Bill C-22, the lawful access bill, was a focal point of debate in the Senate last week. While companies continue to warn they may exit Canada if the bill passes in its current form, the debate’s biggest revelation was that it may take years for the government to pass the regulations needed to fully implement the law. The delay is notable for several reasons, including the government’s insistence in the spring that passing the bill was urgent (to the point that it shut down committee clause-by-clause review) and the regulatory uncertainty that it creates. Indeed, the Senate is effectively being asked to approve a surveillance and data retention framework without knowing who will be covered, what they will be required to build, what data about Canadians will be retained, or what any of it will cost. If this sounds familiar, it is because it has seemingly become the government’s go-to approach on many of its digital bills, from privacy to social media regulation, where key decisions are left to regulations and regulatory processes that take years to complete.
Post Tagged with: "encryption"
Is Compromise on Encryption Possible? Why Bill C-22’s “Minor Opening” Leaves the Central Question Unanswered
Bill C-22, the government’s lawful access legislation, is awaiting Senate consideration this fall with the encryption provisions likely to be the centre of attention given diametrically opposing views from law enforcement and technology companies and experts. Public Safety Minister Gary Anandasangaree told the Toronto Star earlier this month that the bill strikes “the right balance” on encryption, claiming that cracking encryption is “off limits” except in “extenuating circumstances” where there is a “minor opening,” and that “everybody has had to have some water in their wine.” The government’s approach follows the typical legislative playbook of seeking a middle ground that stakeholders can (sometimes reluctantly) live with. Yet the past few weeks have produced an unusual situation in which both sides say no viable middle ground exists. Police claim the bill’s encryption provisions do little to change what they can obtain under existing law. Nearly two dozen technology companies and industry groups argue the same provisions leave every user at risk since even partial weakening of encryption undermines its effectiveness.
RCMP Confirms Bill C-22 Concerns: Police Want Law to Provide Access to Encrypted Communications
As the concerns about Bill C-22 mount, the government’s incoherent response has included Justice Minister Sean Fraser implausibly comparing metadata to phone book data and Public Safety Minister Gary Anandasangaree suggesting that Canada was just trying to match U.S. metadata retention laws (the U.S. has no such law) and claiming that tech company concerns regarding breaking encryption were based on misinformation.
Yesterday, the RCMP appeared before the Public Safety and National Security committee and quickly contradicted the Minister, affirming that concerns about Bill C-22 are well justified. Indeed, the official confirmed that law enforcement wants the bill specifically because it would provide an opportunity to access encrypted communications. The exodus of tech companies, which now also includes DuckDuckGo, can be expected to continue. The relevant remarks embedded below.
Apple on Bill C-22: “This Bill Allows the Government of Canada to Force Companies to Break Encryption by Inserting Backdoors into their Products”
The hearings into Bill C-22 continued yesterday with appearances from the Privacy Commissioner of Canada, Apple, Google, the Canadian Civil Liberties Association, and a series of law enforcement associations. The hearings were a mess: the Privacy Commissioner’s reform recommendations sent in advance weren’t distributed to MPs, one Liberal MP admitted to the confusion about how the bill applies, another Liberal MP thought a good strategy would be to target Apple for not being sufficiently supportive of lawful access initiatives, and the final 30 minutes was spent fruitlessly trying to negotiate an extension to the hearings, which have clearly been inadequate to deal with the many issues raised the legislation.
I could go on, but the fundamental takeaway from the day can be summarized in this single 22-second clip from Apple, which makes clear that the bill poses real risks, and the government thus far seems uninterested in addressing them. The Bill C-22 hearing may have been a mess, but the message was clear.
The Government Tries to Make the Case for Bill C-22: Why Its Own Use Cases Reveal Disproportionate Overreach
Faced with growing criticism of Bill C-22, the government this week mounted a coordinated defence, with senior officials from CSIS, the RCMP, and Public Safety Canada sitting for on-the-record briefings with the Globe and Mail, the CBC, and others. While officials tried to make the case for lawful access, they failed to make the case for Bill C-22, as their use cases reveal a consistent pattern of overreach. Indeed, whether the issue is metadata retention or the technical capabilities the bill would mandate, the powers it would grant extend well beyond the targeted needs the officials describe, resulting in a disproportionate bill in need of significant amendment.
Recent Posts
Years of Uncertainty: Bill C-22’s Missing Regulations and Secret Ministerial Orders 
The Missing Charter Statement: Why Hasn’t the Government Explained How Bill C-34’s Social Media Ban Complies with the Charter? 
Three Years After October 7th: Living With the Shockwaves 
What If the U.S. Demanded This? The Cloud Provider Conditions Behind Canada’s EU Digital Pivot 
Ontario is Done Waiting for Universities to Act on Campus Antisemitism
