Chapter 3: Lawful Access Challenges
Special Report on the Lawful Access to Communications by Security and Intelligence Organizations

Impact of the Absence of a Legal Framework for Intercept Capability

107. According to CSIS and the RCMP, the absence of intercept capability legislation and an outdated legal framework have operational, financial, and policy consequences. First, there is no formal, central authority to set standards or establish priorities. This leaves CSPs to triage multiple requests from CSIS, the RCMP, and provincial or municipal police departments and determine their level of priority. ^{Footnote 251} In the absence of standards for lawful access technology, CSPs choose the technology they deem appropriate, which requires CSIS and the RCMP to tailor individual lawful intercept solutions to each CSP’s infrastructure, which are not easily transferable to other CSPs. ^{Footnote 252}

108. The absence of a formal framework to regulate technical upgrades leaves the government with little ability to control costs. *** ^{Footnote 253} *** ^{Footnote 254}

109. Second, there is no established compensation framework determining who is responsible for paying the costs associated with the development and maintenance of intercept capability. The RCMP, CSIS, and CSP representatives all point to inconsistent approaches across the police and intelligence community on compensating CSPs for intercept capability activities and investments. Some compensate CSPs for their cooperation, while others do not, either because they do not have the resources or in the belief that CSPs have an obligation to support public safety and national security or that these costs, like compliance costs more generally, should be seen as a cost of doing business. ^{Footnote 255}

110. A primary CSP concern is the absence of a formal compensation framework to regulate the cost of intercept solutions and the cost of processing requests from investigators. One CSP noted that current agreements are contracts “subject to great variation depending on the working conditions between the parties involved. For example, the unilateral decision made by several law enforcement agencies over the years to stop compensating the CSPs for technical assistance, including lawful intercepts … has placed financial pressure on CSPs and broke the tacit agreement that [CSPs] would be able to recover [their] costs to operate the new capacity [they] had agreed to develop.” ^{Footnote 256} *** ^{Footnote 257}

111. The RCMP states, “To keep pace with international partners, Canada requires a robust and enduring lawful access framework that introduces legislation, clarifies funding responsibilities, streamlines engagement, and standardizes operations.” ^{Footnote 258} According to CSIS, the lack of intercept capability legislation “is the single greatest differentiator with our [Five Eyes] partners who all have more success than we do because they have lawful access legislation.” ^{Footnote 259} The RCMP states the absence of legislation for intercept capability in Canada is regarded as a hindrance ***.

112. *** ^{Footnote 260}

113. For example, *** the FBI provided intelligence to the RCMP about a Canadian subject of interest who was reportedly a long-time supporter of the Islamic State, ^{Footnote 261} stockpiling weapons and bomb-making materials, and planning to kidnap a former Canadian soldier to engage the government in hostage negotiations on behalf of the Islamic State. ^{Footnote 262} *** ^{Footnote 263} *** As discussions about the legality and feasibility of the assistance order took longer than expected, RCMP investigators opted not to pursue an ODIT and instead engaged the subject directly, given public safety concerns. ^{Footnote 264} Unlike in the U.K. ^{Footnote 265} or Australia ^{Footnote 266} , Canadian CSPs are not legally required to assist CSIS and the RCMP with CNE. ^{Footnote 267}

114. CSPs also note that their companies must balance public perception and reputational risk with corporate responsibility in using a voluntary approach to responding to lawful access requests. In their view, legislation that would compel cooperation would mitigate these risks. ^{Footnote 268} Public Safety summarizes the operational, financial, and policy consequences of the voluntary approach to lawful access in the Table 3.5 below.

Table 3.5: Operational, financial, and policy consequences of the voluntary approach to lawful access ^{Footnote 269}

Current Situation	Consequence
No intercept capable requirement applies to new technologies, and where SOLGEN standards applies, there is still the risk that CSPs will not cooperate.	Intercept coverage gaps, particularly with new technologies. Canada lags behind peers.
CSIS and the RCMP pay majority of development and maintenance costs, and must individually negotiate costs with CSPs.	Limited government control over costs. No standardization of costs between CSPs or agencies, both with respect to when to pay and how much to pay.
CSIS and the RCMP are funding intercept solutions for all police agencies, without a mandate for this model.	The federal government is bearing much of the costs, including for provincial and local law enforcement intercepts.

***