i-SIGMA – Canada Office 190 O’Connor Street, 5th Floor, Ottawa, Ontario K2P 2R3 Phone: 613-241-6000, ext 223 www.isigmaonline.org October 30, 2024 The Honourable Tony Dean, Senator Chair, Senate Standing Committee on National Security, Defence and Veterans Affairs Senate of Canada Ottawa, Ontario K1A 0A4 Dear Senator: As your Committee reviews Bill C-26,

An Act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts, i-SIGMA wishes to bring to your attention an often overlooked aspect of cybersecurity protection: ensuring discarded electronic devices are properly wiped of all personal and other critical information. By way of background, i-SIGMA was created in May 2018 following the merger of the National Association for Information Destruction (NAID) and PRISM International (Professional Records and Information Services Management).

NAID had always been the watchdog association for secure shredding operators worldwide and together with PRISM International the joint association now represents all four pillars of records and information management: physical records and information storage; data protection and media vaulting; digitizing and scanning; and confidential records and information destruction services. As such, i-SIGMA is the umbrella association for these professional privacy practices that stand united, heralding the proper information lifecycle management needed in today’s regulatory climate.

As part of our ongoing effort to keep governments apprised of emerging issues affecting privacy protection and public security, i-SIGMA and our sister associations around the world regularly conduct research into privacy and security risk factors. As a case in point, please find attached a press release from one of our founding associations detailing the results of the largest study to date looking at the presence of personally identifiable information on electronic devices sold on the second-hand market.

The study found that 40% of devices resold through publicly-available channels contained personal information. To ensure credibility, the study was conducted by a third-party forensics lab. Alarmingly, however, the investigation used only basic recovery methods, not sophisticated forensic examination – meaning the information obtained would be accessible to just about anyone. Among the information recovered was credit card information, contact information, usernames and passwords, company and personal data, and tax details.

The devices examined included mobile phones, tablets and hard drives. …/2 Page 2 i-SIGMA feels this study shows the importance of

a) ensuring that individuals and organizations take steps to ensure personal information is wiped from their devices before disposing of them on the resale or recycle market, and

b) that companies working in electronics recycling and/or resale abide by industry standards for the proper erasure of data. We believe these findings may have also identified a less thought about route to commit cyber crime and potentially to launch cyber attacks. This risk is only likely to increase with more electronic devices in circulation, which also means more devices eventually get sent for recycling or destruction. To be blunt, you don’t need a sophisticated hacker to bring down a system if instead that person can simply get all the information he needs from an old computer, tablet, phone, etc.

Furthermore, this is a threat that exists for both individuals and companies. While large organizations probably have strong systems in place to ensure discarded electronic devices are cleansed of data, that may not be the case for smaller businesses. Cyber criminals will often target the weakest link in the system, and that could well be the discarded devices of small businesses found on the second hand market (or sometimes just left on the curb).

As it pertains to Bill C-26, the most relevant finding from our work would be to ensure the cybersecurity programs that will be required under the Act include provisions for wiping old electronics of any personal or other information that could present a cyber risk. More generally, this is an area of cybersecurity protection that all individuals, businesses and organizations will have to keep in mind as more electronic devices enter the market – and then exit the market at the end of their lifecycle.

And as our organization has said for decades: information is only as secure as the weakest link in its lifecycle, and too often little attention is paid to the end of that lifecycle. To reinforce that point, consider the lifecycle of a paper document containing critical financial, security or personal information. An organization should have protections in place throughout its lifecycle, such as safe storage; clear policies on retention requirements; and then safe destruction and disposal when that information is no longer needed.

When it reaches the latter stage, you would not toss it into the trash or recycling bin because it contains valuable information that could be stolen. If someone did dispose of it carelessly in such a manner, all efforts to protect that information during the useful phase of its lifecycle would be negated. That is why attention needs to be paid to the end of the lifecycle; it is just as important as the other phases. Now consider that same document if it only ever exists in electronic form.

People are familiar with protecting their passwords and locking devices, but do smaller businesses know what do to with old electronics? This is a sophisticated area of information destruction and do-it-yourself attempts to cleanse devices are often insufficient, with the information still vulnerable to recapture. As such, when discarding electronics, individuals and organizations may be doing the equivalent of putting a box of critical financial or security information on the curb. …/3 Page 3 The above is not fiction.

In 2010, an audit conducted by the Privacy Commissioner of Canada found that Federal Government computers being donated to the Computers for Schools program had an alarming amount of sensitive personal data retained on them.1 I hope this information is useful, and we look forward to your deliberations on Bill C-26. Thank you for your time. Sincerely, Tony Perrotta Director, Canada, i-SIGMA www.isigmaonline.org Copies to: Members, Senate Standing Committee on National Security, Defence and Veterans Affairs Ms.

Ericka Paajanen, Committee Clerk 1 https://www.priv.gc.ca/en/opc-actions-and-decisions/audits/ar-vr_pidp_2010/ FOR IMMEDIATE RELEASE: Press Release: Personally Identifiable Information Found on 40 Percent of Used Devices in Largest Study To-Date Phoenix, Ariz., March 24, 2017 – The National Association for Information Destruction® (NAID®) announced today the results of the largest study to date of the presence of personally identifiable information (PII) on electronic devices sold on the second hand market. The study showed that 40 percent of devices resold in publicly-available resale channels contained PII.

NAID commissioned CPR Tools, Inc. to analyze the used devices, which included used hard drives, mobile phones and tablets. The current state of electronic storage has made it possible for nearly every adult to carry a form of data storage device. “As data storage is included in nearly every aspect of technology today, so is the likelihood of unauthorized or unintended access to that data” states CPR Tools CEO, John Benkert.

He goes on to say, “Auction, resell, and recycling sites have created a convenient revenue stream in used devices; however, the real value is in the data that the public unintentionally leaves behind.” While there have been similar studies over the past decade, the NAID study is unique insofar as the recovery process used to locate the data on more than 250 devices was, by design, not sophisticated nor was advanced forensic training required. All methods leveraged downloadable shareware.

Robert Johnson, NAID CEO, points out that while this study’s results show a decrease in data found compared to past studies, “NAID employed only basic measures to extract data; imagine if we had asked our forensics agency to actually dig!” He goes on to surmise that “40 percent is horrifying when you consider the millions of devices that are recycled annually.” PII recovered included credit card information, contact information, usernames and passwords, company and personal data, tax details, and more.

While mobile phones had less recoverable PII at 13%, tablets were disturbingly found with the highest amount at 50%. PII was also found on 44% of hard drives. In total, 40% of the devices yielded PII. The study included devices that had been previously deployed in both commercial and personal environments. Johnson cautions that the results are in no way an indictment of reputable commercial services providing secure data erasure. “We know by the ongoing audits we conduct of NAID Certified service providers that when overwriting is properly done, it is a trustworthy and effect process.

The problem lies with service providers who are not qualified and, too often, with businesses and individuals who feel they can do it themselves.” ABOUT NAID The National Association for Information Destruction (NAID) is the international watchdog and non - profit trade association of the secure destruction industry, which currently represents more than 1,900 member locations globally. NAID advocates for a standard of best practices across governments and by service providers as well as suppliers of products, equipment and services to destruction companies.

The mission of NAID is to promote the proper destruction of discarded information through education and to encourage the outsourcing of destruction needs to qualified contractors. For more information visit http://www.naidonline.org/, or follow us on Twitter and Facebook at @NAIDonline.