Wednesday, November 20, 2013

Some comments on the new Canadian Cyberbullying bill, aka Bill C-13 "Protecting Canadians from Online Crime Act"

As promised, and perhaps not surprisingly, I have some things to say about the new Bill C-13, called the "Protecting Canadians from Online Crime Act". It was introduced as Canada's cyberbullying law, but it's more than that. The summary of the bill only refers to the portions of the legislation that deal with cyberbullying, but the government has buried a number of other provisions in the statute that seem to have little, if nothing, to do with cyberbullying.

A word of caution: I've only just gotten my hands on the Bill and my comments are necessarily quick off the mark and without a whole lot of opportunity for reflection. My opinions may change as I digest this or hear responses to this. And, of course, this does not reflect the opinions of my firm, its clients, my friends, my cat or anyone else. If I make a mistake, please let me know and I will be glad to correct it.

First of all, the actual cyberbullying parts, which start at Clause 3 of the Bill:

The heart of it is the creation of a new crime of the non-consensual distribution of intimate images.

162.1 (1) Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty

(a) of an indictable offence and liable to imprisonment for a term of not more than five years; or

(b) of an offence punishable on summary conviction.


Definition of “intimate image”

(2) In this section, “intimate image” means a visual recording of a person made by any means including a photographic, film or video recording,

(a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity;

(b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and

(c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.


Defence

(3) No person shall be convicted of an offence under this section if the conduct that forms the subject-matter of the charge serves the public good and does not extend beyond what serves the public good.

Question of fact and law, motives

(4) For the purposes of subsection (3),

(a) it is a question of law whether the conduct serves the public good and whether there is evidence that the conduct alleged goes beyond what serves the public good, but it is a question of fact whether the conduct does or does not extend beyond what serves the public good; and

(b) the motives of an accused are irrelevant.


This is a very difficult provision to get right and an easy provision to get wrong. It is a good thing, in my view, that in order to be found guilty, the accused has to have known that the person depicted did not give consent. But the standard is then lowered to being reckless about whether or not the person gave their consent. This is problematic, in my view.

Imagine a scenario where a woman (let's call her Anne and also assume she's an adult) takes an intimate image of herself and sends it to her boyfriend, Bob. By doing that she has at least consented to having that image sent to him. Anne sent it to Bob, afterall, but there is not explicit communication of the consent involved. Bob is an idiot and a braggart, so he then sends the image to his friend Carl. Did Bob not have Anne's consent to do that? Probably, but the police would have to prove that he knew that he did not have her consent or that he was reckless about a lack of consent. This would have to be proven beyond a reasonable doubt. But now Carl has it and is two steps removed from Anne and has little knowledge about the circumstances under which Bob got the image. It's harder to convict him of knowledge of lack of consent and probably about his recklessness. Imagine that Bob and Anne broke up. As I said, Bob is an idiot, so he posts it on a website, where it is viewed by Dan and Ed. Both Dan and Ed like the photo, so they re-post it and tweet it all over the internet. Dan and Ed have no idea who Anne or Bob are and have no knowledge of this history. They also don't know that Bob took the photo and posted it on the internet to hurt Anne. Are Dan and Ed criminals in this situation? Are they reckless if they don't inquire into it? Can they, since they don't know who Anne is or how to contact her? In this scenario, I would think that Bob is and Carl may be criminals, but Dan and Ed are too far removed to know whether there was consent and the law can't assume any sort of knowledge about lack of consent. It has to be proven. I would not want the law to assume a lack of consent unless the distributor had confirmed it.

I also wonder what is meant by "publishes". Criminal liability should not attach to an intermediary who has no knowledge of the background and the law should not place an obligation on that intermediary to somehow establish the provenance of the photo or image.

The new Section 162.2 allows a court to prohibit someone convicted under the previous section from using the internet for any indeterminate period of time set by the court.

162.2 (1) When an offender is convicted, or is discharged on the conditions prescribed in a probation order under section 730, of an offence referred to in subsection 162.1(1), the court that sentences or discharges the offender, in addition to any other punishment that may be imposed for that offence or any other condition prescribed in the order of discharge, may make, subject to the conditions or exemptions that the court directs, an order prohibiting the offender from using the Internet or other digital network, unless the offender does so in accordance with conditions set by the court.

Duration of prohibition

(2) The prohibition may be for any period that the court considers appropriate, including any period to which the offender is sentenced to imprisonment.

Court may vary order

(3) A court that makes an order of prohibition or, if the court is for any reason unable to act, another court of equivalent jurisdiction in the same province may, on application of the offender or the prosecutor, require the offender to appear before it at any time and, after hearing the parties, that court may vary the conditions prescribed in the order if, in the opinion of the court, the variation is desirable because of changed circumstances after the conditions were prescribed.



I can see the logic behind this, but I often find myself wondering whether the people who draft these laws and the people who enforce them are detached from living in the modern world. Refusing access to the internet is not the same as prohibiting ownership of a firearm. It is virtually impossible for a young person to live any sort of normal life without access to the internet. I know of few jobs these days, other than flipping burgers, that doesn't involve using the internet in one way or another. It's pretty hard to even get a cell phone that doesn't have access to the internet. (Even the old Nokia 252 sitting in the bottom of my junk drawer can access the internet.) I am concerned that such a measure may be imposed too regularly without enough consideration of what sort of impact this may have on the ability of someone to reintegrate into society.

Next up are a number of amendments to existing sections of the Criminal Code which allow for the seizure of obscenity, child pornography and "crime comics" (yes, you read that right), to which "intimate images" are added.

After that, Clause 6 provides for the forfeiture of property related to the offence.

Clause 7 adds the distribution of intimate images to the category of offences that are applicable for certain warrants. some other sub-clauses look like housekeeping, though I'll take a closer look later.

Clause 8 deals with authorizations to intercept certain private communications with the consent of a party to the communication. It adds a new subsection (5) to Section 184.2 of the Criminal Code:

(5) A judge who gives an authorization under this section may, at the same time, issue a warrant or make an order under any of sections 487, 487.01, 487.014 to 487.018, 487.02, 492.1 and 492.2 if the judge is of the opinion that the requested warrant or order is related to the execution of the authorization.

Likewise, clause 9 adds a similar subsection to section 186 of the Criminal Code:

(8) A judge who gives an authorization under this section may, at the same time, issue a warrant or make an order under any of sections 487, 487.01, 487.014 to 487.018, 487.02, 492.1 and 492.2 if the judge is of the opinion that the requested warrant or order is related to the execution of the authorization.

Clause 10 deals with keeping the affidavit to obtain a warrant secret. This appears, at first glance, to be housekeeping. Clause 11 also looks like a housekeeping amendment.

Oddly out of place, Clause 12 seems to expand the categories of identifiable groups for the advocating genocide crime under Section 318 of the Criminal Code:

(4) In this section, “identifiable group” means any section of the public distinguished by colour, race, religion, national or ethnic origin, age, sex, sexual orientation, or mental or physical disability.

Clauses 13 amends the provisions of the Code dealing with hate propaganda.

Clauses 14-17 amend the existing sections in the Criminal Code addressing computer crime, none of which have anything to do specifically with cyberbullying. Clause 15 augments the offence of possession of a device to obtain use of telecommunication facility or telecommunication service while Clause 17 amends the offence of Possession of device to obtain unauthorized use of computer system or to commit mischief.

Clause 18, on the other hand, actually has to do with cyberbullying. It amends the existing provisions of the Code related to harassing communications and extends them to include all modes of telecommunications:

Message in false name

371. Everyone who, with intent to defraud, causes a message to be sent as if it were sent under the authority of another person, knowing that it is not sent under that authority and with intent that it should be acted on as if it were, is guilty of an indictable offence and liable to imprisonment for a term of not more than five years.

False information
372. (1) Everyone commits an offence who, with intent to injure or alarm a person, conveys information that they know is false, or causes such information to be conveyed by letter or any means of telecommunication.

Indecent communications

(2) Everyone commits an offence who, with intent to alarm or annoy a person, makes an indecent communication to that person or to any other person by a means of telecommunication.

Harassing communications

(3) Everyone commits an offence who, without lawful excuse and with intent to harass a person, repeatedly communicates, or causes repeated communications to be made, with them by a means of telecommunication.

Punishment

(4) Everyone who commits an offence under this section is

(a) guilty of an indictable offence and liable to imprisonment for a term of not more than two years; or

(b) guilty of an offence punishable on summary conviction.


Clause 20 adds new categories of production orders to the Criminal Code, including orders related to transmission data and tracing data, along with giving law enforcement the ability to demand that anyone preserve computer data for 21 or 90 days, depending upon the nature of the offence. They are all somewhat problematic, since all that is required is a "reasonable suspicion", not "reasonable and probable grounds to believe" or another higher threshold. The drafters appear to think that the sort of information that would be produced is not sensitive and should not be afforded a high level of protection.

Preservation demand

487.012 (1) A peace officer or public officer may make a demand to a person in Form 5.001 requiring them to preserve computer data that is in their possession or control when the demand is made.

Conditions for making demand

(2) The peace officer or public officer may make the demand only if they have reasonable grounds to suspect that

(a) an offence has been or will be committed under this or any other Act of Parliament or has been committed under a law of a foreign state;

(b) in the case of an offence committed under a law of a foreign state, an investigation is being conducted by a person or authority with responsibility in that state for the investigation of such offences; and

(c) the computer data is in the person’s possession or control and will assist in the investigation of the offence.

Limitation

(3) A demand may not be made to a person who is under investigation for the offence referred to in paragraph (2)(a).

Expiry and revocation of demand

(4) A peace officer or public officer may revoke the demand by notice given to the person at any time. Unless the demand is revoked earlier, the demand expires

(a) in the case of an offence that has been or will be committed under this or any other Act of Parliament, 21 days after the day on which it is made; and

(b) in the case of an offence committed under a law of a foreign state, 90 days after the day on which it is made.

Conditions in demand

(5) The peace officer or public officer who makes the demand may impose any conditions in the demand that they consider appropriate — including conditions prohibiting the disclosure of its existence or some or all of its contents — and may revoke a condition at any time by notice given to the person.

No further demand

(6) A peace officer or public officer may not make another demand requiring the person to preserve the same computer data in connection with the investigation.

I don't have any particular concerns with this new provision, other than subsection (5), which seems to give the peace officer unfettered discretion to place conditions on the demand, including a gag order. If a gag order is contemplated, it should be clearly set out in the Code, the criteria to justify it should be clearly set out as well and it should be subject to judicial review. Providing the police with such discretion only means it will be exercised in the vast majority of cases.

The following sections allow a police officer to seek a judge's order that data be preserved in similar circumstances.

Next up is a new Section 487.014 of the Code, which provides for a "general production order".

General production order

487.014 (1) Subject to sections 487.015 to 487.018, on ex parte application made by a peace officer or public officer, a justice or judge may order a person to produce a document that is a copy of a document that is in their possession or control when they receive the order, or to prepare and produce a document containing data that is in their possession or control at that time.

Conditions for making order

(2) Before making the order, the justice or judge must be satisfied by information on oath in Form 5.004 that there are reasonable grounds to believe that

(a) an offence has been or will be committed under this or any other Act of Parliament; and

(b) the document or data is in the person’s possession or control and will afford evidence respecting the commission of the offence.

Form

(3) The order is to be in Form 5.005.

Limitation

(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.


Subsequent sections add on production orders for tracing communications (new s. 487.015), to obtain transmission data (new s. 148.016), to obtain tracking (location) data (new s. 487.017) and to obtain financial data from a financial institution (new s. 487.018).

The Bill introduces new production orders that do require judicial authorization, but the threshold for obtaining them are very low. As with the preservation demand, all that is required are “reasonable grounds to suspect” that an offence has been committed, rather than the more onerous “reasonable and probably grounds to believe”. The specific production orders fall under the categories of “general production order” related to any document, tracing data, tracking data, non-content transmission information and financial information. For example the tracking data provisions read:

“tracking data” means data that relates to the location of a transaction, individual or thing.

Production order — tracking data

487.017 (1) On ex parte application made by a peace officer or public officer, a justice or judge may order a person to prepare and produce a document containing tracking data that is in their possession or control when they receive the order.

Conditions for making order

(2) Before making the order, the justice or judge must be satisfied by information on oath in Form 5.004 that there are reasonable grounds to suspect that

(a) an offence has been or will be committed under this or any other Act of Parliament; and

(b) the tracking data is in the person’s possession or control and will assist in the investigation of the offence.


Form

(3) The order is to be in Form 5.007.

Limitation

(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.


New Code section 492.1 provides for warrants to authorize the installation of “tracking devices” on vehicles and things carried or worn by individuals and “transmission data recorders” to obtain transmission data. Again, both these warrants only require “reasonable grounds to suspect”.


The Bill also provides immunity to third parties who voluntarily provide information to the police:

For greater certainty

487.0195 (1) For greater certainty, no preservation demand, preservation order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving or to voluntarily provide a document to the officer that the person is not prohibited by law from disclosing.

No civil or criminal liability

(2) A person who preserves data or provides a document in those circumstances does not incur any criminal or civil liability for doing so.


It does however seem unusual that a service provider would need the immunity in subsection (2) if the “is not prohibited by law from disclosing” is satisfied from subsection (1).

Provisions in the Competition Act related to telemarketing are amended by Clauses 28-35, while the Mutual Legal Assistance in Criminal Matters Act is amended by Clauses 36 – 45 to extend these new investigative powers to incoming requests from foreign authorities. Also amended is the Canada Evidence Act so that a spouse is a competent and compellable witness for the prosecution with respect to the new offence of non-consensual distribution of intimate images.

9 comments:

Ryan Deschamps said...

It seems like the "cyberbullying" portion is not really cyberbullying at all, but instead some combination of harassment and a violation of privacy. That said, I suppose it is good that policy makers are paying more attention to what the real problems are (gendered harassment) than the moral outrage over online "bullies." I am not sure that provincial responses are going to be that effective in the long run.

Laura said...

Thanks for this overview; very helpful. You say: "I would not want the law to assume a lack of consent unless the distributor had confirmed it." I'd like to know, why not? Would that not be in line with existing jurisprudence on consent and sexual assault (eg: Ewanchuk)? There is no defence of "implied consent" in Canadian law, and while an accused can raise an "honest but mistaken belief" that there was consent, this requires that the complainant said or did something that gave rise to the accused's honest belief that she was consenting. In your example, Anne has done nothing of the sort. By sending the image to Bob she has consented to HIM having it, yes, but can we not presume that her consent ends there? Women do not generally exist in a state of perpetual consent to having naked images of themselves being circulated throughout the interwebs! Sending a naked picture to your partner does not imply your consent to have it sent on to anyone else. What should she do - emblazon the image with a "For Bob's eyes only" stamp? Insert a "Do not distribute" message at the bottom? Dan and Ed circulated the image without her consent and had no reason to think she was consenting to its distribution. Unless we believe that men are entitled to circulate nude images of whomever they want, whenever they want, and that women exist in a perpetual state of consent to same unless they explicitly say otherwise, I think it is totally fair (and in line with SCC case law) to hold D&E criminally liable for this behaviour.

privacylawyer said...

Thanks for your comment, Laura. I'm not sure I agree with your direct analogy between reposting a photo and sexual assault.

The fact is, for good or for ill, the internet is full of images of individuals in various states of undress and a significant portion of those are from circumstances where the individual depicted consented to the photos and the republication. It is the law in many jurisdictions and certainly the practice of professional photographers that you obtain a model release to commercially use such images. Such a release would be a consent, but there is no notice on the image or on the web page to indicate that there necessarily is a release on file for the photos.

A large portion of photos of naked folks on the internet are consensual, but without any clear information documenting that consent. So someone who happens upon such an image can likely assume consent, but never knows entirely. Should the law make it a crime for someone to copy and repost such a photo without obtaining express consent of the individual depicted (who probably can't be readily contacted in any event)? If the law presumes a lack of consent and dictates that it is "reckless" to repost the image without confirming consent, that person is a criminal and can be jailed for up to five years. I'm not sure that's reasonable.

Unknown said...

Few things; would it be possible to be charged say if a someone put a crazy concert picture where said indecent exposure occurred in public.
Could a person end up being charged, and in the news while the investigation into what constitutes permission to a photo they may have put up their partners permission.

Lastly wasn't there conditions in the bill to shut down possible dark net or Tor use? OR was that for stealing or stealth IPs? would that making using a different IP to say watch stuff from the BBC website from Britain illegal? This part was poorly covered in the news.

Purple library guy said...

Since it's a work in progress, quick note on a typo: You wrote "little, if nothing, to do with cyberbullying"; I think you want "little, if anything".

Cheers!

Unknown said...

There are 12 elements in the offence. It is important to note that the word "knowingly" is the corresponding fault element for the "intimate image" elements, not for the conduct elements.

1. PHOTOGRAPH (etc) (162.1(2)) - The impugned matter must be photograph, film, or video. The accused is not guilty if it's a painting.

2. CORRESPONDING FAULT (162.1(1) - "knowingly") - The accused must know that it is a photograph, film, or video. The accused is not guilty if he believes that it is a painting.

3. NUDITY (etc) (162.1(2)(a)) - The impugned matter must depict nudity or sexuality. The accused is not guilty if the matter is just 'racy.'

4. CORRESPONDING FAULT (162.1(1) - "knowingly") - The accused must know that there is nudity / sexuality in the matter. The accused is not guilty if he doesn't see the 'nip slip' in the picture.

5. SITUATIONAL PRIVACY (162.1(2)(b)) - The complainant must have had a reasonable expectation of privacy at the time the matter was made. The accused is not guilty if the image was taken at a topless demonstration.

6. CORRESPONDING FAULT (162.1(1) - "knowingly") - The accused must know that there was a reasonable expectation of privacy at the time the matter was made. The accused is not guilty if he honestly believed that the image was taken in a public place.

7. SUBSISTING PRIVACY (162.1(2)(c)) - The complainant must have had a reasonable expectation of privacy in the image at the time of the offence. The accused is not guilty if the complainant had posted it online herself (e.g. porn stars) or if she had shared it so widely that it can no longer be considered private. Note that the commission of this offence would not undermine her privacy (you wouldn't lose a privacy interest in your home if someone committed break-and-enter).

8. CORRESPONDING FAULT (162.1(1) - "knowingly") - The accused must know that the image is private. The accused would not be guilty if he found it online and re-posted it, having no knowledge of whether it was posted by the girl herself or in violation of her privacy.

9. SHARING (162.1(1)) - The accused must have published (etc.) the matter. The accused is not guilty for merely possessing the image.

10. CORRESPONDING FAULT (common law) - The accused must have intentionally published (etc.) the image. The accused is not guilty for accidentally hitting "Instagram" instead of "GMail" on his device.

11. NON-CONSENT (162.1(1)) - The complainant must not have consented to that act of sharing. The accused is not guilty if the complainant consents, but changes her mind afterwards.

12. CORRESPONDING FAULT (162.1(1) - "knowing ... reckless") - The accused must have known or been reckless as to whether there was consent. The accused is not guilty if he honestly believed that there had been consent. Note that once the other fault elements have been proven, it is not harsh to hold the accused to the standard of recklessness - he knows he's dealing with a private intimate image that is not for distribution.

Unknown said...

Cyberbullying"
Here is a FREE GUIDE:
"A Parent’s Guide to Cyberbullying"

http://tinyurl.com/stopcybullying

Download a copy for parents, teachers, clergy so all are ready to help any young person facing this pervasive evil that is costing too many emotionally and costing young lives.

Unknown said...

Can you legally post a picture of someone who has been convicted of sexual assault along with a description of what they did?

chrissy said...

Very interesting read. I recently found out that my ex partner shared intimate photos of myself as well as an ex gf of his via email to a friend in the states. Neither of us consented to the images being shared and the images depict both nudity and activity prohibited. As he periodically accessed his email via my computer I am hsving a forensic audit done on my computer to obtain proof. Heres hoping.