The new surveillance legislation in Canada has been causing waves, but today, we are finally able to actually read the legislation for the first time and the two bills contain some interesting provisions. We look at the legislation (Bill C-46 in this article) that has already worried many Canadians.
Note: This is an article I wrote that was published elsewhere first. It has been republished here for archival purposes
The bills in question are Bill C-46 and Bill C-47. Interesting that there has to be two bills, but we’ll go in numeric order here and devote this article, for the sake of length, to Bill C-46 (which is several pages long).
We should also note that this review of the legislation is made by someone who is not a lawyer, expert of the law or someone giving away legal advice by any stretch of the imagination. What this review strictly is is an average Canadians interpretation of the law who is not specifically or formally trained to be a law expert.
Bill C-46 – Quotes and Comments
Also known as the Investigation Powers for the 21st century. Let’s look at some excerpts of the law:
327. (1) Everyone who, without lawful excuse, makes, possesses, sells, offers for sale, imports, obtains for use, distributes or makes available a device that is designed or adapted primarily to use a telecommunication facility or obtain a telecommunication service without payment of a lawful charge, under circumstances that give rise to a reasonable inference that the device has been used or is or was intended to be used for that purpose, is
(a) guilty of an indictable offence and liable to imprisonment for a term of not more than two years; or
(b) guilty of an offence punishable on summary conviction.
What we can see here is that this section is aimed people who want to start their own ISP. What this might also look like is something that will criminalize the activity of either stealing WiFi or offering open WiFi. The question that comes to mind is: does this criminalize the activity of setting up a TOR node or proxy in Canada? With this legislation, could it be illegal for someone to set up a proxy so, say, someone from Iran could anonymously provide information about what is going on in Iran? After all, that is generally offering, without charge, a telecommunications service.
372. (1) Everyone commits an offence who, with intent to injure or alarm a person, conveys information that they know is false, or causes such information to be conveyed by letter or any means of telecommunication.
(2) Everyone commits an offence who, with intent to alarm or annoy a person, makes an indecent communication to that person or to any other person by a means of telecommunication.
(3) Everyone commits an offence who, without lawful excuse and with intent to harass a person, repeatedly communicates, or causes repeated communications to be made, with them by a means of telecommunication.
(4) Everyone who commits an offence under this section is
(a) guilty of an indictable offence and liable to imprisonment for a term of not more than two years; or
(b) guilty of an offence punishable on summary conviction.
This is only the second excerpt we are looking at and already, stunningly, you could be locked up for up to two years in prison for being annoying on the internet. In a perfect world, the trolls of the internet would be at risk, but what about free speech. What if the copyright industry finds me annoying for posting their press releases and criticizing them on a regular basis? Should I, a reporter, be locked up for up to two years for being annoying under this circumstance? That’s not even touching general comments.
Since this activity will be criminalized if this passes, better get this out of the way now: I think whoever wrote this law is a fool who doesn’t know what the internet is like.
(5.1) Everyone who wilfully does an act or wilfully omits to do an act that it is their duty to do, if that act or omission is likely to constitute mischief causing actual danger to life, or to constitute mischief in relation to property or computer data,
Say what? Oh wait, here’s a definition of “Mischief” under this law:
(1.1) Everyone commits mischief who wilfully
(a) destroys or alters computer data;
(b) renders computer data meaningless, useless or ineffective;
(c) obstructs, interrupts or interferes with the lawful use of computer data; or
(d) obstructs, interrupts or interferes with a person in the lawful use of computer data or denies access to computer data to a person who is entitled to access to it.
Under the term “property”, does that include “intellectual property” perchance? As such, would altering data include the act of cracking software? This section is so vague, that could be possible. Anti-circumvention laws much?
487.012 (1) A peace officer or public officer may make a demand to a person in Form 5.001 requiring them to preserve computer data that is in their possession or control when the demand is made.
(2) The peace officer or public officer may make the demand only if they have reasonable grounds to suspect that
(a) an offence has been or will be committed under this or any other Act of Parliament or has been committed under a law of a foreign state;
(b) in the case of an offence committed under a law of a foreign state, an investigation is being conducted by a person or authority with responsibility in that state for the investigation of such offences; and
(c) the computer data is in the person’s possession or control and will assist in the investigation of the offence.
(3) A demand may not be made to a person who is under investigation for the offence referred to in paragraph (2)(a).
(4) A peace officer or public officer may revoke the demand by notice given to the person at any time. Unless the demand is revoked earlier, the demand expires 21 days after the day on which it is made.
(5) The peace officer or public officer who makes the demand may impose any conditions in the demand that they consider appropriate — including conditions prohibiting the disclosure of its existence or some or all of its contents — and may revoke a condition at any time by notice given to the person.
(6) A peace officer or public officer may not make another demand requiring the person to preserve the same computer data in connection with the investigation.
So really, let’s say, hypothetically speaking, I’m, a Canadian citizen, have been suspected of breaking the laws of the United States DMCA, does that mean I may be asked to preserve all data pending an investigation by, say, Sony BMG in the United States? All this and I have to preserve any data under conditions any police officer demands? Seriously?
Expiry of order
(6) Unless the order is revoked earlier, it expires 90 days after the day on which it is made.
So good news, preservation of data under a court order is 90 days… or about 3 months.
487.02 If an authorization is given under section 184.2, 184.3, 186 or 188 or a warrant is issued under this Act, the judge or justice who gives the authorization or issues the warrant may order a person to provide assistance, if the person’s assistance may reasonably be considered to be required to give effect to the authorization or warrant.
In essence, it looks like if you encrypt your data, you could be ordered to decrypt the data. Legally speaking, encryption is no excuse from the looks of things.
492.1 (1) A justice or judge who is satisfied by information on oath that there are reasonable grounds to suspect that an offence has been or will be committed under this or any other Act of Parliament and that tracking the location of one or more transactions or the location or movement of a thing, including a vehicle, will assist in the investigation of the offence may issue a warrant authorizing a peace officer or a public officer to obtain that tracking data by means of a tracking device.
(2) A justice or judge who is satisfied by information on oath that there are reasonable grounds to believe that an offence has been or will be committed under this or any other Act of Parliament and that tracking an individual’s movement by identifying the location of a thing that is usually carried or worn by the individual will assist in the investigation of the offence may issue a warrant authorizing a peace officer or a public officer to obtain that tracking data by means of a tracking device.
(3) The warrant authorizes the peace officer or public officer, or a person acting under their authority, to install, activate, use, maintain, monitor and remove the tracking device, including covertly.
(4) A warrant may contain any conditions that the justice or judge considers appropriate, including conditions to protect a person’s interests.
So while the French model was to merely allow police officers to covertly track people, such an activity in Canada does actually require a court order. An important distinction at the very least.
Conclusion
All in all, reading this bill from a standpoint of someone who writes news, this legislation can bring in a host of problems and open the doors for abuse. The “being annoying” section, for instance, brings in serious questions of free speech. What if someone is being critical of someone else and that someone else is being “annoyed” by it? That doesn’t require a court order. This bill is frightening to say the least for several reasons in spite of several decent provisions which actually accomplishes what some press releases said it set out to do.
Drew Wilson on Twitter: @icecube85 and Google+.
