The return of the House of Commons from the summer break brings with it a resumption of debate on government bills. Topping the list this week is Bill C-2, the omnibus border measures bill, that buries dangerous lawful access provisions that open the door to warrantless access to personal information and increased surveillance capabilities in Canadian networks. I wrote multiple posts on the privacy concerns before the summer (here, here, here, here, here, and here), expressing concern not only with the substantive provisions but also with a bill that combines everything from border measures to restrictions on cash transactions to warrantless access for law enforcement to personal information. The risk is that no issue will get sufficient attention as major issues get lost among the myriad of disparate provisions. For that reason, the lawful access provisions in Parts 14 and 15 in the bill should be removed and contained, if at all, within a separate bill.

That concern was much in evidence during yesterday’s lengthy House of Commons debate. There were far more mentions of “fentanyl” than “privacy” as the discussion veered in all sorts of directions. The Conservatives and NDP can be relied upon to oppose the bill, but the Bloc suggested there was support based on a desire for measures to address actual border related issues. In this minority Parliament, the government needs backing from one party, and the Bloc might be the one on Bill C-2.

While it is tempting to review some of the wilder comments (notably including Liberal MP Steeve Lavoie, who, in relation to cash transactions, said “does my colleague want us to continue letting people use cash, which increases the number of crimes committed by the very criminals we want to lock up by strengthening our laws, while the current government seeks to prevent rather than cure?”), more important was the attempted defence of the warrantless access rules. After concerns were raised by many opposition MPs, Liberal MP Julie Dzerowicz sought to defend the warrantless access provisions:

Some have argued that the lawful access regime being proposed is a major attack on privacy rights. I would argue that it is not. Rather, it is carefully structured to calibrate law enforcement’s access to information with the nature of information being sought. For the vast majority of information requests, a judicial warrant is required. There are a couple of exceptions to that, but they are ones that I believe all sides of the House can support.

I will give a couple of examples. First, Bill C-2 clarifies the ability of law enforcement to use specific powers and seize specific information without a warrant in urgent, time-sensitive circumstances. One such circumstance would be the live and active abuse of a child. I am sure we can all agree that stopping the abuse of a child is an appropriate exercise of police authority. The second and other instance is when police are trying to find basic information about someone as part of an investigation. This typically happens in the early stages of a police investigation. What we are talking about here is basic information, essentially something that responds to simple yes-or-no kinds of questions. What police would glean from the answer would allow them to go to a judge, seek a warrant and obtain more information. Again, the object of the exercise is to allow law enforcement to move at the same speed as the criminals they are pursuing. Due process is maintained, but speed is also critical for police when pursuing those who use digital tools to communicate.

It is the second instance – warrantless access to what Dzerowicz describes as “basic information” that typically involves a yes/no answer – that matters and which raises serious privacy risks. Indeed, the scope of access is far more significant than she suggests and I would hope that all MPs would oppose (I suspect the Supreme Court of Canada will oppose it should the provision become law).

First, the scope of the information that can be demanded without a warrant extends far beyond yes/no basic information. The information demand power actually includes whether the person provides or has provided services to any subscriber or client, or to any account or identifier. This means law enforcement can start with a name, an IP address, or any other unique identifier attached to a phone in order to confirm service. For example, an IMSI catcher could be used gather phone identifiers at a protest and those identifiers could be used to confirm who provided the cellular service. The information demand also includes the power to demand whether there is transmission data on hand (who was the person communicating with and what apps were they using) as well as where and when was the service provided (were they at the protest). The information demand can also cover when service began, when it ended, and what other communications services are used by the subscriber (do they use Gmail or WhatsApp). The specific content would require a warrant, but all of this data, which can be very revealing, would be available without judicial oversight. Needless to say, many of these answers extend beyond a yes or no.

Second, law enforcement need only “reasonable grounds to suspect” that an offence has been or will be committed in order to invoke this power. An offence in this case is not limited to the Criminal Code, but rather covers any Act of Parliament so this extends far beyond criminal investigations.

Third, the providers who can be targeted with this demand extends far beyond telecom and Internet providers. The information demand power applies literally to anyone who provides services to the public:

A peace officer or public officer may make a demand in Form 5.‍0011 to a person who provides services to the public requiring the person to provide, in the form, manner and time specified in the demand, the following information

There is no definition or obvious limitation on the services in question or the person who provides them – it could be a telecom provider, physician, hospital, library, educational institution, or financial institution. It is critical to emphasize that this is not limited to communications services. If served with the appropriate form, anyone who provides services is required to confirm whether they have provided services to any subscriber, client, account, or identifier. They must also disclose whether they have any information about the subscriber, client, account or identifier as well as advise where and when they provided the service. On top of that, they must advise when they started providing the service and list the names of any other person that may have provided other services.

Fourth, the person disclosing the information is barred from revealing the disclosure for a year and has only five days in which they can challenge the demand. This has huge implications for providers such as lawyers or physicians, who may have legal obligations not to disclose such information but only days to challenge the demand.

Fifth, the bill creates a safe harbour that encourages providers to disclose information about their subscribers or clients without either a warrant or an information demand. Rather, the bill opens the door to law enforcement simply requesting that the information be disclosed on a “voluntary” basis. Should the provider comply, law enforcement is entitled to use the information and the provider is granted full legal immunity from any liability for having disclosed it.

The bottom line is that Bill C-2 creates enormous privacy risks that are certain to be challenged. The government should remove the provisions from the bill and rethink its approach to lawful access altogether in light of the Supreme Court of Canada’s jurisprudence and the importance that Canadians attached to privacy and due process.