Evidence of meeting #38 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A video is available from Parliament.
Senior Director, User Privacy and Child Safety, Apple Inc.
We're here to engage with the committee with whatever time it has.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
Would it be helpful if the committee had more time to discuss this bill, in your eyes?
Senior Director, User Privacy and Child Safety, Apple Inc.
Again, I'm just happy to be here and to answer questions, as we will.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
Mr. Israel, can I ask you that same question, please?
Director, Privacy, Surveillance and Technology Program, Canadian Civil Liberties Association
It would certainly be helpful to have more time. This committee has had three sitting days to hear from witnesses. That's not sufficient for legislation with this level of complexity.
I mentioned the review that the Australian version of this got. It was much more comprehensive. This committee studied Bill C-8 for two months maybe, and it's a similar regime that raises similar questions but of less complexity and scope. I would say, yes; more time is needed to study this bill.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
Yes, I think that this bill is actually much more technical than Bill C-8 because, with Bill C-8, we could understand what different components meant. I think we'll have a witness in the next round who actually talks about what metadata is.
We actually haven't gotten into the technical aspects of this. We have largely heard from people like you—people from Google, people from Apple—about their concerns, but we haven't even had time to delve into the technical aspects as to what this encryption means. Is that with respect to all aspects? Is it end-to-end encryption? I'm not an expert on these things, and we haven't heard about that data or about that analysis from experts. I'm quite concerned.
Mr. Neuenschwander and Ms. Patell, you can weigh in on this. The minister was equivocal when I asked about encryption. Even though we as Conservatives will be putting forward amendments that will clearly say that encryption will be offside when this bill is studied clause by clause, are you still concerned with respect to this bill touching encrypted technology?
Senior Director, User Privacy and Child Safety, Apple Inc.
We would welcome that amendment and seeing it, but we do have concerns that go beyond encryption in terms of how risk is being looked at. As strong encryption protects all users of our services, not just Apple's but across the industry, we think it is critical that this remain protected as Bill C-22 moves forward.
Conservative
Director, Government Affairs and Public Policy, Canada, Google
Yes. In a similar vein, we've put forward a number of suggested recommendations in terms of how to strengthen this bill. I think encryption is one area that we could speak to, but like Apple, we would point to the definition of “systemic vulnerability” as an area that could be strengthened, as well as the sweeping ministerial orders.
I know that my colleague, Kate, would be happy to speak more to how that could be strengthened to be more consistent with international [Technical difficulty—Editor].
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
I'm going to ask a question on that. One of the issues that I see here is that the government has tried to put in a check and balance in the form of the approval by the intelligence commissioner, though the order would remain secret. I think judicial review is actually the ultimate form of check and balance. W
hat do you say to that, either Ms. Charlet or Ms. Patell?
Director, Government Affairs and Public Policy, Canada, Google
I'll turn to Kate to speak to the need for oversight.
Katherine Charlet Senior Director, Privacy, Safety and Security, Government Affairs and Public Policy, Google
Thanks very much for the question.
I do believe that it's instructive to look at some of the models that are out there. Judicial oversight certainly is an important protection. It is not the only protection. If you look at U.S. law, for example, it does require a federal judge to review before ordering a technical modification. The EU electronic evidence regulation explicitly states that any obligation to decrypt data or re-engineer systems for access is not part of the powers. The U.K. Investigatory Powers Act does include a judicial commissioner review.
None of those protections is available in Bill C-22. We recommend that a judicial review be a part of this, but it is perhaps not the only safeguard that could be added here.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Nicola, BC
Along those lines, would you agree....?
This is an exercise in comparative legislation and drafting. One of the deficiencies I think we've had in this committee process is that we haven't heard from experts on EU law or on Australian law, where they keep metadata for even longer but I don't know exactly what categories of metadata they're keeping. Do you see it as a deficiency in this study when we don't actually have people from other jurisdictions, which is something that we heard about from the committee process?
Would it concern you, as an outside observer, that this committee isn't looking at other models and hasn't heard from witnesses who are experts on other models so that we can compare them in order to get the best possible outcome?
Senior Director, Privacy, Safety and Security, Government Affairs and Public Policy, Google
I do agree that it's instructive to look at those other models.
From our assessment, it does appear that Bill C-22 would be the only G7 regime that does not include judicial oversight but does have the expansive ministerial order powers. Certainly others could weigh in on this as well, but I do think it's an instructive part of the conversation.
Liberal
The Chair Liberal Jean-Yves Duclos
Thank you very much for that.
Let me turn to MP Zuberi for six minutes, please.
Liberal
Sameer Zuberi Liberal Pierrefonds—Dollard, QC
Thank you, Mr. Chair.
Mr. Israel, I would like to pick up on the last comment by Ms. Charlet. Given that you're in the Canadian Civil Liberties Association, can you comment on what Ms. Charlet just said with respect to what other jurisdictions are doing?
Director, Privacy, Surveillance and Technology Program, Canadian Civil Liberties Association
The Australian regime does not include judicial authorization. This has been one of the heaviest criticisms levelled at the regime, including by an independent review of the regime that was conducted two years ago. It was the single biggest flaw that the independent review considered needed to be fixed right away. The U.K. regime does rely on judicial review by a commissioner.
Under Canadian law, judicial review, as a mechanism, is different from judicial authorization, and it's important to keep the differences in mind. Judicial review is an assessment of whether the decision-maker made a reasonable decision based on the information in front of them. In contrast, when judges are authorizing a search warrant or something of that nature, they are the ones who are weighing the different considerations.
Given the nature of the bill, it's particularly problematic to rely on judicial review alone, as opposed to a stronger type of independent scrutiny.
Liberal
Sameer Zuberi Liberal Pierrefonds—Dollard, QC
In other Five Eyes or comparable jurisdictions, is there judicial authorization in advance or only judicial review?
Director, Privacy, Surveillance and Technology Program, Canadian Civil Liberties Association
In the U.K., it's judicial review, although the mechanisms of judicial review may differ from what's here in Canada. That regime is currently under constitutional challenge.
In the U.S., the entire regime is overseen by an independent regulator—the Federal Communications Commission—so that's more comparable to judicial authorization.
Senior Director, User Privacy and Child Safety, Apple Inc.
“Erik” is also fine.
Liberal
Sameer Zuberi Liberal Pierrefonds—Dollard, QC
Erik, in terms of what we just heard, are you familiar with other jurisdictions and how they're dealing with these concerns to balance catching bad actors online and protecting civil liberties? Are you familiar with what other jurisdictions are doing?
Senior Director, User Privacy and Child Safety, Apple Inc.
From an engineering standpoint, I am in terms of the scope of what the orders might be able to request.
Liberal
Sameer Zuberi Liberal Pierrefonds—Dollard, QC
With respect to the legislation and the engineering standpoint that you mentioned you're familiar with and that exists in other jurisdictions, do other jurisdictions have the concern that we have, in the sense that we cannot necessarily catch all of the bad culprits that we should be catching within a reasonable period of time, and this legislation seeks to shorten and address that concern about a reasonable time?