Five Top Tech Takeaways: Google Faces an Unexpected AI Competitor, AI Overreach at Work, Sam's Back, SEC's Climate Disclosure Rules, and Apple $2 billion Fine

From Oversight to Overreach? AI's Expanding Role in Monitoring Employees

Robo-Surveillance

In Canada, the rapid advancement of artificial intelligence (AI) has significantly increased the capabilities for workplace surveillance, including tracking employees' locations, monitoring their computer activities, and even assessing their moods during shifts. Despite the growing prevalence of such technologies, experts highlight a concerning lag in Canadian laws to adequately address these changes. Current legislation, such as Ontario's requirement for employers to disclose their electronic monitoring policies, provides limited protections for employees against intrusive monitoring practices. Critics argue that while AI can streamline hiring processes and offer career assistance, its use in employee surveillance often lacks transparency and can be excessively invasive. The federal government's Bill C-27 aims to regulate "high-impact" AI systems but is criticized for not specifically addressing worker protections. As AI technology becomes more entrenched in workplace practices, there is a pressing need for comprehensive legal frameworks that protect employees' privacy and rights in the face of pervasive monitoring.

Key Takeaways:

• AI-driven workplace surveillance is increasing in Canada, with technologies capable of tracking and analyzing employees' activities in unprecedented ways.
• Existing Canadian laws fall short in protecting employees from the potential overreach of these surveillance technologies.
• Calls for more robust legislation and clearer guidelines on the use of AI in workplace monitoring are growing, amid concerns over privacy and the invasive nature of such practices.

(Source: CTV News)

SEC Finalizes Climate Disclosure Rules for Public Companies

The Securities and Exchange Commission (SEC) has finalized new regulations that mandate public companies to disclose their direct greenhouse gas emissions and the climate-related risks that might significantly affect their financial health. This decision, emerging from a protracted two-year review and intense lobbying from various sectors, marks a significant but contentious step towards enhancing investor access to crucial climate-related information. While the SEC has opted to exclude the requirement for businesses to report their indirect (Scope 3) emissions—citing concerns over the complexity and burden of such disclosures—this move has attracted criticism from environmental advocates who argue that it significantly underrepresents the total emissions footprint of companies. Nevertheless, the rule aims to provide investors with consistent, reliable climate risk disclosures, encompassing direct operations and energy purchases (Scope 1 and Scope 2 emissions), and necessitates reporting on how climate-related events like wildfires and floods could materially impact companies.

Key Takeaways:

• The SEC has implemented new rules requiring public companies to disclose their direct greenhouse gas emissions and climate-related risks that could materially impact their financials.
• Indirect emissions reporting (Scope 3) has been excluded from the requirements, sparking criticism for underrepresenting companies' total emissions.
• Despite the controversy, the rule aims to enhance transparency and reliability in climate risk disclosures for investors.

(Source: The Wall Street Journal)

Apple's Antitrust Awakening: A $2 Billion Fine for Restricting Music Streaming Competition

The European Union has imposed a €1.84 billion ($2 billion) antitrust fine on Apple, marking its first-ever penalty against the US tech giant for anti-competitive practices. This historic fine was levied due to Apple's restrictions that prevented rival music streaming services, like Spotify, from informing iPhone users about cheaper subscription options available outside of the Apple App Store. The EU's competition and digital chief, Margrethe Vestager, criticized Apple for abusing its dominant market position, thereby denying European consumers the freedom to choose their music streaming services under fair terms. Apple countered the EU's decision, claiming it was made without credible evidence of consumer harm and stressed the competitive nature of the app market. Apple plans to appeal the fine, which constitutes 0.5% of its global annual turnover, arguing that it ensures a level playing field for all app developers on its platform. The fine includes a significant lump sum intended to deter not only Apple but other large tech firms from future violations of EU antitrust laws.

Key Takeaways:

• Apple has been fined €1.84 billion by the EU for antitrust violations related to its App Store practices.
• The fine targets Apple's restrictions on music streaming services, which hindered competitors from offering cheaper subscription options outside of the App Store.
• Apple disputes the EU's findings, citing a lack of evidence for consumer harm and plans to appeal the decision.

Et Tu, Walmart? The Unexpected AI Challenger to Google's Search Dominance

Walmart's introduction of generative AI search capabilities marks a significant move in the retail industry, potentially challenging Google's dominance in the search engine market. Walmart CEO Doug McMillon highlighted the rapid improvement and customer-focused enhancement of the search experience within Walmart's app, powered by generative AI. This innovation not only streamlines shopping for events by providing comprehensive, theme-based recommendations but also establishes Walmart as a technological frontrunner in retail. The shift towards AI-enhanced searches by retailers like Walmart and others suggests a changing landscape where traditional search engines may lose their grip on the initial stages of the consumer shopping journey, as these platforms can offer more targeted, efficient, and intuitive shopping experiences directly within their ecosystems.

Key takeaways:

• Walmart's generative AI search feature aims to simplify event planning and shopping, challenging traditional search engine models.
• This move reflects Walmart's strategic emphasis on technology and innovation to stay ahead in the retail sector.
• The evolving AI search capabilities among online retailers could diminish Google's role in the initial steps of consumer shopping, potentially altering the search and shopping ecosystem.

(Source: CNBC)

Sam's on Board: OpenAI Announces Board Expansion and Enhanced Oversight Measures

OpenAI has announced the integration of three new board members and the reinstatement of CEO Sam Altman following an independent review by WilmerHale, which concluded that Altman's previous firing was unjustified. The investigation revealed no concerns over product safety, OpenAI's financials, or development pace but highlighted a trust breakdown between Altman and the former board. The review criticized the board's hasty decision-making process and lack of full inquiry. Altman, acknowledging his missteps in handling disagreements, has committed to improving his approach. The board's decision to reappoint Altman is accompanied by governance enhancements, including new guidelines and a whistleblower hotline, aiming to strengthen accountability and oversight within the organization.

Key takeaways:

• An independent review found Sam Altman's firing by the previous OpenAI board was unwarranted, attributing it to a trust breakdown rather than product or financial concerns.
• OpenAI reinstated Sam (as a Board Member) and has introduced three new board members and implemented governance enhancements, including new guidelines and a whistleblower hotline. Per Ars Technica, they include: "The newly appointed board members are Dr. Sue Desmond-Hellmann, former CEO of the Bill and Melinda Gates Foundation; Nicole Seligman, former EVP and global general counsel of Sony; and Fidji Simo, CEO and chair of Instacart."
• Sam Altman has acknowledged his mistakes in dealing with board disagreements and committed to handling such situations with more grace in the future.

(Source: Ars Technica)

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist who is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else. This post was written with the assistance of an AI language model. The model provided suggestions and completions to help me write, but the final content and opinions are my own.

Fiona’s Fury: Flashback to Summer’s Great Rogers Outage (Part 1)

Canadians continue to pick up the pieces after tropical storm Fiona battered the maritime provinces. Although estimates of the damage are yet to be calculated, the “Nova Scotia Premier Tim Houston announced over C$40 million ($29.1 million) in support to help those who were impacted by Fiona” (link). In terms of cellphone outages, CBC reported that “there are still areas of the province without cellphone service Monday although companies declined to say exactly  how many customers have been affected.”

 

The Canadian Radio-television and Telecommunications Commission (CRTC) has asked for estimates on how many people were affected by the outage, but the telecom companies are reticent to share this information. As CBC reported: “Bell and Telus asked for some of their submissions to be redacted, while Eastlink and Rogers demanded their entire reports be kept confidential.”

Photo by Pixabay: link

 

Rogers Outage in Review: What happened last summer?

When looking at the outage that hit the Maritimes, it reminds us of the situation that unfolded over the summer. In July 2022, the Rogers outage was not limited to the East Coast. Instead, it affected the entire country. When Rogers was requested to explain what happened, it appears that they had a more conciliatory tone:

“Rogers Communications Canada Inc. (“Rogers”) is in receipt of a letter containing Requests for Information (“RFIs”) from the Canadian Radio-television and Telecommunications Commission (“CRTC” or the “Commission”), dated July 12, 2022, concerning the above-mentioned subject. Attached, please find our Response to that letter… At the outset, Rogers appreciates the opportunity to explain to the Commission, the Government of Canada and all Canadians what transpired on July 8^th, 2022.  The network outage experienced by Rogers was simply not acceptable. We failed in our commitment to be Canada’s most reliable network. We know how much our customers rely on our networks and we sincerely apologize.” [Emphasis added]

 

Though the documented was redacted, it did provide some background as to what happened. For this post, we will take a look at the outage itself. For the next post, we will look at the lessons learned.  

 

Cause of the outage

Rogers explained the cause of the outage as follows:

“Given the magnitude of the outage, it appears that Rogers had to be more forthcoming with what happened and were “Maintenance and update windows always take place in the very early morning hours when network traffic is at its quietest. At 4:43AM EDT, a specific coding was introduced in our Distribution Routers which triggered the failure of the Rogers IP core network starting at 4:45AM… The configuration change deleted a routing filter and allowed for all possible routes to the Internet to pass through the routers. As a result, the routers immediately began propagating abnormally high volumes of routes throughout the core network. Certain network routing equipment became flooded, exceeded their capacity levels and were then unable to route traffic, causing the common core network to stop processing traffic. As a result, the Rogers network lost connectivity to the Internet for all incoming and outgoing traffic for both the wireless and wireline networks for our consumer and business customers.” [Emphasis added]

In other words, the change inadvertently resulted in an attack pattern similar to a denial-of-service attack – where the network shutdown because it became overwhelmed with traffic.

They also go on to explain that the company “uses a common core network, essentially one IP network infrastructure, that supports all wireless, wireline and enterprise services. The common core is the brain of the network that receives, processes, transmits and connects all Internet, voice, data and TV traffic for our customers… Certain network routing equipment became flooded, exceeded their memory and processing capacity and were then unable to route and process traffic, causing the common core network to shut down.” The implication being that the common core network became a single point of failure.

 

What was and was not impacted

With respect to Rogers Bank (yes, Rogers operates a bank):

“The impact to the Bank’s customers was minimal as the Bank services were available and the Bank’s customers were able to transact on their Rogers Bank credit cards. There was no interruption in the Bank’s core systems (credit card processing, Interactive Voice Response (“IVR”), Call Centre and customer self-serve mobile application) and these core systems remained available to the Bank’s customers. No critical Bank systems were impacted, and all daily processing was completed as required, including by the Bank’s statement printing vendor and its card personalization bureau which received their daily files and were processing them per standard service level agreements and procedures.”

 

This was a different story for those that relied on Rogers phone lines to process payments at their businesses with Interac tweeting:

“There is a nationwide Rogers outage that encompasses all their business and consumer network services. This is impacting INTERAC Debit and INTERAC eTransfer. INTERAC Debit is currently unavailable online and at checkout..”

 

Beyond the millions who had no service, emergency communications were also impacted:

• “Unfortunately, the outage of July 8^th did impact 9-1-1 service across Rogers’ service area, to both wireline and wireless services.
• Wireline impact:  There were approximately [REDACTED] 9-1-1 calls placed successfully across Rogers’ network on July 8th.  The typical daily average of total wireline 9-1-1 calls is [REDACTED] per day. Data is unavailable for unsuccessful wireline 9-1-1 calls.  On July 9^th, there were approximately [REDACTED] 9-1-1 calls placed successfully across Rogers’ network.
• Wireless impact: As can be seen in table below, the outage similarly affected wireless 9-1-1. Total successful calls were [REDACTED] the average daily amount of about [REDACTED] 9-1-1 calls made from Rogers wireless devices.”
•  

Rogers offered service outage credits

The key remedy offered was service credits, but this was not due to breaches in service agreements:

“There was no breach of our service agreements with our retail customers. However, in order to address our customers’ disappointment with the outage, Rogers has already announced it will be crediting 5 days of service fees to its customers. This will be applied automatically to their next invoice.”

 

Cooperation with Bell and Telus

Regardless of the highly-competitive nature of the business, it does appear the Rogers, Bell and Telus were coordinating with each other:

• “On July 17th, 2015, the Canadian Telecom Resiliency Working Group (“CTRWG”), formerly called Canadian Telecom Emergency Preparedness Association, established reciprocal agreements between Rogers and Bell, and between Rogers and TELUS, to exchange alternate carrier SIM cards in support of Business Continuity.”
• “As we stated in Rogers(CRTC)11July2022-1.xviii above, our Chief Technology and Information Officer reached out to his counterparts at Bell and TELUS early on July 8th. Assistance was offered by both Bell and TELUS. However, given the nature of the issue, Rogers rapidly assessed and concluded that it was not possible to make the necessary network changes to enable our wireless customers to move to their wireless networks.”
• “Rogers, Bell and TELUS are presently assessing potential options and will report further findings and potential solutions per the creation of the Memorandum of Understanding that will be delivered in September 2022 to the Minister of ISED by CSTAC.”

In closing, the outage comes down to change management. The error was exacerbated by the industry-standard approach to using a single platform to provide the various telecommunication services. Rogers did offer service credits, but were careful to note that this was not due to breach of agreements. Finally, the industry does come together during crisis situation, putting their competitive differences aside. 

In our next post, we’ll take a look at the lessons learned from this outage. Stay tuned!

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else.