[kwlug-disc] Federal consultation on "Investigative Capabilities"

[Hubert Chathi]

On Fri, 16 Dec 2016 10:26:25 -0500, Dekker <dekker at gratisinc.org> said:

> I was able to get to the site, but I got there about 5 minutes after
> the email hit this list. Its now a 404 because the consultation is
> CLOSED.

> https://www.canada.ca/en/services/defence/nationalsecurity/consultation-national-security.html

That's unfortunate.  I happen to have the page still open, so if anyone
is interested in what it said, here it is:

# Investigative Capabilities in a Digital World

This Green Paper is intended to prompt discussion and debate about
Canada's national security framework, which will inform policy changes
that will be made following the consultation process.

We live in a digitized and highly networked world in which technological
innovation is always forging ahead, advancing our quality of life, but
also bringing new threats to our security.

The same technologies we enjoy and rely on everyday - smartphones,
laptops and the like - can also be exploited by terrorists and other
criminals to coordinate, finance and carry out their attacks or criminal
activities.  Information

For even more information on Investigative Capabilities in a Digital
World read the National Security Green Paper Background Document

We treasure our privacy, and rightly so, but we also expect law
enforcement and national security investigators to be as effective in
keeping us safe and secure in the digital world as they are in the
physical world.

But our laws on how information can be properly collected and then used
in court as evidence were mostly written before the rapid pace of new
technology became a consideration.  In the face of evolving threats,
investigators worry about four main problems:

* slow and inconsistent access to basic subscriber information to help
  identify who was using a particular communications service at a
  particular time;
* the lack of a general requirement that domestic telecommunications
  networks maintain the technical ability to intercept messages;
* the use of advanced encryption techniques that can render messages
  unreadable; and
* unreliable and inconsistent retention of communications data.

Let's look at each of these challenges in turn:

## Basic Subscriber Information

Like looking up an address in a phone book or checking out a
license-plate number, access to basic subscriber information is one way
for law enforcement and national security investigators to identify an
individual.  But Canadian court rulings have reinforced the need for
appropriate safeguards around basic subscriber information, some of
which could, when linked to other information, reveal intimate details
of a person's activities. These rulings, combined with the absence of a
clear law governing access to basic subscriber information, have made it
difficult for law enforcement to obtain it in a timely and effective
manner.  Some other countries allow police and intelligence agencies to
obtain basic subscriber information without going to court.

## Intercept Capability

With legal authorization, the ability to intercept communications is a
valuable tool in national security and criminal investigations.
However, some communications providers are unable to comply with court
orders to cooperate because they do not maintain the technical
capability to do so.  Their resulting inability to intercept
communications can cause key intelligence and evidence to be missed.

## Encryption

Encryption technology is a tool that can be used to avoid detection,
investigation and prosecution.  After investigators get the proper legal
authorizations and make a successful interception or seizure, the
information obtained may be indecipherable due to encryption.  And there
is currently no legal procedure designed to require a person or an
organization to decrypt their material.

## Data Retention

"Data retention" means the storage of telecommunications information -
keeping track of which telephone numbers a person dials, for example, or
how long calls last.  Phone and Internet records of this kind can be
critical to effective investigations.  But there is no general
requirement for communications providers to retain this information.
Some delete it almost immediately.  Some use it for their own commercial
purposes, and then destroy it.

These and other challenges are amplified by the fact that data moves
instantaneously across national boundaries.  Communications providers
may offer their services in Canada, but may have no business presence
here, and thus operate beyond the reach of Canadian law.

## What do you think?

How can the Government address challenges to law enforcement and
national security investigations posed by the evolving technological
landscape in a manner that is consistent with Canadian values, including
respect for privacy, provision of security and the protection of
economic interests?


In the physical world, if the police obtain a search warrant from a
judge to enter your home to conduct an investigation, they are
authorized to access your home. Should investigative agencies operate
any differently in the digital world?


Currently, investigative agencies have tools in the digital world
similar to those in the physical world. As this document shows, there is
concern that these tools may not be as effective in the digital world as
in the physical world. Should the Government update these tools to
better support digital/online investigations?


Is your expectation of privacy different in the digital world than in the physical world?


## Personal Information (Optional)
Name

Organization

Location

Which of the following best describes you?
[ ] Journalist / media
[ ] Academic
[ ] Student
[ ] Private sector
[ ] Not-for-profit
[ ] Engaged citizen
[ ] Law enforcement
[ ] Government
[ ] Other

## Basic Subscriber Information (BSI)

Since the Spencer decision, police and national security agencies have
had difficulty obtaining BSI in a timely and efficient manner. This has
limited their ability to carry out their mandates, including law
enforcement's investigation of crimes. If the Government developed
legislation to respond to this problem, under what circumstances should
BSI (such as name, address, telephone number and email address) be
available to these agencies? For example, some circumstances may
include, but are not limited to: emergency circumstances, to help find a
missing person, if there is suspicion of a crime, to further an
investigative lead, etc…


Do you consider your basic identifying information identified through
BSI (such as name, home address, phone number and email address) to be
as private as the contents of your emails? your personal diary? your
financial records? your medical records? Why or why not?


Do you see a difference between the police having access to your name,
home address and phone number, and the police having access to your
Internet address, such as your IP address or email address?


## Interception Capability

The Government has made previous attempts to enact interception
capability legislation. This legislation would have required domestic
communications service providers to create and maintain networks that
would be technically capable of intercepting communications if a court
order authorized the interception. These legislative proposals were
controversial with Canadians. Some were concerned about privacy
intrusions. As well, the Canadian communications industry was concerned
about how such laws might affect it.


Should Canada's laws help to ensure that consistent interception
capabilities are available through domestic communications service
provider networks when a court order authorizing interception is granted
by the courts?


## Encryption

If the Government were to consider options to address the challenges
encryption poses in law enforcement and national security
investigations, in what circumstances, if any, should investigators have
the ability to compel individuals or companies to assist with
decryption?


How can law enforcement and national security agencies reduce the
effectiveness of encryption for individuals and organizations involved
in crime or threats to the security of Canada, yet not limit the
beneficial uses of encryption by those not involved in illegal
activities?


## Data Retention

Should the law require Canadian service providers to keep
telecommunications data for a certain period to ensure that it is
available if law enforcement and national security agencies need it for
their investigations and a court authorizes access?


If the Government of Canada were to enact a general data retention
requirement, what type of data should be included or excluded? How long
should this information be kept?


## Providing feedback

For more information on other ways to provide feedback please visit the
Consultation on National Security webpage.

Please note that participation in this consultation – in whole or in
part – is voluntary. Acceptance or refusal to participate will in no way
affect any relationship with the Government of Canada or with any of its
organizations. The information provided during to this engagement
initiative can be subject to Access to Information and Privacy requests
and will be administered in accordance with the Access to Information
Act and Privacy Act.