Google Sound Alarm on Lawful-Access Bill, Citing Surveillance and Transparency Risks
Google is urging the government to make further changes to its lawful-access bill, warning that, as currently worded, it would allow Ottawa to create a “new surveillance infrastructure” and to impose blanket data-retention demands on tech companies that treat users as “potential criminals.”
A briefing note sent by the tech giant to Senators, who are now scrutinizing bill C-22, suggests they make changes to the text to protect encryption. Other suggested amendments would curb the power of a minister to issue secret orders to tech companies demanding they make changes to their systems.
Bill C-22 would require electronic service providers to make changes to their systems to give surveillance and monitoring capabilities to police services and the Canadian Security Intelligence Service. Tech companies operating in Canada would have to keep secret any ministerial orders they receive.
The Google document sent to Senators says the government’s proposed framework mandating technical changes would “undermine the principles of transparency and due process” and “is highly problematic” for a number of reasons.
“Public transparency is critical for the effective functioning of a democratic state, particularly in the context of state surveillance. If surveillance directives are made in secret, citizens cannot understand or scrutinize state power,” the briefing paper, obtained by The Globe and Mail, adds.
The Canadian Chamber of Commerce and a number of international and Canadian tech companies, including Apple and Meta, have already expressed misgivings about the bill. Others, including encrypted messaging app Signal, have warned they would withdraw their services from Canada if asked to compromise their users’ privacy.
Simon Lafortune, a spokesperson for Public Safety Minister Gary Anandasangaree, said the bill does not authorize indiscriminate surveillance or compel companies to introduce systemic vulnerabilities into their systems.
He warned that “making the technical details of ministerial orders public could potentially give criminals a roadmap to the capabilities investigators rely on – and help them evade lawful investigations.”
“Confidentiality is essential, but it does not mean an absence of accountability. Under Bill C-22, ministerial orders require independent approval from the Intelligence Commissioner and can be subject to judicial review. That independent oversight ensures accountability without exposing sensitive information to those seeking to break the law,” Mr. Lafortune added.
The bill proposes new powers to force tech companies to collect the metadata of customers and store it for up to six months.
Such metadata would not include e-mails, web-browsing history, social-media activity or text messages, but it could include information about which telephone numbers have been in touch with each other and data allowing someone’s location to be pinpointed.
Google suggests that an amendment be tabled removing provisions requiring such metadata retention. It warns that such provisions “could permit the state to impose blanket metadata retention obligations, without any individualized suspicion.”
“This treats all users as potential criminals. Metadata is not merely ‘administrative’ data – in some cases metadata can contain core biographical data that is fundamental to a citizen’s private life.”
The Supreme Court of Canada has repeatedly held that individuals have a reasonable expectation of privacy in metadata, it says.
“Canadian law already contains mechanisms for targeted preservation orders, where data retention is constitutionally compliant, necessary and appropriate,” Google adds.
In response to widespread criticism from civil liberties groups, tech companies, academics and lawyers, Mr. Anandasangaree introduced a number of amendments to the bill in the House of Commons, including reducing from up to a year to six months the amount of time metadata could be retained.
But Google says that despite this change, the bill would allow “general population-level bulk retention of metadata without requiring targeted, individualized suspicion.” It warns that storing this much metadata could create a cybersecurity risk and “honeypots” of information attractive to hackers.
The bill is expected to enter a committee in the Senate as early as next week where Senators are expected to propose further amendments.
The bill says that an electronic service provider would not be obliged to comply with ministerial orders or regulations if doing so would require the company to introduce a “systemic vulnerability.” An amendment introduced in the Commons before Parliament broke up for its summer break, bolstered the definition of what counts as such a vulnerability.
But Google says although it now protects against directly breaking end-to-end encryption, other ways to undermine system security were not addressed by the change to the bill’s wording.
The tech giant suggests changes to the definition of systemic vulnerability to tighten protection for encryption and to ensure there is no credible risk to confidentiality and security.
The document, written this month, says that Google is committed to supporting the efforts of law enforcement and intelligence agencies to protect the public against crime and terrorism. But it says this can be achieved “without engineering vulnerabilities into products and services that weaken security for all users.”
Google, in a statement, said that amendments adopted in the Commons failed to adequately address many critical issues but it is continuing to engage with the government on the proposed legislation, as well as Senators.
This article was first reported by The Globe and Mail
