Good afternoon, Mr. Chair.
My name is Alexander Surgenor. I'm counsel with the Canadian Constitution Foundation. We are a non-partisan, donor-funded legal charity. Our work consists of education and advocacy on matters pertaining to civil liberties, the rule of law and our constitutional order more generally. This is my first time appearing, so I thank you for the invitation.
Our concern with this bill is long-standing. It dates back to really the progenitor bill, Bill C-2. While we're pleased with the evolution there and the modest amendments and changes that followed, we remain concerned, and in fact even more concerned, about Bill C-22. That's why I'm here. I don't mean to be hyperbolic, but truly it's difficult to escape the inference that Bill C-22 would establish a pretty powerful regime of surveillance and constitute a pretty severe invasion into the privacy of everyday Canadians. Our concerns are fundamentally about the intrusiveness, the vulnerability and the overall secrecy that this bill envisions.
Allow me to identify exactly what I understand this bill to require. So-called core providers may be ordered to develop, test and maintain technical capabilities for extracting information, in particular computer data. I'll get to that in a moment. This would be achieved in part by installing, using and maintaining prolonged and continued access to perhaps any given device. The concern here, of course, is that it's not just so-called core providers. It's the fact that electronic service providers, carrying an enormously broad definition, could also be required, following a ministerial order, to undertake those same acts that the so-called core providers are. Very quickly, an electronic service provider could also become a core provider. There's no reassurance to be had in really defining those two terms differently. They're one and the same, and they would be quite quickly.
What is an electronic service provider? It is any entity that provides business in this country, or conducts a portion of its business in this country, through electronic channels, be it through the Internet or perhaps through software that's installed and kept locally on a device. Internet connectivity is relevant in that case.
Now, at the heart of it here, and really the pith of it, is the concern about metadata. Metadata is information about information. While the context of a text message might not be accessible, the fact that a text message, as an example, was sent could be accessed. To whom, when, how—all of that is fair game. The fact that a phone was used on the Hill in Ottawa, two days later in a library in Corner Brook, and then on another day finds itself in a hotel room in Saskatoon—that is all fair game. With this bill, we can monitor that, keep track of that and follow that.
In other words, the entirely innocuous and inherently private comings and goings of ordinary citizens are up for grabs. Up to a year's worth of movement, communication, work and ordinary life would be preserved for review while the private citizen, of course, is kept completely oblivious as to this occurring or not. Though the bill says no such order would be made if it would introduce a systemic vulnerability, I'm not particularly sanguine about that. The notion that only the good guys will have access to this flies in the face of examples from our peer nations in the Five Eyes that have suffered data breaches of exactly the sort that would constitute a systemic vulnerability.
If the aim is to better investigate criminal activity—I have some knowledge of this, having worked as a criminal defence lawyer and having seen both sides of this—it's unclear to me why the proposed powers have to be so broad to capture basically every device in this country. The CCF would gently remind everyone of the terms “public official” and “private citizen” and the key distinction there.
The importance of privacy cannot be overstated. Privacy is about dignity and autonomy. These are the predicates of a free society. To have a truly free society, we must be free to make our choices without the sense of being monitored—and, of course, not even knowing that we're being monitored.
I see that I'm at time. Once again, I thank you for hearing our concerns and inviting me to participate in this critically important discussion.