Evidence of meeting #37 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A video is available from Parliament.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
You never discussed that. Okay. Thank you.
I have just one more question.
In your experience, is it typical? You've probably been part of these processes before. I assume you have been; I could be wrong. Is it typical for consultation reports involving external experts and stakeholders to be withheld entirely? Have you seen that before?
Associate Professor, As an Individual
I've never been involved before in a consultation that was run by an external party, so I'm not sure. Typically, I've been involved in consultations that are run by the government itself, and they usually—
Conservative
The Vice-Chair Conservative Frank Caputo
I'll interrupt for just one moment, please.
We have a meeting here. I don't mind whispers; I know that's going to happen. If it needs a meeting, we should go outside, please. Thank you.
I'm sorry about that.
Associate Professor, As an Individual
That's all right.
I've never been involved in a process similar to this. In the past, in government consultations, I've seen “what we heard” reports be published. This was a different kind of process.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
It sounds like, in part of the process, you may have seen the report. Can you comment on whether it would be helpful for us in...?
Conservative
Rhonda Kirkland Conservative Oshawa, ON
You saw a list of recommendations.
Without disclosing anything confidential that you may have seen, can you tell the committee if the report reflected a diversity of views? Do you know if there were recommendations including concerns and cautions raised by experts and stakeholders in terms of privacy?
Associate Professor, As an Individual
Yes, because my own concerns were reflected in the list of recommendations.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
Thank you.
Beyond that report, I would like you to expand the specific recommendations you have for amendments. Could you give one or two that you think would really make this bill a much better bill? We know about lawful access and how important it is. I appreciate the chiefs in the meeting today because of how important it is.
Can you give us one or two amendments that could seem fairly simple and that you think we could all agree on in order to get this right versus racing...?
Associate Professor, As an Individual
Yes.
As I mentioned, I would implore the committee to hear from technical experts who know, better than a lawyer, how to capture all the types of vulnerabilities you would like to avoid in the definition of “systemic vulnerability”. I also think that the current retention provision as drafted is overbroad. We've seen similar provisions, even more narrowly tailored ones in Europe, to be found to engage the right to privacy and be unreasonable. I think that provision in and of itself needs to be reformed to ensure that any regulation is narrowly targeted, necessary, proportionate and reflects the seriousness of what they're asking for, which is the creation of large pools of private data.
Conservative
Rhonda Kirkland Conservative Oshawa, ON
Thank you.
We know that broad definitions often lead to future governments misusing or abusing legislation—
Conservative
The Vice-Chair Conservative Frank Caputo
Unfortunately, Ms. Kirkland, your time is up.
Up next is Ms. Acan for five minutes.
Liberal
Sima Acan Liberal Oakville West, ON
Thank you very much, Mr. Chair.
Dr. Leah, it's great to see you again.
My question for you will be on foreign entity requests. Canada is currently the only Five Eyes and G7 member without modernized lawful access legislation. Does our lack of a technical capability framework hinder our ability to co-operate with international partners on transnational threats? How does part 1's new mechanism for foreign entity requests solve this problem?
Associate Professor, As an Individual
Yes, it does.
Talking to folks across the Five Eyes, my understanding is that in other jurisdictions the threshold upon which they can obtain subscriber information is lower than that in Canada. Often it's not required to be judicially authorized, or it might be on a reasonable suspicion standard or even lower than that. When they try to use the MLAT process in Canada, there's no parallel in Canada that would allow us to enforce their orders.
Having a new provision focused specifically on subscriber information and transmission data with a threshold of reasonable grounds to suspect would allow us to partner better with foreign jurisdictions because it would be more in line with how they obtain subscriber information in their jurisdictions and allow for equitable enforcement.
Liberal
Sima Acan Liberal Oakville West, ON
Thank you very much.
I'll focus primarily on the operational side of policing and ways to support the work that the investigators do when it comes to organized crime, extremism, child sexual exploitation and other complex crimes.
Chiefs, Bill C-22 creates a confirmation of service demand, which simplifies the process by which law enforcement identifies the proper recipient of a production order. Would you say that this helps in the context of a time-sensitive investigation dealing with organized crime, extremism, hate or child exploitation? How does this provide the main operational benefits to you?
Chief of Police, Toronto Police Service
Thank you for that.
I think the practical reality is that we often have a phone number or another clue that requires us to then pursue the digital footprint, the digital evidence, that the phone number or other information provides.
In the present regime, there is no provision for us to make a demand for service providers. We have to do production orders multiple times to simply identify that this is a service provided by a particular telco, for example. There's an incredible amount of time spent doing this. Just by way of example, numbers-wise, over a 20-month period, our detective operations alone in Toronto did 1,900 production orders.
Something that would help us very much is to have the ability to understand which service provider to focus our investigative efforts on and to then pursue that through a judicially reviewed process: production orders or warrants. That saving of time is very real and will impact our ability to succeed.
As was asked in the previous question, the type of evidence that can get lost while we determine who the service provider may be—video evidence, forensic evidence—may involve greater victimization or ongoing victimization that proceeds for a longer period of time while we, in the present regime, determine who the service providers are. The ability to know where to focus our investigative energy quickly and then to go through the process of gathering evidence through production orders, which are scrutinized by a justice, is something that we very much welcome.
Liberal
Sima Acan Liberal Oakville West, ON
Thank you very much.
In this context, Bill C-22 has metadata retention requirements where metadata is to be held for up to 12 months. Yesterday, we heard from officials that in Australia they keep it for two years. In the U.K., they keep it for one year.
Would you say that requiring core providers to retain metadata for 12 months is a reasonable time frame, given the fact of how quickly providers may otherwise delete the data? Sometimes it's 30 days. Sometimes it's three months.
This is still remaining flexible for providers and supportive of investigators, especially when complex cases can go beyond three to six months or even over a year.
Chief of Police, Thunder Bay Police Service
Maybe I will start with this one, and the chief can follow up.
Yes, I think 12 months is a good start, but yes, obviously you're right. If the investigations are prolonged, and they can be very long in some of these cases, retention beyond the 12 months—24 months or 36 months—would be ideal.
Conservative
The Vice-Chair Conservative Frank Caputo
I'm sorry, Chief Fleury. We have to cut you off there.
Mrs. DeBellefeuille, you have the floor for two and a half minutes.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
Thank you, Mr. Chair.
Dr. West, you heard the two police officers discussing data retention periods. You told us that one year is too long. The people who work for police services have just told us that, for them, one year is the minimum and that two or three years would be even better.
How do you see things?
Do you lean more toward a shorter retention period? How do you respond to what the other witnesses just said?
Associate Professor, As an Individual
I certainly understand from the law enforcement perspective why they would want all the data they need to be available for as long as necessary, but in terms of charter protections, my opinion is informed by what I've read of European jurisprudence on this issue.
Also, it's not just that it's one year. It's one year for any type of data for any purpose: for mischief or for investigating jaywalking, for example. I'm not saying that's what they would do, but it's the fact that it's for any purpose, for any type of data, that creates a chill in people that they could be under surveillance when all of their data is being held for this long period of time.
Right now, there's nothing that constrains the retention. It's any type of data for a year, for any purpose, and I think that's what needs to be amended to make sure that it's more narrowly tailored to the type of data, the requirement and the investigative imperative.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
If we want to share information with the Five Eyes, shouldn't we retain metadata for the same period, on average, as the countries we collaborate with?