Once again, the RCMP calls for warrantless access to your online info. Once again, the RCMP is wrong

The CBC and the Canadian Press are reporting on comments made by RCMP Commissioner Bob Paulson calling for warrantless access to internet service provider customer information. (Bob Paulson, RCMP boss, wants warrantless access to online subscriber info - Politics - CBC News)

Yes, this is a revival of the lawful access debates that have taken place intermittently over the past decade or so.

Lets take a close look at what he said and why he's wrong.

Police need warrantless access to Internet subscriber information to keep pace with child predators and other online criminals, says RCMP Commissioner Bob Paulson.

The top Mountie said Wednesday that a Supreme Court of Canada ruling curtailing the flow of basic data about customers — such as name and address — has "put a chill on our ability to initiate investigations."

I don't disagree with that. But having to get a warrant to search someone's house also puts a chill on investigations.

"I'm all for warrantless access to subscriber info," Paulson told a security conference in Ottawa, comparing the process to his beat-cop days of entering licence-plate data into a computer and coming up with a vehicle owner's name.

"If I had to get a judge on the phone every time I wanted to run a licence plate when I was doing my policing, there wouldn't have been much policing getting done."

Whoa! This is an absurd characterization. Commissioner Paulson is either ignorant or disingenuous. The courts have held that you don't have an expectation of privacy -- vis-a-vis the police -- in your license plate information and your car registration information that it is connected to. The Supreme Court of Canada, in R v. Spencer (the case that Paulson clearly doesn't like or agree with), said very clearly that you have an expectation of privacy in your online customer data. In fact, the Court said at paragraph 50 of that decision:

"I conclude therefore that the police request to Shaw for subscriber information corresponding to specifically observed, anonymous Internet activity engages a high level of informational privacy."

And as Paulson should know, where there is an expectation of privacy, the police must get a warrant. It's that simple.

Mounting public concern

In June last year, the Supreme Court of Canada ruled police must have a judge's authorization to obtain customer data linked to online activities.

The high court rejected the notion the federal privacy law governing companies allowed them to hand over subscriber identities voluntarily.

The Supreme Court of Canada was not at all ambiguous about it. You and I have a reasonable expectation of privacy (which includes anonymity). In the absence of a production order from the Court or exigent circumstances, they police can't have it. (For a summary of the case, you may want to read this blog post.)

The Charter is the supreme law of Canada and the Supreme Court gets to have the final word. No amount of wishful thinking by the police will change that. Since their job is to uphold and enforce Canada's laws, they should start with that.

Police say telecommunications companies and other service providers — such as banks and rental companies — now demand court approval for nearly all types of requests from authorities for basic identifying information.

The Supreme Court judgment came amid mounting public concern about authorities quietly gaining access to customer data with little oversight or independent scrutiny.

Paulson said after his speech that he advocates giving police ready access to basic subscriber information while respecting the Charter of Rights and Freedoms.

'We've been consistent'

"I think we've been consistent in recognizing that we are very respectful of the charter and people's charter rights and nobody is recommending that we go any further," he said. "But there needs to be some sort of administrative access to basic subscriber information."

No, they really haven't. Not at all. The Charter requires a warrant. Paulson wants a way around that fundamental legal fact that is rooted in the supreme law of our country.

The Canadian Association of Chiefs of Police revealed in August that government officials were mulling just such a scheme — though it's not clear exactly how it would square with the court ruling.

The chiefs said a discussion paper spearheaded by the Department of Justice was presented to the federal, provincial and territorial cybercrime working group of senior officials.

The paper outlined three legislative options for allowing access to basic subscriber information:

• An administrative scheme that would not involve court approval.
  
• A new judicial order process or a tweak to the existing regime.
  
• A judicial order process for subscriber information with a greater expectation of privacy and an administrative, non-judicial one for less sensitive subscriber data.

Paulson said while the Internet is a marvellous boon to communication, education and commerce, it is also a place where a vast array of crime takes place, including rampant sexual abuse of youngsters.

Time for a public conversation

Children are "being hurt at a pace and a frequency that is alarming," the commissioner said.

"Technology is fuelling that. So now these people can encrypt their communications and they can exploit children for sexual purposes and it's a little harder to get at them from a police point of view."

Many people want the Internet to be completely free, without rules, Paulson noted. "That's fine if we don't want justice there."

The as expected "think of the children!" appeal. I'm surprised that he didn't mention the terrorists. It is worth noting that the RCMP Commissioner and the Canadian Association of Chiefs of Police advocated for Bill C-30, which would have provided for warrantless access to customer data even for a parking ticket or even no crime had been committed.

Also, nice straw man there, Paulson. Please show me the people who are contributing to the debate who call for the Internet to be "completely free, without rules." You won't find them. Your opponents in this debate do not question that police need appropriate powers to investigate online crime.

It's time for a public conversation about how best to prevent all kinds of exploitation in cyberspace, he said.

Allies in the United States, Britain, Australia and New Zealand are confronting the same issues, Paulson added.

"We're all struggling with this. It's hard to keep people safe on the internet right now.

The RCMP and the lobbying agency for Canadian police are obviously trying to revive a debate that has been definitively settled. If they want to try to make the judicial authorization process more efficient or to tweak the thresholds for getting customer information in the event of serious crime, I can help them with that. But when the police state things that are simply wrong about a subject matter they really should know very well, I'm going to call them on it.

Presentation: Use of drones in journalism & media

I had the great pleasure of speaking at the annual conference of the Canadian Media Lawyers Association's annual meeting in Toronto on the topic of legal issues related to the use of drones by the media and in journalism in Canada.

For anyone who may be interested, here's the presentation:

Let's all avoid technopanic in the call for additional privacy regulation for drones

Full disclosure: I'm not a bystander to this discussion. I'm an avid drone user, having purchased a training drone and then DJI Phantom 3 Advanced in May of this year. I've been capturing, editing and proudly showing relatively unique perspectives of the beautiful province in which I live. Feel free to check my videos out: https://www.youtube.com/playlist?list=PLFgopbjgzsAGlZhNB_mRf3VCgXAUPoZgO.

---

Over the past few months, Transport Canada has been engaged in a consultation process to look at how to safely integrate unmanned aerial vehicles into Canadian airspace. This involved a call for comments regarding draft regulations or proposed regulatory approaches. Sensibly, Transport Canada was focused on their mandate under the Canadian Aviation Regulations, which is to enhance safety and competition in Canadian airspace.

The Office of the Privacy Commissioner of Canada submitted a response dated August 27, 2015. (Notably, this was posted on the OPC's website in October, well after the opportunity to respond.) There has been some reporting on this (Protect schools, homes from drones' prying eyes, privacy czar says | Toronto Star), but not much.

If you think there's some vacuum regarding privacy and the use of drones, think again. Federal agencies are subject to the Privacy Act and the Charter. Provincial agencies are subject to relevant Freedom of Information and Protection of Privacy Acts and the Charter. Private companies are regulated under the Personal Information Protection and Electronic Documents Act or the Alberta, Quebec and British Columbia equivalents. All of them -- and private citizens -- are subject to the Criminal Code for voyeurism and the torts of "invasion of privacy". There really is no gap. And in most of them, we consider whether there is a reasonable expectation of privacy in the totality of the circumstances.

With respect, I think at least part of the position articulated in their submission is wrongheaded and is an example of technopanic. The Commissioner's office calls for the creation of a completely new concept of "sensitive and protected areas". These are areas that " while perhaps public, carry with them some expectation of privacy when people use them". Here's the relevant sections of the submission:

Sensitive and protected areas

From a safety perspective, operation of UAVs in crowded areas, around aerodromes, airports and heliports has already been restricted, both in Canada and many other countries. Other jurisdictions, including many in the US, have placed outright bans on usage of UAVs in certain sensitive areas where people might congregate or other aircraft might be operating – certainly until such time as sense and avoid systems are better developed and more widely deployed.

We would encourage CARAC members to give thought to exploring a similar line of reasoning with regard to privacy concerns. Residential areas, schoolyards and shelters, hospitals and prisons, places of worship and memorial sites – all come to mind as spaces which, while perhaps public, carry with them some expectation of privacy when people use them.

As with identification methods noted above, we do not here have an exhaustive list of locations in mind, nor would we recommend an outright prohibition on usage in these areas, but would ask CARAC to consider developing a best practices approach to flag certain spaces like those mentioned as privacy sensitive (places where individuals’ sense of potential intrusion is generally heightened). Just as we would anticipate organizations concerned about their own security would be alarmed by sudden increases in the use of UAVs around their property, we would expect citizens could be similarly concerned if certain spaces were encroached upon.

For a recent specific example of regulation in this context, please see guidance issued this summer by Argentina’s Data Protection Authority, and where investigative use is contemplated, you might refer to our own Office’s Guidelines on the Use of Video surveillance by Public Authorities.

One of the great characteristics of Canadian law is that it is technologically neutral. We generally focus on the mischief, rather than the instrumentality. Fraud is fraud, regardless of whether it is done with a quill, a pen, a phone or a fax machine. While we may get excited about new technologies, we don't legislate about them specifically unless there really is a need to do so or a clear gap in the law.

With "sensitive and protected areas", we are still talking about public spaces. Is there any difference between taking a photo in a residential area with a DSLR or with a drone? I have a 300mm lens for my Nikon D90 and any law that said I couldn't use it to take photos in the park down the street would be unconstitutional. My drone has a 20mm wide angle. A military predator drone can do much better than anyone's civilian digital camera. If there is a problem with people taking photos in parks or residential areas, make a law that deals with photos in residential areas or parks. And any law would have to apply to me in the same what that it applies to a TV news crew. (And then see whether it survives a Charter challenge.) It should not matter what technology you use to do that. If the problem is the effect, focus on the effect. Not on the shiny new technology that you think may be creepy.

Everyone who uses these devices needs to follow all relevant laws, which include privacy laws. And that covers it.

---

If you want more about this, I just gave a presentation at the Unmanned Systems Canada 2015 conference on privacy law and drones and will be speaking at the Canadian Media Lawyers Association - Ad Idem conference on privacy and drones.

Presentation: Privacy and drones in Canada - the current state of the law

I had the pleasure of presenting at the Unmanned Systems 2015 conference this week, on the topic of privacy and drones (or unmanned aerial vehicles or unmanned aerial systems). I mostly spoke about what privacy laws apply to the different aerial activities in Canada, with a bit of discussion about what might be over the horizon.

For anyone who may be interested, here's the presentation I gave: