Unwarranted Lawful Access

The new federal government is seeking to give law enforcement new investigative powers without judicial oversight. In an economy where nearly everything now is subscription based, giving these agencies the ability to demand data from any business about any client at any time on the mere reasonable suspicion of a possible future offence, without a warrant, may be taking things too far.

Michael Geist has been raising the alarm about Bill C-2 over the last few weeks and his analysis of the bill should be required reading for all legislators involved.

Bill C-2

Bill C-2 is officially described as “An Act respecting certain measures relating to the security of the border between Canada and the United States and respecting other related security measures.” The powers it expands, however, greatly exceed anything related to border security issues. Section 158 in particular amends the criminal code to give any law enforcement body the ability to demand ostensibly basic information from any “person who provides services to the public” — essentially any business doing anything in the country where there’s a vaguely identifiable client.

This ‘basic information’ enumerated in paragraphs 158(1)(a) to (e) of the bill is broad. It includes “whether the person provides or has provided services to any subscriber or client, or to any account or identifier,” “whether the person possesses or controls any information, including transmission data, in relation to that subscriber, client, account or identifier,” as well of the dates and locations of service, and, crucially, “the name or identifier, if known, of any other person who provides services to the public and who provides or has provided services to that subscriber, client, account or identifier and any other information, if known.”

This law only applies if, per 158(2), there are “reasonable grounds to suspect” that “an offence has been or will be committed under this Act or any other Act of Parliament; and” that “the information that is demanded will assist in the investigation of the offence.”

The trouble with all this isn’t that law enforcement agencies can request this information. In the normal course of a normal investigation into a crime such as, say, tax fraud, these are all reasonable targeted requests in the pursuit of essential information. The problem is that these are broad and intrusive powers with neither record-keeping nor oversight requirements.

Clause (e) requiring the disclosure of other businesses known to deal with the same client is of particular concern in the digital world. If we take it as written, it would allow a law enforcement agency to, for example, force a company like Meta (facebook) or Google to disclose all businesses that a particular user is known to have dealings with, without a warrant. With their marketing models based entirely on cross-platform tracking under surveillance capitalism, this isn’t “phone book information” but rather a comprehensive profile of each individual, crossing the corporate-law enforcement barrier. And that without any oversight.

The onus for judicial oversight is shifted entirely to the companies receiving these requests. Paragraphs 7-10 of section 158 allow someone who receives a request for information about their client to immediately notify the relevant agency of their intent to contest the request to a judge, and they then have five days to make a court application to do so (likely at significantly greater cost than simply complying).

However the production notice itself can have a deadline to comply of as little as 24 hours (paragraph 4); there is a prohibition on disclosure of the existence of the demand (paragraph 5); and it may be revoked at any time by the requesting agency (paragraph 6) meaning a contested notice can be withdrawn and, since there are no approval steps or record keeping required, simply reissued, voiding the challenge.

This blatant overreach could be easily resolved by keeping the onus on law enforcement to prove the need for the information in the first place, and it should definitely require a log of every time it is used that can be audited and subpoenaed. Section 159, the very next item in this bill, does require a warrant for the content of any client service. That information will be known to exist thanks to the dragnet collection enabled in section 158.

Taken together, this bill will allow law enforcement agencies to go on fishing expeditions looking for metadata patterns in digital subscriber and transaction information, magazine subscriptions, grocery store and gym memberships, real estate and automotive clients, and anything else one can imagine. The phrasing of the bill could just as easily be used to ask a barber whether a particular client cuts their hair there, and then compel the barber to disclose any other businesses that client is known to interact with. Any person doing business with any other person in Canada is covered by this bill and can be compelled to provide their basic customer information if it “will assist in the investigation” of an offence. Without any quantitative limits, the requests can be sent in a manner that simply iterates through all possible customers of all possible businesses. It risks becoming FINTRAC on steroids.

There is no limit on the quantity of data that can be collected in this manner, as long as the two conditions are met: that there’s a high probability of an offence being committed in the past or the future, and that this data will help investigate it. Both are so broad as to be utterly meaningless.

It means that law enforcement agencies can use the data they collect to build detailed profiles of the public on the level of what social media and digital marketing companies are already doing, with no judicial oversight except by the occasional business that will take the time to make a court application for each individual request — impractical if an agency wants, for example, data on every subscriber to a common service in a major urban area, ostensibly because an offence was committed in the vicinity and the information would help with the investigation.

Having such detailed profiles of the public will, without a doubt, assist in the investigation of numerous offences, and will probably expose ones that law enforcement agencies weren’t even aware of in the first place — but at the price of a broad curtailing of Canadians’ privacy and civil liberties.

As Geist documents, in the year 2011, over one million requests were made of just nine service providers at a time when law enforcement agencies had to pay a nominal fee to those providers to get this type of data, before it was shut down in the 2014 Spencer decision at the Supreme Court of Canada. Bill C-2 restores the access that court ruling took away, and removes the possibility of fees that had existed, avoiding another practical quantitative limitation.

Enabling this economy-wide fishing expedition and data gathering by law enforcement agencies in the pursuit of compliance with the criminal code or “any other Act of Parliament” is a patent violation of Canadians’ charter rights.

Law enforcement agencies have wanted these powers for a long time, and the new government may not recognise the dangers posed by Bill C-2. It will be up to Parliament to fix it at committee if it gets that far. They will need to amend section 158 of this bill to provide some kind of serious oversight and put limits on the abuse this bill not only enables but encourages in the spurious name of border security along one of the world’s safest borders.

At the very least, those powers require detailed record-keeping and judicial oversight.

Lawful Access on Steroids: Why Bill C-2’s Big Brother Tactics Combine Expansive Warrantless Disclosure with Unprecedented Secrecy