On one side, you have the lawyers and executives of every major tech company, every telecom company, and every major internet provider all saying that the Carney government's Bill C-22 goes too far. On the other side, you have Public Safety Minister Gary Anandasangaree claiming that these companies simply misunderstand the legislation.
Who to Believe?
I am not siding with Minister Anandasangaree. The point of Bill C-22 is to update Canada's legislation for the digital age. It would allow police greater access to online information with an applicable warrant from a judge or justice of the peace. No one disagrees that Canada's legislation needs updating and that this bill is a step in the right direction. The problem is that the bill goes too far in requiring companies to build and sustain technical capabilities to retain data on users and, according to some companies, allow backdoor access to user data.
In response to concerns raised by various tech companies, Minister Anandasangaree says they just do not understand. Clearly, there is a need for better understanding of this bill, he told reporters last week. Tech giants are misinterpreting some of the safeguards that are already built in, including on ensuring that encryption is not in any way interrupted as part of Bill C-22.
This week, officials from Public Safety Canada held briefings with members of the media where they again said that the tech companies do not understand the law. Richard Bilodeau, the acting assistant deputy minister for the cybersecurity branch, spoke to Chris Nardi with the National Post and again said the tech companies just do not understand. I think there may have been some misunderstanding of the intent of the legislation, Bilodeau told Nardi. One of the things that is quite clear is that this is not about mass surveillance. This is about giving law enforcement and CSIS the ability, under court-authorized judicial warrants, to access very specific data that are being held by certain electronic service providers.
Intent vs. Wording
The key word in that first sentence is intent. A bureaucrat like Bilodeau may believe that his intent with the law leads in one direction, but if the words in the legislation lead in another then that means nothing. This is a piece of legislation that grants cabinet the ability to change regulations and who those regulations apply to without going back to a vote in the legislature.
The legislation, as written, is far too broad. This is a sloppy piece of legislation that should leave any company worried about the implications. Meta, the parent company of Facebook, Instagram, and WhatsApp, has said that they support the intent of the bill, they support the first part of the bill but are worried that the second part goes too far. Rachel Curran, the company's head of government relations in Canada, appeared before committee two weeks ago laying out their concerns. The technical assistance obligations in part two could conscript private companies into service as an arm of the government's surveillance apparatus, she said. As drafted, the bill could require companies like Meta to build or maintain capabilities that break or undermine encryption and force providers to install government spyware directly on their systems.
Tech Companies Unite in Opposition
Meta is not alone. Apple has said they could stop offering some services in Canada as a result of this legislation. This legislation could allow the Canadian government to force companies to break encryption by inserting backdoors into their products – something Apple will never do, Apple said in a statement.
It is definitely time to update Canada's legislation surrounding lawful access, but once again, the Carney government has gone too far. You can believe the top minds and top lawyers of the largest tech companies and major Canadian players, or you can believe Minister Anandasangaree and his team who say everyone else is wrong. I believe the tech companies who say they are protecting your data and your privacy, and you should too.
