Alarming privacy threats are buried in the Liberal border bill

Globe and Mail

2 days ago

Michael Geist holds the Canada Research Chair in internet and e-commerce law at the University of Ottawa's faculty of law.
A border security bill tabled by the Liberal government this week will have wide reach far beyond the 49th parallel. Buried in the massive bill are provisions to allow law enforcement to access information about internet subscribers without a warrant. While there may be a case for new police powers in the digital era, these should be presented in their own bill and be debated on their own merits.
The pressure from Canadian law enforcement for access to internet subscriber data dates back to 1999, when government officials began crafting proposals that included legal powers to access surveillance and subscriber information. What followed were a series of lawful access bills that sparked opposition, both from the public and in the courts.
For example, in 2012, then-public safety minister Vic Toews infamously said to Francis Scarpaleggia, now the Speaker of the House but then a critic of an internet surveillance bill, that he could 'stand with us or with the child pornographers.' The comment did not help his case, and the overwhelming negative publicity pressured the government to quickly backtrack by placing the lawful access bill on hold.
Border security bill would give law enforcement access to internet subscriber information without a warrant
Liberal government's Throne Speech passes as Carney survives first major test of confidence
The lawful access campaign was effectively derailed for a decade by the Supreme Court of Canada in 2014, when it ruled that there was a reasonable expectation of privacy in internet subscriber information. It doubled down on that ruling last year, expanding the privacy safeguards by adding that IP addresses were similarly protected.
The Strong Borders Act seeks to circumvent these decisions by creating a new 'information demand' power for law enforcement that does not require court oversight. The new power targets information about a subscriber, such as whether they use a particular internet service and if the provider has data about their usage. The provider may also be required to disclose where and when the service was used, as well as information about any other services the subscriber used to communicate.
This is akin to law enforcement approaching a bank to demand if a particular person is a client and whether there is information about their account transactions, and which branches were used, but stopping short of asking for the actual account information. There are obvious privacy implications here that are certain to result in a legal challenge, should the bill pass in its current form.
In most cases, obtaining further subscriber information will still require a warrant. The government is turning these into global production orders as it seeks to loop in foreign providers as well. This means that potential warrant targets extend well beyond Canadian internet and telecom providers to also include international platforms.
Ottawa to overhaul financial-crime laws in new border security bill
The standards for obtaining these production orders should give pause. This bill makes it easier to pass the threshold when compared with previous proposals, since law enforcement only needs to suspect that an offence has been or will be committed. Moreover, these orders can be applied to any Act of Parliament, granting law enforcement exceptional powers to pursue internet subscriber information for everything from Criminal Code violations to camping in national parks without the necessary permit.
The bill introduces a new term – 'electronic service provider' – that is presumably designed to extend beyond telecom and internet providers by scoping in internet platforms such as Google and Meta. Those international services are now key players in electronic communications (think Gmail or WhatsApp), though some may be beyond this form of regulation, such as Signal.
All electronic service providers are subject to obligations to 'provide all reasonable assistance, in any prescribed time and manner, to permit the assessment or testing of any device, equipment or other thing that may enable an authorized person to access information.' Moreover, all are required to keep such requests secret.
Electronic service providers that the government views as 'core providers' are subject to additional regulations that effectively grant law enforcement direct access to their systems for the purposes of communications retrieval and interception. This is a revival of old proposals in which law enforcement sought access to the systems of Canada's major telecom and internet providers.
These provisions will sound technical to most Canadians, and are seemingly designed to escape notice at the end of a 140-page bill purportedly about a safer border. But Bill C-2 is far from just a border bill. The government and law enforcement are running back a decades-old warrantless access playbook that should be roundly rejected as it trades a border crisis for a privacy one.