Don't throw the (judicial oversight) baby out with the bathwater

I have been trying to encourage an informed dialogue about "lawful access" on this blog, in an effort to cut through some of the rhetoric to get to useful substantive issues. In that effort, Detective Constable Warren Bulmer has written a couple of guest posts, including the most recent "A police officer's response to my recent critique of lawful access".

As I indicated when I posted Warren's piece, I mentioned I'd probably have a response. Here it is.

According to police, voluntary disclosure of subscriber information by internet service providers is too unpredictable for police officers to rely upon and the current system of judicial pre-authorization often takes too long. I'll acknowledge that this is a real problem.

My starting premise is that agents of the state (law enforcement and national security types) should not be able to obtain personal information from a third party without judicial authorization (unless there is an actual and immediate threat to life, health or safety). To me, anything that falls short of this is simply not acceptable.

Production orders are the natural means by which police should be able to obtain customer name and address information in the appropriate circumstances. (Search warrants simply don't work for these sorts of cases.)

D/Cst Bulmer has identified that production orders, as currently set up under the Criminal Code are limited to circumstances where the crime has already been committed but don't cover where there are grounds to believe a crime will be committed, so such orders are inadequate. (Though I note conspiracy to commit a future offense is usually an offense.) The solution is not to throw out judicially-authorized production orders but to fix this omission. Amend section 487.012 of the Criminal Code to include circumstances where there are reasonable grounds to believe that the production order will lead to evidence related to a crime that will be committed.

Here is what it would look like:

(3) Before making an order, the justice or judge must be satisfied, on the basis of an ex parte application containing information on oath in writing, that there are reasonable grounds to believe that

(a) an offence against this Act or any other Act of Parliament has been, is being or is about to be committed or is suspected to have been, is being or is about to be committed;

(b) the documents or data will afford evidence respecting the commission of the offence; and

(c) the person who is subject to the order has possession or control of the documents or data.

Fifteen words fix it.

If there's an emergency -- an actual imminent threat to life, health or safety -- police should be able to get access to subscriber information as soon as possible. The police, D/Cst Bulmer included, complain that ISPs don't always share this sense of urgency. In my own experience and from speaking with some within the ISP industry, this may be a result of "once bitten, twice shy" syndrome due to previous cases where the urgency of the situation was misrepresented, leading to the conclusion that it was only done to circumvent the need to get a production order. The way to deal with this is either via tele-production orders (similar to telewarrants, which are provided for under the Criminal Code) or by after-the-fact accountability.

This works for serious crimes, such as kidnapping, child exploitation and cyber-bullying.

Again, don't throw out judicial oversight simply because of some limited difficulties.

With respect to intervening in suicide, which is not a criminal offence in Canada, I have some difficulties. I am generally of the view that the intrusive powers of the state should be reserved for the investigation of serious criminal offences. Remember, violating a lawful demand under the Criminal Code or under C-30, if passed, would result in criminal charges against the person who refuses to hand over the information. It's not a neutral thing. They can be arrested. If an adult decides to deliver a suicide note via social media, it's not a criminal offense that bears investigating. With a young person, it is a different matter so perhaps an exception should be applicable.

As far as other examples advanced by some law enforcement officers are concerned (but not raised in D/Cst Bulmer's post), the full force of the state should not be brought to bear to reunite an individual with their lost phone. It's absurd that a telco could be criminally charged or convicted of contempt of court for failing to help find the owner of a lost phone.

In a free and democratic society, judicial oversight of the exercise of intrusive state powers is simply essential. It cannot be foregone because the current scheme of production orders is not perfect. Fix what we have so judicial oversight is maintained.