Mr. Speaker, the focus of my remarks today on Bill C-22 will be on part 2, which is the so-called lawful access proposal, and specifically what the bill as written actually does and why Canadians should be deeply concerned about it.
There are two competing interests at play here, in this so-called lawful access proposal. On the one hand, there is the public interest in safety, security and the effective suppression of crime. On the other hand, there are the privacy interests of all Canadians: the right to be left alone, free from unwanted intrusion by the government or its agents. In my view, the Liberal government bears the burden of demonstrating, one, why these new powers are necessary; two, why our current system is inadequate; and three, that the measures in Bill C-22 strike the right balance between the protection of privacy and public safety.
In my view, the Liberals have failed on all accounts. They have failed because Bill C-22 is overbroad and disproportionately interferes with the privacy interests of all Canadians. It does this by forcing what are known in the bill as “electronic service providers”, who provide to Canadians what is called in the bill “electronic service”, to build into their systems interception and monitoring capabilities to collect and retain data about Canadians. As I will show, there are almost no guardrails respecting who will be caught by this proposal, nor are there sufficient limits on the data that it proposes to capture. Perhaps most troubling is that the data includes location data, effectively turning every connected device into a government-spying device. On top of it all, the minister is given power to do all of this in secret.
Part 2 of Bill C-22 will require a wide range of electronic service providers to build interception and monitoring capabilities into their system. A plain reading of this proposal leads to the conclusion that nearly any entity providing electronic services to Canadians will be caught. Let me unpack two key definitions to show just how broad the proposal really is. The first is “electronic service provider”, and the second is “electronic service”. An electronic service provider is defined in the relevant part of the act as a person who “provides an electronic service, including for the purpose of enabling communications”. The keywords here are “electronic service” and the phrase “including for the purpose of enabling communications”.
The Liberals would have us believe that this definition targets only telecoms and big tech. The Minister of Justice said so in his speech. He said, “we are mainly focused on large-scale networks to ensure that we understand the metadata behind messages”, but that is not what the bill says. The bill says, “including for the purpose of enabling communications”. The word “including” is a deliberate drafting choice, and it signals a non-exhaustive list. It means that the definition of “electronic service provider” will capture much more than just those who are enabling communications, much more than just big telcos and big tech.
That becomes even more clear when we look at the second definition, of electronic service, which reads, in part, as follows: “a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form”, and the definition goes on. I realize that is a mouthful.
Taken together, these definitions create an extraordinarily broad scope. Based on the text as written, I could qualify as an electronic service provider. Banks could qualify, law firms could qualify and news media could qualify. They all create, store and transmit electronic information to Canadians.
Where exactly are the boundaries? I have not heard them yet, including from the Minister of Justice. The Liberals, who proposed this, bear the burden of delineating those boundaries clearly and narrowly, and they have failed to do so. This failure becomes problematic when we get to secret orders, which we will do shortly.
A subset of these electronic service providers will be designated as core providers. We do not know which companies will fall into this category, because the Liberals have not told Canadians. It will be proposed in regulations sometime in the future. What we do know is that core providers will be required to build technical capabilities into their systems allowing government to access Canadians' data.
The Liberals have attempted to assure Canadians that these obligations will be limited to a narrow subset of metadata. The justice minister reiterated this when he said in his speech that the goal is “not specifically requiring the individual content of every message, but only trying to identify what messages may have been sent at what time”. However, that is not what the bill says. Proposed paragraph 5(2)(a) allows cabinet to make regulations requiring core providers to develop, implement and maintain these technical capabilities. Importantly, regulations may be made “related to extracting and organizing information”. The phrase “extracting information” is extremely broad and goes well beyond metadata. Moreover, proposed paragraph 5(2)(a) is not limited by the restrictions respecting metadata in proposed subsection 5(4). Those are the restrictions around browsing history and social media.
Even if the requirements were restricted only to certain metadata, the proposal would still be overbroad. Metadata, including location data, is far more revealing than, as the minister said, what messages were sent at what time. Metadata is a comprehensive record of communications behaviour. Combined with the subscriber data available under part 1 of the bill, it creates a detailed picture of Canadians' daily habits, places of residence, movements, social relationships and private lives. This is exactly why similar blanket retention laws in Europe were struck down as a disproportionate interference in privacy rights.
For all electronic services providers, whether they are core providers or otherwise, the government maintains even more sweeping powers. Proposed subsection 7(1) allows the minister to issue an order to any electronic service provider imposing the same obligations that can be required of core providers.
All of these powers, whether exercised with respect to core providers or any other electronic service provider, can be exercised in secret. Regulations made by cabinet for core providers are exempt from the Statutory Instruments Act. Ministerial orders for electronic service providers are exempt from the Statutory Instruments Act. That means they would not be published in the Canada Gazette. That means they would be secret. Worse still, electronic service providers would be prohibited from publicly disclosing that they are even subject to such an order.
These requirements to build systems into electronic service providers' provision of electronic services to Canadians would create serious vulnerabilities in our infrastructure. Providers would be creating a front door for government access, one that can and likely will be exploited by bad actors or the government itself. That is not my conjecture; that is a demonstrated fact.
I have two examples. First, in 2004-05, hackers exploited Vodafone Greece's built-in lawful interception systems to illegally tap the phones of the Prime Minister, cabinet ministers and other senior officials for months. More recently, the China-linked Salt Typhoon hacking group breached lawful intercept systems operated by major U.S. providers, including Verizon and AT&T. In both cases, systems built for authorized government access became gateways for serious abuse, including by Communist-backed hackers.
These systems would be abused by government. I do not trust the government to exercise these powers in the public interest, because it has shown itself to be untrustworthy.
There is another path. Our current legal framework already provides for police to obtain court authorizations for information, preservation orders and assistance orders. Critics argue that the process is slow and burdensome, and those are serious concerns that deserve serious merit. However, the solution is not blanket authorizations to retain vast amounts of data by an untold number of service providers.
In summary, Bill C-22 would create a broad surveillance framework covering vast amounts of Canadians' data, and it would do so largely in secret and without sufficient oversight or remedies for misuse. It would also introduce new vulnerabilities into our digital systems that would make Canadians' data less secure. These are vulnerabilities that bad actors and even governments themselves may abuse.
With all these things taken together, the government has failed to demonstrate why these expansive new powers are necessary, why the current system cannot be improved upon, and that Bill C-22 strikes the right balance between public safety and the protection of Canadians' privacy interests.