The Liberal government’s second attempt at giving police and spies easier access to Canadians’ information includes what’s anticipated to be costly demands on a range of private businesses to to change how they manage their data.
But the government says it doesn’t yet know how much the companies — or Canadian taxpayers — would have to pay.
“The costs are potentially huge,” said Michael Geist, the University of Ottawa’s Canada Research Chair in Internet and E-commerce Law, and a vocal critic of the bill.
“That has competition-related effects in terms of who bears those costs. Will they exempt certain providers? It gets very messy very quickly.”
Section 15 of what is now Bill C-22 would require “electronic service providers” — a broad category of businesses — to update their systems so they can seamlessly turn over information to law enforcement agencies and CSIS, if they have a warrant, as part of criminal and intelligence investigations.
It’s meant to address a problem police and intelligence agencies have flagged, describing dealing with providers as the Wild West where consistency and reliability is lacking.
Supt. Nicolas Gagné, director general of the RCMP’s technical investigation services, says asking three different telecommunication companies for information on a suspect can yield three wildly different results.
“Sometimes that piece of information that we’re lawfully authorized to have access to is really hard to exfiltrate and provide in a readable format for the investigators,” he said.
“And in some instances it’s not. It’s readily available. So there’s a variance.”
Telecom group wants costs covered
The Supporting Authorized Access to Information Act (Section 15 of Bill C-22) would require electronic service providers to develop and maintain capabilities in order to retrieve and store that information. Bill C-22 would also require “core providers” to retain metadata for up to one year.
Who qualifies as a core provider is yet to be determined. But Public Safety says they would “likely include traditional telecommunications companies, satellite providers and others.”
The government says the changes would provide investigators with an organized system “like a filing cabinet, where certain types of information would be available with legal authorization.”
“The timeliness of getting information we seek to prevent, investigate or prosecute criminal offenses is key, especially at the beginning of an investigation,” said Gagné.
Eric Smith, senior vice-president of the Canadian Telecommunications Association, made it clear the industry will be seeking compensation.
“Telecommunications service providers incur significant costs to build and maintain their networks. But the technical capabilities contemplated in Bill C-22 go beyond normal business operations,” he said in a statement.
“There is a well-established principle that providers should be able to recover the reasonable costs of implementing these capabilities — an approach adopted in jurisdictions such as the United Kingdom and recognized by Canadian law enforcement agencies.”
RCMP discussed compensation models: documents
Documents obtained by researcher Ken Rubin show government agencies have been discussing compensation models. According to minutes of the lawful access advisory committee from May 2024, the RCMP presented various models from around the world to committee members, including CSIS, police officers, government officials and companies including Bell, Rogers and Telus.
The preferred model, including from the communications giants and law enforcement agencies, would see a governing body administering the development and maintenance, and pay for its operation. While preferred, the documents note it’s a complex, “long-term endeavour.”
“Without the proper level of funding it makes it quite difficult,” the committee noted. “We are all aligned with the need to move on lawful access in Canada.”
Public Safety Canada said the requirements on core service providers will be established through regulations, which are still under development, and so cost will be figured out down the road.
“Cost is an explicit factor that must be considered in making regulations related to capabilities,” said a spokesperson for the department.
In 2012, when the then Conservative government pushed a lawful access bill that also would have forced internet and phone service providers to collect customer information for police, the cost was pegged at around $80 million.
That number has likely ballooned, said Geist, given that the government’s use of the broad term “electronic service providers” could mean that “device makers, the Apples of the world, potentially the platforms, social media companies” will be included.
Bill C-22 would also require at least some employees at these core providers to get security clearances in order to deal with sensitive requests.
The department said the cost would depend on how many electronic service providers are identified as core providers.
“There is an embedding of law enforcement with this direct line of sight into the networks and the device manufacturing that is unprecedented,” said Geist.
‘Search the haystack’
Geist said one of his main concerns is about how long private companies are being asked to retain metadata on Canadians, calling it “wildly disproportionate” to law enforcement’s needs.
“What they’re effectively saying is that they want data retained on every single Canadian that subscribes to a wireless provider or an internet provider so that they can search the haystack for the needle so to speak, if the need arises,” he said.
He gave the example of someone who carries their cell phone everywhere they go, “which is pretty typical.”
“Every time they move with the cell phone, all that information is being retained. It is not being retained right now. The government would require its retention,” he said.
“It’s very, very problematic.”
The Liberal government has introduced a new lawful access bill that it says will help police track those using social media or AI to commit crimes.
Instead, he argues police should be able to take a “quick freeze approach” and seek that information on a suspect while an investigation is ongoing.
Bill C-22 is the government’s second kick at the can trying to bring in a lawful access regime.
The first iteration, C-2, was panned for being too broad and intrusive as it would have allowed agencies to get warrantless access to basic subscriber information from a broad spectrum of providers, including medical offices. Bill C-22 narrows certain warrantless access powers.
Minister of Public Safety Gary Anandasangaree defended the new bill as a better balance of the “needs of law enforcement with the privacy and civil rights.”
“It is not about surveillance of Canadians going on about their daily lives,” he said when introducing it earlier this month.
“It is about keeping Canadians safe in the online space.”
