OK. I'm gonna try to summarize the 'so what?' of part 14 of bill C-2. Bill C-2 first and foremost aims itself at border security, but has also tabled numerous modernizations and reforms of various and sundry things like immigration asylum claims, money laundering, sharing of information and intelligence, and police search and seizure and lawful access. Part 14 focuses on the latter. I occasionally teach search and seizure matters in a few different courses my organization runs for police and other peace officers. Unfortunately, ducking back to add this as I write, this is turning lengthy, so unless you're masochistic enough to subject yourself to my law nerding, feel free to scroll.
Section 8 of the Canadian Charter of Rights and Freedoms protects everyone from unreasonable search and seizure. A search is when we do something to intrude on your 'reasonable expectation of privacy'- we act so as to be able to perceive or access information that we could not absent that intrusion. You do not have an REP over the make and model of the car in your driveway, but you do have REP over the contents of the trunk. You do not have an REP over the fact that you have a Starlink antenna on your roof visible from the street, but you have an REP over your subscriber data that identifies your IP address, your name and address as a customer, and your billing info and communications content. You do not have an REP over the fact that you are seen by a surveillance team holding a black iPhone 13 as a public bus stop, but you have an REP over the content of your text messages, calls, and internet browsing on that phone.
A Seizure is when we take something and deprive you of it. If you are arrested and your phone is taken, it is seized. If a bank provides a copy of your customer records pursuant to a court order, that's not a seizure. If your car is pulled over for secondary at the border and CBSA finds your bricks of cocaine, they are seized; if CBSA provides police with records of your entries and exits from Canada, that's not a seizure. If you put your garbage out to the curb on garbage day and we take it, that's not a seizure. If you walk away from your tray at the mall food court and leave and we take your abandoned straw, that's not a seizure.
Any search or seizure, if not authorized in advance by the court, is presumptively unreasonable- but we can rebut that presumption by showing another lawful authority; I arrested someone for impaired driving, and while searching them incidental to arrest, I found a gun. The search and the seizure can both be articulated and found reasonable. If we're stacked up outside a drug house waiting for a search warrant to come back, but the wiretap monitor hears the occupants receive a call saying "the cops are outside, flush the shit", and we go in to prevent loss of evidence, the drugs and guns we immediately find would be presumptively inadmissible because a judge didn't say we could yet, but we can articulate it to be reasonable.
So that, in a super quick nutshell, is a not-even-101 on search and seizure vs the Charter.
There are various ways the courts can give us permission to search and seize, or alternatively, the courts can order another party to provide documents or data that they have, or let us do other things that would intrude on someone's reasonable expectation of privacy. The one everyone knows is a search warrant. I I have reasonable grounds to beleive that in a place there is a thing that will afford evidence of an offence, a judge or justice can sign a simple search warrant giving me permission, with certain limitations, to enter that place, search and seize that thing, and then report back to the court what was seized. If, while I'm in the house looking for the gun, I also find drugs, baggies, and scales, I can seize those too as evidence, but I have to report them.
If I have reasonable grounds to believe that a third party has documents or data that will afford evidence of an offence (e.g., bank records of a fraudster), we can get a production order that compels that third party to provide the records- but they have 30 days to do it. Now, not all data is asintrusive. Your full bank records are pretty intrusive. The fact that you have a Canadian dollar account at TD Bank, that it was opened on May 1st 2017, and that it's registered to your name and address, while still attracting a reasonable expectation of privacy, is less intrusive. So on a lower threshold of reasonable grounds to suspect that an offence has been or will be committed, and to suspect that documents or data exist, we can get a production order for less detailed into; so if I have an account number I can get account holder info, or with a name and date of birth, I can get account number and type. Not how much is in it, or transactions, just that the account exists and who holds it. With a full production order (reasonable grounds to beleive), we can get account subscriber information- basically, that IP address 297.54.2.23 comes back to Rogers customer Bob Smith at 123 Main Street, Napanee, ON. The subscriber info's not very intrusive, but we have to be already at the level of reasonable belief to get it, so that's a bit of a barrier.
So that's all good. If I reasonably believe you shot at the synagogue and there's a gun in your house and I can reasonably articulate that belief, I can get a warrant to search your house and seize the gun as evidence, and I have to file a report that you get access to about all the stuff I seized and you can apply to get it back. If I have reason to believe you're committing money laundering, and I at least have something to point me to a specific bank, I can identify account numbers on a reasonable suspicion, and then if I get to the point of reasonable belief I can get full records like transactions.
That law has mostly all existed for quite a while, with minor updates. But then computers happened, and are involved in friggin' everything. Smart phones are computers. Search warrants that let us search a place for a thing don't say anything about data. Data's an intangible. It's not a thing I can grab and deprive you of- but at the same time, can anything be more intrusive than the state looking into the contents of your computer and more recently your phone? The courts have in the past decade and a bit come to say 'no'. To examine phones or computers, we need search warrants in which we've come up with a practice of describing the way we then will examine the phones for data. We search a place (often our evidence locker) for a thing (the phone), but what we care about is the data. But if we examine data, do we need to report it to the court the same way, such that the suspect gets to know about it right away? Right now the courts aren't consistent across provinces for that, so that needs clarity. One of the new provisions in Bill C-2 explicitly provides for searches of computers for data, and clarifies that copying and examining data is not reportable to the person under investigation if we can articulate why. So, if a school IT administrator find child porn on a teacher's computer during the summer break, calls police, and tells police what's on it, if this provision of the bill passes, it's now clear that when we get our search warrant we don't need to call the guy and tell him 'hey, so we're looking at data we just seized from your work computer'. That's currently a gap, with divergent case law across provinces.
A couple years ago in a decision called Bykovets, the Supreme Court ruled that a bare IP address attracts a reasonable expectation of privacy- literally just 'what IP was used in this crime?'. Not who it belongs to, just the number itself. In that case, a person made a fraudulent online purchase. The store reported it to Calgary Police, they contacted the payment processor - a third party, I think it was Stripe. Stripe says to Calgary Police "sure, here's the IP address the guy logged in from". Police got the IP without a warrant or production order, notwithstanding that it was used in a fraud, and the . Ultimately Supreme Court said that literally just getting the IP address without a warrant - even though it was voluntarily handed over! - is a Charter breach. The fraud charge was tossed. Now, in that case, police knew about it and asked up from. But since Bykovets, what's regularly happening is police get proactive child porn disclosures from the US National Center for Missing and Exploited Children - who are obligated to inform police - identifying, say, a Discord user account name and server on which child porn was being shared, and the user's IP address. Police officers have had to write production orders addressed to their own police service who now hold that proactive and voluntary disclosure of evidence, bring them to court, and get the court's permission to use these proactively disclosed IP addresses. We then need a second production order to the Internet Service Provider to identify the account holder, and they have thirty days to respond. I have personally seen this in a file I recently worked. It's fucking absurd. One of the provisions of the new law is that, if a third party is lawfully in possession of data, and voluntarily provides it to police, we're allowed to use it. So we'll be able to simply use the IP addresses given with child porn referrals, and knock the Production Orders from 2 down to just 1. A raw IP just identifies and Internet Service Provider; we still have to get a production order to compel the provider to give us the account holder information.
Now, that production order is slated to get a bit easier. Right now we have to get it by a general production order, which is a higher threshold of belief. To get 'who owns this internet account?' I have to hit the same level of justification as getting full bank records, or hospital records. It's a bit much. One of the amendments in this bill creates a new more limited production order for subscriber information, at the threshold of reasonable grounds to suspect. So, rather than being at the level of medical records of bank transactions, merely identifying the owner and address of an internet account will not be at the same level as identifying the owner and address of a bank account when all we have to start is the bank account number. That's coherent and reasonable.
To get even those - basic account holder info for a bank account, or, soon, an internet account, we still have to at least be able to articulate that we suspect a person has a customer relationship with that company. We can't just guess, we can't just throw out an order to every bank and credit union. And that's fine, we should at least have some grounds before we go to the court.
The new bill includes an information demand that would allow us to demand from a service provider only confirmation that the documents or data exist. So, Bell would not tell the police that Brihard has an account with phone number 343-687-5309, or that I had it since October 2018 or what my address is- but they would have to, within at little as 24 hours hours but no less, confirm that records of some sort exist, for us to then request access through the courts. Right now we're completely dependent on the banks, ISPs etc voluntarily providing us with that confirmation, but nothing obligates them to. If we're working a file where we know the bad guys are using crypto, we know they're turning ot to cash and depositing it into a Canadian bank but no idea which one, all we can do right now is reach out to the banks, tell them "We're investigating Bob Smith 1979-03-25 for offences relating to money laundering, please let us know if he has any account at your institution?" but they don't have to. The Information Demand in the new bill would compel simply a 'yes or no' that we would then have to write to for the court.
I work in a unit with a 24/7 on call rotation; stuff that comes in weekends or after hours that would go to a specific investigative team or unit during the week will get handled in the initial phases by on call members. Some months back, I was the lead for a n alleged kidnapping where there was a risk to safety. It was, if memory serves, 8 or 9 on Friday night. everything was closed. I had to try to get after hours contact with several banks, a phone company, and a couple social media companies to try to identify account info that we could work with on an exigent basis to try to ascertain location and safety. Most of the time, companies are pretty good about it, but nothing obligates them to even confirm there's an account. If we have reasonable grounds to believe there's an offence, and documents/data that would afford evidence, I can write up a production order - and take it to the court on Monday. If it's signed the same day, they have 30 days to reply. So, we have no compulsory mechanism to compel a service provider to provide subscriber information in an emergency, allowing us to, for instance, get an emergency disclosure on the subscriber behind a social media account posting an imminent bomb or active shooting threat, or the email address from which a kidnap and ransom demand was sent, or from which child porn was shared. Again, most providers are generally pretty good about it (if we can reach someone after hours), but it's voluntary. If they choose not to cooperate, we're kinda hooped until 30 days after a production order is signed and sent.
To fix that, one of the new provisions of the bill is a very limited authority for exigent circumstances where the legal grounds to get a production order for subscriber info, or to trace a communication exist, but we don't have time. The specific new provision will in these limited circumstances allow us to compel an emergency disclosure. of subscriber information. Again this would be things like threats of violence or threats to life or safety, or where an investigation would be badly harmed by the delay. Remember the child porn file with two production orders for the IP address and then the account holder (and then we probably still need a search warrant for the residence on top of it)? If we believe there may be ongoing victimization of a child, that's a great example where the exigent disclosure of subscriber information will punch through a major and dangerous obstacle that presently exists.
There are a few other things; we can get warrants to track a thing like a car or a phone to help track a suspect's location- again, same deal, we have to write it up and get it signed by the court. Unfortunately if they switch hpones (say they ditch a burner) or switch cars (swap out the rental), we have to write it all over again. A new provision lets us continue the tracking if they switch to a similar thing. It will close a gap that experienced criminals will regularly use to frustrate surveillance.
So, in sum, the search and seizure and lawful access provisions (not all of them but I've discussed most):
- Creating of a new 'reasonable suspicion' Production Order for subscriber info, comparable to what already exists for basic bank account holder data. This simplifies getting basic and less intrusive data into who's behind a phone number, IP address, or social media account, but stilll requires sign off by a court.
- An 'exigent circumstances' emergency provision for same; super useful in imminent threats files.
- An 'information demand', that we can use only if we have reasonable grounds to suspect an offence, that compels a service provider merely to confirm that documents or data exist, so that we can then seek a production order through the court. The demand itself will not get us evidence, it just points us in the direction of it, but then we need a judge or justice to sign an order.
- A more flexible Tracking Warrant so we can follow the suspect to a new car, phone, or other thing being physically tracked, as long as it's similar to what the court already let us track. (There's a similar one for Transmission Data, which is basically just the date/time/duration/phone numbers of calls made or received, but not content- I didn't get into that but it's similar).
- Clarification of how we deal with 'computer data' for search warrants, allowing more coherent dealing with cases when someone turns over a computer that we then need to get a search warrant to search for evidence without burning an investigation. All of Canada will be dealing with the same rule set.
So, that's a not-so-quick-but-dirty sum up of the Criminal Code amendments in C-2.