Chapter 4: Government Response — The Government’s Response to Lawful Access Challenges — 42nd Parliament (2015 to 2019)
Special Report on the Lawful Access to Communications by Security and Intelligence Organizations
The Government’s Response to Lawful Access Challenges
42nd Parliament (2015 to 2019)
140. In October 2015, Canadians elected a new government. The following month, the Prime Minister instructed the Minister of Justice and the Minister of Public Safety and Emergency Preparedness to introduce new national security legislation. Between September and December 2016, the government held public consultations on this proposed legislation through a national security green paper. Footnote 319 Intended to “prompt discussion and debate about Canada’s national security framework,” the green paper included a chapter on “Investigative Capabilities in the Digital World” that raised four challenges: BSI, intercept capability, data retention, and encryption. There was also a chapter about “Intelligence and Evidence.” Footnote 320
141. *** Footnote 321 *** Footnote 322 *** Footnote 323 *** Footnote 324 *** Footnote 325 ***
142. In May 2017, Public Safety published the “What We Learned” report about the green paper consultation. Public Safety had held five in-person town halls, fourteen in-person sessions with academics and experts, and one roundtable with civil society experts. The Ministers of Public Safety and Justice co-hosted several of the events, including the roundtable with 36 civil society experts. Footnote 326 The two ministers’ parliamentary secretaries also hosted events; for example, the Parliamentary Secretary to the Minister of Justice hosted a town hall in Yellowknife, Northwest Territories. Footnote 327 There were also seventeen engagement events led by members of Parliament at the constituency level that involved members of the public. Public Safety received 58,933 responses to the online questionnaire, 17,862 email submissions, and 79 submissions from organizations and experts. The lawful access part of the consultation generated about 70% of total online responses and significant input from experts and organizations, demonstrating a high level of public and stakeholder engagement. The vast majority of responses indicated that the expectation of privacy in the digital world is the same as or higher than in the physical world. A clear majority of respondents opposed any move to weaken encryption, and 7 out of 10 respondents considered their BSI to be as private as the actual contents of their emails or personal diary. Almost half (44%) of online responses saw no demonstrable need to give investigators new tools, although a further 41% of online responses said investigators should have access to updated tools in a digital world if they could demonstrate the need for them. Footnote 328
143. Public Safety’s internal analysis of the 2016 consultation highlighted the views of 35 notable entities including law enforcement, civil society, academics, CSP’s, and FPT privacy commissioners: “Across all themes, [these] stakeholders believed it was unclear why existing statutory powers were inadequate for the needs of investigators. Many stakeholders called on the Government to provide clear evidence to justify that changes are necessary.” These stakeholders responded to the four lawful access issues in the green paper:
- Lawful access to BSI: “Most stakeholders — spanning the civil society, academic, and CSP sectors — believed that investigators should require judicial authorization in order to access BSI.”
- Intercept-capable CSP networks: “While they did not express support for this proposal, most CSP stakeholders did not outright oppose the introduction of intercept capability requirements” as long as the requirements “do not interfere with business operations or competitiveness” and the government compensates them.
- Data retention: “Many civil society, academic, and CSP stakeholders, as well as FPT Privacy Commissioners questioned the necessity of creating data retention requirements given that data preservation powers were enacted [in the Criminal Code] in 2015.” “CSP and civil society stakeholders which did not express outright opposition to data retention still noted serious concerns regarding the potential impact of such [a] measure on the privacy of Canadians and on the security of their data.”
- Encryption: “Stakeholders across the civil society, academic, and CSP sectors supported strong encryption … [and] opposed ‘exceptional access’ measures (such as [decryption] key escrow or technical ‘backdoors’) … .” Footnote 329
144. Also in May 2017, and expressly in response to the green paper, the Standing Committee on Public Safety and National Security (SECU) tabled a report entitled Protecting Canadians and their Rights: A New Roadmap for Canada’s National Security. SECU recommended against legislation regarding encryption or access to BSI. Footnote 330 In its public response to the report, the government agreed, stating that it was “in Canada’s interest to ensure that encryption technologies remain robust and widely used,” and that: “…While the spread of powerful encryption has created significant gaps for law enforcement and national security agencies, the Government does not consider legislative responses to these challenges to be viable. The Government continues to examine options to ensure departments and agencies have the resources necessary to gain access to decrypted data required to prevent terrorist incidents and address criminal activity.” Footnote 331 The response was silent on SECU’s recommendation against legislation for BSI.
145. On June 20, 2017, the government tabled Bill C-59, the National Security Act, 2017, without any lawful access provisions. Footnote 332 Earlier that month, Public Safety had informed DoJ that it had “some concern” about proceeding with planned consultations on intercept capability, and similarly asked Justice to “‘stand down’” any further consultations on BSI. Footnote 333
146. Later that month, Canada hosted the 2017 Five Country Ministerial meeting of Ministers of Public Safety and Attorneys General in Ottawa. In their public communiqué, Ministers acknowledged how encryption could “severely undermine public safety efforts by impeding lawful access to the content of communications,” but committed Five Eyes’ governments to engaging CSPs to “explore shared solutions while upholding cybersecurity and individual rights and freedoms.” Footnote 334
147. The following year in Australia, the Ministers of Public Safety and Attorneys General of the Five Eyes met and published a Statement of Principles on Access to Evidence and Encryption. The statement encouraged CSPs to “voluntarily establish lawful access solutions to their products,” but also noted that governments might “pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.” Footnote 335
148. *** Footnote 336
149. In June 2019, SECU tabled a report entitled Cybersecurity in the Financial Sector as a National Security Issue. The report endorsed an expert’s definition of strong encryption — i.e., “‘encryption algorithms for which no weaknesses or vulnerabilities are known or have been injected …’” Footnote 337 — and recommended “that the Government of Canada reject approaches to lawful access that would weaken cybersecurity.” Footnote 338
150. The Five Eyes’ focus on encryption continued at the following meeting in July 2019 in the U.K. Its Five Country Ministerial communiqué noted that CSPs “should include mechanisms in the design of their encrypted products and services whereby governments, acting with appropriate legal authority, can obtain access to data in a readable and useable format” to support investigations and to take action against illegal content. Footnote 339