What is Lawful Access?

‘Lawful Access’ refers to legislation or government policies that extend authorities’ powers to access communication data. Authorities can include a range of state actors, including security and intelligence services, policing bodies, ‘peace officers’ (e.g. sheriff, warden), or designated government regulatory organizations. In Canada, recent legislative efforts would have expanded the powers held by peace officers, policing groups, Canadian Security and Intelligence Services (CSIS), and the Competition Bureau.

These changes to law and policy are traditionally associated with three kinds of access powers: search and seizure provisions, interception of private communications, and the mandatory production of subscriber data. Search and seizure provisions govern the warrant requirements for searching individuals or property or to lawfully seize evidence. Interception provisions govern the live capture of communications, which can include audio-, video-, and text-based communications formats. Modifying production order powers can affect the ease by which authorities can collect billing information about individuals from service providers, as well as information that can subsequently be used to ‘stitch together’ disparate online communications. In an Internet context, this information might include IP addresses, unique mobile device identifiers, email addresses, or pseudonyms that a subscriber might have  registered with the service provider.

Lawful access powers were comprehensively tabled by the federal government in February 2012 as Bill C-30 “Protecting Children from Internet Predators Act.” The legislation was subsequently killed in February 2013 prior to advancing to Committee hearings. The following summarizes some of the ways that surveillance capacities could have, specifically, been expanded under this lawful access legislation:

  1. TSPs would have been forced to provide subscriber information to authorities when compelled to do so. Specifically, authorities would have received subscribers’ names, addresses, telephone numbers, e-mail addresses, and SPIN numbers along with IP addresses. It was unclear what information, specifically, authorities would have provided to uniquely identify subscribers to TSPs.
  2. TSPs would have had to possess data preservation facilities. Authorities could serve a preservation demand if they had reason to suspect that a crime had been, or would have been, committed in Canada. If preserved because of a possible Canadian Criminal Code infraction then the TSP would have had to retain data for 21 days; if preserved to assist with resolving foreign offences data could have been retained for 90 days. Officers could establish conditions around the preservation – such as preventing the TSP from disclosing that it had received a preservation demand – and could revoke such conditions at any time.
  3. TSPs would have been forced to maintain capacities to provide intercept services and deliver subscriber information to authorities as new technologies were deployed and products offered to subscribers.
  4. TSPs would have had to develop systems capable of covertly activating location technologies carried by their subscribers, or enabling a system by which authorities themselves cloud ‘plug in’ to a TSP’s network and activate tracking features.
  5. Telecommunications Service Providers (TSPs) would have been required to decrypt any communications that they were responsible for encrypting. This meant that while your TSP – such as Rogers, Facebook, or email provider – could have made your communications generally secure they could not have secured them from the government. In effect, the legislation would have established pseudo-encryption, whereby you could have protected yourself from a similarly positioned agent in the network but not the state actor governing the network.

Together, these powers expand the capacity of authorities legally to access citizens’ and residents’ communications from online service providers such as social networking companies, mobile device providers, and Internet service providers. Lawful access legislation that has been put forward by successive federal governments of Canada that would have affected each of these industries.