Evidence of meeting #37 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A video is available from Parliament.
Canada Research Chair in Internet and E-Commerce Law, Professor of Law, Faculty of Law, University of Ottawa, As an Individual
I'll respond this way. I appeared yesterday before a Senate committee on AI, where much of the focus was on cybersecurity. I have to say I find it positively dizzying going from one committee, where we're talking about things like Claude Mythos and the desperate need to ensure that we have cybersecurity that's as strong as possible, to then walking in and talking about legislation that would knowingly undermine that security.
Make it make sense—
Conservative
The Vice-Chair Conservative Frank Caputo
Thank you very much, Professor Geist. I apologize.
I want to exercise my prerogative as the chair, because there's one thing I think we're going to hear about in the next round that I think is very important. I'll ask you for a very brief, 15-second response.
You mentioned that 30 days for metadata would be appropriate. Oftentimes, there's not even an investigator assigned to an Internet luring case in 30 days. Bearing that in mind, what would you think about 90 days, given those types of crimes, to address those types of crimes or the metadata that would allow us to address those types of crimes?
Canada Research Chair in Internet and E-Commerce Law, Professor of Law, Faculty of Law, University of Ottawa, As an Individual
I guess the best way to respond to this is that too much of the policy-making associated with lawful access has not been evidence-based. It's based on the occasional anecdote without strong evidence.
It seems to me that if we are in the realm of trying to ask what the appropriate amount is—a year is clearly way too long—what we need is far more evidence, frankly, about when there are instances when that metadata is actually needed and how long it usually takes before you might be able to get that order.
Conservative
The Vice-Chair Conservative Frank Caputo
We will try to get that in the following panels. Thank you very much.
Thank you to our witnesses.
We will suspend briefly.
Conservative
The Vice-Chair Conservative Frank Caputo
We are now into our third panel.
I want to welcome our next panel of witnesses here to speak. We have, from the Canadian Centre for Child Protection, Monique St. Germain; from the Canadian Chamber of Commerce, David Pierce; and from the Peel Children's Aid Society, Mary Beth Moellenkamp.
Thank you, witnesses. You have five minutes each for an opening statement.
Ms. St. Germain, we will hear from you first, please. Thank you.
Monique St-Germain General Counsel, Canadian Centre for Child Protection
Thank you very much, Mr. Chair and committee, for inviting us to participate in this study.
My name is Monique St. Germain. I am general counsel for the Canadian Centre for Child Protection, a national charity that works domestically and globally to reduce the incidence of missing and sexually exploited children.
We also operate Cybertip.ca, Canada's tip line for reporting the online sexual exploitation of children. In 2025 alone, we received 28,000 reports.
We also operate Project Arachnid, a platform that prioritizes the removal of harmful child sexual abuse and exploitation material. As of this month, Project Arachnid has issued 141 million notices requesting CSAM removal.
On a daily basis, our agency directly witnesses egregious privacy violations on children whose child sexual abuse material is circulating online for the world to view. We hear directly from children and families impacted by online crimes like CSAM, online luring and extortion. We welcome the measures in Bill C-22, particularly the confirmation of service demand and the subscriber information production order.
It's been over a decade since the Spencer decision left it open for Parliament to enact a reasonable law. We hope this time we can finally get there. In the intervening years, we have witnessed a number of growing threats to children, including an exponential increase in CSAM online. StatsCan figures show that CSAM incidents have quadrupled from 2014 to 2024. Then there's online luring. Reports to Cybertip.ca surged 344% between 2020 and 2025. StatsCan has this crime going up 65% in 2024 over 2023. Sextortion is another big issue. Cybertip.ca has received over 14,000 reports since 2020.
Even though crimes against children are through the roof, StatsCan data reveals that, in 2024, charges were laid or recommended in just 24% of all sexual offences against children online and in only 6% of CSAM incidents. We have to ask ourselves why.
This is obviously complex, but it has to be acknowledged that offenders are increasingly using sophisticated tools like burner phones, bulletproof hosts and VPNs, and networks like Tor that hide IP addresses. Some apps are blatantly and intentionally designed for anonymity. Offenders are able to rapidly change their digital identities through fake accounts. It's very common for offenders to use multiple apps, devices and accounts. Unravelling that web is incredibly complicated. On top of that, some of these investigations involve multiple jurisdictions and service providers. Record-keeping and co-operation amongst these providers varies widely. This has to be having an impact.
At our agency, we are now at the point where nearly one-third of contacts to Cybertip.ca or our support services come from children seeking help. These are just the children who come to us—often only when they are in crisis and, in some cases, suicidal. By the time these children feel able to reach out for help, the evidence that might help police identify their offenders could be gone. Even a single offender left unchecked can inflict an enormous amount of harm. Here is just one example: An Alberta offender posing as a female teenager was able to lure 92 children.
We wish to address one specific area of the bill that we would like to see changed. We believe the confirmation of service demand should include basic jurisdiction information, such as province and municipality. Having this information is critical, especially at the outset of an investigation when the available information is limited. Knowing the jurisdiction will help ensure that the right policing agencies are involved and that production orders are brought forward to the right court, and this can help police be much more effective in their investigation.
In closing, Canadian children have been forced to pay a very steep price as this debate rages on. Past failed efforts at lawful access reform are a powerful reminder of how long children and families have been waiting for action. We want police to be able to act. We need them to have the tools to do so.
Thank you.
Conservative
David Pierce Vice-President, Government Relations, Canadian Chamber of Commerce
Thank you very much for the opportunity to be here today on Bill C-22 and lawful access.
I am here as the Canadian Chamber of Commerce on behalf of our 400 network chamber partners and boards of trade across the country, our 200,000 combined members and more than 100 industry associations. I'm also here as a father. I can share that many representatives from Canada's digital companies also have families. We all want to ensure that law enforcement has the tools it needs to pursue criminals, especially online.
I'd like to express our appreciation to the Minister of Public Safety, the Minister of Justice and their teams for the extensive back-and-forth over the past year. The amendments made to Bill C-22 in part 1 addressed many industry concerns, and we thank the government for acting, but when you compare Bill C-2's part 15 and Bill C-22's part 2, it's clear that the government doesn't share the same concerns as the vast majority of our members at the Canadian Chamber of Commerce.
I’ve worked in and around cybersecurity for years. I don't understand why we treat cybersecurity differently from other crimes. If a business is hacked, the business CEO must apologize. The liability is on the business, even if the hackers are state-sponsored, yet our discussions here today are not about how we can support business to further protect their systems and our data. Instead, we’re talking about obliging them to install devices, open their digital doors and give access to information to “authorized persons” essentially on demand.
Conservative
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
The interpreter isn't able to do their job.
Vice-President, Government Relations, Canadian Chamber of Commerce
I'm sorry.
Conservative
The Vice-Chair Conservative Frank Caputo
Thank you so much.
Mr. Pierce, if you could, please speak a bit slower. We do have interpretation.
For all witnesses and all members, particularly when we're reading we do tend to read a bit faster. Please, everybody, just bear that in mind.
Thank you.
Vice-President, Government Relations, Canadian Chamber of Commerce
Absolutely, Chair, I'm happy to.
Let's imagine that this law is on the books. In a year or two, imagine hundreds and maybe thousands of investigations across multiple national law enforcement agencies and federal departments on all of our digital systems. Who's managing all those secure keys? Who's accountable for patching and updating those systems to make sure they are secure?
If I leave you with one message today, it's this. The business community supports production orders and we support urgent 24-hour production orders in exigent circumstances, but we are very concerned at the prospect of unfettered access by a government-authorized person to pull information from encrypted, secured systems.
What's also puzzling about this debate is that I've had the privilege of working with some of the most talented lawyers in the country, and there is a debate right now about whether or not Bill C-22 in part 2 requires a warrant. It is critical that the powers in Bill C-22's part 2 be amended to clarify this important point, especially in proposed subsections 5, 7, 14 and 20.
On the discussion of metadata, this will impose significant costs—millions of dollars—on businesses, and not just on the infrastructure to retain the data, but to manage it, to manage it securely and to have it in a usable format for law enforcement. As soon as you store large volumes of sensitive data, it becomes a cyber-target. As soon as data is retained, it's a target.
We recognize the importance of non-disclosure orders, but these should be limited to court-authorized actions tied to national security risks and active investigations.
Bill C-22 could also penalize successful Canadian companies that operate here in Canada but also have operations in the United States and Europe. If you are an electronic service provider based in Canada today, with customers in the United States and Europe, complying with parts of part 2 could put you offside with law enforcement and regulators in those jurisdictions. At a time when businesses are already facing tax competitiveness pressures, tariff uncertainty and the broader economic risk that we're all facing, adding another layer of regulatory burden on Canadian companies at this particular time may incentivize them to relocate.
Finally, with regard to the definition of “core provider”, without an amendment to this section, it potentially captures the vast majority of Canadian businesses that communicate or provide an electronic service.
In closing, the business community very clearly has signalled that they're concerned about Bill C-2 and part 2 especially. I think we all trust that the current Prime Minister, the Minister of Public Safety and the Minister of Justice will use the measures in this law in a way that's appropriate and as they've said. I'm sure the public servants who were at the committee on Tuesday would do the same. They seemed to be very honest and reputable—
Conservative
The Vice-Chair Conservative Frank Caputo
Thank you very much, Mr. Pierce.
We'll now move on to Ms. Moellenkamp for five minutes.
Mary Beth Moellenkamp Chief Executive Officer, Peel Children's Aid Society
Mr. Chair and members of the committee, thank you for the opportunity to appear. My name is Mary Beth Moellenkamp, and I'm the chief executive officer of the Peel Children's Aid Society.
Peel Children's Aid is a mandated child protection agency for Peel Region, including child protection responses connected to Toronto Pearson Airport. We also lead, alongside our partners, nCourage, Peel's anti-human sex trafficking integrated service hub, and CWICE, the Child Welfare Immigration Centre of Excellence.
Through this work, we see how trafficking, immigration, housing instability and cross-border movement intersect with child safety and reflect broader provincial and national trends. That experience gives us a particular perspective on Bill C-22.
Bill C-22 responds to a real challenge: whether lawful systems can move quickly enough to protect children in a fast-moving, digitally enabled environment. Children can be groomed, isolated, threatened, moved and controlled through digital tools faster than systems can identify risk and respond. Timely, lawful access to digital evidence can help find a child, identify the adult causing harm, prevent further exploitation and support coordinated intervention.
At the same time, safeguards are essential. The use of these tools must remain grounded in lawful authority, appropriate oversight, clear thresholds, privacy protections and respect for children's rights and dignity.
The child welfare system holds a difficult but necessary tension. We are responsible for protecting children from harm while also protecting their privacy, voice and civil liberties; and both matter.
Children and youth involved with child welfare often already experience high levels of system involvement. They are disproportionately represented among victims of sexual exploitation and trafficking. Many have experienced trauma, abuse, neglect, instability and disrupted relationships.
Traffickers exploit these vulnerabilities. What begins as connection can quickly become coercion and control. Some youth are drawn into other forms of criminal exploitation, including auto theft, fraud, drug movement or recruiting other youth. These children are often being manipulated, threatened and isolated.
In Ontario, as in other jurisdictions, human trafficking is recognized as a child protection concern. We have a clear role in assessing safety, supporting caregivers, collaborating with police and community partners, and protecting children from ongoing harm. Increasingly, our efforts focus on identifying traffickers and exploiters as the individuals causing harm rather than viewing parents and caregivers as failing to protect.
Traffickers exploit gaps between systems and jurisdictions. They exploit delays and digital platforms that move faster than our legal and service responses. The average age of recruitment into sex trafficking is estimated to be 13 years old.
At Peel CAS, we have supported children as young as nine years old. Last year, our agency identified more than 200 cases where a child or youth was suspected of involvement in trafficking for sexual exploitation, and yet we know that this is significantly under-reported. Often a child may only know a trafficker through a phone number, social media handle, app, vehicle, hotel or email address. Those fragments matter. They may be the difference between not knowing where to look for a child and locating a child.
The value of Bill C-22 for child welfare is indirect, but it's important. It may help our police partners obtain lawful digital leads that child welfare agencies, trafficking hubs, survivor services and community organizations can translate into safety planning, protection and survivor-centred support. Exploited youth must be treated as victims and survivors, not as offenders.
Digital information alone will not make children safe. Safety requires coordinated systems, including child welfare, police, survivor-led supports, indigenous and culturally specific services, immigration expertise, housing and mental health supports. Used lawfully and with safeguards, Bill C-22 may help partners locate children sooner, disrupt exploiters faster and strengthen collective efforts to protect children and youth.
Thank you.
Conservative
The Vice-Chair Conservative Frank Caputo
Thank you very much, Ms. Moellenkamp.
I want to thank this panel of witnesses.
I will begin the first round of six minutes now.
Ms. St. Germain, you probably don't remember me, but I consulted you when I was writing the bill to change the name from child pornography to child sexual abuse and exploitation material. I first became acquainted with your work when we both attended the same B.C. ICE provincial strategy conference. For those who don't know, the RCMP in Vancouver has a specific unit that investigates Internet and child exploitation. People from all sorts of agencies gathered at the conference. I really appreciated your interventions there.
One thing we were talking about in the prior round was how long it takes for an investigation to kick off. I have prosecuted an Internet luring case. A lot of people don't realize this, but the software for a service provider, let's say, Facebook, could pick up an attempt to lure a child. Then, that goes to Washington, D.C., as I recall—it used to anyway—to the National Center for Missing & Exploited Children. I believe it would then go to the national headquarters for the RCMP, and then it would go to the province. Is that somewhat accurate?
General Counsel, Canadian Centre for Child Protection
Yes, assuming this is coming through mandatory reporting in the United States.
General Counsel, Canadian Centre for Child Protection
That is how it goes.
Conservative
The Vice-Chair Conservative Frank Caputo
That process takes a fair amount of time. I asked one of the legal experts on our previous panel about this. When we're talking about data retention, how long do we need to retain data? I don't think anybody thinks data should be retained indefinitely. You're a lawyer. You understand where people are coming from. We also have to look at how long data needs to be retained in order to have an investigation.
In your experience, can you tell us how long it takes for an investigation to kick off to the point where somebody would look at it and say that they need something? For example, it could be a missing IP address that is an evidentiary gap, and if they were to have it, this would help them catch a child predator. Hopefully, I'm being clear.
General Counsel, Canadian Centre for Child Protection
Yes, I understand what you're asking. I'm not sure that I'm the person you should be asking. We're not police. The role we play is very distinct and separate from police. We get tips from different places and pass things on to police, but then the investigative process they follow is within their knowledge.
We know, from where we sit in the continuum, oftentimes when the tips are coming in to us from Canadian children and families, that they can't be acted upon. By the time the information gets through to police, there may not be sufficient information for them. There certainly have been delays, in terms of getting subscriber information, to link the information they have to an actual location so that they can start to investigate someone.
For an example, an IP address may lead to an individual house, but within that house, there may be four individuals living there. There's a whole process. Every step in the process helps narrow down and get closer to the actual person.
On the issue of metadata, what I understand from the bill is that this is being left to regulation to go through what metadata is being captured, being saved and being saved for how long. That is an important process in order to clarify what pieces of information are going to be helpful. Certainly, from what we see in the courts, that information is critical in terms of linking an offender to a particular piece of activity on the Internet.
Conservative
The Vice-Chair Conservative Frank Caputo
I appreciate that.
One of the greatest challenges I saw was linking the person in the prisoner's box to the person behind the computer screen or on the phone because you must have a piece of evidence that is linked in every spot.
How long does it generally take from the time you get a tip to the point where something can be sent to a police agency?
General Counsel, Canadian Centre for Child Protection
Our role is to turn the tips around as quickly as possible. We will process the information, and if it appears to reveal that it is a criminal act, then we will send it to the police agency that we believe has jurisdiction.
We will use tools to try to figure out what we can, based on what we have. We're not necessarily getting things like IP addresses or anything like that. We're getting what the child is saying, such as the username of the person or the description of what is happening. We're trying to get the police where the child is, unless we can figure out something about the offender.
We turn it around fairly quickly. Within 48 hours, if not sooner, we will have something turned around. We certainly try to prioritize things and get through everything very quickly.
Conservative
The Vice-Chair Conservative Frank Caputo
That username is then used to get a production order, ideally, on oath or on affirmation, which is part of what this bill is about.
Ms. Moellenkamp, do you have anything to add to this, based on your expertise?