Lawful access: The comeback?

It's baaack. Or is it? The federal government is promoting Bill C-13 – The Protecting Canadians from Online Crime Act – as legislation to prevent online bullying. But in no time after its introduction in the House of Commons last month, critics lambasted it for reviving lawful access provisions from the unpopular “cyber-snooping bill” – or Bill C-30 – which the government promised, a mere nine months ago, was dead and buried.
 
Opponents call C-13 an omnibus bill because it addresses much more than cyberbullying. Bill C-13 does indeed criminalize the non-consensual publication or distribution of “intimate images.” But the bulk of the bill’s other provisions cover everything from hate speech to increased penalties for stealing internet and cable, and new enforcement tools to fight terrorism.

The government rejects the labelling and arguing that its aim is to modernize the Criminal Code to make it fit for the 21st Century.

Regardless, the bill brings back many of the changes around production orders and search warrants that sank along with C-30 that would allow police to collect personal data and track Canadians' whereabouts.
 

Cyberbullying

David Fraser, a partner with McInnes Cooper in Halifax, and expert on digital law is "deeply disappointed" with the bill’s drafting, he says the Criminal Code provision on distributing images is a good thing. "It gives police and prosecutors an additional thing they can use in order to pursue cyberbullying, without having to go so far as charging somebody for child pornography offence," he says.
 
But there is a problem: it is not simply illegal to distribute the image where there is a lack of consent, but also where there is “recklessness in respect to a lack of consent," he says.
 
That could mean that, anyone wishing to forward one of these images would be required first to show due diligence of sorts to obtain consent. "You do want to punish blameworthy behaviour, but you need to find where the line of blameworthy behaviour is," says Fraser.
 
In the case of Rehtaeh Parsons, which Justice Minister Peter MacKay singled out when he introduced the bill, the intimate images were forwarded throughout her high school. Depending on the courts interpret the bill, every person who forwarded the images along the line could be liable under the act.
 
Asked about this, a spokesperson for the department confirmed that the bill was designed such that there would be no consideration for motive or malice in spreading the images. "This offence, much like the existing voyeurism offence, protects the privacy interest a person has in his or her nudity, and does not concern itself with whether the accused wanted to embarrass or harass the victim by distributing the image," the spokesperson said.
 
What constitutes “knowledge” versus “recklessness” – proven beyond a reasonable doubt – in distributing the image would be largely left up to the courts, the spokesperson added, “Recklessness is included as a mental state to ensure that the offence would capture situations where the accused appreciated that there was a substantial risk that the person did not consent to the distribution of the image – but was not absolutely certain of it – and proceeded to share the image anyway."
 
The problem, Fraser says, is that a lot of internet pornography is amateur. If a 15 year-old boy came across one of these videos, and forwarded it to a friend without knowing that it was distributed wilfully, would it be reckless?
 
According to Edward Prutschi, partner at Adler Bytensky Prutschi Shikhman in Toronto, much of the problem lies in how images and videos spread on the internet. The threshold for what constitutes recklessness could be so high that the law is rarely used, or it could be so low so as to charge numerous offenders – especially minors. "It's hard to predict what direction a law will go to once it's in the wild," says Prutschi.
 
"Maybe they got it right," says Fraser. "Maybe prosecutors are going to exercise discretion and judges are going to be nuanced." We won't know until the bill passes and police begin to lay charges.
 
His real concern lies with the “slew of unrelated stuff that they threw in.”
 

Hate speech and cable theft

"Modernizing these investigative tools for all cyber-related offences will enable the police to more effectively address cyberbullying," the Justice Department spokesperson said in an email statement. But even the government acknowledges that Bill C-13 contains a fair bit that has nothing to do with cyberbullying, not least of which is making telecommunication theft an offence that can be prosecuted either summarily or as indictment. It now carries a two-year maximum sentence.

Of all the changes in Bill C-13, says Prutschi, "it's one thing that sticks out as a sore thumb."
 
It has been suggested that the amendment was a hat-tip to industry. Shaw Communications met representatives from the government a half-dozen times in 2013, meetings which involved conversations about the theft of satellite signals.
 
Still, the telecommunications changes haven't raised too much ire. Other amendments, however, on broadening the classes protected against hate propaganda, have sown some confusion.
 
C-13 adds national origin, age, sex, mental and physical disability to the classes protected by s. 320(1) of the Criminal Code, which makes hate propaganda illegal.
 
The department says the additions were intended to cover a soon-to-be-created gap in the Criminal Code. Whereas previously s. 13 criminalized hate speech against an individual on the basis of age, sex and disability, those provisions will be deleted in the new year, thanks to a private member's bill from the Conservative backbenches.
 
But it's the inclusion of “national origin” that has aroused suspicions. The spokesperson for the department underlined that it's merely widening the scope to its logical place. Others see a political reason behind it that could have a very real impact for freedom of speech.
 
"Israel is the obvious choice that comes to mind,” Prutschi says.

If passed, it's possible that the law could be used to crack down on anything from neo-nazis to radical Islamic groups.
 
The department said the provision would apply even if one's national identity isn't a recognized nation state – for example, if one were Kurdish. A spokesperson says the move was to bring Canadian law in line with European conventions against cyber-hate crimes.
 

Production orders

The section of the bill raising the most red flags are the amendments to how police are required to get production orders for digital evidence, if they are required to get them at all.
 
The bill implements sweeping changes to the way police officers will be able to conduct investigations. If the bill passes as-is, as it appears likely to do, police officers will need only a "reasonable ground to suspect that an offence has been or will be committed" to obtain production orders to trace a communication, track data, and obtain financial information.
 
“Reasonable suspicion” carries a far lower burden of proof than the previous standard, “reasonable grounds for belief.” Fraser calls the new threshold “so low so to almost be meaningless.” If the bill passes, he says, “the information they can get from production orders, in this day and age, is staggering,” particularly when one considers how rich in information metadata is compared to a decade ago. Metadata is a catch-all term for the secondary information stored in users' cellphones, email accounts, social media profiles, web browsers and computers.

The Justice Department is adamant that collecting this information is not an invasion of Canadians' privacy. Setting the lower standard for obtaining production orders for metadata, they say, is merely bringing the requirement to its logical level. The criteria to obtain a warrant for digital fingerprints like metadata, they argue, shouldn't require the higher standard that emails or DNA require.
 
The department further argues that the bill increases the evidentiary threshold required to track individuals. While technically true, the new legislation in fact raises the standard for putting tracking devices on individuals while maintaining the lower standards for placing tracking devices on things, including vehicles. What’s more, these changes make the need to put tracking devices on people almost obsolete, as police could more readily receive GPS coordinates relayed by someone's cellphone, email address, and bank account.

Also, the changes ensure that a tracking warrant is valid for an entire year, up from the current 60 days, if the suspect is believed to be involved with terrorist activity or organized crime. That change is repeated throughout the bill for a variety of different production orders and warrants, including those used to obtain metadata.
 
Michael Geist, a professor of law at the University of Ottawa, where he’s the Canada Research Chair of Internet and e-Commerce law, is amongst those concerned. He says that while C-13 is not as bad as C-30, it still presents enormous challenges.
 
"There were so many problematic parts of C-30," he told National. "It's true that they excluded a couple of the issues. But that exclusion may be more of a function of the fact that people chose to focus on the most problematic provisions. That's why there was a lot of attention on mandatory warrantless disclosure and ISP surveillance capabilities, and there was less attention on the standards on warrants for metadata and immunity for voluntary disclosure. Now that those parts of the bill are still there, unsurprisingly, people are concerned."

A Supreme Court ruling last month meant that at least one element of C-30 couldn’t be transferred to C-13 even if the government had wanted to.  Provisions allowing police access to any computer found during the execution of a search warrant would run contrary to a Supreme Court decision in R. v. Vu , which ruled that police need a specific search warrant to access personal computers.
 
In a “facts and myths” information sheet provided to journalists, the Justice Department writes that the lawful access changes are intended to help police enforce the provisions on the non-consensual distribution of intimate images.
 
"Bill C-13 does not include the former Bill C-30’s controversial amendments relating to warrantless access to subscriber information and telecommunication infrastructure modification.  It simply aims to provide police with the necessary means to fight crime in today’s high-tech environment while maintaining the judicial checks and balances needed to protect Canadians’ privacy. There would still be a requirement for appropriate judicial oversight."
 
"That is, unfortunately, wrong," says Geist. C-13 provides civil and criminal immunity from prosecution for any institution that voluntary surrenders users' data to police. "No production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing," the Bill says.

The Personal Information Protection and Electronic Documents Act (PIPEDA) first established the information-sharing relationship between the data-collectors and investigators 13 years ago. C-13 brings that much farther while shielding corporations from any legal blowback.
 
"PIPEDA already opened the door to that occurring as part of an investigation. [C-13] kicks that door down by providing full immunity to organizations that provide that information," says Geist.
 
Because warrantless, voluntary disclosure requires no intervention by a judge, Geist figures that the new standard will be for police to vigorously employ that route, and for corporations,  including email and cellphone providers, to comply with the requests.
 
Police shouldn't have their hands tied, Prutschi says, but they already have ample tools available. "I'm not at all comfortable as a defence lawyer to see more reliance on simple production orders that don't have judicial oversight on them," he says. "Giving police the easiest route to evidence isn't always the best thing to do in a free and democratic society."
 
Former Privacy Commissioner Jennifer Stoddart, who stepped down this week, has also expressed concerns for the bill, particularly regarding “the potentially large number of ‘public officers’ who would be able to use these significant new powers; and a lack of accountability and reporting mechanisms to shed light on the use of new investigative powers.”
   
Stoddart has asked the Justice Department for clarifying information as to what oversight will be provided for the new changes, which public officers will have the power to exercise these new powers, and what limitations will be placed on the use of these new production orders.
 

Tell Peter everything?

While C-30 was opposed by a broad coalition of opponents – everyone from the Canadian Bar Association to hacker group Anonymous – which created the #TellVicEveryhing hashtag to sardonically mock the then-public safety minister who introduced the bill – the same degree of opposition hasn’t yet materialized this time around.

While the bill is still in early stages, it’s possible that being wrapped up in legislation around cyberbullying has softened the opposition.

Prutschi says it’s a favoured play of the government, “to take a laudable purpose and wrap it around things that are a little more controversial and a little less need, and kind of throw it at Parliament.”

Geist calls it “cover” to re-introduce the unpopular elements.

Still, the government is showing a willingness to bend on some of the more controversial aspects of the bill. MacKay told the House that he looks forward to hearing from the Privacy Commissioner in committee. It’s unclear, however, whether that will be Stoddart, who finished her tenure on Dec. 2, or interim commissioner Chantal Bernier.

The bill will be before committee in the coming weeks.