Bill C-22 | Alexander Surgenor

[00:00:02]As the summer break approaches, the federal liberal government is trying to ram some last-minute legislation through the House of Commons. The Liberals introduced a motion Tuesday that if passed would cut down the time the House Public Safety Committee can consider Bill C-22, the Lawful Access Act. The legislation is designed to give law enforcement updated tools to investigate modern digital and cyber threats, but the bill has faced massive public pushback for its expansive surveillance measures. Alexander Sergeinar is a lawyer with the Canadian Constitution Foundation. He recently appeared before the Commons Standing Committee on Public Safety and National Security to share his concerns about the bill, and he joins me now. Alexander, thanks so much for being here today.

[00:00:50]>> My pleasure, Janet. Good morning.

[00:00:51]>> Good morning. Okay, so Alexander, when you appeared before the committee, what concerns did you share?

[00:01:00]>> Well, it's a shame really, Janet, because I only had 5 minutes, but I tried to say as much as I could in that short time. Uh really, we focused on the privacy concerns that this bill raises, and they are numerous. I said 5 minutes was not enough, and truly, this an interview with you for an hour wouldn't be enough to to cover it all.

[00:01:20]Um the greater focus and the greatest points of pressure that we wanted to make known to them were the fact that the definitions that this bill includes, at least at this stage, are very, very broad. Hopefully, they get pared down.

[00:01:33]They've said as much that as time passes, when when the regulations take effect, if the bill becomes law, then we could see a bit of a narrowing, but the concern was really just the enormous scope uh of information that can be captured by police and intelligence personnel.

[00:01:48]>> Okay, so we're looking at Canadians' privacy, basically.

[00:01:52]>> Absolutely.

[00:01:53]>> Okay, all right. Obviously, a lot of concerns about that. Um I guess that it's it's been framed as a bill that would help police and CSIS investigate crimes more quickly, but I guess core internet providers are going to be put into a position where they will be ordered to provide customer data. So, what could they be forced to do?

[00:02:15]>> Well, in some sense, it's important Jennetta to point out that these powers already exist, more or less. This bill would be an expansion, a very large expansion of the powers that already exist. And when it comes to those electronic service providers, those core providers, and there's a distinction there, it's a pretty slim and thin one. They could be required, after a judge orders them to do so, to do really anything that's required in the according to the police and to the spy agency, if they deem it necessary to create doors, or backdoors is the word you hear a lot, to access data that could be location data, messages being sent, the fact that they were sent, to whom and when. Whatever it's whatever you might imagine could help police and intelligence personnel identify a suspect and investigate a criminal matter, that's fair game, and it's enormously broad.

[00:03:12]>> Yeah, so my understanding is they could install something on my cell phone to surveil me without me knowing, right?

[00:03:20]>> Well, exactly, and I don't want to be dramatic, but when I first read about it, I thought that they could install something in your toaster if Samsung is the one who who built the toaster, and by the definition in the bill, they would be an electronic service provider.

[00:03:34]If the police think that installing some microphone in your toaster, and I'm being dramatic to make the point, that would be fair game. I mean, that's what how broad this bill is at this point.

[00:03:43]So, absolutely, your cell phone would be site it would be ground zero for that sort of surveillance. You better believe >> So, we could be even looking at uh smart televisions, uh anything like that.

[00:03:56]>> Absolutely. Phones, the the TV in your in your home, uh any your car, the list goes on.

[00:04:03]>> Okay. That's a little interesting. Would there be just cause? Like in other words, for people who are suspicious of committing a crime, or could they do this to just anyone, Joe Schmo?

[00:04:14]>> Well, it's not it's not as broad as as giving them the power to just look into anyone willy-nilly. But, other lawyers and other privacy experts have pointed out that the the barrier to doing all of this is quite quite low. The police need to have a reasonable suspicion. Those are those are legal terms in our criminal uh in the in their criminal in the criminal law space. Uh it's the lowest level of suspicion needed for the police to go to a judge and tell the judge, "Look, we think something's going on. We believe it's happening here with this individual.

[00:04:47]Give us the green light, please, and we'd like to take a deeper look." And and presumably that would be enough.

[00:04:52]>> Uh the Conservative Opposition says that it's concerned about part two of this bill, which is called the Supporting Authorized Access to Information Act.

[00:05:02]And it would require core providers to maintain metadata. So, what is metadata, and and what's the concern there?

[00:05:11]>> Right. So, metadata, as I've as I said at committee, is information about information. So, if you text a friend of yours, that that message, whatever it happens to say, isn't what's going to be accessed.

[00:05:26]But, and I'm no expert on uh computer science, uh but the fact that a message was sent from your device to some other device, there's a way for that to be captured.

[00:05:38]That's that's encoded in a certain way where the the core providers and electronic service providers, if they're asked to act like core providers could be required to keep that data. And so, it's really not much of a protection at all when it comes to our privacy. It doesn't necessarily matter that I sent a friend a text message if the fact that if they can still identify that I texted this or that person or made this or that phone call or bought this plane ticket or gassed up my car at this or that gas station. That sort of information.

[00:06:11]That's fair game. And of course, it would include location data. If your vehicle is the device, I'll use the word device. The vehicle's the device in question.

[00:06:22]Metadata would include its location. The probably how many miles it has and and so forth. It's quite broad.

[00:06:29]>> I feel like this is already in existence though. I feel like if if any law enforcement officer wanted to find out where I was, they can ping cell towers.

[00:06:37]They can see that you have texted certain people at certain times. I I watch a lot of Dateline, obviously.

[00:06:45]But usually you know, a warrant is involved with the service provider. So, you're saying this sort of bypasses the warrant.

[00:06:54]>> Yes and no. So, back to that comment about core providers. At at least at the outset of an investigation, part one of the bill will create a power called a confirmation of it's called a confirmation of service demand. And that was that yes or no question I mentioned a moment ago. So, do you in fact provide services to this individual, yes or no?

[00:07:16]Presumably, of course, if the answer is yes, that's that might right there be enough for the authorities to say to the police, okay, we we now strongly suspect that this individual is the individual we've been monitoring. And that's a round about way Janette of saying that yes, these powers do exist. And the government has been saying all along that this is really a way to modernize, speed things up. And to some extent, that's true. but the concern again is how broad these powers would now become because the definitions are just so broad.

[00:07:49]>> What is the purpose of the bill wanting to do this? Is it to monitor possible terrorist activity or other crimes or are people you know, I understand like there might be people that are worried this could turn into something more like government compliance monitoring, kind of like what we saw during the pandemic. Is it going to go that far?

[00:08:12]>> Well, it certainly could and that's the concern, right? I mean, we don't know at this point in time what the final product, so to speak, what that will look like. In in a perfect world, they the government would hear all of these privacy concerns being voiced by countless different organizations and private citizens and agree to scale back and and limit what this bill proposes.

[00:08:34]To answer your question as to the focus of this proposed law, uh, yes. They've been They've made it quite clear that the purpose here is to monitor and investigate organized crime, uh, international crime, terrorism, of course, um, and certain sensitive all all criminal activity is is of course sensitive, but child exploitation, human trafficking, these are noble pursuits. I I'm not opposed, of course, to investigating crime.

[00:09:04]But again, it's it's a it it it looks like a bit of a blunt instrument at this point in time and that's the concern.

[00:09:11]Again, I have to just point out that these powers do exist. What I understand the authorities to be complaining about and maybe that's too harsh a term, is that it's just moving too slowly. So, they want to go in hard, fast and keep as much data as they can to speed up the investigation when it's time to really for the for the rubber to really hit the road later.

[00:09:31]>> And who would have access to this data?

[00:09:36]>> Well, primarily it would be Well, first and foremost, that data already exists.

[00:09:43]Every time we agree to the terms and conditions when you use an electronic device or you browse the internet. So, that data exists already. What the police and the spy agency are hoping to achieve is to open the door to access that data. So, it's not just the the police themselves and CSIS. It's also Google, Netflix, Apple, the list goes on. And of course, that's the concern here, Janette, is that when when those people who already are to a fairly honorable extent managing and protecting that data. The fact that they have to keep it for so long and in such a robust form so that the police can get it later, well, that's what makes it susceptible to hackers down the road. And that's another huge concern, of course.

[00:10:30]>> Really quickly, how concerned should we be about possible data breaches?

[00:10:37]>> Well, I more concerned than we should always be.

[00:10:41]And I think the concern now is heightened because if I'm a bad actor somewhere looking to exploit vulnerabilities somewhere and I'm reading the news, well, I've just heard that Canada is proposing to create a really expansive network of data collection that's required by law if a judge makes that order. And so, if I'm a hacker or or a nefarious actor, I'm I'm licking my lips thinking that, "Okay, well, Canada's going to be an excellent playground for me because the data being gathered and and being ordered to to be preserved is just so enormous and it's very sensitive private data.

[00:11:20]Location, uh communications, it's the concern is always there, but it's certainly far greater now.

[00:11:27]>> Uh looks like we're out of time here, but Alexander, thanks so much for joining us today and uh bringing our attention to this.

[00:11:33]>> My pleasure. Thank you, Janet.