Wednesday, November 07, 2012

Privacy Commissioners respond to Police Chiefs on Bill C-30 and lawful access

An interesting debate over lawful access is playing out in the pages of the Windsor Star. First, the paper ran an opinion piece from the leadership of the Canadian Association of Chiefs of Police that peddles the common line that connecting an internet user's IP address to their name and address is just like (and no more intrusive than) using a phone book:

Police chiefs speak out

As Canadians, we rightly place a very high value on our privacy.

As a career police officer, I have spent much of my life ensuring that my actions and those of the officers under my command do not intrude into the privacy of others, unless authorized by law and in pursuit of those who threaten, harm or steal from others.

While all new laws should be subject to rigorous debate, I worry that the misinformation surrounding the proposed Bill C-30 "Protecting Children from Internet Predators Act" is distracting us from the true goal of this bill - protecting victims by updating laws last introduced by Parliament in 1974. At that time, telecommunications consisted of rotary phones, telegraphs and physical lines of wire.

A technology revolution has seen the rapid adoption of mobile devices, computers and social media - an evolution of technology not envisaged by lawmakers back in the 1970s.

Canadians reap many benefits from today's technologies. So do criminals. We have inadvertently created safe havens for those who exploit technology to traffic in weapons, drugs and people. It is a boon to pedophile networks, money launderers, extortionists, deceitful telemarketers, fraudsters and terrorists.

Cyber bullies communicate their vitriol with impunity. If we stand by and do nothing, criminals will continue to use these interactive platforms to harass and threaten others, commit frauds, scams and organized and violent crimes with little fear of being caught.

I enthusiastically agree that privacy is a right to cherish and guard vigorously. We believe that the new legislation, with our recommended amendments to strengthen privacy rights, will help make Canada a safer place. To level the playing field for law enforcement, successive federal governments introduced updated lawful access legislation in 2006, 2007, 2009 and 2010.

All of these bills "Died on the Order Paper." In the meantime, the threats to individuals and community are increasing. The current proposed legislation includes the following assurances/improvements:

  • Access to private information will continue to require a judicial authorization (warrant).

  • Telecommunications providers will be required to preserve data while a warrant is being obtained.

  • Basic subscriber information (the equivalent to information provided by a telephone directory) will be obtainable in a timely and consistent manner. As opposed to today's environment, the new legislation builds in an audit trail to ensure accountability (including making available reporting to the judiciary and privacy commissioners) and to limit those within policing who can make such a request.

What is the cost of not proceeding with the modernization of our laws? Organized criminals will plan their killings and kidnappings using communications providers whose systems do not have the technical ability to be monitored through the warrant process.

Terrorists will be able to exploit these same gaps. Victims of scams will be told that the evidence trail linking the suspect to the crime has disappeared because the service provider has no obligation to preserve data.

Perhaps even worse, the parents of a child who has been lured or criminally harassed over the Internet will learn that the police investigation will be delayed or completely unsuccessful because of the need to obtain a warrant for basic subscriber information.

The RCMP's National Child Exploitation Co-ordination Centre looked at a sample of 1,244 requests for basic subscriber information in 2010. The average response time to gain such information was 12 days. This is unacceptable!

The challenge of Bill C-30 is to strike the right balance between providing law enforcement with investigative tools to ensure individual and public safety while ensuring the protection of privacy. We support the greater protections which have been built into this bill.

Vancouver police Chief Jim Chu is president, Canadian Association of Chiefs of Police.

Privacy Commissioners from Ontario, British Columbia and Alberta have sent the paper a reply:

New surveillance powers shouldn’t come at the expense of our right to privacy | Windsor Star:

Re: Police chiefs speak out, guest column, by Jim Chu, Nov. 6.

In his opinion piece, police Chief Jim Chu repeats the now much-discredited analogy that subscriber data is equivalent to what is found in a phone book. We disagree.

This information, which includes e-mail addresses and Internet protocol addresses, is not publicly available and can be used to reveal the web-related activities of law-abiding citizens.

This is why Canadians across our country expressed such strong concerns about the federal government’s introduction of Bill C-30, the Internet surveillance bill.

As Privacy Commissioners, we understand that the police may need new tools to investigate crime as technology advances.

However, Commissioners have consistently asked for evidence that police need the power to compel Internet Service Providers to turn over personal information of subscribers without a warrant in order to attain these ends.

To date, law enforcement officials have failed to provide persuasive factual evidence that current law has impeded police investigation of serious crimes, like those involving individuals who exploit children.

Current law recognizes exigent circumstances that justify immediate access to information to solve serious crimes.

If police need additional powers, they must be demonstrably justified, and come with appropriate judicial oversight and accountability.

New surveillance powers must not come at the expense of our right to privacy.

ANN CAVOUKIAN, PhD, Information and Privacy Commissioner, Ontario, JILL CLAYTON, Information and Privacy Commissioner, Alberta, and ELIZABETH DENHAM, Information and Privacy Commissioner, B.C.

Today, the Federal Privacy Commissioner added her voice to the debate:

Bill C-30 must be amended to respect privacy rights | Windsor Star

Re: Police chiefs speak out, guest column, by Jim Chu, Nov. 6.

My office appreciates the challenges faced by police officers in fighting online crime, with out-of-date tools and at a time of rapidly changing technologies.

We agree with Jim Chu, chief constable of the Vancouver Police Department and president of the Canadian Association of Chiefs of Police, when he states that the federal government’s lawful access bill could be improved to better protect privacy rights in Canada.

We were encouraged to see the head of the police association specifically support a provision to clarify privacy rights, in his recent op-ed. In fact, Bill C-30 must be amended to respect privacy rights.

Chief Chu suggests the information behind an IP address is equivalent to information found in a phone book. To me, this vastly underestimates what it may reveal about someone.

Unlike a phone book, information behind an IP address is not generally publicly available and can unlock doors to much more information about people.

My office’s technologists are currently looking at this, and studying the degree of privacy intrusiveness in relation to the specific information that the Bill proposes to make readily accessible to law enforcement.

We are also continuing our discussions with public safety and law enforcement officials, as well as civil society, to ensure that privacy issues are adequately addressed.

It is true that law enforcement powers need to be modernized, but so too do the laws that ensure Canadians’ privacy rights are fully respected. The Privacy Act, which applies to federal departments and agencies, has not been substantially amended in more than 30 years and, as a result, citizens have little mechanism for redress when things go wrong. The federal private sector privacy law, PIPEDA, is also well overdue for an update.

We look forward to elaborating on our views about Bill C-30 with parliamentarians and we will also continue to advocate for federal privacy laws that meet the challenges of this new world.

JENNIFER STODDART, Privacy Commissioner of Canada, Ottawa

No comments: