My first post on the privacy threats in Bill C-13 focused on the voluntary disclosure of personal information and the complete civil and criminal immunity granted to intermediaries such as ISPs and telecom companies that provide such disclosures. This post focuses on the low threshold the bill establishes for a new “transmission data” warrant and explains why this represents a serious privacy risk.
The bill defines transmission data as data that:
(a) relates to the telecommunication functions of dialling, routing, addressing or signalling;
(b) is transmitted to identify, activate or configure a device, including a computer program as defined in subsection 342.1(2), in order to establish or maintain access to a telecommunication service for the purpose of enabling a communication, or is generated during the creation, transmission or reception of a communication and identifies or purports â€¨to identify the type, direction, date, time, duration, size, origin, destination or termination of the communication;
(c) does not reveal the substance, meaning or purpose of the communication.
The bill creates a new warrant that allows a judge to order the disclosure of transmission data where there are reasonable grounds to suspect that an offence has been or will be committed, the identification of a device or person involved in the transmission will assist in an investigation, or will help identify a person. The government relies on the fact that this is a warrant with court oversight to support the claim that Canadians should not be concerned by this provision. Yet the reality is that there is reason for concern as the implications of treating metadata as having a low privacy value is enormously troubling.
most browsers used to surf the Internet are programmed to automatically retain information about the websites the user has visited in recent weeks and the search terms that were employed to access those websites. Ordinarily, this information can help a user retrace his or her cybernetic steps. In the context of a criminal investigation, however, it can also enable investigators to access intimate details about a user’s interests, habits, and identity, drawing on a record that the user created unwittingly: O. S. Kerr, â€œSearches and Seizures in a Digital Worldâ€ (2005), 119 Harv. L. Rev. 531, at pp. 542-43. This kind of information has no analogue in the physical world in which other types of receptacles are found.
In recent months, there have been numerous articles, reports and studies on the privacy value associated with metadata:
- A Stanford study recently found that researchers could predict romantic relationships automatically using only phone metadata.
- Ron Deibert highlights an MIT study that examined months of anonymized cellphone data and found that only four data points were needed to identify a specific person 95 percent of the time.
- Susan Landau points out that metadata can reveal locational information, medical information, or important business information.
- Jay Stanley and Ben Wizner identify studies that have found that sexual identify can be guessed based on Facebook metadata.
- The Privacy Commissioner of Canada released a study earlier this year on the privacy value of IP addresses, noting how that one data point could lead to information on website habits that includes sites on sexual preferences.
- Ontario Privacy Commissioner Ann Cavoukian has issued a primer on metadata that finds that it may be more revealing than content.
In fact, even CSEC apparently acknowledged in 2008 that:
bulk, unselected metadata presents too high a risk to share with second parties at this time, because of the requirement to ensure that the identities of Canadians or persons in Canada are minimised, but re-evaluation of this stance is ongoing.
A recent lawsuit launched by the British Columbia Civil Liberties Association challenges the constitutionality of ministerial directives that permit widespread metadata collection. In sum, the debate over metadata isn’t much of a debate at all since analysis of the privacy implications of metadata regularly concludes that it has significant value.
Given the privacy importance of metadata, Canadians might have reasonably expected the government to establish a standard in the transmission data warrant that at least matches conventional warrants. In fact, the Justice ministers report that serves as the policy basis for Bill C-13 recommends the creation of new investigative tools in which “the level of safeguards increases with the level of privacy interest involved.”
Yet despite the privacy implications of metadata, the threshold for the transmission data warrant is extremely low. The reason to suspect standard sets a very low bar, requiring only the possibility of criminal behaviour. That is in contrast with the reasonable grounds to believe standard used with a conventional warrant. As Michael Spratt notes, the Supreme Court of Canada has ruled that the reason to suspect standard is only acceptable where the privacy interest is not high (Craig Forcese argues that the standard may be appropriate in this post).
The government would like Canadians to believe that invoking the existence of court oversight is enough to address the privacy concerns in Bill C-13. But with the privacy significance of metadata and the low threshold established by the proposed transmission data warrant, the bill’s lawful access provisions are the source of genuine privacy concerns.