Overview:
This is the third article in a series examining recent government bills or laws that experts say deserved more scrutiny.
Canada’s latest privacy battle is being fought over information most people never see: metadata showing their movements, contacts and online activity.
Bill C-22, the Lawful Access Act, would give police new tools to investigate people using telecom or digital services, and could compel these providers to assist in this process.
The bill passed the House of Commons on June 18 after the Liberals cut short line-by-line review of the bill. It is now awaiting second reading in the Senate.
University of Ottawa Law Professor Michael Geist says the bill aims to address a legitimate problem: police can struggle to obtain digital information quickly and efficiently during their investigations.
But not all of the government’s proposed powers are justifiable, Geist says.
“The government can be right and at the same time still propose provisions that are problematic, potentially unconstitutional and go beyond the need,” he said.
The bill’s metadata retention provisions could have “the effect of creating the equivalent of a surveillance map of all Canadians that applies, effectively, retroactively.”
New powers
Broadly, Bill C-22 does two things: it introduces new police powers and imposes new requirements on tech and telecommunications companies.
The bill would enable police to require a telecommunications provider to confirm — with a yes-or-no answer — whether it serves a particular person.
Geist considers that a “pretty reasonable request,” since police may otherwise spend significant time seeking an order from a company that does not have relevant information.
More controversially, police could seek court orders compelling service providers to disclose information associated with a subscriber’s account, including their name, email address and details about the services they use.
To obtain the order, police would only need to show they have reasonable grounds to suspect the information would help an investigation — a lower legal bar than is typically required for police searches.
A Public Safety Canada spokesperson said this rule would help police identify or rule out witnesses, victims and suspects before taking more intrusive steps, such as executing a search warrant.
Rules for companies
Bill C-22 would also enable the government to require certain tech and telecommunications companies to have the technical capacity to extract and provide customers’ metadata to police.
Providers could be required to retain customers’ metadata for up to six months.
Metadata does not include the explicit substance of a message. But it can reveal information such as someone’s location, contacts, or use of devices.
Metadata can expose routines, relationships, workplaces and possible political or religious affiliations, says Cynthia Khoo, a digital rights researcher at the University of Toronto’s Citizen Lab.
“ When you think about what metadata is, that would basically be giving law enforcement access to people’s locations and who they talk to,” she said. “From there, you can instantly see how that might have a disproportionate impact on historically marginalized groups.”
The House of Commons did amend the bill to limit some of these provisions.
But Tamir Israel, director of the Canadian Civil Liberties Association’s privacy, surveillance and technology program, says the bill still introduces cybersecurity risks.
“ We refer to these [technical] capabilities as ‘backdoors’ because what they are essentially doing is creating a door in an otherwise secure service to data that is currently not accessible, under the assumption that only police are going to be using that door,” he said.
“We know for a fact that every time you create one of these backdoors, other people are going to use it,” he said, noting foreign intelligence agencies, hackers or other malicious actors could exploit these vulnerabilities.
A rushed review
Critics have raised concerns that Bill C-22 did not receive sufficient scrutiny from members of Parliament.
The House public safety committee heard from 61 witnesses and received 57 written briefs, which did lead to various amendments.
But MPs’ clause-by-clause review of the bill was cut short before they could fully discuss the changes.
On June 17, the Liberals adopted a motion ordering the committee to reconvene within one hour. The motion said that if clause-by-clause review was not completed within 30 minutes, remaining amendments would be deemed moved and put to successive votes without further debate.
The committee completed its review and returned the amended bill to the House in the early morning of June 18. The House passed it later that day.
Geist says MPs’ questions showed they were still struggling to understand how parts of the system would operate.
Israel notes that some submissions were not translated and circulated early enough to inform amendments.
“ Other types of services — like virtual private networks, that are clearly impacted by this — just never got to even participate in the process.”
The Senate can now amend the bill or conduct a longer study.
“The government decided it was more important to pass the bill than actually discuss the amendments and provisions that were being proposed,” Geist said.
“It looked like it was really just interested in being able to check off a box … as opposed to getting the bill right.”
There are pros and cons to this. Pro: being able to use a person’s Metadata to locate them them if they’re missing, go after criminals, follow criminal affiliations. Neg: corrupt police could use it for discrimination and hate targets. Something needed to be done. Not sure if this was the right way but where there’s a will, someone will find a negative way to abuse any law