Information & Ethics Committee on Aug. 9th, 2022

[The Chair, Conservative, Pat Kelly]

I call this meeting to order.

Welcome, everyone, to meeting number 32 of the Standing Committee on Access to Information, Privacy and Ethics. Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Tuesday, July 26, 2022, the committee is meeting to study device investigation tools used by the Royal Canadian Mounted Police.

Today's meeting is taking place in a hybrid format, pursuant to the House order of Thursday, June 23, 2022.

I've just discovered in the notice that this morning we have two witnesses for this meeting. I am going to run the meeting in two separate panels. These are the witnesses who were contained in the motion we adopted. In our meeting this afternoon, we will have, in one panel, all three of the witnesses who were provided by the parties.

We'll begin with Mr. Therrien for the first hour, and then in the second hour we will have Ms. Polsky.

With that, I welcome former commissioner Therrien, who is no stranger to our committee. We've had many committee meetings together. I welcome him back and invite him to begin this first panel with his opening statement.

Mr. Therrien, you have up to five minutes.

[Daniel Therrien, Lawyer, As an Individual]

Thank you very much, Mr. Chair.

It's a pleasure to be here.

Thank you for inviting me to testify as part of the important study you are conducting further to the June 22 publication of the government's response to a question that MP Tako Van Popta asked regarding mobile device surveillance.

In that response, the Royal Canadian Mounted Police, the RCMP, revealed that it had secretly used device investigation tools to collect data from mobile and other electronic devices of Canadians, always with judicial authorization pursuant to the Criminal Code.

I have no knowledge of facts beyond what was reported by the RCMP in response to Mr. Van Popta. My remarks, therefore, will focus on the content of the applicable law. I know that the RCMP reiterated yesterday that it does not use what it calls ODITs without judicial authorization as this would be an offence under the Criminal Code.

There is no doubt that the covert collection by the state of personal and other information residing on the digital devices of Canadians is an extremely intrusive practice. However, such level of intrusiveness can still be lawful and consistent with privacy principles if the collection of information is authorized by law and is necessary and proportional to the achievement of compelling government objectives.

The RCMP says that its use of on-device investigative tools always follows judicial authorization, pursuant to the Criminal Code. These provisions include several privacy safeguards. They can be invoked only for serious crimes. They require judicial authorization, often on a high standard of reasonable grounds to believe that a crime has been or will be committed and that evidence related to the crime will be found on the device to be searched. Judges can subject the collection of information to terms and conditions, including conditions designed to limit the invasion of privacy.

I believe that these provisions are reasonable or, at least, that they constitute a good starting point for protecting privacy in the context of criminal investigations in which the state has compelling grounds to act and in which its actions are governed by judicial authorization.

Can those provisions be improved? Possibly, and the government seems receptive to the idea. However, to conclude that statutory changes are necessary, I think it would be important to determine how the current provisions have been applied and, where possible, to identify grounds for concern. You questioned the RCMP about this, particularly regarding the content of warrants obtained.

Your study ultimately concerns the fundamental conditions that must exist so that Canadians can be confident that their rights are protected when law enforcement agencies employ intrusive methods. And central to that issue of confidence is the existence of a sound legal framework and independent oversight. The balance between the transparency and protection of police methods is also an issue. I will be pleased to address those themes at greater length in response to your questions.

Lastly, the RCMP supports the use of device investigation tools and other intrusive methods in addressing the issues raised by data encryption, for example. I think that's acceptable provided the use of those methods is subject to judicial authorization on a case‑by‑case basis and the protection that encryption affords the general public is not otherwise compromised. On that point, I refer you to the brief published by the Office of the Privacy Commissioner on December 5, 2016, as part of a government consultation on Canada's national security framework.

I will be pleased to answer your questions.

[The Chair, Conservative, Pat Kelly]

Thank you, Mr. Therrien.

Before I go to the first speaker, I have some housekeeping information for committee members. We not only potentially have to deal with motions that may be moved, but we also have to give some instructions to the analysts. I propose that we do that at the end of the second panel. I'm told by the clerk that we will have a few minutes at the end of the second panel to deal with those items of committee business, so that's my intention.

With that, the first round of questions will begin with Mr. Bezan.

You have up to six minutes.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you, Mr. Chair.

I want to thank you, Mr. Therrien, for joining us today.

What years did you serve as the Privacy Commissioner of Canada?

[Daniel Therrien]

I served between 2014 and 2022.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Were you surprised, during the testimony yesterday by the RCMP and Minister Mendicino, that the on-device investigative tool for hacking into our cellphones predated your time as Privacy Commissioner and they never once consulted you or asked about the privacy impact of using this on our devices?

[Daniel Therrien]

I was surprised by the tool itself, by how intrusive it is, and that it was used for so long. Certainly, there have been many discussions over the years—as the RCMP said yesterday, probably since the early 2000s—on the lawful access issue. Both in my term as commissioner and when I was at the Department of Justice, I was following and part of these discussions. But the use of this particular tool to go around encryption, yes, was a surprise.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

When you look at their, I guess, intentional non-disclosure of using this technology, if you'd known about it sooner, would there have been recommendations made on how it should be used to protect the privacy of Canadians, coming from the Office of the Privacy Commissioner? Had you known, would you have been more, I guess, condemning of the RCMP for the use of this technology, or of Public Safety, for that matter, for not providing the regulatory tools to ensure the protection of the privacy of Canadians?

[Daniel Therrien]

It's a complicated question. I would say, as Commissioner Dufresne said yesterday, that I would have looked at—as he will—the detailed conditions under which this tool would be used to see whether there were any recommendations to be made on how it would be used beyond the four corners of the law, which is, again, a good start.

Part VI of the Criminal Code is a good start. It sets privacy safeguards. It sets high thresholds for judicial authorization. It has judicial authorization, so it's not as though the RCMP can use this tool without oversight by an independent body. But even with all of these good safeguards, I would have looked at—and I understand that Mr. Dufresne will—the sum total of the conditions under which the tool is used to see whether any further recommendations could be made on how to use it in a way that protects privacy.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

As you know, as somebody with a great deal of experience on legal matters and the workings of government and providing advice on things like justice and protecting the rights of individuals, under section VI of the Criminal Code there are different types of warrants, whether it's a wiretap or video surveillance. There are general warrants that are more broad-sweeping. Do we need to have a recommendation for a new type of warrant for the use of on-device investigative technology?

[Daniel Therrien]

You asked yesterday whether judges who receive requests for judicial authorization have the technical.... They certainly have the legal expertise, or they have the technical expertise to make the best decisions, I'm assuming. I heard yesterday in testimony from the government—I think from the minister and certainly from the RCMP—that judges of superior courts have the expertise, so there must be some training given to judges.

Should there be special kinds of warrants? It would depend on whether the current regime as applied by judges with the expertise, legal and technical, they have, is sufficient to protect privacy. It may well be. I don't know.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Yesterday we were talking about the Order Paper question. The Order Paper question actually said the RCMP had consulted with you as Privacy Commissioner, or with the Office of the Privacy Commissioner, about the use of ODITs, which we now know never happened. How did you interpret that response to the Order Paper question versus their actual testimony?

[Daniel Therrien]

The comment that we were consulted most likely related to some other related initiative, not the use of this particular technology.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

As we look at zero-click spyware like Pegasus, now we're finding out there are other companies out there—

[The Chair, Conservative, Pat Kelly]

Mr. Bezan, you really are out of time.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Okay.

[The Chair, Conservative, Pat Kelly]

Wind it up quickly.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you. Are you sure that was six minutes?

[The Chair, Conservative, Pat Kelly]

Yes. You started asking a question at five minutes and 55 seconds.

We're going to Ms. Hepfner for up to six minutes.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Thank you, Chair.

Thank you, Mr. Therrien, for being with us again today.

You mentioned during your opening statement that you understand that even technology as intrusive as an ODIT can be lawful in some circumstances. It can be necessary for law enforcement to have the ability to be that intrusive.

Could you go into more detail about what sorts of situations might require police to have a tool like this?

[Daniel Therrien]

I think what's at play is the balancing of privacy and other public interests. There is no question that this particular tool is extremely intrusive. It's more intrusive than traditional wiretap tools. It does not just record communications on the phone between person A and person B. It sits on the phone, on the digital device of the individual, and the state—the police—has access to everything on that phone. It is extremely intrusive.

When you look at the balancing, therefore, there needs to be an extremely compelling public interest to justify the state being able to have that kind of information and use these tools. The Criminal Code sets out a limited list of offences, serious offences, where the police, with judicial authorization, are able to use the technology in question—things like murder, terrorism, drug trafficking and the like.

I think by and large the list of offences in question does fit the definition of “compelling state imperatives”.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Given that technology has advanced so much and that criminal organizations are very easily able to overcome traditional types of wiretapping, I'm wondering why you were surprised to know that police had advanced their abilities to investigate in the current technological age.

[Daniel Therrien]

My surprise did not relate to the fact that the police have technologies to intercept communications in the context of investigations. Traditionally these tools were somewhat limited. Wiretaps, again, intercept a specific communication. It is the intrusiveness of the tool that surprised me, not the fact that the state would use technology in the context of investigations.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

What we heard from the police yesterday is that communications these days are encrypted either before they leave the device or when they come in. This is the technology they would use to overcome that encryption.

[Daniel Therrien]

I accept that. I accept that encryption, although it has many benefits for society protecting the privacy of communications of ordinary Canadians, commercial transactions and the like, can pose serious challenges for law enforcement. I accept that.

As I said in my opening statement, I think that to have technology to address the challenges of encryption with judicial authorization on a case-by-case basis does not impede others from benefiting from encryption. I think that's acceptable.

I'll say that part of my surprise was that there has been an ongoing public debate in the context of lawful access about this specific issue and to what extent the police can use means to overcome challenges of encryption, and it never came about in public debate that ODITs were used to that effect.

I'm not saying that it is unacceptable for ODITs to be used, but it was surprising that, in the context of many debates in the public about the challenges of encryption when I was Privacy Commissioner, I was not told that a tool was used to overcome encryption.