Telecom Commission Letter addressed to John Lawford (Public Interest Advocacy Centre)
Ottawa, 16 October 2020
Our reference: 8665-C12-202000280
BY EMAIL
Mr. John Lawford
Executive Director and General Counsel
Public Interest Advocacy Centre
285 McLeod Street, Suite 200
Ottawa, Ontario
K2P 1A1
jlawford@piac.ca
RE: Disclosure of Confidential Information - Unauthorized Mobile Telephone Number Transfers and SIM Swapping in Canada
Dear Mr. Lawford:
Unauthorized mobile telephone number transfers and SIM swapping is a public policy issue of great importance to Canadians. This letter addresses a request by the Public Interest Advocacy Centre (PIAC) for disclosure of information designated as confidential by the Canadian Wireless Telecommunications Association (CWTA) and various mobile carriers concerning this issue.
By letter dated 23 July 2020, PIAC requested under section 38 of the Telecommunications Act (Act) the disclosure of information concerning the measures being proposed by the CWTA to address unauthorized mobile telephone number transfers and SIM swaps, as well as data filed by mobile carriers on the number of unauthorized mobile telephone number transfers and SIM swaps.
PIAC noted that the Commission staff letter dated 17 July 2020 requested mobile carriers to confirm whether they and any affiliated mobile service provider would be implementing the measures set out in paragraphs 47 to 55 of the CWTA’s 14 February 2020 letter and the date by which these measures will be fully implemented. It also noted that the Commission had previously sent requests for information on this issue on 15 January 2020 and 28 May 2020.
PIAC stated that it was in receipt of the heavily redacted responses to these requests, as well as the responses regarding implementation of the CWTA’s proposed (confidential) measures to address SIM swap fraud. PIAC indicated that the responses failed to provide any meaningful information or the expected date of implementation of the CWTA and industry’s measures. Further, PIAC stated that the specific information and data being withheld is timely and relevant to SIM swap victims as consumers need access to these details to be able to provide input and raise any concerns they might have at this stage, rather than after the measures are implemented.
PIAC also reiterated that the Commission should issue a Notice of Consultation on the overall issue Footnote1 as it is the only process that would properly satisfy Canadians that: this serious fraud problem was being properly resolved in a manner that protects consumers to the maximum extent possible; the new requirements would not unduly impede mobile number transfer ability; consumers would have access to the information they need to protect themselves against unauthorized SIM swap and number transferring; and consumers and the Commission can ensure compliance and enforcement with any rules developed. In PIAC’s view, all stakeholders, including consumer groups and other competitive telecommunications service providers (including potential mobile virtual network operators) should be given an opportunity to be involved in the resolution of this problem in an open public proceeding with access to all content.
By letter dated 29 July 2020, Commission staff requested that CWTA and the mobile carriers respond to PIAC’s 23 July 2020 request for disclosure by 4 August 2020.
CWTA argued that the disclosure of their technical and procedural steps to be used to enhance the verification process would make this information available to parties engaged in fraudulent number porting schemes. CWTA submitted that even seemingly mundane details or the timing of the implementation could reveal important information for fraudsters, allowing them to adjust their schemes and defeat the intent of these new measures by circumventing them. As a result, the disclosure of such information could reasonably be expected to result in material gain for these bad actors and cause significant financial and reputational harm to Canadians who are targeted by these schemes. CWTA considers that these specific and direct harms overwhelmingly outweigh any public interest in disclosure.
The mobile carriers agreed with CWTA’s claim for confidentiality of the new validation process and the important risks that disclosure entail. Further, they argued that the harmful consequences associated with materialization of the risks resulting from disclosure would befall consumers, not wireless service providers.
Bragg Communications Inc., carrying on business as Eastlink, stated that there is no benefit to the public disclosure, and it will undermine the work that has been done to implement measures to prevent unauthorized mobile telephone number transfers and SIM swapping in Canada.
Rogers maintained its position that the public disclosure of this confidential information directly undermines the industry efforts to protect Canadian consumers from fraud. CWTA and TSPs would never publicly disclose details of steps the industry takes, or is contemplating taking, to prevent any type of fraudulent or criminal behaviour, including unauthorized ports and SIM swaps other than in confidence to the Commission.
SaskTel added that it acknowledged that providing information on the systems and procedures to be adopted to prevent unauthorized SIM transfers will provide information that may be used by those with good intentions such as PIAC. SaskTel stated however, this same information may be used by those with bad intentions such as criminals. Canadian service providers are working to provide a safe and secure system of number porting and SIM swapping. These service providers have their customers’ interests in mind.
The mobile carriers Footnote2 argued that releasing the data on the number of unauthorized mobile telephone numbers transfers and SIM swaps on the public record would provide competitors with access to highly confidential commercially sensitive information and which would allow them to develop new and more effective business plan and marketing strategies. In their view, the risks of disclosing far outweigh any limited benefit to the public.
Shaw Communications Inc. added that the release of the data on the volume of unauthorized mobile telephone number transfers and SIM swaps would be dangerous information to put on the public record. Service providers with a relatively large number of fraudulent ports and SIM swaps, as adjusted for their overall number of subscribers, would appear to be more vulnerable to additional fraudulent activity. Therefore, any benefit to Canadians earned by gaining access to fraudulent porting and SIM swapping volumes would be substantially outweighed by the increase in fraudulent activity that would inevitably follow from the disclosure of this data.
Commission Staff Analysis and Determination
The current request for disclosure was assessed in light of section 39 of the Act. In evaluating a request, an assessment is made as to whether the information falls into a category of information that can be designated confidential pursuant to section 39 of the Act. An assessment is then made as to whether there is any specific direct harm likely to result from the disclosure of the information in question and whether any such harm outweighs the public interest in disclosure. In making this evaluation, a number of factors are taken into consideration, including the degree of competition and the importance of the information for the purpose of obtaining a fuller record. The factors considered are discussed in more detail in Procedures for filing confidential information and requesting its disclosure in Commission proceedings, Broadcasting and Telecom Information Bulletin CRTC 2010-961, 23 December 2010, as amended by Broadcasting and Telecom Information Bulletin CRTC 2010-961-1, 26 October 2012 (Bulletin 2010-961) and section 39 of the Act.
Request for disclosure of new measures to address unauthorized mobile telephone number transfers and SIM swaps
Commission staff is of the view that it is in the public’s interest to know that the mobile carriers are taking the matter of unauthorized mobile telephone transfers and SIM swaps seriously and that they are actively engaged in resolving this issue. However, disclosure of information regarding technical and procedural steps to enhance the verification stage of the overall process would also make this information available to highly sophisticated parties engaged in fraudulent activities. The details of the measures being implemented would provide fraudsters with a better understanding of the processes intended to elude them and thus possibly allow them to adjust their schemes in order to defeat or circumvent the measures. As a result, the disclosure of such information could reasonably be expected to result in a material advantage for these bad actors and cause significant financial and reputational harm to Canadians and their service providers who experience these fraudulent activities. With the potential for significant financial loss arising from every unauthorized customer transfer and SIM swap incident, it is Commission’s staff’s view that there is a level of public harm that outweighs any public benefit in disclosing the details of the measures.
Having regard for the above and the circumstances in which the relevant information was filed with the Commission, Commission staff concludes that the specific measures being implemented to enhance the verification process for transfers of mobile telephone numbers and SIM swaps should not be disclosed.
Request for disclosure of data
In the circumstances of this case, Commission staff considers that the disclosure of the data on the number of unauthorized mobile telephone number transfers and SIM swaps would not meaningfully benefit the public interest.
In this regard, staff notes that the requested data is historical as it covers the period August 2019 to June 2020 and would not reflect the impact of the measures the mobile carriers have put in place since then, nor their initial (albeit suspended for a short period of time) roll-out of certain additional measures.
Given this, the data would shed little to no light as to the efficacy of the measures taken or contemplated but would rather serve to inform the question as to whether additional measures are needed to combat fraudulent activities, which the CWTA and mobile carriers have already agreed is the case.
Further, releasing the data on the number of unauthorized mobile telephone number transfers and SIM swaps on the public record would provide competitors with access to commercially sensitive information, or insights that might allow them to derive such information, and which might allow them to develop new and more effective business plans and marketing strategies. In view of this, the specific direct harm of the disclosure of the data to other competitive mobile carriers also outweighs the public interest in disclosure.
Therefore, Commission staff conclude that the data on the numbers of unauthorized mobile telephone number transfers and SIM swaps should not be disclosed.
PIAC’s request for a Notice of Consultation
Commission staff thanks PIAC for its letters and interest in protecting Canadian mobile consumers. However, in Commission staff’s view, based on reasons explained above, a public vetting of the measures intended to address the issue of unauthorized mobile telephone number transfers and SIM swaps may provide fraudsters with information and time to circumvent them before their effectiveness can be tested or proven.
In addition, it is doubtful that a proceeding will lead to measures that are much different from what the mobile carriers have already implemented or are in the process of implementing, but it most certainly could have for effect to create further delays in the implementation of protective measures, further increasing the potential harm to the public.
While the Commission will not be initiating a Notice of Consultation proceeding at this time, Commission staff will continue to monitor the implementation and assess the effectiveness of the measures taken by the mobile carriers to curb unauthorized mobile telephone number transfers and SIM swaps.
Sincerely,
Original signed by
Michel Murray
Director, Dispute Resolution & Regulatory Implementation
Telecommunications Sector
c.c.: Ursula Grant, CWTA, ugrant@cwta.ca
Eric Smith, CWTA, esmith@cwta.ca
Bell Mobility Inc., bell.regulatory@bell.ca
Bragg Communications Incorporated (carrying on business as Eastlink), Regulatory.Matters@corp.eastlink.ca
Rogers Communications Canada Inc., rwi_gr@rci.rogers.com
Saskatchewan Telecommunications, document.control@sasktel.com
Shaw Telecom Inc., Regulatory@sjrb.ca
TbayTel, rob.olenick@tbaytel.com
TELUS Communications Inc., regulatory.affairs@telus.com
Videotron Ltd., regaffairs@quebecor.com
Xplore Mobile Inc., carl.macquarrie@corp.xplornet.com
- Date modified: