Comments of Electronic Frontier Canada and Electronic Frontier Foundation
Lawful Access Consultation,
Criminal Policy Section
5th Floor,
284 Wellington St.,
Ottawa, Ontario, Canada, K1A 0H8
December 17, 2002
RE: Request for Comments on Lawful Access – Consultation Document
Electronic Frontier Canada (EFC) and the Electronic Frontier Foundation (EFF) appreciate the opportunity to submit comments on “Lawful Access – Consultation Document.” (“Proposal”)
EFC's mandate is to conduct research into issues and promote public awareness in Canada regarding the application of the Charter of Rights and Freedoms to new computer, communication, and information technologies, such as the Internet. Its aim is protect freedom of expression and the right to privacy in cyberspace.
EFF is a non-profit, member-supported civil liberties organization working to protect rights in the digital world. With almost 8,000 active members worldwide, EFF actively encourages and challenges industry, government and the courts to support free expression, privacy, and openness in the information society. Founded in 1990, EFF is based in San Francisco and maintains one of the most-linked-to Web sites < in the world.
1.Introduction
EFC and EFF oppose the Proposal as a vague and unjustified plan for intrusive covert surveillance of private communications that clearly threatens the fundamental values and fabric of Canadian society.
First, the Proposal radically expands surveillance powers over private communications, including Internet communications. The Internet is not merely a one-to-one medium of communication: it is a valuable yet inexpensive publication medium as well as a virtual assembly hall for political, religious and cultural association. As such, the Proposal threatens not only Canadians’ right of privacy protected by s. 8 of the Charter but also the fundamental freedoms of expression and association protected by s. 2 and the right to liberty protected by s. 7.
Second, we seriously question the Proposal’s general approach to communications privacy, which essentially contemplates making fine distinctions among telecommunications and data associated with telecommunications according to the mechanics of their transmission or use. From the individual’s perspective, communications are communications, whether telephone conversations or e-mail. Why should the mere fact that Internet communications leave more detailed traces entail less privacy vis-a-vis the government in those communications? Why should individuals even need to think about whether their communications and associated data are more or less protected according to technical details about how they are stored, processed or transmitted?
Third, the Proposal cannot be evaluated in isolation; it must be viewed in light of other proposed erosions of privacy and freedom. For instance, it makes no sense to contemplate a centralized national database of Internet subscribers without also considering the plan of the Canada Customs and Revenue Agency (CCRA) to establish a database on the foreign travel activities of Canadians. The experience of “function creep” teaches that “Big Brother” need not be built in a day.[1]
Fourth, we reject the Proposal’s implicit assumption that Canada’s participation in international instruments like the Council of Europe Convention on Cybercrime (“Convention”)[2] can justify the Proposal. Insofar as Canada has not yet ratified the Convention, the Proposal is clearly premature. Significant public debate is necessary before Canada even ratifies the Convention. Moreover, Canada should not violate the rights of Canadians simply because other nations place less value on individual privacy. As we note below, s. 8 is more protective of privacy than the American Fourth Amendment.
Finally, we reject the Proposal’s simplistic statement that law enforcement and national security agencies need to “maintain lawful access capabilities” in the face of technological developments. Not only would the Proposal increase such capabilities beyond their present scope,[3] s. 1 of the Charter requires that restrictions on rights must be “demonstrably justified” and consistent with “a free and democratic society.” No such need been empirically demonstrated.
Equally important, it is illogical to use this supposed hindrance to law enforcement for one particular area to justify invading fundamental rights while ignoring the many technological developments that have helped law enforcement, such as advances in surveillance and forensic technology. An intellectually honest approach would frankly admit that computers have aided law enforcement activity in many ways and exposed more of individuals’ daily transactions to monitoring, collection, and “data-mining.” Indeed, the very notion of “maintain[ing] . . . capabilities” implicitly assumes that the present level of telecommunications privacy is socially desirable — a dubious assumption. Today, few electronic communications are encrypted; they would be more private if encryption were widely used. Using today’s online world as a baseline essentially “freezes” privacy at its current level.
We therefore urge that the Proposal be rejected.
2.Background
Privacy is a value of fundamental importance in Canadian society. The Supreme Court has made clear that the Charter’s function “is to provide . . . for the unremitting protection of individual rights and liberties,”[4] and that the purpose of the right “to be secure against unreasonable search or seizure” under s.8 “is . . . to protect individuals from unjustified state intrusions upon their privacy.”[5] Moreover,
“that right, like other Charter rights, must be interpreted in a broad and liberal manner so as to secure the citizen’s right to a reasonable expectation against governmental encroachments. Its spirit must not be constrained by narrow legalistic classifications based on notions of property and the like which served to protect this fundamental human value in earlier times.”[6]
The Supreme Court has distinguished three types of privacy: territorial or spatial, personal, and informational.[7] The Proposal poses a great threat to the right to informational privacy, which “derives from the assumption that all information about a person is in a fundamental way his own, for him to communicate or retain for himself as he sees fit.”[8] In modern society especially, “retention of information about oneself is extremely important. We may . . . wish or be compelled to reveal such information, but situations abound where the reasonable expectation of the individual that the information shall remain confidential to the persons to whom, and restricted to the purposes for which it is divulged, must be protected.”[9]
The protection of privacy against state intrusion has been of particular concern to the courts in assessing the validity of surveillance measures, due to the inequality of power in the relationship between individuals and the state, and the resultant vulnerability of individuals to state abuses of power. In R. v. Duarte,[10] the Supreme Court emphasized this distinction in finding unauthorized audiovisual surveillance to be unconstitutional:
“[T]he regulation of electronic surveillance protects us from a risk of a different order, i.e., not the risk that someone will repeat our words but the much more insidious danger inherent in allowing the state, in its unfettered discretion, to record and transmit our words.
The reason for this protection is the realization that if the state were free, at its sole discretion, to make permanent electronic recordings of our private communications, there would be no meaningful residuum to our right to live our lives free from surveillance. The very efficacy of electronic surveillance is such that it has the potential, if left unregulated, to annihilate any expectation that our communications will remain private. A society which exposed us, at the whim of the state, to the risk of having a permanent electronic recording made of our words every time we opened our mouths might be superbly equipped to fight crime, but would be one in which privacy no longer had any meaning.”[11]
Another rationale offered for the Proposal is that other nations have updated their legislation, and changes in Canadian legislation are required for Canada to remain an “effective partner internationally.”[12] Inasmuch as Canada has not yet ratified the Convention, this rationale is unconvincing; indeed, if ratification would result in Canada’s being required to adopt the Proposal, then ratification is a bad idea. For instance, s. 8 of the Charter is more protective of privacy than the Fourth Amendment of the U.S. Constitution; in determining whether personal information is “private,” American law focuses almost exclusively on whether the information is confidential, while Canadian law also looks at how a police practice would affect the freedom and dignity of the individual in a democratic society.[13]
Moreover, this rationale tells a very small part of the story. Attempts at passing such legislation have been fraught with problems in many nations (particularly in other Commonwealth nations), due to strong objections by a variety of parties, such as industry groups, academics, the media and civil liberties organizations. For example, in Australia, the Telecommunications Interception Legislation Amendment Bill 2002, which would have allowed interception of communications delayed or stored in transit without a warrant, was rejected by the Senate.[14] In South Africa, the Interception and Monitoring Bill, which mandated interception capability and permitted access to traffic data without a warrant, was dropped after the expression of significant opposition.[15] In the United Kingdom, there was positively an uproar amongst the media,[16] legal academics[17] and civil liberties organizations[18] over the Regulation of Investigatory Powers Act[19]and its amendments. The U.K. Information Commissioner was also highly critical of the Act.[20] The resultant delays and last minute changes attest to the controversial nature of such legislation.[21]
In this connection, we emphasize that neither the Convention[22] nor the Proposal itself is empirically justified. The Proposal speaks broadly of the need to combat cybercrime, but offers no factual basis for believing that existing law is inadequate. Have any important investigations been frustrated because law enforcement officials lack these proposed powers? What kind of investigations? How many? What percentage?
Nor does the Proposal provide means for evaluating whether, if adopted, it will have actually aided law enforcement in fighting cybercrime without unduly sacrificing Canadians’ privacy rights. Indeed, the Convention expressly requires that Parties obligate service providers to “keep confidential the fact of and any information about the execution of any power” provided for in Articles 20 and 21, with no durational limit.[23] Such provisions hinder the accountability necessary both before and after a free and democratic society expands its domestic surveillance power. As the Supreme Court has said, s. 8 “requires a means of preventing unjustified searches before they happen, not simply of determining, after the fact, whether they ought to have occurred.”[24]
In addition, surveillance of communications implicates not only the right of privacy, but also the s. 2 freedoms of expression and association. This is true not only for one’s conversations, whether by telephone or e-mail, but also for the many other informational functions of the Internet such as researching, reading, or working with others on writings or political, religious, and cultural activities. Of particular concern here is the broad working definition of “service provider,” which clearly includes universities, colleges and libraries that provide Internet access to the public.[25]
Given the importance of these constitutional rights, especially the right to be free from unreasonable search and seizure (and its peculiar vulnerability to covert abuse), civil liberties must be given paramount consideration before changing Canadian law. Strict limits on law enforcement powers are required in order to protect the civil liberties of Canadians. Law enforcement officials do not have an inherent right to search and seize information for whatever purpose they see fit. Government objectives, no matter how apparently noble and pressing, cannot escape the reasonableness inquiry demanded s. 8: "assessment of the constitutionality of a search and seizure . . . must focus on its `reasonable' or `unreasonable' impact on the subject of the search or the seizure, and not simply on its rationality in furthering some valid government objective."[26]
3.Intercept Capability Requirement
a.Should There Be a Requirement of Intercept Capability?
The Proposal would require all service providers to ensure communications intercept capability. As a preliminary matter, this requirement appears unnecessary in order for Canada to comply with the Convention. Nor is there any indication that this requirement is necessary to law enforcement, either in the sense that important investigations have been hindered or impaired without it, or that technological changes will make such impairment likely in the future. On this basis alone, the requirement of intercept capability should be rejected.
More fundamentally, the intercept capability requirement would be a major step toward an undesirable and unwise government-telecommunications industry “surveillance partnership.” In unprecedented fashion, the government would be in a position to wield great influence over the design and operation of modern telecommunications. Such a partnership raises significant issues of proportionality and accountability, especially in light of how individuals use the Internet to learn and to speak about matters of personal importance to them. As the Supreme Court has recognized, “privacy concerns are at their strongest when aspects of one’s individual identity are at stake, such as in the context of information about one’s lifestyle, intimate relations or political or religious opinions.”[27] Medical and health privacy issues must also be recognized as more medical information is electronically transmitted and as doctor-patient communications take advantage of new communications technologies.[28]
A public/private surveillance partnership raises proportionality issues because both government and business have strong incentives to use surveillance technology. Government, of course, wants access to personal information for efficiency reasons and for broader public policy purposes like national security and law enforcement.
Business, meanwhile, wants personal information for marketing and efficiency reasons. In the Internet context, technologies like “cookies” and “Web bugs” only exacerbate the privacy problems associated with the inherent traceability of Internet activity. For instance, on the Internet one can hardly protect one’s privacy in commercial transactions by using cash. Even non-commercial Internet activity, such as reading documents on Web pages, invariably requires the transmission of IP address information that can unambiguously identify what one reads. The Supreme Court in Dyment observed that “[c]ertainly, physicians, hospital employees and other health-care workers ought not to be made part of the law enforcement machinery of the state.”[29] The same principle applies to telecommunications, which for the modern user is, among other things, a library, a telephone and a printing press.
The danger here is that a public/private surveillance partnership will lead to individuals’ being increasingly watched by unseen entities. As our lives become increasingly tied to the electronic media and computers, from ubiquitous cellular telephones to public video cameras to biometric scanning devices, more and more of our daily activity is subject to scrutiny by one or both of these surveillance partners. Every website we visit, every e-mail we send, every purchase we make, perhaps every step we take, may be recorded permanently. The uncertain prospect of such covert and detailed surveillance will, for many, create tremendous pressures toward social conformity. Individuals will be more wary of reading about controversial cultural, social, political and religious ideas for fear that they will be subjected to surveillance. A report commissioned by the European Parliament’s Civil Liberties Committee noted that while surveillance technologies are justified under state interest rationales, they are often used to monitor political dissent, journalists, minorities and political opponents; the report concluded that surveillance technologies have a chilling effect on those who may wish to take dissenting viewpoints and protest government policy.[30]
At the same time, a public/private surveillance partnership makes it more difficult to hold state agents accountable for their actions. Government can sit, like an innocent bystander, while businesses gather personal information; then, under reduced legal standards, collect that detailed information. The problem is that when the government is intimately involved in the operation and design of telecommunications or computer systems, individuals have no easy way to know whether and how the privacy of the commercial systems they use for communicating have been affected by government requirements. Nor will they know how the government makes use of its new power.
In terms of promoting intercept capability, the stated goal of the Proposal is to make it feasible for law enforcement to intercept, “subject to a lawful authority,” the content and related data associated with any communication. This general mission statement raises at least three privacy concerns. First, to safeguard the rights of citizens, any legislation authorizing intercept capability for new technology should specify what kind of “lawful authority” is necessary before the interception capability can be used. Second, if government is to require all telecommunications providers to build in interception capability, it should specifically state what legal standards govern the interception of different kinds of communications data. Third, given the broad working definition of “service provider,” universities, colleges, and libraries will all be affected.
First, the Proposal specifies that intercept technology will include the ability to intercept the content of communications in addition to the complete range of communications associated data. Accordingly, it is essential that government specify what type of lawful authority is needed before interception can occur. Canadian law treats different aspects of communications differently. For example, a lower showing is required for law enforcement to obtain a list of the telephone numbers an individual dials than for the content of a communication. In emerging communication media, there will be a range of communication attributes, some of which will be similar to telephone numbers in the quantity of information they are capable of revealing, some of which will clearly be communications content, and others of which will fall somewhere in between. For example, the name of a file attached to an e-mail has both attribute and content characteristics.[31] Another important issue is so-called “location” data, such as the location of a cellular telephone user. Government must specify what “lawful authority” means before information conveyed through new media can be intercepted. As the Supreme Court has noted, “where privacy is outweighed by other societal claims, there must be clear rules setting forth the conditions on which it can be violated. This is especially true of law enforcement, which involves the freedom of the subject.”[32]