that could be recovered, if you know where to look. It’s very rare that systems are designed like that, because then what they’re doing is, they’re copying every single email that you get.

Alternatively, the way systems generally are designed is that you’ll receive an email; it will be in your mailbox and that will be the only location for it. Then, at some time after the email has been sitting in your mailbox, it will get backed up, usually onto tape, and that may be the evening after you’ve received the email, if you do backups every day. Sometimes backups are only done once a week, but generally nowadays backups are done every day. So the email will be backed up at the end of the day.

Those backups are designed as disaster recovery backups. They’re so that if the server fails or some disaster occurs, you can restore the server system back to the way it was at the time that it was backed up. They generally aren’t used—in a lot of cases they are not used as long-term archival storage because of the way the technology works. They’re generally basically a snapshot of what’s there at the time the backup is made, and because they’re made for disaster recovery, they aren’t kept very long. Usually they will be kept for a day, a week, maybe a month, but they aren’t kept very long because you’re creating a new snapshot every day. The snapshot that you have today is more up to date than the snapshot you made a week ago, and so why do you need to keep the one from a week ago?

But there is another system that the government has implemented—and a lot of organizations now implement this, which is called by various terms. The generic term, or at least the generic term that I use, is an “archiving system.” It’s also called a vault. It’s also called offline storage. There’s a number of different terms for it. Basically it can have two different roles. It can either be used just as a way to lower the cost of storing emails so that if you want to keep an email for a long period of time—it’s unlikely you’re going to be accessing it very often, but you want it there for the time that you do access it. Basically what it does is, it moves it to a different location physically so that it can free up space on your primary server for new emails.

The other way that these systems work is that they are actually designed as retention archiving systems. Once an email will move to the system, it will be in the retention system and you can’t delete it or anything, but it depends on how the system is configured.

From my understanding of the way the government’s Enterprise Vault system is configured, it’s configured for the former definition, as I said, as offline storage or—not offline storage, as secondary storage. Physically, the email will not be on the main server; it will be on a secondary server. But from the user’s perspective, it doesn’t make any difference. It looks like it’s all in the same place.

1510

Given all these different areas where you can have copies of emails, if you have situations like that, if you want to recover an email that no longer appears in a person’s mailbox, you can look in other locations and see if it’s there. Now, if it has been out of the mailbox for longer than the time that backup tapes have been retained—if you’re only keeping your backup for a week, and it was deleted two weeks ago, then it’s not going to be on any backup tape anymore. If the archiving system is configured so that when you delete the email from your mailbox, it actually does delete it from the archiving system, then it won’t be there either.

So it’s possible, depending on how things are configured, that when you delete an email, it actually does delete the email and it’s no longer available.

Ms. Lisa M. Thompson: Thank you for distinguishing that. Moving along, the Ministry of Government Services sent a letter dated July 22, 2013, claiming there were roughly 1,233 backup tapes with emails that came from the Premier’s email account—Kathleen Wynne’s email account, to be specific—that could be recovered if the committee requested it. Last week, we asked them to recover this information, with very specific search terms that we defined in a motion, if everyone recalls. If that request comes back unresponsive, is there a reason to believe, based on your experience, that there is, let’s say, foul play or something that could be still withheld?

Mr. Chuck Rothman: If I understand you correctly, if they search the backup tapes and they don’t find any responsive emails, you’re asking if the emails could still be there?

Ms. Lisa M. Thompson: Yes, that’s what I’m asking.

Mr. Chuck Rothman: Well, if they search them properly and they don’t find anything, then they aren’t there.

Ms. Lisa M. Thompson: All right. I had to ask. That’s very good.

Last week, we also directed the committee to retrieve backup tapes that contained emails authored by Kathleen Wynne, the current Premier. The Ministry of Government Services and Cabinet Office claim that each tape could be processed at a processing rate of two to four hours per tape, which means it could take anywhere from, say, upwards of 2,500 hours to 5,000 hours—rounding up, of course—to retrieve the data that was stored on the 1,233 tapes.

Are you familiar with the process used to retrieve this data? Do the numbers that have been shared with us from the Ministry of Government Services make sense? And then I have a supplemental question to that.

Mr. Chuck Rothman: Okay. If the Ministry of Government Services is doing the restoration and searching themselves, those numbers do make sense, because I would not expect the Ministry of Government Services to have highly specialized equipment and techniques to be able to do this. They don’t do it on a day-to-day basis, or probably ever, to restore over 1,000 tapes, so they would have to go through their normal tape-restoration procedures, which are really designed to restore one tape at a time. So that number doesn’t seem out of line to me.

Ms. Lisa M. Thompson: Okay. If I may, your answer implies that there could be a faster method. Can you explain what faster methods could be employed?

Mr. Chuck Rothman: Okay. Working in electronic discovery, there are sometimes calls to restore backup tapes, because the information is not available anywhere else and they need to be restored to, hopefully, find the information on the backup tapes. So techniques and software and tools have been designed to deal with large volumes of tapes more efficiently. Third party vendors who specialize in this type of work have that type of software.

Basically, what it does is, instead of having to copy all the information off the tape onto a server and then search it, they actually search the tape itself and only copy off what they need, which makes the process go somewhat faster—not that much faster, because you’re still limited by the physical rate at which you can move the tape and read the tape. So it will still probably take two to four hours a tape, but you don’t have the secondary step of searching everything afterwards because you’re combining it together.

Also, the specialized vendors will do a number of tapes concurrently. So even though the total number of hours may be the number you said, in actual elapsed time, it will be quicker.

Ms. Lisa M. Thompson: Okay. Very good.

How much time do I have left?

The Chair (Mr. Shafiq Qaadri): Seven minutes.

Ms. Lisa M. Thompson: Okay. I am going to change gears here a little bit. As you know, there is an ongoing OPP investigation happening right now. I’m wondering if you have had any conversations with the OPP officers who are investigating the government and removing hard drives from government facilities.

Mr. Chuck Rothman: No, I haven’t.

Ms. Lisa M. Thompson: Okay. Were you ever part of an OPP investigation where officers thought to obtain deleted data from electronic sources? Have you ever been part of an investigation whereby the OPP involved you in recovering deleted information?

Mr. Chuck Rothman: No, I haven’t.

Ms. Lisa M. Thompson: Okay. The OPP has removed a number of backup data hard drives, as you know, from various government storage facilities. I’m wondering, has the removal of hard drives from the government’s backup facilities meant that the government’s response to demands made by the justice committee will be tough to fulfill, and that they have to do it themselves?

Mr. Chuck Rothman: I’m not sure I understand—

Ms. Lisa M. Thompson: Do you think the OPP are doing the investigation themselves because they feel that MGS is not capable of doing it for the justice committee?

Mr. Chuck Rothman: I have absolutely no idea—I don’t know any of the details at all. I don’t even know what hard drives they’ve taken. I couldn’t make any comment on that.

Ms. Lisa M. Thompson: All right. My last question for you right now: Could you share with us what you anticipate the OPP might find in terms of the kinds of information that could be present on the tapes they have confiscated?

Mr. Chuck Rothman: I have no idea what they’ve confiscated. I don’t know what information would be on it, so I couldn’t comment on what they might find.

Ms. Lisa M. Thompson: Okay. That’s fine. Thank you.

The Chair (Mr. Shafiq Qaadri): Thank you, Ms. Thompson. To the NDP side.

Mr. Peter Tabuns: Mr. Rothman, I wanted to thank you for the information and perspective you gave us the last time you were here. You were very thorough. Neither I nor my colleague has any questions of you.

The Chair (Mr. Shafiq Qaadri): Thank you. The NDP cedes its time?

Mr. Jagmeet Singh: Yes, thank you.

The Chair (Mr. Shafiq Qaadri): Even you, Mr. Singh?

Mr. Jagmeet Singh: I do, indeed. Thank you.

The Chair (Mr. Shafiq Qaadri): Oh, my goodness. All right. Thank you. I will pass it now to the government side. Mr. Delaney.

Mr. Bob Delaney: Thank you, Chair. We, too, hope to make a virtue of brevity.

Welcome back, Mr. Rothman. It’s good to see you again. The last time you appeared, you told the committee, just to recap, that you’re not a lawyer, correct?

Mr. Chuck Rothman: Correct.

Mr. Bob Delaney: But you are a forensic engineer, and for the past 15 years, your focus has been on computer forensics and electronic discovery, correct?

Mr. Chuck Rothman: That’s correct.

Mr. Bob Delaney: Is your primary role to advise lawyers and their clients on the technical aspects of digital information recovery?

Mr. Chuck Rothman: Yes, it is.

Mr. Bob Delaney: Did you assist the Information and Privacy Commissioner at all?

Mr. Chuck Rothman: Yes, I did.

Mr. Bob Delaney: Did you provide her with any advice on what other questions to ask?

Mr. Chuck Rothman: Yes, I did.

Mr. Bob Delaney: Were you ever given any direction by staff from the Ministry of Government Services with respect to that task?

Mr. Chuck Rothman: No, I wasn’t.

Mr. Bob Delaney: The last time you appeared, you said that you didn’t have any knowledge of the type of backup tapes that the Ministry of Government Services uses, that these backup tapes generally are essentially large versions of cassette tapes and that the archiving systems can be configured in a variety of ways within a number of days, but that you didn’t have any direct knowledge of how that particular server or servers or tape backup facility were configured. Is that still true?

Mr. Chuck Rothman: Well, I do have some additional information on how the archiving system is configured, just by reading the transcripts from last week. There was some information in there that described it. But apart from that, I have no additional information.

Mr. Bob Delaney: Okay. Yes, I should perhaps have phrased the question, “direct information.”

Mr. Chuck Rothman: No, no direct information.

Mr. Bob Delaney: All right. Last week, the former deputy minister, Kevin Costante, and the acting deputy minister, David Nicholl, testified that the retrieval of information from backup tapes is very infrequent and was only done about 12 times last year. Mr. Costante and Mr. Nicholl said that backup tapes are retained for disaster recovery purposes and, as you mentioned earlier, they’re not a complete archive of records created, sent or received by an individual. That pretty much is in keeping with the testimony you just gave, I understand.

Mr. Chuck Rothman: Generally, that’s the case. It’s very rare that an organization would use backup tapes to store all of their information for retention purposes.

Mr. Bob Delaney: Right. Are backup tapes normally considered a part of the record-keeping environment?

Mr. Chuck Rothman: Sometimes.

Mr. Bob Delaney: Okay. Is there anything else that you wanted to add to that today?

Mr. Chuck Rothman: No.

Mr. Bob Delaney: Your firm has been involved in assisting the Ministry of Government Services in responding to a motion from the committee. Could you explain what role your firm is playing?

Mr. Chuck Rothman: I’m not sure if it’s the Ministry of Government Services. I’m not directly involved in that—it’s other people in my firm—but I do know that we are working for a couple of the ministries in responding to requests.

Mr. Bob Delaney: Has your review also included working with any political staff in the minister’s office or the Premier’s office?

Mr. Chuck Rothman: Not to my knowledge, no.

Mr. Bob Delaney: Okay.

Chair, I have no further questions at this time.

The Chair (Mr. Shafiq Qaadri): Thank you, Mr. Delaney. Back to the PC side: 10 minutes, Ms. Thompson.

Ms. Lisa M. Thompson: Thank you. Again, I want to go back to the OPP investigation. It’s my understanding that the OPP have confiscated 12 tapes. I’m just wondering, based on your experience, would you anticipate that the government would still have access to the 12 tapes that the OPP has confiscated?

Mr. Chuck Rothman: Is it tapes or hard drives?

Ms. Lisa M. Thompson: Hard drives. Pardon me.

Mr. Chuck Rothman: Are you asking me—the OPP has confiscated those hard drives. Would the government still have access to them?

Ms. Lisa M. Thompson: Yes.

Mr. Chuck Rothman: I don’t know. It depends on if the OPP gives them access, I guess.

Ms. Lisa M. Thompson: All right, very good. Then you also mentioned, actually, in your comments, in terms of electronic discovery, that a number of tapes can be concurrently searched at one time. Based on your experience—we’re talking about doing two to three tapes in tandem, if you will—how many could your company do at a time if you were contracted to retrieve data?

Mr. Chuck Rothman: Wortzmans doesn’t do that work ourselves. We would hire a tape restoration vendor to do it.

Ms. Lisa M. Thompson: And the restoration vendor: How many, based on your experience, do you feel that they could do at a time?

Mr. Chuck Rothman: Probably two, three, maybe four. It depends on the equipment; it depends on the type of tape; it depends on the backup software. I can’t say for certain, but it would probably be in the two-to-four range.

Ms. Lisa M. Thompson: Okay, very good. The third party vendors: Do they write their own software programs or do they buy it in?

Mr. Chuck Rothman: It depends. Again, it depends on the software, on the type of tape. They may use software they’ve written themselves or they may use commercially available software.

Ms. Lisa M. Thompson: Okay.

I’m good. Thanks.

The Chair (Mr. Shafiq Qaadri): Thank you, Ms. Thompson. To the NDP side—

Mr. Peter Tabuns: No questions.

The Chair (Mr. Shafiq Qaadri): Thank you, gentlemen. Back to the Liberal side: Mr. Delaney, final 10 minutes.

Mr. Bob Delaney: Thank you, Mr. Rothman. We have no further questions.

The Chair (Mr. Shafiq Qaadri): Thank you, Mr. Delaney, and merci beaucoup pour votre présence and your testimony, Mr. Rothman. You are officially dismissed.

We’ll adjourn, but go into a subcommittee meeting. I will likely leave you in the able hands of Mr. McNeely for that. Thank you.

The committee adjourned at 1524.

CONTENTS

Tuesday 25 March 2014

Members’ privileges JP-1303

Mr. Chuck Rothman JP-1303

STANDING COMMITTEE ON JUSTICE POLICY

Chair / Président

Mr. Shafiq Qaadri (Etobicoke North / Etobicoke-Nord L)

Vice-Chair / Vice-Président

Mr. Phil McNeely (Ottawa–Orléans L)

Ms. Teresa Armstrong (London–Fanshawe ND)

Mr. Bob Delaney (Mississauga–Streetsville L)

Mr. Steven Del Duca (Vaughan L)

Mr. Frank Klees (Newmarket–Aurora PC)

Mr. Jack MacLaren (Carleton–Mississippi Mills PC)

Mr. Phil McNeely (Ottawa–Orléans L)

Mr. Rob E. Milligan (Northumberland–Quinte West PC)

Mr. Shafiq Qaadri (Etobicoke North / Etobicoke-Nord L)

Mr. Jonah Schein (Davenport ND)

Substitutions / Membres remplaçants

Mrs. Laura Albanese (York South–Weston / York-Sud–Weston L)

Mr. Bas Balkissoon (Scarborough–Rouge River L)

Ms. Lisa MacLeod (Nepean–Carleton PC)

Mr. Jagmeet Singh (Bramalea–Gore–Malton ND)

Mr. Peter Tabuns (Toronto–Danforth ND)

Ms. Lisa M. Thompson (Huron–Bruce PC)

Ms. Soo Wong (Scarborough–Agincourt L)

Mr. John Yakabuski (Renfrew–Nipissing–Pembroke PC)

Clerk / Greffière

Ms. Tamara Pomanski

Staff / Personnel

Mr. Ian Morris, research officer,
Research Services

Mr. Jeff Parker, research officer,
Research Services

Mr. Peter Sibenik, Table Research Clerk,
Table Research