Bill C-51: Digital Fearmongering

It seems that some of the digital world is getting in a tizzy concerning the new Bill C-51 which will be included in the omnibus crime bill, in particular "online spying". The Globe and Mail has a somewhat recent article.

Anyhow, here's the legislative summary of Bill C-51. As far as I can tell the actual text has not been released and won't be until Parliament is back in session and the omnibus crime bill is introduced.

At first reading what has been written about it, I was worried. Reading the summary, the fear of internet spying though seems exaggerated. The first part seems somewhat ominous:

According to the Department of Justice, the new investigative powers within the proposed legislation give law enforcement agencies the ability to address organized crime and terrorism activities online by:

enabling police to identify all the network nodes and jurisdictions involved in the transmission of data and trace the communications back to a suspect. Judicial authorizations would be required to obtain transmission data, which provides information on the routing but does not include the content of a private communication;

requiring a telecommunications service provider to temporarily keep data so that it is not lost or deleted in the time it takes law enforcement agencies to return with a search warrant or production order to obtain it;

Requiring the keeping of data by ISPs seems somewhat uncalled for. My guess is that many people just read this section and panicked. But, if one looks on the section talking about the tools of "internet spying" it's actually a very reasonable bill:

2.1.2.1 Preservation Demand and Order (Clause 13)

Information in electronic form may be easily and quickly destroyed or altered. Clause 13 of the bill therefore adds a new investigative tool to the Code to preserve this type of evidence, which may take one of two forms: a preservation demand or a preservation order. A preservation demand is made by a peace officer (new s. 487.012 of the Code), while a preservation order is made by a judge, on application by a peace officer (new s. 487.013 of the Code).

A preservation demand or order directs a person, such as a telecommunications service provider (TSP), to preserve “computer data”13 that is “in their possession or control”14 when they receive the demand or order. However, a TSP may still voluntarily preserve data and provide it to a law enforcement agency, even where there is no demand or order (new s. 487.0195 of the Code).

This new investigative tool is different from the data retention measure in effect in some countries,15 which compels TSPs to collect and retain data for a prescribed period for all their subscribers, whether or not they are the subjects of an investi­gation. On the other hand, a preservation demand or order relates only to a particular telecommunication or person, in the context of a police investigation. A preservation demand or order may be given to a TSP only where there are “reasonable grounds to suspect”16 that an offence has been or will be committed17 (new subsections 487.012(2) and 487.013(2) of the Code). However, the person who is suspected of the offence may not be compelled to retain data under a preservation demand or order (new subsections 487.012(3) and 487.013(5) of the Code).18

Preservation demands and orders are temporary measures: they are generally in effect long enough to allow the law enforcement agency to obtain a search warrant or production order. The maximum length of a preservation demand is 21 days, and the demand may be made only once (new subsections 487.012(4) and (6) of the Code); the maximum length of a preservation order is 90 days (new subsection 487.013(6) of the Code).

A person to whom a preservation demand or order is made is required, after the demand or order expires, or after the data have been given to the law enforcement agency under a production order or search warrant, to destroy the computer data that would not be retained in the ordinary course of business (new ss. 487.0194 and 487.0199 of the Code).

Contravention of a preservation demand or order is an offence punishable, respectively, by a fine of not more than $5,000 (new s. 487.0197 of the Code) or a fine of not more than $250,000 and imprisonment for a term of not more than six months or both (new s. 487.0198 of the Code).

In other words, a police officer(or a judge)can temporarily require an ISP to hold a specific piece of data under their control for 21 days (90 in the case of a judge) so that they can get a warrant if there is reasonable grounds to suspect a crime has or will occur.

There's even a little section on how it's different from other countries who require the retaining of data for all internet users.

The next section on production orders also seems sensible:

2.1.2.2 Production Orders (Clause 13)

A production order is made by a judge and is similar to a search warrant, the difference being that the person in possession of the information must produce it on request, rather than the law enforcement agency’s going to the site to obtain the information by searching and seizing it. A law enforcement agency with a production order will be able to more readily obtain documents that are in another country, for example.

The Code already provides a procedure for obtaining a general production order, that is, an order that applies regardless of the type of information a law enforcement agency is seeking.19 Issuance of the order is based on the existence of reasonable grounds to believe that an offence has been committed. The Code also provides for specific production orders, that is, orders for obtaining certain precise information, such as banking information or telephone call logs.20 Issuance of specific production orders is based on the reasonable grounds to suspect that an offence has been or will be committed.

Clause 13 of the bill creates new specific production orders, issuance of which is based on the existence of reasonable grounds to suspect that an offence has been or will be committed, which allow a peace officer to obtain two types of information from a TSP:21 “transmission data” (new s. 487.016 of the Code) and “tracking data” (new s. 487.017 of the Code).22

Essentially, “transmission data” are data that indicate the origin, destination, date, time, duration, type and volume of a telecommunication (e.g., a telephone call or Internet communication), but does not include the content of the telecommuni­cation.23 This type of data is useful: for example, it may be used to identify all TSPs involved in the transmission of data and identify the initial TSP and thus determine the origin of a telecommunication (new s. 487.015 of the Code). “Tracking data” relate to the location of a thing or individual.

These new production orders allow law enforcement agencies to obtain historical transmission or tracking data, that is, data already in the possession of the TSP when it receives the order. To obtain these types of data in real time, law enforcement agencies need a warrant.

A review procedure is provided for challenging any type of production order, existing or new (new s. 487.0193 of the Code).24 A person who has received an order may apply to a judge to revoke or vary it if production is unreasonable25 or discloses privileged information.26 As for a preservation order, violation of a production order is punishable by a fine of not more than $250,000 and imprisonment for a term of not more than six months, or both (new s. 487.0198 of the Code).

Basically, with reasonable grounds, a judge may require an ISP to provide information to police officers.

This seems like a perfectly sensible piece of legislation; a good compromise to give police powers while not hurting privacy. Objections of "internet spying" seem to be nothing more than hyperbolic fear-mongering.

On the other hand, the bill is not without worries, particularly the hate propaganda section:

2.1.1.1 Hate Propaganda (Clauses 4 and 5)

Hate propaganda offences must be committed against an “identifiable group.” Clause 4 of the bill adds “national origin” to the definition of “identifiable group.”8

Clause 5 of the bill provides that the offences of public incitement of hatred and wilful promotion of hatred may be committed by any means of communication and include making hate material available, by creating a hyperlink that directs web surfers to a website where hate material is posted, for example.

I generally dislike hate propaganda offences; free speech should be free no matter how repugnant it may. Hate propaganda may not be nice, but any curtailments of free speech are worse. On the other hand, expanding it to national origin is not really that big a change and nothing to get newly excited over.

Besides the expansion of hate propaganda, clause 5 could be worrying, depending on the exact wording, as it could make hyperlinking to a site an offence. The way it is written it seems far too over-reaching, but given the poor-writing in the summary, the actual text may not be as bad as the impression gives.