Playing Big Brother on the NET
Proposed online surveillance powers go too far

Michael Geist
The Ottawa Citizen Special

August 25, 2005

Justice Minister Irwin Cotler's announcement late last week that the federal government plans to aggressively move forward to establish new Internet-related law enforcement powers has justifiably attracted considerable critical attention.

The federal government refers to the proposals as its "lawful access" initiative, because they would make legal dramatic new surveillance powers.  Critics, who call the plans "awful access," have good reason to believe they will seriously erode citizens' rights and privacy while failing to truly boost Canadians' security.

The lawful access initiative dates back to 2002 when law enforcement first raised the prospect of establishing new powers to combat terror activities online.  While the possibility fell off the radar screen soon after, it was back--this time on the fast track--earlier this year.  The government hosted consultations with interested stakeholders and now it confidently plans to forge ahead with a legislative package early this fall.

Although the bill's specifics remain unknown, the spring 2005 consultations provided a good sense of what Canadians can expect.

If enacted, lawful access would compel Internet service providers to install new interception capabilities as they upgrade their networks.  Canada's major ISPs, who provide service to the majority of Canadians, will eventually be capable of intercepting data, isolating specific subscribers, and removing any encryption or other changes that they make to data transmissions.

The proposal will likely contain an exemption for smaller ISPs, but all will be required to report on their readiness to conduct interceptions six months after the law takes effect.  Failure to comply with the new standards would carry stiff penalties with fines of up to $500,000 and potential imprisonment for five years.

Lawful access would also provide law enforcement authorities with a wide range of new powers.  For example, authorities could apply for new "production orders" with which they could compel disclosure of tracking data such as cell phone usage as well as transmission data, including telecommunications and Internet usage information.

Law enforcement authorities would also have access to a new "preservation order" that could be used to compel ISPs to preserve Internet usage information for up to three months, forcing ISPs to store far more data than is currently the case.

Among the most troubling aspects of the lawful access proposals are a series of new powers that are not accompanied by any judicial oversight.  Law enforcement authorities, including the police, CSIS agents, and even Competition Bureau authorities, will have the right to obtain ISP subscriber information simply upon request without a warrant.  In fact, the proposals even envision ISPs responding to such requests in certain situations within 30 minutes based solely on a phone call.

With the London bombings still fresh in mind, many Canadians may be inclined to support the lawful access initiative.  The threat of terrorism remains real and undoubtedly everyone wants to ensure that law enforcement has the tools it needs to provide effective security.

Before supporting this initiative, however, Canadians ought to ask some tough questions.

First, are all these new powers necessary?  Obtaining personal information without a warrant or establishing new tracking capabilities will obviously make life easier for law enforcement authorities.  The price for these new powers should not be underestimated though, as lawful access will lead to reduced privacy and increased consumer costs.

Given the high price, it should fall to law enforcement to make the case that their existing powers are inadequate.  They have thus far failed to do so, neglecting to point to a single case in which current Canadian law ultimately resulted in a botched investigation or failed prosecution.

Second, do the new powers contain sufficient judicial oversight?  The answer to this question appears to be an obvious no.  In order to preserve the privacy and security balance, greater safeguards should accompany the increase in network surveillance.  Instead, the proposal contemplates the opposite approach with greater surveillance and fewer safeguards.

Third, are the lawful access provisions constitutional?  There is considerable uncertainty on this issue since the lack of judicial oversight and the potential for access to information without judicial warrants suggest that the provisions will, at a minimum, face constitutional challenge and tough scrutiny from Canadian courts.

Fourth, is lawful access strictly designed to address the threat of terrorism? Once again, the answer appears to be no.  While the genesis of the initiative dates back to the post-9/11 environment and the desire to address terror concerns, lawful access is now envisioned as a catch-all for Internet-related issues including child pornography, identity theft, phishing and spam.  It is certainly important to address these issues, yet many would question why we must sacrifice our privacy in order to protect it.

Fifth, will lawful access actually prove successful in battling Canadian terror?  While no one knows the answer to that question, there is reason to doubt it will.  Encryption technologies are left largely untouched by this proposal, which may allow some groups to communicate without fear of surveillance.  Moreover, with smaller ISPs exempt from the new surveillance requirements due to cost considerations, evading the surveillance may require little more than subscribing to exempt providers.

Once new surveillance is built into the network, it will be virtually impossible to "unbuild" the dramatically different Internet that has been created.  Given the long-term implications, it is crucial that Ottawa now strike the right privacy and security balance.

Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law.  He can reached at [email protected] or online at www.michaelgeist.ca.