Liberals to improve protection for encryption in police data interception bill after fierce criticism

OTTAWA — After weeks of fierce criticism towards his lawful access bill, Public Safety Minister Gary Anandasangaree said Liberals will propose some changes to better protect encryption and water down the type of data companies must retain.

Speaking to reporters about Bill C-22, the minister also swung back at some of the tech companies opposing the hotly contested Bill C-22, arguing that they need to better protect Canadians’ privacy.

Parties had until Wednesday afternoon to table amendment proposals for the bill, which proposes a new regime that would compel electronic service providers to create or maintain capabilities for police and intelligence agencies to receive or intercept private data if granted a judicial warrant.

Anandasangaree told reporters that he is dead set on getting the bill through Parliament, arguing police and intelligence services desperately need many of the proposed changes to better tackle crime in the digital era, such as extortion or child sex abuse material.

But he accepted concerns that the bill did not spell out clearly enough that the government cannot demand that companies undermine their own encryption services.

“The encryption issue is one we will clarify, because this bill was never meant to breach encryption,” he said. “We look forward to working with the opposition on an appropriate language that we can live with.”

Lawful access, or the ability to obtain Canadians’ private information and intercept communications, is one of the most intrusive powers afforded to police and intelligence agencies. Creating such a regime for the digital age in Canada has been the subject of fierce debate for decades.

In Bill C-22, the government is proposing that police and the Canadian Security Intelligence Service (CSIS) be able to approach telecommunications companies and ask them if, yes or no, an individual is a client before having to get a warrant for more information.

The bill also proposes new obligations to electronic service providers to organize and retain various types of client data for up to one year in a way that makes it obtainable by law enforcement or CSIS with a warrant.

That means that if passed, the bill would compel electronic service providers to store and make information like device locations or cameras available to police or CSIS with the requisite warrant. That could be used to track a person’s live location in case they pose a threat to national security or are considered to be in danger, the government cited as examples.

But the one-year metadata retention clause has become highly controversial, with privacy and security specialists arguing it’s far too long and a violation of Canadians’ right to privacy. But police services had told MPs they’d prefer the period be extended to two or three years.

The minister said Wednesday that the government would set a “clear definition” of the types of metadata to be retained, which is currently undefined in the bill. But he said he would not be changing the “up to one year” retention time.

“We will clarify what metadata is. It does not imply that we are looking for backdoor ways of collecting information,” he said.

Finally, the minister noted he was looking at legislating compensation for companies who have to put in place data interception or storage capabilities due to the bill, such as telecommunications providers.

Tech giants such as Apple, Meta and Google and many other encrypted services providers such as messaging platform Signal and VPN provider NordVPN have aggressively criticized Bill C-22 for undermining encryption and forcing them to create a “backdoor” for police.

Anandasangaree was visibly irritated at the firms on Wednesday and told reporters that they should look inside themselves first when discussing data privacy.

“We’re living in a world where big tech, whether it is Apple, Google, or the range of other big tech companies, are operating without any type of accountability, without any type of protection of privacy,” Anandasangaree said, visibly irritated.

“So, when we talk about privacy, there’s a real conversation to be had as to what that entails. So the companies that are coming forth and… talking about privacy, talking about privacy protection, talking about vulnerabilities, (had) better step up and provide their path to how they’re protecting the privacy rights of Canadians,” he added.

He pointed to the fact that many email providers use data from those messages to serve advertisements to users, or that his car tracks his location and feeds that back to the maker.

“My point is that there’s no transparency on what type of privacy that is being protected” by tech companies, he said.

In a subsequent interview with National Post, Anandasangaree watered down some of his criticism of tech giants, but maintained that there are many “misunderstandings” about what his bill does and doesn’t do.

On the same day, the leaders of the Conservatives, NDP and Green Party all lambasted the Liberals’ bill, arguing that it’s textbook government overreach.

National Post

cnardi@postmedia.com

Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our politics newsletter, First Reading, here.