ELECTRONIC COMMERCE ACT, 2000 / LOI DE 2000 SUR LE COMMERCE ÉLECTRONIQUE

COMMUNITECH ASSOCIATION

JOSHUA DOIG

E-WITNESS INC
MYTEC TECHNOLOGIES INC

CONTENTS

Tuesday 29 August 2000

Electronic Commerce Act, 2000, Bill 88, Mr Flaherty / Loi de 2000 sur le commerce électronique, projet de loi 88, M. Flaherty

Communitech Association
Ms Sangeeta Sindwani

Mr Joshua Doig

E-Witness Inc; Mytec Technologies Inc
Ms Janet Hebbes
Mr Don Waugh

STANDING COMMITTEE ON JUSTICE AND SOCIAL POLICY

Chair / Présidente
Ms Marilyn Mushinski (Scarborough Centre / -Centre PC)

Vice-Chair / Vice-Président

Mr Carl DeFaria (Mississauga East / -Est PC)

Mr Marcel Beaubien (Lambton-Kent-Middlesex PC)
Mr Michael Bryant (St Paul's L)
Mr Carl DeFaria (Mississauga East / -Est PC)
Mrs Brenda Elliott (Guelph-Wellington PC)
Mr Garry J. Guzzo (Ottawa West-Nepean / Ottawa-Ouest-Nepean PC)
Mr Peter Kormos (Niagara Centre / -Centre ND)
Mrs Lyn McLeod (Thunder Bay-Atikokan L)
Ms Marilyn Mushinski (Scarborough Centre / -Centre PC)

Substitutions / Membres remplaçants

Mr Tony Martin (Sault Ste Marie ND)
Mr Gerry Martiniuk (Cambridge PC)
Mr Mario Sergio (York West / -Ouest L)
Mr Wayne Wettlaufer (Kitchener Centre / -Centre PC)

Also taking part / Autres participants et participantes

Mr John Gregory, general counsel,
Ministry of the Attorney General

Clerk / Greffière

Ms Susan Sourial

Staff / Personnel

Mr Avrum Fenson, research officer,
Research and Information Services

The committee met at 1201 in the Ron Eydt Village Conference Centre, University of Waterloo, Waterloo.

ELECTRONIC COMMERCE ACT, 2000 / LOI DE 2000 SUR LE COMMERCE ÉLECTRONIQUE

Consideration of Bill 88, An Act to promote the use of information technology in commercial and other transactions by resolving legal uncertainties and removing statutory barriers that affect electronic communication / Projet de loi 88, Loi visant à promouvoir l'utilisation des technologies de l'information dans les opérations commerciales et autres en éliminant les incertitudes juridiques et les obstacles législatifs qui ont une incidence sur les communications électroniques.

The Chair (Ms Marilyn Mushinski): I will call the meeting to order. Good afternoon, ladies and gentlemen. This is a meeting of the standing committee on justice and social policy to consider Bill 88, An Act to promote the use of information technology in commercial and other transactions by resolving legal uncertainties and removing statutory barriers that affect electronic communication.

Before we hear from the first delegate this afternoon, I should bring you up to date on our inquiries with respect to the two outstanding delegations in Ottawa. I was instructed by committee to cancel that meeting because we only had two. We have been in touch with those two delegates. The first one is Mr Michael Geist, who has chosen to withdraw completely. My understanding is that he is an expert witness and he would be happy to entertain any questions that any committee members may have. So we'll certainly give you his telephone number after the meeting if you wish it.

The other delegate was the Public Interest Advocacy Centre. They will be submitting a written submission by the end of the week and, again, will be happy to entertain any questions that any members may have of them.

COMMUNITECH ASSOCIATION

The Chair: We'll hear from the first representative this morning, who is Sangeeta Sindwani of Communitech Association.

Mr Mario Sergio (York West): Madam Chair, have we provided for an overview before, or are we going directly into-

The Chair: My understanding is that it was a request by one of the presenters and will be used a little later.

Mr Sergio: Oh, OK.

The Chair: Good afternoon, Ms Sindwani. You have half an hour and if you complete early then we may be able to have some questions from members of committee.

Ms Sangeeta Sindwani: I'm pleased to have been invited to speak to this standing committee concerning Bill 88, Ontario's Electronic Commerce Act.

The Chair: Excuse me. This is kind of noisy, so if there's any opportunity to-and I realize it may have to be on during the presentation, but it's difficult to hear. Please carry on.

Ms Sindwani: I'm especially pleased that this standing committee has come to Canada's technology triangle to solicit various views on this bill. I've been asked by Greg Barratt, the president of the Communitech Technology Association, to speak to the topic of Bill 88 and to express Communitech's support for this bill.

By way of background, the Communitech Technology Association is an organization dedicated to building critical mass for the technology industry real enterprise in the Kitchener-Waterloo region. It has as its members technology companies, educational institutions and various levels of government, all working together toward the continued development of the technology industry in this area, both as providers and users of technology.

In terms of my history, my involvement in the area of electronic commerce has been as a lawyer in private practice, advising clients on issues related to information technology law, which I think is an area that's quite broad and covers the realm of electronic commerce.

In 1998, I joined the electronic commerce working group of the Uniform Law Conference of Canada, a group that was responsible for the development of uniform law in the area of electronic commerce. The group developed, as I'm sure you're all aware, the Uniform Electronic Commerce Act which is actually very similar to the bill we're here to discuss today. At present, I am an associate with the law firm of Gowling Lafleur Henderson.

At the outset, I should state that Communitech has not had any specific consultations with any of its members concerning this bill. However, generally it has had general consultations in the past with its members and has been able to get a good feel for what is happening within the Kitchener-Waterloo community. It was therefore felt that it would be better to express an opinion or a general view on Bill 88 as opposed to remaining silent on such an important initiative.

The support that is being expressed here today on behalf of Communitech is support for what we see as the intention behind Bill 88, that being the removal of a few roadblocks toward the full adoption of electronic commerce. In other words, we support law that removes legal barriers to electronic commerce by validating electronic documents and by increasing confidence and predictability in the result of transacting on-line without dictating the type of technology that is to be used to do this.

The concept of increasing confidence in the legal effect of on-line transactions is an important one and we feel that this bill is a step toward this goal because it really removes the legal ambiguity as to whether something that was traditionally done using paper can now be accomplished electronically.

As a participant in the Canadian E-Business Opportunities Roundtable, Communitech has had the opportunity to accumulate various data on electronic commerce. The roundtable consists of a group of industry leaders, including John Wetmore of IBM Canada and John Roth of Nortel Networks, who have with the other participants presented a report to Industry Canada on accelerating Canada's leadership in the Internet economy. Part of the data that has been accumulated for this report is the Statistics Canada survey on the use of information and communication technologies in electronic commerce. The results of the survey show that Canada is second only to the United States in world rankings of overall connectedness to the Internet. The government of Canada has publicly stated that its goal is to be the most connected country in the world, and with the statistics I've just mentioned it appears that we are fast approaching that goal.

Communitech's vision is similar in that the Kitchener-Waterloo region is a hotbed for technology companies and would only benefit from increased connectivity to the Internet. Establishing law that validates electronic documents will likely reduce public apprehension to performing transactions on-line and will assist in bestowing greater confidence in this revolutionary way of conducting business. It's anticipated that this will further our efforts toward the goal of greater connectivity, both on a local and global scale.

Despite high connectivity rates here in Canada, there still appears to be a slow adoption of electronic commerce in both the business-to-consumer and business-to-business markets. Statistics show that only 10% of private sector firms use the Internet to sell goods and less than 14% of private sector firms use the Internet for purchasing. These numbers are somewhat disappointing given that our population is highly connected, as well as the fact that there's been key infrastructure in place for communicating electronically. These statistics reflect our own local experience here in this region.

1210

At present, therefore, it appears that the majority of the private sector just doesn't feel comfortable enough with the Internet to use it as a medium for conducting business. By providing a legal framework to validate electronic documents, this initiative may accelerate the adoption of electronic commerce by the private sector.

The minimalist approach taken by this bill is viewed favourably by Communitech. Many of the technology companies that exist in this region are on the cutting edge in terms of products and services they offer. They may not want to see legislation that prescribes specific technology to be used in the validation of electronic documents. Such legislation could stifle the development of new technology. Bill 88 does not prescribe specific technology, which is really in keeping with the concept of continuous development and improvement in technology.

Based on my own background and knowledge in this area, I am familiar with certain legal initiatives that have been taking place in Canada and around the world. Internationally, there is a recognition that consensus is required among countries developing laws in this area. The goal is really not to have identical laws, but to have the same philosophies and principles operating behind these laws.

The Uniform Law Conference of Canada is a body within our own country with a mandate to harmonize laws throughout Canada. This organization viewed electronic commerce as an area requiring consistency among the provinces, and therefore has adopted a uniform law on electronic commerce. At the federal level, as we are all aware, Bill C-6, the Personal Information Protection and Electronic Documents Act, has now been passed and is similar to the uniform law. Bill 88 is also similar to the uniform law and, from a policy perspective, is what many other countries are doing in an attempt to remove legal barriers to electronic commerce.

That really concludes our support statement before the standing committee. As a representative of Communitech, I've been asked to raise a few points for consideration by the committee. I don't know if it's appropriate at this moment that I go ahead and do that.

The Chair: That's quite appropriate.

Ms Sindwani: First, it has been expressed by the Ministry of the Attorney General in their fact sheet to the Electronic Commerce Act that the bill does not permit people to collect biometric information, such as dynamic signature information. Can somebody from the panel clarify the meaning of "dynamic signature"?

The Chair: What you should do is relay all of your outstanding concerns to committee, and then perhaps we can have a member of committee respond to them.

Ms Sindwani: That would be the first question. I guess where Communitech is coming from is just to ensure that the use of digital signatures is not being prohibited. The president of Communitech as well as myself were not able to answer that question, and that's why I raise it.

Second, in the same fact sheet it is stated by way of exclusion that the act "does not override existing provincial laws and regulations that permit, regulate or prohibit the use of electronic documents." Communitech would like to know what the reasoning is behind allowing other laws to override this bill. Practically speaking, by using this exclusion are we moving forward or are we at the same point we have been without any legislation in place?

Those are the comments that the president has asked to relay.

The Chair: That's it?

Ms Sindwani: That's it.

The Chair: We have about 15 minutes, so each person can have maybe five minutes for questions. Mr Martin.

Mr Tony Martin (Sault Ste Marie): Could I suggest, in the interests of answering those two questions, because I certainly would be interested in the answer, that either the gentleman who presented yesterday or our research person might just take a couple of minutes and give it a shot?

The Chair: Mr Gregory, would you like to just very briefly respond?

Mr John Gregory: Thank you, Madam Chair. There were two questions. The first was, what is meant by dynamic signature?

The Chair: Or biometric information.

Mr Gregory: I'm trying to remember just what the-

Ms Sindwani: Would you like the fact sheet?

Mr Gregory: No, I know what the fact sheet says. Anyway, the short answer is that this is not intended to prevent digital signatures. As the Teranet representative explained to the committee yesterday, digital signatures are a use of encryption technology and mathematical algorithms in order to transform a digital version of the message. It has nothing to do with biometrics, which of course deals with the measurement of personal characteristics.

In defining "biometric information," section 29 of Bill 88 says it's "information derived from an individual's unique personal characteristics, other than a representation of his or her photograph or signature." So that is a representation of a photograph or signature. If someone uses a digital photograph as your identifier, that is not biometric. It may be biometric technically, by the dictionary definition, but we are not trying to get at that in the provision of the biometric thing. It doesn't apply to biometrics. If someone takes your picture or uses a digitized picture as an identifier, that doesn't fall into the provision of biometric information in the act.

Likewise, a dynamic signature is the kind of signature created when you sign a computer-sensitive pad. For example, a number of department stores have done that, where you don't sign with a pen but you sign with something that feels like a pen, a stylus. You sign on a computerized pad and that records not only the shape of your signature-you sign what would normally be your signature if you were doing it with pen and ink-but it is a computer-sensitive pad and you get not only the picture but you get the pressure and the speed and the angles recorded. So you have much more information than you have with an ink-on-paper signature. That is recorded in a computer and that is associated with the document that you signed, so that can be reproduced. If someone were to say, "Show me the signed document," they can pull it up on a computer screen and there it is with your signature on it. But as I say, there is more information than simply what looks like your signature. That is fairly common.

That is excluded from the provision on biometrics. The reason for that is simply that it's very hard to do that accidentally. The point of the biometric provision, as we heard yesterday, was to say there has to be express consent to the use. It may well be possible to take biometric information from somebody without their really realizing how it's done. There are computer mouse devices which read your fingerprint as you use them. Someone might use one of those without really realizing that that was happening. Or if someone does a voice recognition pickup, that can happen without your really realizing that's what they're doing. It's very difficult to sign on a pad without realizing what they're doing. So it limits the application of the biometric provision by saying, "All right, if they use a picture, then they can use a picture." It's not particularly intrusive to use a picture. It's on my driver's licence. It's a fairly common kind of thing, and for a dynamic signature it's not a problem.

The other reason-and I'm not sure how technical you want to get-is something we talked about with the Information and Privacy Commissioner. One of the concerns with the use of biometrics that was expressed by the Information and Privacy Commissioner was that the data, the biometric information that the computer picks up, might be used to find you, might be able to identify you, identify a criminal, identify someone in a database to find out whether there's a fraud or whatever. They want to identify you not just to say, "Do I have the right to withdraw money," or whatever, but more broadly. With dynamic signature, you can't really use it for that purpose.

I won't impinge on Ms Sindwani's time, but the other question was, if this act yields to other provincial laws that prohibit electronic information, isn't that a threat to the purpose of the act, which is to harmonize and modernize? That's something we did discuss yesterday, both in my presentation and in some of the other presentations.

1220

The point is that there are several hundred provincial statutes that have not had provisions made for electronic documents and we don't want to amend them all. This saves us amending them all. Harmonizing what's been done is a very difficult diplomatic process among ministries. We may eventually do it, but we figured if we had to do that first it would be years before we get the new-

The Chair: Thank you, Mr Gregory. Mr Sergio, do you have any questions?

Mr Sergio: A question and a comment, yes indeed. First of all, thanks for coming down and making a presentation to this committee. Other than what you expressed to us today, was there any other area that you or your company may have a concern about with the bill?

Ms Sindwani: No. I was asked to express those two concerns and I've done so. I've had consultations with the president of Communitech. Like I said, in the short time span that we were given there was really little time to consult the members of Communitech, so this is a general view that's being provided. What I've expressed here today is basically an expression of his thoughts on the bill.

Mr Sergio: Given the shortness of time, did you notice in the bill, for example, that there is no mention at all with respect to privacy or confidentiality issues?

Ms Sindwani: Yes.

Mr Sergio: Is that one of your concerns?

Ms Sindwani: No. Again, when I speak or give any type of opinion, I'm speaking personally; I'm not speaking on behalf of my employer. Because of the time span, there was no opportunity to take a view of what the other lawyers in my firm or the members of Communitech think. I think it's a separate issue that can be dealt with separately. I don't see that it would be necessary to include it in this type of bill.

Mr Sergio: If it were to be included in some other piece of legislation, do you think, at least in dealing with such an important issue as Bill 88, that we should have made mention of that to cover the possible effect that it may have in the future under a different piece of legislation-the issue of privacy and confidentiality?

Ms Sindwani: I think it is in some respect covered in this bill in that there's mention of it, which is better than no mention at all, in my opinion, and that's just the statement that there's preservation of other laws regarding privacy and access to information, and that would give way to those types of laws that actually protect privacy of individuals. Insofar as it goes that far, I think that would be good; any further, I don't know how, other than drafting a section that deals with privacy. I don't know, other than that, how to go about mentioning it better than it has been here. Again, that's my personal view.

Mr Martin: Certainly we picked up the message that you want this to move on so that it will give people out there the confidence they need. You also highlighted that in Ontario and Canada today the percentage of people actually doing business in this way is still minimal. I can tell you that from some of the material we've looked at it, the complaints about e-commerce by consumers have risen by about 1,000% over the last year or so, so there are still some big issues out there.

This is a very important initiative. I guess the question I would have for you is, in trying to establish this on a foundation that's solid and will give people the confidence that they need, and actually reflecting the fact you're coming here today not having had much lead time to consult with your partners and all of that, wouldn't it make more sense to actually be doing a wider consultation on this in order to bring people into the discussion and, as such, then have them understand more fully the potential that's here but also some of the challenges that are in this that might, in the end, if we're not careful, even add more to the frustration and consternation and concern of people out there who actually try to do this?

Once this is passed, and it sounds like it's going to move rather quickly, then it's legal to do business in this way. If people aren't educated and prepared to actually participate in a constructive and positive way in that, they will have signed a whole lot of documents now that initially were sort of iffy and so you at least had some recourse if you made a mistake or you didn't think it out properly, but now it's done and you're stuck. That could be quite a surprise and create some real difficulties, it seems to me, in the industry. Any comment?

Ms Sindwani: I think certainly education is a key factor in something this important. I can speak as well just from my own client base that I would benefit from, or the Kitchener-Waterloo region specifically, as I speak to that, would benefit from knowing a little bit more about the act and the initiative, as opposed to remaining ignorant and then finding out later that this is law. I think what we're doing here today is a good step toward that because you bring members forward who can speak to it and then spread the word.

I'm not sure what the process was in terms of choosing areas in which this bill would be presented by members of the various communities. I don't know the thought process behind that. But certainly in terms of canvassing other cities and other jurisdictions within Ontario, I don't see an issue. But at the same time, I think I can also say that those within the technology industry would certainly welcome something on paper-more than something on paper-with the intention of validating electronic documents, but within a reasonable amount of time, because this is a fast-paced industry and obviously taking time to get consultations may slow down the process. It would certainly help in terms of educating, but at the same time, saying that electronic documents are valid within certain parameters is, in my view in terms of my clients, helpful in terms of moving forward. I don't know if I've specifically answered your question, but that's my answer to it.

Mr Martin: Thank you.

The Chair: Mr Wettlaufer, for about two minutes.

Mr Wayne Wettlaufer (Kitchener Centre): Ms Sindwani, thank you for your submission. You mentioned in your submission that, while Canada has the second-highest connectivity rate, second only to the United States, we still only have 10% of sales conducted by e-commerce, and 14% of purchases.

Ms Sindwani: That's right.

Mr Wettlaufer: That's a rather alarming figure. There is also a very low percentage of business-to-business transactions. I'm not sure what the figures are there offhand, but I know they are low.

You did mention lack of confidence as being one factor. Would there be any other factors that you can bring to mind for the attention of this committee, and do you believe this bill will assist in increasing the transactions and also increasing the business-to-business transactions?

Ms Sindwani: I'll answer your second question first. I think, yes, having this bill would increase predictability, as I've said, and confidence in terms of the results of transacting on-line, which I think Canadian society is a little apprehensive of to begin with, more so than the United States. Again, that's a personal view. Having something in place will instill this confidence, it's hoped, and help us move forward, and I think the bill does that.

In terms of the reasons that business-to-business e-commerce is slow, I have a Statistics Canada survey here in front of me-not the survey but actually a brief summation of some of the things that come out of it. It is stated that some of the reasons private sector firms do not use e-commerce are that they believe the goods and services do not lend themselves to electronic commerce, they prefer to maintain current business models, and there are concerns regarding security. Those are three of the other reasons that I've come across.

The Chair: Thank you very much, Ms Sindwani, for coming this afternoon. We appreciate your presentation.

1230

JOSHUA DOIG

The Chair: The next delegate is Joshua Doig. Good afternoon, Mr Doig. You have 15 minutes.

Mr Joshua Doig: I'm sorry I didn't have anything written down, but I have a statement I'd like to read off, background about myself.

My name is Joshua Doig. I work here at the university. I am just a recent graduate, in April. I have been very interested on a personal level in the technology sector in general-not, maybe, specifically e-commerce-because I've seen at least 12 of my graduating comrades leave the country for greener pastures down south. It seems to be limited very much to the technology sector. Also, there seem to be a lot of regulatory problems in Canada that inhibit their starting up their own businesses. E-commerce might not be directly applicable to all that because there are broad-based concerns there, but it is one portion of the problem. So I am very much in support of this bill to try to help facilitate technology and acquisition in the growth of the technology centre in Canada.

I did a number of studies in my last year-I was in economics-on why people are leaving, what the problem is and why in this particular sector. That got my own personal involvement in here. I think we should be very concerned about Canada's competitiveness in this region, our government support in this region, and why we're losing. The growth all around the world is in the new technology, the new jobs, and our governments need to be supportive of this industry and help it grow. If we fall behind, we'll just continue to fall behind at an aggregate level that increases.

If you change e-commerce to make it easy and more legal at a rate where we can move forward with that, you not only have more companies feel better about doing it on-line; you help the consumer, because he knows that what he is signing is a legal document, and therefore the company should come through. Once you do that, you have more companies wanting to go on-line, if they feel secure about it. They would then hire more people. The people who need to service this kind of technology are very skilled. You would create more jobs, and hopefully some Canadian companies would get on board a bit quicker.

There was an article in the paper yesterday that said the second biggest barrier to doing an IPO with a high-technology firm in Canada was government regulation. I'm sure that tends to be more indicative of the actual progress of doing your IPO, but it's also reflective of problems we are having in Canada with government regulation. Instead of the government trying to support this stuff, they seem to be cautious and not sure what they want to do, so consequently nothing is getting done quickly. Our government needs to respond quickly to keep pace with this kind of thing. It is still written documents, and people need to know that it is legal all around. I think you clarify a lot of issues if we all know that what we are signing is legal.

Anything that would encourage adopting the technology sector quicker is better for our economy. Our young people, who continue to leave, need government support. They are on-line with this technology already. The government needs to catch up with them and help them out. That's where I'm coming at it from, not so much the legal but more the economic impact, especially with young people trying to get involved and company-to-company, and then fostering growth in this sector.

I think that's my statement, if you have any questions.

The Chair: Thank you, Mr Doig.

Mr Martin, you have about three and a half minutes.

Mr Martin: I agree that we need to be moving as aggressively as we can to make sure we actually, in some instances, get out in front as opposed to always playing catch-up. Certainly this whole area is one that is just flying ahead in many parts of the world.

However, I think you have to do it intelligently, and I think government has a role to play to make sure that people are protected and that we are supporting an industry that is sustainable and as inclusive as possible of all parts of your jurisdiction.

For example, I said a few minutes ago that, according to the Ministry of Consumer and Commercial Relations, complaints about e-commerce have risen by about 1,000% over the last year or so. And that's with a statistic of, as was said earlier-except I've got some slightly different statistics. Stats Canada released a benchmark study on August 10 which said that goods and services ordered by Canadians on the Internet in 1999 represented only 0.2% or $4.4 billion of total economic activity, about 20 cents out of every $100. However, there are some sectors that are doing more business. The cultural industries have done 20% of business using the Internet; private educational services, 17%. But in the area of the province that I represent, northern Ontario, which still continues to be very much tied into forestry, logging and mining and resource-based activity, we're looking at probably 1%.

I guess what I'm wondering about in this rush to be in front and to be first and to take advantage of this is, are there not some things that we need to make sure that we're doing to, on one hand, include all parts of the province, the north in particular, and rural Ontario, and on the other hand, to make sure that we're not setting people up to be taken advantage of? Is that not a role the government should be playing? Or, if they're not going to play it, who's going to play it as this industry evolves as it looks like it's going to?

Mr Doig: An interesting couple of points: the complaints have risen 1,000%; I wonder what the facts are on how much the volume has risen in the same time period. That would be neat to cross-reference. But, at the same time, some sectors may never-forestry may never get on to the Internet, but that doesn't mean you should slow it down for the industries that are trying to get on. I think you be inclusive by designing a system that anybody can get on at any time. Some sectors may never, ever use this but some sectors definitely need to use it. I think that you're actually probably helping the consumer very much by making it a legal document because it's often the consumer that suffers because I enter into a contract with a business, I don't get the product that I was told I was going to get through this contract and my legal recourses are fuzzy right now because what obligations does the company have? I think if you want to protect the consumer, that's great.

As far as educating the public, the public should be aware of their legal obligations already. It's just like any other issue. I just graduated from university. I sign a contract to be a tenant very often; I move around. I might not be aware of every issue involved there; I tend to educate myself when I need to. But the information should be made available for me and it is my responsibility to check it out ahead of time. I think, as long as you're clear with everybody that this is a legal document, as long as everybody is made aware of that, that education should be self-responsible.

Mr Wettlaufer: Mr Doig, we have the University of Waterloo here, which is turning out graduates of extremely high quality, the highest in the world. We're very proud of that. We're proud of the graduates and we're proud of the university.

Companies like Mortice Kerns are leaders in the e-commerce area, but we are finding all the time that in spite of the graduates we're turning out, we do not have adequate numbers of top-notch, high-tech graduates to work in the companies, to help these companies grow, whether it be Mortice Kerns or Research in Motion or Open Text or on and on. We find, and I'm sure you do too, that so many of what are called "techies" are moving to the United States. Now the federal government tells us that that is not the case, and certainly we have heard the opposition members from time to time say that is not the case. In the government budget that was presented in May of this year, we provided an incentive for the tech graduates to stay in Canada when we said that the stock options that they would receive from their companies would no longer be taxed upon receipt but rather when they were sold at some point down the road. Of course, the federal government has opposed us in that regard as well.

Do you agree that we are having many of our brightest graduates leaving to go to the United States for what they see as a brighter field because of taxes or because of something like this bill?

1240

Mr Doig: Without a doubt. I did a lot of research especially on the StatsCan information that was released about a year ago that claimed that we don't have a brain drain. How they did their figures was they took what we had coming in as kind of techie or medicine and they put it against what we had leaving, a kind of exodus, and they came up pretty close, that we're only losing a couple of hundred.

I found there are two really scary issues with that. One is that there was no measure of the quality of the people who were leaving versus the quality of the people we were getting. They just classified that they had a degree of some sort from somewhere and where we might have been losing people who already had started companies and were running things. Second of all, the scariest thing is that we as Canadians tend to think, "Oh, Jeez, we're only losing 100. We might be losing 1,000 but we're gaining 900; not to worry." What you are losing is a huge potential. It should be looked at as, "Wow, we could have kept 1,000 and got an extra 900," so we could have been plus 1,900. This industry, as you said, is growing so rapidly, an extra 1,900 would just be a nickel or a dime in the pocket.

So the way StatsCan and the federal government currently do it is that they don't seem to be recognizing that we're still losing potential. I mean, we could have had 1,900. "Well, good. We're close to even. Excellent." It seemed ridiculous to me, with the reports they had out, and we're definitely losing. Not only that, if you lose a couple of key people-if you look at companies like RIM, they were only started by two or three individuals.

A friend of mine who wanted to start a company here couldn't get venture capital. He made sound equipment that's called Quinnware for your computer. You could download it; it's like a CD player. He couldn't find venture capital. He hired one person here in Kitchener-Waterloo, he got a venture capital offer from San Francisco, he left, and now the company he works for-he has a little division of it now-employs about 15. You lost one, but the problem is that you really lost 15 people, all the tax revenue they would have been able to pay in the community, the houses they bought, the cars they bought, the CD players they bought and everything else they would have bought, not to mention the skills they would have garnered through this company that would enable them to start their own company one day.

I think we're definitely suffering a huge amount of brain drain. Not only that, it tends to be the best and brightest who get picked off. I'm still here in Canada. I did not take a technology degree and an American company doesn't want me. I had some very bright, very aggressive friends, much more entrepreneurial than I am, and they're gone. They're the kinds of guys you probably needed to have around to have a strong economy and the education sector and every other thing that the economy can derive money from.

Mr Wettlaufer: You sound pretty brave to me.

Mr Doig: I should have gone into technology.

The Chair: Mr Sergio, you have about two and a half minutes.

Mr Sergio: Joshua, thanks for coming down. That is a separate issue for another time.

What we are dealing with today, Bill 88, is to promote the use of information technology in commercial and other transactions by resolving legal uncertainties and removing-I'm reading the heading of the bill itself. So there are two particular things. One is to support this technology, which I think we all agree is about time. The other is that it's about time that we do it right at the same time because, as you say, it affects the bottom line, the consumers, and of course the users as well. Those are the two main intents of the legislation as it is presented.

We Liberals see a need for that as well and we'll support that, but we'd like to see it done right so that the government doesn't come up six months from now to introduce another piece of legislation that will take care of other areas, as they will. We believe there should be room in this legislation now that takes care indeed of how this new commercial information technology will affect the users and the consumers at the end. That is our problem.

For example, I believe there should be a tie-in there with respect to privacy, confidentiality and even how it may affect the powers of the Integrity Commissioner, that the powers of that commission, for example, will not be affected by this piece of legislation. If they are not included in Bill 88, how will we manage to safeguard those privacy and confidentiality issues, including the powers of the commissioner?

We do support it, but I believe those are issues we should be dealing with to make sure that when we go into the marketplace we use it not only conveniently, safely and properly but also in a legal manner, that we do not affect either the welfare or the benefits of the end users nor infringe on the confidentiality and privacy of those people as well.

Have you had enough time to look at Bill 88 with respect to those specific issues?

The Chair: You have 30 seconds.

Mr Doig: I looked it over quite a bit. We already have a legal infrastructure, I believe, to take care of it. Second, I think that sometimes you have to move forward and some of these things will become available to you. It's sometimes better to move forward and find some mistakes and correct them then than not to move forward for months and months on end and a lot of people suffer.

Third, I think that with privacy it sometimes gets blown out of proportion in the Internet sphere. If you go into a store like Gap and you buy a piece of clothing and you pay with your credit card, they have your information. Nothing safeguards you from a regular commerce act. They have your information, they have you on file as a customer, and they can do what they want with it. It could be the same, that you don't need to have any extra protection through e-commerce. The privacy act should be separate, in that if I visit a site just to visit it, you shouldn't be able to get my information. That's a different issue, not to do with e-commerce. With e-commerce it shouldn't be any greater privacy than you already have when you go down to the local hardware store, or whatever you want to do, and purchase, and I think that should be taken care of. If you think the local hardware shouldn't be able to sell your information or keep you on file, then that's a much broader context than this bill.

The Chair: Thank you very much, Mr Doig.

1250

E-WITNESS INC
MYTEC TECHNOLOGIES INC

The Chair: The next presenters are Janet Hebbes and Don Waugh of E-Witness and Mytec Technologies. Good afternoon.

Mr Don Waugh: I'd like to thank the committee for allowing us to do this presentation today. We are the last presenting group?

The Chair: Yes.

Mr Waugh: We moved forward. Would we be able to take a little bit more time?

The Chair: All of the delegations have been given half an hour, so if you can try to keep it within half an hour, we'd appreciate it. If you go a little over, I'm sure that we have a very flexible committee.

Mr Waugh: Thank you very much. I appreciate that.

We have a little agenda just to give you an outline of how we're going to approach this today. First, we thought we'd introduce ourselves and then talk about an application of the technology into a specific area. Of prime importance was to address confidentiality issues and then we wanted to review what PKI, digital signature technology, is and represents, in that it certainly is a technology that has been around for 20 years, to tell you the truth, and how it does provide protection to the consumer, protection that does not exist today.

Finally, we wanted to move into a demonstration of the technology that was developed by two Canadian companies, and we hope to be able to take a leadership position in the marketplace, and then to review the proposed legislation and some impediments to our success that we would like to have considered by the committee, if that's OK with you.

To introduce E-Witness, our roots actually go back to one of the centres of excellence, CRESTech, which is the Centre for Research in Earth and Space Technology. This centre of excellence actually helped establish the Internet in Canada back in 1988. Our company, Cool Water Internet Design-we have developed for a number of companies, but what has happened is that we have developed a technology that addressed some of the requirements or solving a problem for allowing doctors to prescribe medicine over the Internet. Rather than hide this in Cool Water as an Internet company, we have established a separate company called E-Witness to capitalize on this technology, bringing it to the marketplace, the Internet space, and delivering a full PKI solution through a standard Web browser, which I'll tell you more about later.

We've also included biometrics in our implementation with our partner, Mytec, and that's led to our first joint venture, the establishment of Pharma Trust, which is a trust that will allow doctors to prescribe medicine over the Internet.

I'd like to turn things over to Janet, who will just give you a little bit of background about Mytec.

Ms Janet Hebbes: Good afternoon, Madam Chair and committee members. My name is Janet Hebbes and I'm director of business development with Mytec Technologies. Mytec is a biometric firm. We decided to concentrate on fingerprints as the biometric that identifies you as an individual. John Gregory spoke just a few moments ago and was identifying that it could be either an iris scan or a face scan or voice recognition. One thing to qualify is that when you're using Mytec and their product-like the brand Campbell soup; their brand is called Bioscrypt-you will always know when you are giving your fingerprint. You will never be mistaken in giving your fingerprint without your knowing.

Mytec is a Canadian company. Two gentlemen who started out of Chubb security developed an alarm system company called Counter Force. Many of you may actually have it in your homes. It's a private security system. This was started in 1988. The company went public on the TSE in 1993. This year we sold off Counter Force for about $28 million. This was the cash cow that was sponsoring a lot of research and development for Mytec for our biometrics. We are going to the market with biometrics and our Bioscrypt as our algorithm, our software, and we're focusing on many of the different solutions, one of which John and his company have taken up.

I think everybody right now is very familiar with the different ways that you can authenticate who you are. If you take a look at this slide, many of us have PINs, personal identification numbers. This allows us access to our banks and to our credit cards. If you're in the office, you have to type in a password and you have to remember that password. In high security areas it could be very long, 120 digits. You sometimes have to write it down. We all have the debit cards. Those first two things are only as good as you protect them. If you lend it to someone or if it's stolen, that's how fraud happens. With the biometric, we use your fingerprint. It's very secure and it only authenticates that it's you.

That big word down there, non-repudiation, I wasn't sure what that was. We're going to get to that a little bit later so that we have a clear understanding.

Why biometrics? Biometrics makes it convenient, it makes it safe and secure, and it offers non-repudiation. Don's going to show you a little bit later on this product we have that we're taking out, and it's actually being used. We call this our Bioscrypt Enterprise. Here's what happens. Actually, it's very cool. It sounds like a James Bond thing, not to be glib. What you do is take your fingerprint. What Mytec uses is called pattern recognition. If you look at your fingertip, there are thousands of points there. We don't use minutia, which other competitors do. We make sure that we get a scan of your fingerprint. You would go through and enrol and say, "I'm Janet Hebbes." Then what it does is take either the PIN or the password that you have and it embeds that password into the scan of your fingerprint. It scrambles it up and it creates a Bioscrypt, so it's like a piece of the pie, it's like a jigsaw puzzle. Never, ever is the fingerprint left on the server. What happens is, when you want to access it, everything is happening in this one unit, this one device, the Bioscrypt. Nothing is staying on the server, which means very simply that it's very non-threatening. There's never an infringement on your personal identification. That's one of the coolest things they have.

We're using Bioscrypt Enterprise, and Don's going to show you how he's incorporated that with his technology. In addition to Enterprise, we're also moving more into the portable, the m-commerce, mobile commerce. We're looking at telephones, we're looking at Palm Pilots, we're looking at Research in Motion, so that when you're walking around you'll actually have your telephone. If you want to make a trade you first have to verify that it's you, Janet Hebbes, who's going to issue 50,000 shares; at 4 pm on the TSE I'm making that trade.

What is the non-repudiation? My broker calls me up the next day and says, "That stock's gone down, Janet, just so that you know, by 50%." If I try to deny that, they say, "No, we've authenticated it because it was your fingerprint that actually unlocked the key." We do this in a very safe and secure manner.

My point in going through all of this is that for government and for us to understand the implication for Bill 88, the most important thing is that it's secure already. This is not about convenience. This is about security; it's about privacy. This is already being done.

The next point I want to make is that there is no infringement on the individual, on the person, so as far as fraud there is no way of ever getting in and taking that fingerprint. This is why legislation should be passed so that we can allow not only consumers but businesses in the business-to-business section to be able to pass cheques and to do transactions such as the passing of deeds on-line. The technology is already here.

One of the ways you can see this-I think it's important for Don to share with you something he has used in conjunction with PKI, which is Public Key Infrastructure, not to get bogged down with the background of technology but to understand, as you've said, Tony, that the education is already there, it's already secure and it already looks at privacy.

Mr Waugh: One of the reasons we've chosen the Mytec device is because it did protect the fingerprint information. It did not release it. It actually encrypted it. It's called triple DES encryption, which means it's indestructible, impregnable. Not even the largest supercomputer in the world today could penetrate this script. It means the confidentiality of the user is 100% guaranteed.

This is a Mytec device. This device has its own key. It's in the firm where you can't see it, you can't release it, you can't gain access to it. When you enrol in this, you create a template of yourself to which to compare. Once the enrolment has been done, that fingerprint template is encrypted triple DES under this devices key. This means the only place you can actually decrypt that file is inside this device.

Ms Hebbes: Not on the server.

Mr Waugh: Not on the server. It's not being passed around. You're not passing around your biometric information.

When you go to authorize a transaction, you scan your fingerprint, creating a current value. It then decrypts the template from when you originally enrolled and compares the two inside this device. If it is positive, it will release your private key, releasing it to the on-line transaction.

We had to be very, very concerned when we originally developed this because we're dealing with patient data. There are 266 million prescriptions prescribed by doctors in Canada every year. You can imagine if that type of information got released; it would be a catastrophe to people's lives and professions. It would undermine the whole trust environment.

1300

This technology in the past has not been available. The core of PKI has been around, as I said, for 20 years. It was developed by RSA; RSA is where the original technology was developed down in the States.

The biometrics has been developed. What we needed to do was actually deliver it in such a way that it could be used by a doctor and a pharmacist and that it would basically address five principles. These principles were established by colleges of pharmacists across Canada, and those five principles were:

(1) A method to guarantee the confidentiality of the patient's information, that it could not be released to anyone other than the doctor and the pharmacist-no other person or organization.

(2) There had to be a method to authenticate the doctor. In Canada, the only persons who can prescribe medicine are the doctors themselves. They are licensed by the College of Physicians and Surgeons and one of their responsibilities is the prescribing of drugs. Because user names and passwords are so easy to give out-and there are many situations where the doctor has their user name or password on a sticky note on the terminal-it's very easy to release that. So the college required biometrics in order to authenticate the doctor 100% in the transaction.

(3) There had to be a method that would ensure the integrity of the script itself so it would not be subject to modification and duplication, because we are talking about the distribution of drugs in Canada.

(4) There had to be a method that would prevent the diversion of the script itself, so it couldn't be duplicated or diverted to another group, poly-pharmacying, poly-doctoring.

(5) Finally-and this was our challenge-we had to deliver this in a completely open architecture so that any doctor, any pharmacy could participate, regardless of operating system, regardless of network, regardless of the applications that they have deployed for managing their own internal operations. This is what led to the establishment of our PKI plug-in in a browser technology.

So there are basically two technologies at work here. One is the PKI; two is the biometrics. We had a choice of many other biometric companies to choose from. All the rest, by the way, are in the United States, which is important to note.

The E-Witness PKI plug-in for a browser-basically we are developing this in collaboration with the University of Toronto. Professor Ian Blake is a part of our algorithm development team. He is one of the leading experts in elliptic curve algorithm development, as well as standard RSA algorithms.

We have delivered it through a browser, which you will see shortly. It's simple to use. People understand what they're doing. It's being delivered through a browser. People understand that ubiquitous interface to many e-commerce applications, which means that it will support any e-commerce application. This is very important, because today there is no protection mechanism. If I order a stock over the Internet-and I've heard stories where a person claims they never made that order and they have no basis for arguing with their provider.

Ms Hebbes: Right, just like Visa. You can order a book from Amazon books, you get the book and it's already been charged to your Visa card. You get your book, you've got your statement, you call up Visa and you say, "I didn't order this book. Take the $50 off my Visa account," and they will do that.

Mr Waugh: Eight per cent of delivered goods are actually resulting in cardholder repudiation or cardholder-not-present types of situations, and it's 22% for digitally delivered products. There are businesses, there are retailers being hurt today by this lack of support, a lack of a methodology that gives the legal and audit backup to the transactions you're actually conducting.

So it's simple to use, with a low cost of deployment. We have the opportunity to change the way in which consumers are protected, both in terms of the transactions they're deploying on the Internet as well as the information itself. We've done that in collaboration with Mytec and using the biometrics for the private key release, which is the fundamentals of PKI. You have the public key, the private key. Has that been explained to you?

The Chair: No.

Mr Waugh: This is the whole basis of this act, the public and private key. The mathematics is really quite tremendous. It's very simple, but basically if I encrypt with my private key it can be decrypted using my public key, so that anyone decrypting that document that I've signed using my private key has the assurance that it was actually signed by me because I used my private key. It's 100% assured when we attach that key or integrate it into the biometrics for key release.

If I encrypt it under the recipient's public key, then I know as the sender that only that recipient can actually decrypt it, which was a fundamental principle of the doctor prescribing medicine over the Internet and the pharmacist receiving that. Only those two individuals could see this information.

What I'd like to do now is actually turn over to the demonstration. This is Rahim Alibhai. Rahim works with E-Witness, CoolWater, was the principal architect in the development of this technology. We do not intend to lose him to the United States. We do intend to make this company grow here in Canada. That was one of the principles of the centres of excellence. So if we could just turn it over to Rahim.

Ms Hebbes: The PKI companies, by the way, are companies like Entrust, and e-Scotia is very much involved in initiating PKI. So it would be also instrumental to get their opinions on the act.

Mr Waugh: Entrust has been working with the Canadian government and the Ontario government for the last 16 years and now has 40% market share of the PKI market and is one of the leaders in terms of the delivery of digital signature technology.

This is a demonstration of a doctor prescribing medicine over the Internet. As you can see, there is a standard Web browser using a standard Web form. Basically, the doctor would indicate who the patient is and this will eventually be connected into the physician practice management system, so it updates the doctor's patient file automatically, actually increasing the accuracy of the patient file and therefore probably the quality of health care. It's simply a matter of choosing the drug for the patient and then, rather than just hitting "submit," what we're doing is encrypting that information that's in the form and then sending it. Part of the encryption process is actually the signing of the document by the doctor.

In this particular case, we're going to authenticate ourselves here. We're a little nervous-our fingerprints are moist-because of the importance of the presentation.

Ms Hebbes: CIBC has been using biometrics, just as a point, as far as physical access into their buildings. You know how you have one of those pass cards to get into the building. You can give that pass card to anybody to get in but you still need your fingerprint to authenticate that it's you who's actually going in. So this biometrics as well, for your information, isn't new.

1310

Mr Waugh: This is leading-edge technology. It is part of the future.

If you'll bear with us during this period, we're going to try to do it. There we go. I scanned my fingerprint on the device. It took-

Mr Sergio: I don't think he was using his whole thumb before.

Mr Waugh: Maybe he used the wrong finger, which is nice about this technology. Say you're at an ATM machine and you've got someone with a gun to your head. With this technology I can switch fingers, and that could be my SOS finger, and let this transaction go through but send a 911 emergency call. There's a lot of things that you can do with this.

So I scanned my finger. It compared my finger to my biometric template which was imbedded in this device. It decrypted the template, compared the two, the two were equal and it released my private key to the process where it's taken that data-and, as you can see, it's come from Dr Don, but I don't know who the patient is. I can't see that, or the patient's address or telephone number. I do know what was prescribed by Dr Don but I don't know the dosage and I don't see the rest of the comments regarding the prescription itself. I'm going to go in as pharmacist Don since I was successful. Now, this is on the receiving side. I've identified myself as the pharmacist in this case.

This is actually coming off of the server that's in our offices in Toronto. This is not being retrieved locally.

Ms Hebbes: It's not canned. It's happening live.

Mr Waugh: The data, as you see, is still in its encrypted form. No one can read that unless they have the right keys. I'm going to once again authenticate. As a bona fide recipient, it's released my private key, allowing the data to be decrypted. We are protecting the patients' data and we can apply this to any consumer information, protecting the consumer but at the same time creating the legal environment that allows commerce to actually take place, which does not exist today, and that's my biggest concern from a business perspective. If JVC wants to receive a $500,000 order from Future Shop, with this technology we have the ability to make that legally binding for JVC.

Ms Hebbes: Right. And it's not just the Bioscrypt that allows it to be binding. Do you want to go through all that?

Mr Waugh: We have another one, but I'd like to address our particular concern about the legislation.

We've been working very hard for the last year and a half to solve these issues and we consider this legislation of prime importance to commerce in Canada-in Ontario-in protecting the consumer, in protecting the merchants, in establishing the legal environment under which our future can prosper. It's very important.

It's also catch-up legislation to the US and Europe. This technology has been around for 20 years-the RSA patent is actually being released; it's coming out of patent protection on September 20-and it's been the basis for many ways in which our armed forces and security organizations have protected information in the past.

It is the basis for electronic commerce and it's going to open up all sorts of opportunities for streamlining Canadian business operations, making us more productive and therefore increasing our standard of living. But I'm concerned. I'm concerned that the Elections Act has been kept out. With this technology we can allow shut-ins to vote, to participate in government. We can increase the frequency of their participation and we can make sure that you know it's coming from a person who has the right to vote.

I'm concerned that cheques are not allowed in here. You know, 1.8 billion ATM transactions are going through that are not protected, but 1.4 billion cheques are being processed every year here in Canada and they're being excluded. The cheque is the source of fraud in Canada. Companies are being hurt by employees who change the face of cheques and have them deposited in their own accounts. This technology would eliminate that.

Land transfers: With this, lawyers can be enrolled; we know who they are. They can do a land transfer on-line with this technology.

The message I would like to deliver is: Do not exclude these documents. If you can, include them. But if you can't include them specifically, include them subject to regulatory approval.

Ms Hebbes: And know that Mytec and E-Witness are only but a few companies that are in the same industry that are sharing the same technologies that make what you want to do possible, which is privacy security, no infringement on personal privacy.

We're open to taking any questions.

The Chair: Thank you for a very comprehensive presentation. I think we will allow one question, if you can try to keep it brief, please, members of committee. We'll go to the government side first.

Mr Wettlaufer: This doesn't really apply to the bill, but how would your technology apply to smart cards?

Ms Hebbes: I won't say where I was yesterday but it was pretty close to Bay and Wellesley. It applies very much to smart cards. We're very well aware of the Ontario smart card initiative that Angela Longo and her team are putting together. Mytec, as a biometrics company, can easily work in conjunction with a smart card. Let's just say that this is my smart card, and you have your chip that has your health insurance number, and maybe it has in the future your driver's licence number. If you want to have a Bioscrypt chip, a biometric chip on that smart card, it is easily applied there. If you only want to get information about health records from that smart card, technology will enable that to happen.

Mr Wettlaufer: It will ensure complete patient confidentiality?

Ms Hebbes: Yes, 100%, and ensure that Janet Hebbes, with the correct spelling and address, because of her fingerprints, is only getting access to those services once.

Mr Sergio: I have no particular questions, but thanks for coming down. It was a good presentation. It's good to know that that is available and on the market, and hopefully we can put it to good use some time. Thank you.

Mr Martin: It certainly was good to have an example of how this works so we can get our heads around it. We're not techies, we're politicians, and sometimes I have to confess to not having all the knowledge or the answers to lots of really important questions. So it was good that you showed this today.

I just wanted to tell you that yesterday we had the bankers come before us to say that they were very leery of this whole area of biometrics and they were happy that we had centred it out in the document as something that wasn't going to be included, because as far as they were concerned the refining of that technology is years out and it's not dependable and has not been developed to the point where it actually could be used in the way that you've suggested here today.

Ms Hebbes: That's good. I haven't been in to all the banks yet, but you can rest assured that I'm on a mission there and that the technology is there for biometrics.

Mr Waugh: I'd like to comment on that if I could. Changes to the Financial Administration Act-I'm not certain where it actually occurs, but you'll have noticed ATM machines are now white-labelled because basically the door was opened to competition with the banks.

The bank is really two things: a method for moving money and a place to park it. Banks in making that statement are speaking in their own self-interest, because the longer they hold those papers in place the longer they control the flow of money in Canada. This technology has matured where we can guarantee its movement and guarantee who signed it and what was actually signed. They are acting in their own self-interest to delay that legislation, and I'm very concerned about that.

Mr Martin: I can share with you their presentation to us and perhaps give you the name of the gentleman who presented so that you might have a discussion with him about that. It certainly would be helpful.

The Chair: Thank you very much, Ms Hebbes and Mr Waugh, and you too, Doctor. We really appreciate your submission this afternoon.

That concludes the public representations to committee. I will remind committee that amendments are due by September 22 at 5 pm; clause-by-clause consideration will be on October 2 at 3:30.

The committee adjourned at 1321.