Mr. Speaker, I will continue. Part of the challenge in debating legislation like Bill C-22 is that many of the terms involved can sound deceptively benign. Words like “subscriber information” or “metadata” may sound minor, but anyone with experience in digital systems understands otherwise.
Metadata can reveal a tremendous amount about an individual. It can reveal who someone communicates with, when they communicate, where they are located, what services they use and patterns of behaviour that paint a detailed portrait of their private life. In many cases, aggregated metadata can reveal far more than people assume. Over time, it can expose routine relationships, movement patterns and behavioural habits with remarkable precision, often allowing detailed inferences even without access to message content itself.
It is also worth remembering that digital identifiers do not always map neatly onto individuals. An IP address or subscriber record may identify an account holder or Internet connection but not necessarily the person behind specific content. That is one more reason Parliament must proceed carefully when expanding access to such information. When the government proposes mandatory metadata retention, expanded access powers and technical interception capabilities, Parliament must treat those powers with the seriousness they deserve.
This reminds me of the time when, as a young teenager, I was hired at a local Internet service provider, when I was living in Forest, Ontario. I was going to North Lambton Secondary School, and my job after high school was not working at the local grocery store stocking shelves or at the local gas station pumping gas. My first job was working at the local Internet service provider, back in 1996. As part of that role, I was in charge of web development and tech support, and I had access to all of the data for all of the customers. It was not just customers' accounts. There were times I had administrative access and I could see, in real time, where people were going on the Internet. I asked myself, what are the stipulations in protecting this information?
Again, it was 1996, and even though I was an employee, I had the maturity to tell myself this information should be private, should be kept within the company and should not be shared with my neighbours, including my friends at the local high school. It was interesting, as an employee of the local Internet service provider, to walk through the halls of North Lambton Secondary School back in 1996 at age 16. I would see my friends and my peers at school, and I would know where they went on the Internet and also where their parents went on the Internet. Yes, I knew the dirty laundry of Forest, Ontario, and also of Lambton County.
These are precisely the kinds of questions that must be tested carefully at committee to ensure the right balance is struck. We need to balance law enforcement tools with the privacy that Canadians entrust us with under the Charter of Rights and Freedoms. This is not merely about giving police access to isolated records. It is about creating and mandating digital surveillance infrastructure. That requires caution for two reasons.
The first reason for caution is that governments must never simply be trusted to exercise broad powers perfectly. Parliament must legislate based not on ideal assumptions but on real-world experience. Many Canadians remain concerned whenever governments seek expanded powers touching on privacy and civil liberties. That does not mean such powers are never necessary. It means Parliament has a duty to ensure that they are narrowly drafted, proportionate and subject to proper oversight.
The second reason for caution is technical. Bill C-22 would require certain providers to build and maintain technical interception capabilities and retain metadata for up to one year. Every additional repository of retained data creates a target. Every additional access mechanism creates a vulnerability. In cybersecurity, one of the most basic principles is to minimize unnecessary access pathways. Systems are generally made more secure by reducing points of entry, not by multiplying them. Parliament must be cautious whenever legislation proposes to move in the opposite direction.
Those of us with experience in cybersecurity understand a simple reality: Every access point created for lawful use is also a potential attack surface for unlawful exploitation. That concern is becoming more urgent, not less. Artificial intelligence is dramatically accelerating offensive cyber-capabilities. Anthropic recently declined to publicly release one of its most advanced models after reportedly concluding that its ability to identify and exploit software vulnerabilities posed serious security concerns.
Parliament cannot ignore the reality that the tools available to malicious actors are becoming more powerful at an unprecedented pace, so it must ask itself if it is prudent to mandate the creation of more retained data, more interception infrastructure and more potential vulnerabilities if not absolutely necessary. In trying to improve lawful access for investigators, we must be careful not to weaken the broader security of the systems Canadians rely upon. These are complex, technical considerations, and Parliament should take the time to fully examine them before finalizing this framework.
There is also an economic and innovation dimension to this bill. Canada has already seen how digital regulation can produce unintended consequences when burdens are poorly calibrated. Following the passage of the previous Parliament's Bill C-18, Meta chose to block Canadian news content on its platforms rather than comply with the framework Parliament imposed. That is a reminder that large digital firms can and do make strategic decisions about whether operating under Canadian rules is worth the cost.
Even more importantly, while dominant, multinational firms may have the leverage and resources to absorb significant compliance burdens, smaller Internet providers and emerging competitors often do not. If Parliament imposes overly onerous technical requirements, it risks creating barriers to entry, discouraging innovation and entrenching the very largest incumbents at the expense of competition in Canada's digital economy.
These potential impacts should be carefully considered as this bill moves through committee. None of these concerns mean that lawful access reform should not proceed, only that it must proceed carefully. Conservatives believe police should have modern tools.
