Canada’s Bill C-22, the Lawful Access Act, has cleared another hurdle.
It would force not only telecoms but also “electronic service providers” – such as those offering messaging apps – to build in surveillance capabilities for the police and the country’s intelligence service, CSIS.
They would also have to obey confidential ministerial orders, and keep metadata of all their users, for up to six months, regardless of whether those users are suspected of any wrongdoing.
The bill passed the House of Commons on June 18, and on Thursday, the Senate gave it second reading and sent it to committee, meaning time is running out for Canadians to try to convince their lawmakers to reject or at least substantially amend it.
Canadian citizens can learn how to push back here.
Those who are now urging the senators to do just that are civil liberties groups, tech companies, and researchers.
They have a lot to object to, starting with the fact that the Senate chose to send the bill to the Standing Senate Committee on National Security, Defence and Veterans Affairs, on division, instead of the Legal and Constitutional Affairs Committee.
Conservative Senator Denise Batters, who is the critic of the bill and a member of the Legal Committee, is unhappy about this, saying, “What kind of study is the government now expecting from the Senate? A speedy rubber stamp?”
Fellow committee member, Senator Paula Simons, shared Batters’ sentiment: “I regret that it does not seem to be headed in that direction.”
Batters remarked that this is the seventh time a government has tried to pass a lawful access bill.
If it becomes law, C-22 would give the cabinet power to designate “core providers” and impose obligations on them, including installing and maintaining equipment and retaining metadata. This is defined as “the type, date, time, duration, origin, destination, or termination of an exchange” – so, in the case of a phone call, who called whom and for how long – but the government promises that it does not include web-browsing history or message content.
But Google, in a briefing note to senators, said the bill would allow for “general population-level bulk retention of metadata without requiring targeted, individualized suspicion” and that this “treats all users as potential criminals.”
Senator Simons said that “core providers” are not defined in the bill: “It tells you where to go to look for the definition, and then the page is blank.”
She also cited University of Calgary law professors who said that the US has no similar rules, while under C-22 “metadata on every single Canadian would be retained for six months.”
Batters tried to find out when exactly the first set of rules implementing the bill would be known, and was told by government officials that the first set of regulations would likely take 18 months to two years after the bill becomes law, and the rest in five years.
The cost of non-compliance is high: fines of up to $250,000 per violation, with each day a separate violation.
In June, Public Safety Minister Gary Anandasangaree’s amendments to the bill cut the retention period from one year to six months, and introduced a provision that no provider would have to decrypt data they do not hold the key to.
His spokesperson, Simon Lafortune, said the bill does not authorize indiscriminate surveillance, and that “making the technical details of ministerial orders public could potentially give criminals a roadmap to the capabilities investigators rely on.”
Batters is not satisfied with the reduced retention period, saying, “While this shorter timeline is better, it still does not solve the considerable problems with widespread data retention.”
Google is also not satisfied with the changes, saying that while they protect against directly breaking end-to-end encryption, there are other ways to undermine security.
Google also remarked that the secrecy around ministerial orders means that “if surveillance directives are made in secret, citizens cannot understand or scrutinize state power.”
Senator Colin Deacon, meanwhile, has calculated that more than 99% of Canadians “would be subject to Bill C-22’s weakened privacy protections to potentially assist in investigations involving fewer than 1%.”
Previously, we reported that Public Safety Minister Anandasangaree told police chiefs in March that the bill is “not about the surveillance of honest, hard-working Canadians going on about their daily lives.”
But under the bill, metadata of all users has to be kept for up to six months – which means that every Canadian who uses a phone or a computer is covered, regardless of whether they are suspected of any crime.
The provision to keep the records of every single citizen for six months, with the rules about who has to do it and how, to be revealed at some point in the future, means that the bill is very much about the surveillance of every Canadian.
And even if the minister says it is not, and even if the police chiefs may have been placated, tech companies that would have to implement the proposed law are not.
In October, Signal’s Udbhav Tiwari said that even the amended bill still allows for orders “that can be ruinous for encryption and privacy for all Canadians,” and that storing metadata “would fundamentally break Signal.” The company would rather leave Canada than comply.
Toronto-based VPN company Windscribe said that “in its current state, VPNs would almost certainly require us to log identifying user data.” The company added that it would move its headquarters out of Canada if the bill becomes law.
Proton, meanwhile, has already dropped plans to locate its North American headquarters in Canada. Government officials, however, told Batters that they do not take these threats seriously.
In an open letter, a number of tech companies told the government that “a backdoor for law enforcement is a backdoor for everyone.”
In July, US Senator Ron Wyden warned that the bill could allow Ottawa to secretly force American companies to help spy on Americans.
The rules on who has to build what capabilities, and how, will be written by the cabinet, years from now, and out of sight of current political and public debates.
A Senate committee is now the last place where the bill can be changed. If it passes as it stands, the surveillance infrastructure will be built first, and only then will the rules be written to regulate it.
