Summary of Submissions to the Lawful Access Consultation

Chapter 3: Comments by Law Enforcement

Total Number of Written Submissions Received: 58

The Canadian Association of Chiefs of Police submitted a response to the lawful access consultation document on behalf of Canadian law enforcement¹⁴. The majority of individual police forces wrote separate letters indicating their support for the CACP submission. A number of RCMP detachments also responded expressing support for the lawful access initiative. Several police forces had additional points to make that have been included in the summary below. Due to their subject matter, submissions from two government departments have also been included in this chapter. A list of law enforcement respondents is given in Annex A and the government departments are shown in Annex E.

A. General

Communications technology has continued to advance rapidly but the ability of police to access telecommunications services and gather necessary information to apprehend criminals has not. This gap is creating a safe zone where serious criminals can operate free from fear of detection and arrest.
Canadian law enforcement considers a number of broad principles to be very important to this discussion:
- The circumstances in which Canadian police may intercept private communications must continue to be the subject of prior court approval.
- The technological ability to implement court ordered access must always exist and never be compromised. There should be no "intercept safe havens"¹⁵ in Canada.
- New communications technologies are not of themselves problematic. However, left unregulated and without the necessary checks and balances, they can have unintended detrimental consequences. Modern legal mechanisms are required to ensure we as a society balance the needs of global competitiveness with those of effective public safety.
- Modern communications technology shrinks distances and operates free of geographical constraints. Organized criminals, Internet predators and terrorists take advantage of these facts. Legislation in Canada must reflect the growth of cross border crime.
- Some service providers require law enforcement agencies to pay significant fees before they will implement a court ordered interception. No persons, whether corporate or otherwise, must be permitted to erode the authority of the court by imposing fees or other financial obligations as a condition of compliance with a lawful order from the court.
High speed Internet and modern wireless services benefit Canadians at large. At the same time, police are increasingly faced by sophisticated criminals who use these same telecommunications technologies to support their unlawful operations and to hinder police efforts to bring them to justice.
Canadian lawful access powers need to be harmonized with those available in other countries, to help combat increasing international crime. Australia, New Zealand, the United Kingdom, the Netherlands and the United States are ahead of Canada in adopting lawful access legislation in line with today's technology.
Lawful access provisions should be transparent. That is, they should clearly articulate the appropriate procedure to be followed depending on the type of evidence and the expectation of privacy attached to it. They should also be transparent in the sense that they are framed in as technology neutral terms as possible.

B. Requirements to Ensure Intercept Capability

The minimum acceptable standard is that all new or significantly upgraded services shall be intercept capable, with the goal that all telecommunications services operating in Canada shall be intercept capable within a specific period of time defined in the legislation.
CSPs should have the technical capacity to provide real-time access for law enforcement and national security agencies to the following information and services, regardless of the range of services and features offered to the subscriber:
1. The telecommunications of the subject of an interception order isolated from any telecommunications outside the scope of the order and to provide the intercepted information only to the specified law enforcement or national security agency.
2. The entire telecommunications of the subject, including content, allowing the authorized agency to conduct real-time monitoring for the full duration of the interception.
3. All attempts of the subject to establish telecommunications.
4. A means to accurately associate the telecommunications associated data¹⁶ with the call content.
5. The physical, personnel and administrative measures to ensure security in relation to interceptions.
6. Telecommunications encrypted by the CSP to be delivered to authorized agencies en clair.
7. The transmission to law enforcement and national security agencies of the most accurate location information available to the CSP network.

C. Regulations

Regulations should not only be consistent with international standards, but should also be effective and workable in Canada.
Regulations will be required to allow law enforcement agencies to access both the content of communications and the related traffic data such that they may be associated together to an acceptable standard for use as evidence in criminal proceedings.
CSPs must be required to enable police to monitor only those targets authorized in a given court order. This would include obligations to ensure the privacy and security of the content of the intercepted communication, the associated traffic data and the identities of related persons.
Regulations should define the required capacity for simultaneous interception at service provider facilities, security requirements for police operations, as well as the integrity, competence and reliability of the service provider staff involved.
Regulations should prohibit CSPs from recovery of infrastructure costs from law enforcement and national security agencies through any cost recovery scheme - such as burying them in operational or hook-up charges.

D. Forbearance

Forbearance of intercept capability and capacity obligations should be the rare exception rather than the rule.
Disputes between law enforcement agencies and CSPs as well as forbearance requests should be handled either by an arm's length body responsible to the Solicitor General and the Minister of Industry or by a cabinet appointed three person board with representatives from the federal Solicitor General's office, Industry Canada and the CACP Lawfully Authorized Electronic Surveillance (LAES) subcommittee.
Forbearance sections in the proposed legislation should cease to operate and no further applications for forbearance should be accepted five years after the legislation receives Royal Assent.
Forbearance applications should be processed within 90 days from receipt and applicants should not be subject to the financial or other penalties set out in the legislation during this period.
Forbearance should not be granted for intercept capabilities 1, 2, 3, 4 and 6 listed in B2 above or if the forbearance might result in the creation of an "intercept safe haven".
CSPs should be required to submit with each forbearance application an implementation plan, with quarterly reporting, showing in detail how full compliance with the legislation will be achieved. The period granted for a given forbearance should not exceed 12 months. At the end of this time, the CSP should either be fully compliant or should be required to apply for a 12 month extension which would be assessed as a new application.

E. Compliance Mechanism

A compliance mechanism should be put in place by the proposed legislation which is independent of government, effective, efficient, appropriately funded and resourced. It should also be responsible for forbearance decision-making with appeals being made to the federal cabinet (see D2 above).
Significant fines should be imposed for non-compliance with mandatory capability requirements¹⁷.
With law enforcement and service providers working together in a cooperative partnership, the vast majority of difficulties will be worked out. Only the most severe and blatant contraventions of the capability and capacity standards set out in the proposed legislation would result in enforcement action.

F. Costs

CSPs should bear the entire cost of providing access capability to new or significantly upgraded technologies.
Even when the capability to intercept exists and the courts have authorized the interception, some CSPs have attempted to impose significant charges on the police - leading to regrettable ad hoc agreements between law enforcement agencies and individual telecommunications companies. Canadian law enforcement maintains that these costs relate to the public good and urges the government to legislate a firm prohibition against CSPs charging fees for compliance with any court orders. CSPs should also be prevented from recovering infrastructure costs¹⁸ from police forces.
Some CSPs charge law enforcement agencies look-up charges for subscriber information which is provided free of charge to the public - such as access to the Local Service Provider Identification (LSPID) database on the web. There seems little or no justification for this practice. Any charges for more demanding look-up tasks, such as subject telecommunications history, should take into account how readily CSPs can access the required information given fast access to in-house databases and other up-to-date facilities.
Haulback lines to transfer intercepted material from the CSP to police and national security agency facilities are charged by Canadian carriers at commercial rates, in line with Canadian Radio-television and Telecommunications Commission (CRTC) regulations. Increased bandwidth requirements needed to handle modern communications technology are pushing up these costs. Law enforcement and national security agencies should be granted reduced line tariffs as provided in section 27 of the Telecommunications Act.
Law enforcement agencies recognize that CSPs should be able to recover reasonable costs incurred in providing court-ordered assistance, but are strongly opposed to those costs being paid for by police forces, most of which do not have the necessary resources.
Cost recovery by CSPs should be broadly and equitably distributed, as well as being reasonable and proportional to the actual assistance provided - like the 911 fee on phone bills. Charges should also be subject to independent third party review.
Any CSP charges authorized by the proposed legislation should be consistent and applied in accordance with a standard practice across Canada. The fees should be reviewed every two years with a specific date set for changes to be implemented.
After a date proclaimed by Cabinet, CSPs should be given a fixed period in which to provide information about the lawful access capabilities of their network. The information that a CSP provides about the upgrades or modifications necessary to meet legislated capabilities should be used to determine what assistance and reimbursement the CSP will receive to meet the requirements.

G. General Production Orders

Production orders of the type outlined in the consultation document make sense in today's world. Third party custodians of information can usually find it much more quickly and with less disruption to their other activities than law enforcement agencies. A production order could also help secure information in the control of, but not in the possession of, third parties - including information stored outside Canada.
The use of anticipatory investigatory techniques is very common in the successful resolution of criminal cases. The establishment of a production order empowering a judge¹⁹ to authorize the monitoring of transactions over a specific time period is a logical and common sense proposal which is consistent with the law as it stands today²⁰. It represents a reasonable compromise between the obligation to obtain a search warrant for information with higher confidentiality and free access to information without any form of judicial authorization.
Search warrants should only be required for information that tends to reveal intimate details of the lifestyle and personal choices of the individual affected by the order²¹.
Production orders should be issued by a judge who is satisfied by a declaration under oath (or affirmation) by the investigating officer concerned that he/she is engaged in the bona fide execution of a lawful duty and that the order is reasonably required to allow this duty to be carried out.

H. Specific Production Orders for Traffic Data

There are no Criminal Code provisions at present that address the collection of traffic data. A specific production order should be established for the acquisition of traffic data obtainable under a similar process to that for dialled number recorders (DNRs).
The definition of traffic data given as "telecommunications associated data" in the consultation document should be adopted in the proposed legislation.
Section 492.2 of the Criminal Code should be expanded to allow acquisition of DNR and traffic data where it is reasonably expected that the information may enable law enforcement agencies to prevent imminent bodily harm or death of any person - even if an investigation into a possible criminal offence is not involved.

I. CNA/LSPID Information

Accurate and accessible subscriber information is an essential investigative and evidentiary tool. Authorities must have the ability to determine the owner of an account or service.
Customer name and address and local service provider information (CNA/LSPID) is not personal information and should not require judicial authorization to obtain it. However, CSPs are not compelled to produce this information on request at present. A statutory provision should be created requiring CSPs to provide law enforcement and national security agencies with CNA and LSPID information. If this is rejected on privacy grounds, a production order with a nominal procedural threshold should be considered instead.
CNA/LSPID information is critical to law enforcement's role in Canada and to meeting its international cooperation commitments. The maintenance of CNA/LSPID records should be made a prerequisite for CSPs conducting business in Canada. The fact that they operate in a competitive business environment should not relieve them of the fundamental responsibilities of Canadian corporate citizenship.
A national database could be set-up for CNA/LSPID information, populated by CSPs and accessible by law enforcement and national security agencies. It could be run and maintained by a private sector company selected through competitive bidding as in Australia or possibly a public/private partnership.
Alternatively, a distributed data system could be established allowing requests from law enforcement agencies to be automatically directed to individual CSP databases through an intermediary system. Results would be passed back to law enforcement via the same route. Whichever system may be chosen, security measures would be required to prevent unauthorized access.
The federal government should be responsible for funding the selected system.

J. Assistance Orders

Judges may already issue an assistance order under section 487.02 of the Criminal Code. However, this section should also be expanded to include reference to production orders.

K. Data Preservation Orders

Electronic forms of evidence are inherently volatile, so a mechanism is needed to ensure that evidence is not lost or destroyed before authorities can secure appropriate judicial authorization to seize it. The process for granting such an order should be streamlined and should reflect the fact that privacy interests are minimally affected when a third party, such as an ISP, is simply required to preserve data already in existence.
Where an authority is provided to order a service provider to preserve data temporarily, law enforcement agencies cannot subsequently seize that data without meeting the test of judicial authorization as would be required for any other search warrant.
The investigating officers, or designated law enforcement officials, should be authorized to issue exigent preservation orders valid for seven business days.²² Within this period, law enforcement agencies would be required to get judicial approval to extend the preservation order for up to 90 days. CSPs should be notified of the date and time when the judicial preservation order will be served at the time of being served with an exigent order.
Preservation orders should apply to stored computer data as well as to paper records.
Preservation orders should be issued by a judge who is satisfied by a declaration under oath (or affirmation) by the investigating officer concerned that he/she is engaged in the bona fide execution of a lawful duty and that the order is reasonably required to allow this duty to be carried out.
Legal standards need not vary depending on the type of data to be preserved. The nature of the data should only be considered when it is to be acquired by law enforcement agencies rather than simply preserved by a CSP or other custodian.
The time period for preservation of data should be a maximum of 90 days as stipulated by the Convention on Cybercrime - subject to subsequent extensions being granted by the courts for just cause.
The existing Criminal Code offences of "Obstruction of Justice" and "Disobeying an Order of the Court" as well as the common law offence of contempt of court are sufficient to deal with deliberate non-compliance with a preservation order.

L. Virus Dissemination

The infrastructure of the Internet should be given protection against malicious and damaging attacks by the addition to the Criminal Code of the offences of possessing, creating or selling a virus without lawful reason.
Canada's legislation should be uncompromising and in line with comparable laws in other western democracies and with the Convention on Cybercrime.

M. Interception of E-mail

Canadian law enforcement welcomes the government's proposal to clarify the existing laws as they relate to the interception and seizure of e-mail.
The ways in which existing Canadian laws apply to the interception and seizure of e-mails are confusing and should be clarified. Access to e-mail content and its seizure should always be subject to prior judicial approval. However, seizure of this material does not appear to meet the definition or procedural requirements of interception. An e-mail is more like a letter sent through the postal system which should be seized under the search warrant provisions of the Criminal Code.
A specific Criminal Code provision should be created covering court-ordered acquisition of e-mail.
The stage of the transmission of an e-mail should be an irrelevant consideration in determining the type of the order required to acquire it. Moreover, the higher procedural safeguards that apply to the acquisition of voice communications should not be required in order to access e-mail data.
People talking on a conventional phone or a cellphone can reasonably conclude that no copy will be made of their conversation. This cannot be said of e-mail communications over the Internet. An e-mail consists of text that often passes through a number of third party computer systems where copies are made of the message before it reaches its destination. So the degree of privacy that could be reasonably expected when using e-mail would not be the same as that when using transitory verbal communications over wireline or wireless communications networks.

N. Other Topics Introduced by Respondents

Video Intercepts

1. Section 487.01(4) of the Criminal Code has provided the police with an effective tool to fight serious crime. However, it requires video interceptions to be carried out exclusively by police officers. This is a serious drain on police resources today.
2. Trained civilian monitors, who are already involved in interceptions authorized under Part VI of the Criminal Code, can readily handle video intercepts as well.
3. Section 487.01(4) of the Criminal Code should be amended to allow video intercepts to be executed not only by a police officer, but by a person acting under the direction of a police officer.

Target-Based Communications

4. Part VI interception orders authorized by the courts specify the location at which the interception will take place. This approach presented no problem when most interceptions were on wireline services involving conventional phones, but it is not applicable to today's highly mobile wireless services such as two-way paging, wireless e-mail and coded numeric paging.
5. Some law enforcement agencies express the view that subsections 185(1)(e) and 186(4)(c) of the Criminal Code should be amended by replacing any references to the location of the interception with a description of the devices²³ to be intercepted.
6. Others propose that intercept orders be restructured to authorize the interception of the communications of a particular subject rather than specified pieces of equipment believed to be held by the subject. They point out that technology now allows an interception subject to add new devices and to discontinue use of previously held devices on a daily basis.
7. Any amendment that may be adopted should not apply to Part VI warrants authorizing entry to premises to install a listening device, where the requirement to describe the location of an interception would obviously still be necessary.

Live Monitoring

8. Law enforcement is seriously concerned about the rising costs of compliance with the live monitoring clauses included in most judicial authorizations under Part VI.
9. Live monitoring requires an authorized person to listen to a private communication being intercepted long enough to decide whether it can be lawfully intercepted or not. If it cannot be listened to in its entirety, the listener will "drop" the call.
10. Automatic monitoring records all the private communications associated with a given device for later review and analysis. The person who plays back the automatic recording is able to "block" any communication which is not authorized for interception in the same way as the live monitor. The call block protocol maintains a record for later inspection by a court of how much of a given interception was listened to by law enforcement agencies and how much has never been heard.
11. The Criminal Code should be amended to dispense with the live monitoring requirement, where call block facilities are available to an intercepting agency.

Pre-paid or Pay-As-You-Go Services

12. Pre-paid/pay-as-you-go cellphones, Internet access cards, Internet cafés and Internet facilities at public libraries all pose an obstacle to law enforcement agencies because the identity of the service user is easy to conceal from law enforcement.
13. In keeping with the principle that no intercept safe havens be created, regulatory obligations should be established in Canada requiring the identification of users of prepaid communications services and the maintenance of an accurate subscriber database by the service provider.

Cross Border Interceptions

14. Several Canadian wireless companies and satellite communications system operators have service areas that overlap the Canadian/US border. This can mean that the subject of a Canadian authorization may be physically located in Detroit, although the interception itself is being carried out on a wireless switch located in Windsor.
15. The Criminal Code should be amended to make wireless and satellite cross border intercepts legally admissible as evidence in the courts, provided the interception takes place on a telecommunications facility in Canada.
16. When the service provider is in the US and the subject of a Canadian authorization is in Canada, the situation becomes more cumbersome. The only current means of gathering evidence in the US is by means of letters rogatory²⁴ which are subject to judicial approval or by invoking a mutual legal assistance treaty, if it exists. New expedited procedures or agreements should be put in place to provide rapid assistance. A central location in each country where this data could be retrieved would be very valuable to law enforcement agencies on both sides of the border.

Communications Service Providers with No Infrastructure in Canada

17. Canadians can obtain Internet services from a number of companies which, although they have an office in Canada, have their entire infrastructure located in the US. This means it is not possible to execute an interception authorization in Canada.
18. Legislation should be created that would compel all CSPs offering services to Canadians to have intercept capability available in Canada. Any new infrastructure costs incurred in order to comply with this requirement would be the sole responsibility of the CSP.

Mobile Wireless Networks and Personal Digital Assistant Services

19. The high-speed data overlay network²⁵ quite recently introduced by Personal Communications Service (PCS) providers presents lawful interception difficulties to law enforcement. This challenge will become tougher to tackle with the arrival of the very high-speed 3G mobile wireless networks.
20. Likewise, paging and Personal Digital Assistant (PDA) services can be hard to intercept without close cooperation from the manufacturers, because they use proprietary algorithms.
21. CSPs should be prohibited from using any technology that precludes lawful interception, regardless of whether they are the manufacturer or the purchaser of the technology.

Date modified:: 2021-09-07