Public Safety Committee on June 11th, 2026

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

How do you get from having IP addresses to looking for subscriber information?

[Aaron Gilkes]

That's part of the challenge.

If you're able to do an open-source check on the information that you receive, then you might be able to identify the IP range for a particular provider.

Now, as I alleged earlier—I think it may have been on Tuesday—it's possible that there are resellers of IP ranges. A large company may resell a certain range of IPs to a smaller company, and so forth and so on, until an address is sold to the subscriber. Just because the allotment of IP addresses was to a larger company, it doesn't mean that they're actually going to have the subscriber information that would be associated with that particular IP address at a particular time.

Police have the challenge of trying to identify which company might have provided direct services to whoever used that particular IP address.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

How do you get from there to this clause?

[Aaron Gilkes]

In terms of the production order for this information, this would be a good example of where you receive many IP addresses and you're trying to identify who they might actually belong to. You're trying to identify whether these IP addresses could potentially belong to the victim or to the person who is claiming to be a victim. At that point, you don't necessarily know, or you haven't confirmed, whether a crime has actually occurred. You have, for example, a conflicting statement from the victim, or the potential victim, and the bank itself. You have the possibility that the crime has actually occurred.

If you have only the possibility, you're not at reasonable grounds to believe yet. You need to have, or it would be nice to have, another tool to be able to write the possibility that this crime has occurred. The information received would allow you to confirm or deny, or at least provide evidence of, the offence.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

What you're saying is that you can ask the bank for a production order, but you can't just ask Shaw or Telus or Rogers for a production order.

[Aaron Gilkes]

Well, that would really depend on how you obtained it yourself. When I started walking you through this, I was giving a particular example. That won't always be the way we're going to receive it. Some of the time it can come in the form of a potential breach that has been reported by a bank, “Oh, we believe these IP addresses may have fraudulently accessed accounts.” If that has not necessarily been confirmed, we won't have any evidence to corroborate what has been provided.

We could also simply receive IP addresses and have to determine, based on these IP addresses, whether a crime has been committed, and then obtain information in relation to those to actually further the investigation.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

With regard to the kind of example you're laying out, let's say I have a bank branch in my community where five seniors have gone in that week who are all missing money from their accounts. When the bank goes and does its internal investigation, they realize that in all five withdrawals, the same IP addresses were used. They call you. Now you are trying to figure out where the next piece is on the trail of breadcrumbs.

[Aaron Gilkes]

That's right. The reason we're doing this is that it's not enough to obtain an IP address. We have to obtain information while thinking down the road about conviction. We'll have to associate an IP address to potentially a device, and then associate that device to potentially an individual, and then identify or try to figure out whether that individual is actually the one behind the device or whether someone else was using that device to commit the offence.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

What are the limits now in terms of associating those IP addresses with a device that this part 1, and specifically this section, is trying to address so that we can tie it to the subamendment? I always want to be relevant.

[Aaron Gilkes]

What we're experiencing now, in terms of police challenges, is the initial step to be able to execute or to have enough grounds to go and obtain a production order from a justice or a judge. We need reasonable grounds to believe that an offence has actually been committed. As I mentioned before, if we're not sure—if there are conflicting statements, or if there's nothing more than a declaration by a witness or a victim or something like that—it might not be enough to prove that you have the grounds to believe an offence has been committed. There's the possibility, but there's maybe not the probability.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

Okay.

In terms of this subamendment, it lays out a list of things. The way the bill was originally drafted, the idea was that law enforcement could simply go to a judge and say, “I'm looking for subscriber information and I want all of it”, or say, “I just want subscriber information; give me an order for subscriber information.” Then the Bloc amendment said, well, we're going to limit it to subscriber information specified in the order. Mr. Housefather's subamendment now says that the order can only compel production of subscriber information that is in the Criminal Code definition of subscriber information.

Let me ask you this: Is this an exhaustive menu, or is this where, when you go for the order, you just need to specify what it is and the judge will decide whether or not your list is a good list or a bad list? Is there a limit to the menu here?

[Aaron Gilkes]

It is up to the justice or judge to decide whether your menu, as you might call it, or your items to be searched for are pertinent to your investigation.

Part of the issue you experience as a police officer is not being able to establish exactly what types of records are kept and exactly what they're called. You could miss records depending on what's kept by the entity itself. You don't always have that back-and-forth, that ability to contact the entity itself and ask those questions as to what types of records they keep, how long they keep those records for and so on. If you don't have knowledge of exactly what's kept, and you send a production order asking for general information, then you might miss out on key evidence that would lead you potentially to other types of....

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

In this case, is it reasonable to say, then, that Mr. Housefather's subamendment here would not only provide greater privacy protection, but it would also help law enforcement be more specific about what they're looking for?

[Aaron Gilkes]

Would it be more specific?

It would be inclusive of the different types of potential data that may exist for the different types of service providers.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

I just want to be clear.

Again, it's interesting. During the break while we were voting, I got a text from a constituent who said that she was watching. She said some nice things, which is lovely. She's continuing to be concerned about this legislation. She's finding this conversation to be helpful in explaining it, which is nice to hear. It's good to know that the work that we're doing here, if we have you through the afternoon and the evening, is going to be a benefit to people who are trying to understand what's happening in this bill. It's very nice to hear from people. I'm really glad that the people in my community are engaged with this.

You have really helped people who are worried. There's been so much confusion between part 1 and part 2 of the bill. We are in part 1 of the bill. As our friends across the table know, one of the things that we've proposed and would like to see is this bill split in order to help Canadians understand that there's this one type of activity going on over here, and there's a different activity going on over there that requires more scrutiny.

In this part of the bill, you've done a nice job of explaining the fact that this comes to you because it is initiated. There are reasonable grounds. There is a standard. We may have a bit of a discussion about that in further subamendments and amendments. There is a standard that is applied, and it is a legal standard, so it's not just a fishing expedition. You have to go to a judge. You are going to have to specify that information. The judge is there as a check on what information is allowed to be provided. There are standards of review of your information that come with that.

This part might be one of the most important parts that I'd like to hear more from you on. The data is already in the provider's possession or control when the order is received. Can you elaborate on that and talk about how that differs from the kind of data collection and activities that are talked about in part 2 of the bill?

[Aaron Gilkes]

You want me to speak about how that differs from part 2.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

First, let's explain it with an eye to being able to differentiate it.

[Aaron Gilkes]

Essentially, when we're applying for a production order—it could be any type of production order—in this case, if we're talking about subscriber information, generally this information is kept for business purposes. This is very similar to information that would be kept in part 2 in terms of the reasons that the information is initially kept. What tends to differ is how long the information is kept for.

For example, if we're talking about financial services, there's an obligation to keep that information for a certain amount of time, and that's a legal standard that is put forward by the PCMLTFA or some other type of finance act that establishes that.

In terms of the information that would be targeted in part 2, we're talking about information that a lot of the time is collected for network sanity, for billing purposes or for analytics, to see how their clients are using the network at any given time in any particular area. This is information that's generally not going to be kept for as long because, after you've established that your network is functioning for a certain amount of time, you don't need to keep that information generally for much longer.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

That's fair, but when you're talking about network functioning information, for example, that's not information that goes to whether or not a crime has been committed. That's not the kind of information you'd be looking for here.

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

Thank you, Mr. Chair.

Ms. Kronis, I find your set of questions quite interesting and relevant for the individual in your constituency whom you're talking about. These are really interesting details.

We analyzed this type of information during the committee study. We're now working on the clause‑by‑clause consideration.

Mr. Chair, we're talking about the subamendment to amendment BQ‑4. While this is quite interesting—I'll give you that—I would like us to stay on topic.

[The Chair, Liberal, Jean-Yves Duclos]

Indeed, we've already been working on Bill C‑22 for 24 hours. Many of these topics have already been explored in detail by the regular committee members. Of course, as members of Parliament, you have the right to delve deeper if you wish. However, I urge everyone to remain focused on the subamendment to amendment BQ‑4.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

I really appreciate the comment.

I would like to respond in French, but I'm quite tired. I imagine that you are too.

I'm asking about the part of Mr. Housefather's subamendment that talks about the Criminal Code's definition of “subscriber information”, which specifically includes information that's already in the provider's possession or control when the order is received. What I'm trying to parse through is the question of what information is in the subscriber's control and what information isn't in the subscriber's control.

I realize that you had a very long discussion about this in the more general sense of it, but since we are discussing the subamendment, I'm trying to zero in on the information that's relevant to the subamendment from that subset.

Does that help?

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

It's up to the chair to decide if....

[The Chair, Liberal, Jean-Yves Duclos]

It's not for me to decide. It's just for me to invite everyone to be as helpful as they can be, and that's everyone's choice to decide how they want to do that.

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

Thank you.

This is in the interest of making it easier for people at home to understand exactly what we are debating with respect to this subamendment because, as you know—you've been here for the conversations—people are very worried about what information is going and what information isn't going. It's the kind of information that is being asked for in this section.

Please zero in, as per the chair's request, on the kind of subscriber information that would be retained. It was really helpful to point out that banks are already retaining your records. We want banks to retain our records. When we have to do our taxes, sometimes it's frustrating because you can only get so much digitally, and you have to make requests for records. It's what kind of subscriber information you would be asking for from different kinds of service providers.