Proposed legislation would give police and Canada's spy service new powers to investigate online activities — powers they say they need to keep pace with criminals in the digital age.
The bill tabled in the House of Commons on Thursday would require internet and phone companies to tell authorities whether they provide service to a particular person or account number.
The legislation would allow police to then seek a production order from a court to obtain subscriber information from a company, such as the name, address, phone number and services provided.
The bill also updates warrant powers for computer searches and proposes a new authority to allow Canadian police to make requests of foreign electronic service providers, including social media and AI chatbot companies.
The government says police and the Canadian Security Intelligence Service need new tools to investigate national security threats and organized crime because existing laws have not kept pace with changes in technology and court rulings.
A previous version of the bill alarmed civil liberties advocates who said it would allow authorities to demand to know whether a person has an online account with any organization or service in Canada — which could risk exposing a person's medical information or other private details.
Public Safety Minister Gary Anandasangaree indicated a willingness in recent months to retool the legislation.
"We're not looking for sneaky ways to surveil Canadians," he told a news conference Thursday. "We're doing our part to combat bad actors in both the physical and digital worlds."
Deputy RCMP Commissioner Bryan Larkin called the new bill "a significant step forward which gives us tools that we currently don't have."
Under the proposed law, authorities could demand that a telecommunications company or internet service provider — but not a hotel, car rental company or medical facility — reveal whether it services a phone or account number of interest.
The government says police would need reasonable suspicion that a crime has been or will be committed, and would have to demonstrate that the information would be helpful in investigating that offence.
Police would need to give the telecommunications provider at least 24 hours to confirm or deny whether it provides services to a specific person or account number.
The service provider would have five business days to apply to a court to challenge the demand, and would not have to hand over information until the court had made a final decision. A court could amend or revoke the demand.
Currently, police can obtain a general production order from a court to go further and obtain subscriber information, such as the name and address linked to an account.
The government says this can take time. The new legislation would create a narrower court order that would allow police to seek subscriber information from a service provider.
Police would need to apply to a judge and establish that they have reasonable grounds to suspect criminal activity.
Police would also need to satisfy the court that subscriber information will assist their investigation. The proposed law would not allow authorities to obtain private communications or content, such as text messages or emails.
The service provider could apply to the court to challenge the request for a production order.
The bill would also:
- clarify that police are not required to obtain court approval to accept information that is publicly available, or that is given to them voluntarily;
- allow police to seize certain types of information in emergency situations, such as a terrorist episode;
- create the means for Canadian police to obtain court approval to request subscriber information and transmission data from a foreign organization in the context of a criminal investigation.
The bill would also establish requirements for key telecommunication service providers to develop and maintain technical capabilities so they are able to respond to requests from police and CSIS quickly and accurately.
The legislation would allow the public safety minister to issue targeted orders compelling an electronic service provider to develop specific capabilities — for instance, the ability to track a person's location through their cellphone.
A service provider that fails to comply with obligations under the law could face fines or other penalties.
