In February 2012, then Public Safety Minister Vic Toews introduced Bill C-30, the "Protecting Children From Internet Predators Act." While the government marketed the bill as an attempt to protect children from Internet predators (and infamously accused opponents of siding with child pornographers), it soon became readily apparent that the bill was really about adopting a wide range of measures that increased police powers, stripped away privacy rights, and increased Internet surveillance. The overwhelming negative publicity led the government to put the bill on hold. Earlier this year, then-Justice Minister Rob Nicholson announced that Bill C-30 was dead:
We will not be proceeding with Bill C-30 and any attempts that we will continue to have to modernize the Criminal Code will not contain the measures contained in C-30, including the warrantless mandatory disclosure of basic subscriber information or the requirement for telecommunications service providers to build intercept capability within their systems. We've listened to the concerns of Canadians who have been very clear on this and responding to that.
Nicholson's commitment lasted less than a year (the same was true on lawful access in 2007, when Stockwell Day promised no warrantless access to subscriber information only to have Peter Van Loan backtrack a year and a half later). Yesterday, Peter MacKay, the new Justice Minister, unveiled Bill C-13, the Protecting Canadians from Online Crime Act. The similarly-named bill is now marketed as an effort to crack-down cyber-bullying, yet the vast majority of the bill simply brings back many (though not all) lawful access provisions.
There were hints that this might be the government's plan. In October 2012, the Canadian Association of Chiefs of Police renewed its call for lawful access (the bill was still on hiatus at the time), shifting away from child predators to cyber-bullying:
Criminal bullying is extremely concerning to all Canadians, especially the parents of young children, and Bill C-30 also provides new legislation to help police intervene and investigate cyber bullying in their early stages to prevent needless tragedy. The Bill makes it an offence to use telecommunications, including social media and the Internet, to injure, alarm and harass others.
As I noted at the time, the government had not mentioned cyber-bullying in any of its materials on Bill C-30. In April 2013, Jesse Brown noted that cyber-bullying might lead to a reboot of the lawful access bill. Rumours this fall that lawful access might be on the agenda started when Peter MacKay gave a speech in August indicating that cyber-bullying legislation could be forthcoming. As I blogged on August 26th, the press reported that:
MacKay said he also won't be intimidated or deterred from considering new lawful access provisions despite privacy concerns that ultimately led to the death of previous bills.
MacKay was asked about the issue in a Hill Times piece in September with a spokesperson confirming the latter part of the Nicholson's commitment, but not the first part:
"[W]e have no plans to move forward with measures related to the warrantless mandatory disclosure of basic subscriber information or the requirement for telecommunications service providers to build intercept capability within their systems."
Of course, Nicholson's commitment went further than that since he stated that attempts to modernize the Criminal Code would not include measures contained in Bill C-30. The government has simply ignored that commitment by focusing on cyber-bullying and claiming that the remaining provisions are a response to the Federal/Provincial/Territorial Ministers Responsible for Justice and Public Safety June 2013 report on cyber-bullying that recommended bringing back lawful access:
The Working Group strongly recommends that the Federal Government enact investigative tools and procedures which will enable law enforcement to keep pace with modern technology, similar to those elements which have previously been introduced by the Federal Government.
With that foundation, Bill C-13 includes several provisions designed to target cyber-bullying and dozens of pages of reforms that come straight from prior lawful access bills. The bill excludes warrantless mandatory disclosure of basic subscriber information and the requirement for telecommunications service providers to build intercept capability within their systems, yet that is cold comfort given the Snowden revelations about ubiquitous surveillance that may include access to subscriber information and the collection of seemingly all Internet and communications traffic.
Cyber-bullying
As for the cyber-bullying provisions, David Fraser does a good job of parsing the legislation, which focuses on creating an offence for:
Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty
(a) of an indictable offence and liable to imprisonment for a term of not more than five years; or
(b) of an offence punishable on summary conviction.
The law also includes the prospect of an Internet ban for offenders, with Section 162.2 allowing a court to prohibit someone convicted under the law from using the Internet or other digital networks.
Criminalizing Software
Once the cyber-bullying provisions are done, the bill includes a wide range of computer-related provisions and new warrant powers. For example, the Criminal Code will be expanded to cover computer programs (currently limited to devices) that can be used to gain access to telecommunications service without payment or lawful excuse (this would include a cable television service, wifi service, Internet services, or phone service) or cause mischief such as interfering or obstructing lawful use of computer data. The expanded provision may mean that coding such a program or merely downloading it will now be a criminal offence.
Harassing Emails
The bill also expands provisions covering false messages or harassing communications. The harassment provision is drafted in a very broad manner, suggesting that multiple harassing communications to a person would be a crime:
Everyone commits an offence who, without lawful excuse and with intent to harass a person, repeatedly communicates, or causes repeated communications to be made, with them by a means of telecommunication.
One can certainly envision repeated emails from an angry constituent or customer now falling under the Criminal Code. The law currently restricts harassment to telephone calls.
Warrant Powers - Metadata
The new warrant powers include a new court-ordered preservation warrant and order requiring the recipient to preserve computer data. There is also a new court-ordered production order, requiring recipients to produce a document in their possession. The production order links closely to a reduced standard for accessing metadata. The bill includes a provision defining "transmission data", which covers the much-discussed metadata created from telecommunications. The production order can be used to order to production of any transmission data (ie. metadata). The standard is lower than for other warrants.
Ironically, the lower standard for metadata comes just as the Supreme Court of Canada has warned that "it is difficult to imagine a more intrusive invasion of privacy than the search of a personal or home computer" in the R. v. Vu case. The court specifically points to metadata as one of the reasons why:
Most browsers used to surf the Internet are programmed to automatically retain information about the websites the user has visited in recent weeks and the search terms that were employed to access those websites. Ordinarily, this information can help a user retrace his or her cybernetic steps. In the context of a criminal investigation, however, it can also enable investigators to access intimate details about a user's interests, habits, and identity, drawing on a record that the user created unwittingly: O. S. Kerr, "Searches and Seizures in a Digital World" (2005), 119 Harv. L. Rev. 531, at pp. 542-43. This kind of information has no analogue in the physical world in which other types of receptacles are found.
While this discussion is in the context of a personal computer, the same metadata may be generated on the ISP side.
Warrant Powers - Location Data
The bill also creates new tracking orders, which involves data that relates to the location of a transaction, individual or thing. The production order can also be used to obtain tracking data as well as financial data. The tracking orders can also be used to install tracking devices.
Ban on Disclosure of Warrants
The bill grants a judge the power to prohibit the disclosure of the existence or content of a preservation order or production order. The judge must be satisfied that disclosure would jeopardize the investigation.
Voluntary Disclosure With Legal Immunity
The bill also encourages telecom companies, ISPs, and others to disclose information on their customers without a court order. The bill establishes immunity from criminal or civil liability for such disclosures. The bill states:
(1) For greater certainty, no preservation demand, preservation order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving or to voluntarily provide a document to the officer that the person is not prohibited by law from disclosing.
(2) A person who preserves data or provides a document in those circumstances does not incur any criminal or civil liability for doing so.
This particular provision is enormously problematic as it opens the door to cooperation on the widespread surveillance revealed by the Snowden documents. It has become increasingly clear that many telecom companies willingly provided millions of documents on their subscribers. With this immunity in hand, Canadian telcos could "voluntarily" provide surveillance data without fear of any liability.
There are also pages of forms and provisions on mutual legal assistance (along with a very confusing set of coordinating amendments that involve the anti-spam legislation - I could not figure out what they mean).
Law enforcement have been asking for some of these provisions for many years and there could be a good debate on the merits of many of the proposed reforms. As this post suggests, some of the provisions raise some serious concerns. Yet the government is signalling that it would prefer to avoid such debates, wrapping up the provisions in the cyber-bullying flag and backtracking on a commitment made earlier this year to not bring forward Criminal Code amendments that were contained in Bill C-30.
