Chapter 3: Lawful Access Challenges
Special Report on the Lawful Access to Communications by Security and Intelligence Organizations
The Effects of Advances in Technology
57. Cybersecurity expert Susan Landau describes humanity as being in the midst of a Digital Revolution, a period transforming human society as significantly as the preceding Agricultural and Industrial Revolutions, but moving more rapidly and with more profound consequences. Footnote 96 The introduction of the microprocessor, the opening of the Internet for commercial use, the rapid adoption of cellphones and their subsequent evolution into smartphones, and the advent of social media and webmail, among numerous other advances, have fundamentally transformed how human beings live their everyday lives. Artificial intelligence will likely increase this already exponential rate of change.
58. The widespread adoption of digital technologies has also transformed how intelligence and law enforcement organizations investigate threats to national security. According to Public Safety, while these technological advancements mean there are more opportunities for interception, they come with new and different challenges for national security practitioners, as depicted in Figure 3.1. Footnote 97 For their part, CSIS and the RCMP describe this new environment as increasingly complex for several key reasons. Footnote 98
59. First, Canadians have more ways of communicating than ever before, including more devices, more services, and more providers. Footnote 99 Consequently, the volume, variety, and velocity of data being generated is greater than ever before. Types of data include voice communications, internet browsing histories, chat transcripts, and geolocation, creating an abundance of metadata or “data about data.” Footnote 100 A variety of everyday web-enabled “smart” objects, such as personal fitness trackers, televisions and cars, now have embedded sensors, electrical components and software collecting data and information from their surroundings, adding to this abundance of metadata. Described as the Internet of Things, the Canadian Centre for Cyber Security projects that there will be more than 30 billion Internet of Things connections by 2025. Footnote 101
Figure 3.1: Lawful access, then and now Footnote 102
Today’s targets have more devices and services, meaning more opportunities, but with new and different challenges
Stable analog
services
1996
Icons of a house, envelope, desktop computer, landline phone, mobile phone, car, and keys, indicating stable analog services.
Dynamic
encrypted
services
2024
Target's virtual life
Network of colorful user icons connected by dotted lines with social media logos and green shield icons representing secure virtual connections.
Target's physical life
Icons of a house, keys, car, envelope, laptop, smartphones, and telephone, each with a green shield and lock symbol indicating security.
60. Second, the content of communications has become easier to protect with the ubiquitous use of encryption, which is the process of converting digital information into an unreadable format so that only someone with the decryption key can read it. Encryption is used to authenticate users and keep information confidential, safeguarding both “data at rest” and “data in transit.” Footnote 103 Widely regarded as a best practice to enhance security and protect privacy online, encryption is vital to cybersecurity, e-commerce, data and intellectual property protection, and commercial interests. Footnote 104 According to CSIS, 90% of internet traffic is encrypted. Footnote 105
61. The last decade has also seen an increase in the adoption of “over the top” communication applications and services with end-to-end encryption (e.g., WhatsApp or Telegram). Even where a solution has been put in place with a CSP, use of applications with end-to-end encryption limits the ability of law enforcement and security agencies to read messages for their intended recipient because neither the message service provider nor the carrier can decrypt the messages. In addition to encryption technologies, the prevalence of anonymizing technologies such as virtual private networks, The Onion Router, and the dark web also makes it hard ***. Footnote 106 Looking to the future, the evolution of artificial intelligence and the anticipated adoption of quantum computing will add further complexity (see text box).
According to the Canadian Centre for Cyber Security, the dark web or DarkNet is an unindexed segment of the Internet that is only accessible by using specialized software or network proxies such as the Onion Router. This access is mainly designed to hide the identity of the user: “[d]ue to the inherently anonymous and privacy-centric nature of the dark web, it facilitates a complex ecosystem of cybercrime, and illicit goods and services trade.” Footnote 107
62. Third, the transnational nature of the Internet means that cross-border data flows are the rule rather than the exception. Cyberspace is not constrained by geopolitical boundaries. Many, if not most, Canadians use digital services whose messaging solutions are from third-party companies that are based outside of Canada.
According to CSE, quantum computers are a future threat to cyber security, engineered to leverage quantum physics in a way that can solve some computational problems much faster than current computers, making current cryptography methods obsolete. Footnote 108 While powerful enough quantum computers capable of decrypting all of today’s encryption have yet to be developed and are not projected until the next decade, threat actors could store current encrypted information to decrypt in the future.