Submission to the Senate Standing Committee on National Security, Defence and Veterans Affairs: Study of Bill C-26,

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts Submission by Kate Robertson Citizen Lab, Munk School of Global Affairs & Public Policy University of Toronto

Part 1. Introduction 1. In 2022, Citizen Lab published Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act (“Cybersecurity Will Not Thrive in Darkness”).1 The report was authored by Dr. Christopher Parsons.2 Dr. Parsons critically examined the proposed draft legislation under Bill C-26, including identified deficiencies. In doing so, Dr. Parsons provided necessary historical and international context surrounding the federal government’s proposed telecommunications sector reform.

Canada is not the first of its allies to introduce new government powers as a result of heightened concern and awareness surrounding real and pressing risks to critical infrastructure. However, Dr. Parsons identified that although the draft legislation may advance important goals, its current iteration contained thematic deficiencies that risked undermining its effectiveness. This report is set out in Appendix B. 2.

Integrating the analysis in Cybersecurity Will Not Thrive in Darkness, and addressing subsequent developments since the report was published, including the study and amendment of Bill C-26 by the Standing Committee on Public Safety and National Security (SECU), the submissions in this brief are set out in two parts: a.

Part 2: Vulnerabilities in Mobile Communications Networks:

Part 2 of this Brief situates Bill C-26 in the context of historical and continuing deficiencies in regulatory oversight, transparency, and accountability for telecommunication networks have led to serious threats associated with contemporary mobile networks. b.

Part 3: Bill C-26 and the Canadian Charter of Rights and Freedoms (“Charter”):

Part 3 of this Brief discusses the nexus between Bill C-26 and the Charter. It focuses, in particular, on the impact of Bill C-26 on freedom of expression (Subsection 2(b)) and privacy (Section 8). The Charter implications of the proposed legislation should be a central consideration for this Committee, and throughout the Parliamentary process ahead.

Part 3 also provides substantive analysis and recommendations for amendments to address thematic deficiencies in Bill C-26. These recommendations are intended to address overarching deficiencies, including secrecy and transparency issues, and the need to incorporate guardrails for the new government powers that the Bill creates. c.

Part 4: Bill C-26’s encryption-undermining powers:

Part 4 addresses how lawmakers should be focused on the creation of robust, vendor-neutral and uncompromised security standards that apply across Canada’s networks, as opposed to selectively focusing on particular vendors. If Bill C-26 passes unamended, all telecom providers in Canada would instead be compellable through secret orders to weaken encryption or network equipment. To that end,

Part 4 1 Christopher Parsons, “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act,” Citizen Lab Research Report No. 158, University of Toronto, Oct. 2022. 2 This report was also published at the time that Dr. Parsons was a senior researcher at the Citizen Lab. As such, the report’s conclusions and recommendations also do not necessarily reflect those of Dr. Parsons’ current employer.

2 addresses the need for an amendment to ensure that the federal government is not authorized to compel network operators to compromise the integrity of necessary security standards.

Part 2. Historical and Continuing Vulnerabilities in World’s Mobile Communications Networks 3. The laws under consideration in Bill C-26 should be considered against the backdrop of historical and continuing vulnerabilities in mobile communications networks. In 2023, the Citizen Lab published Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure (“Finding You”), authored by Gary Miller and Christopher Parsons.3 The report provides a high-level overview of geolocation-related threats sourced from 3G, 4G, and 5G network operators.

Evidence of the proliferation of these threats shows how the signalling protocols used by telecommunications providers to facilitate roaming also allow networks to retrieve extraordinarily detailed information about users. These protocols are being constantly targeted and exploited by surveillance actors, “with the effect of exposing our phones to numerous methods of location disclosure.”4 Risks and secrecy surrounding mobile geolocation surveillance are heightened by layers of commercial agreements and sub-agreements between network operators, network intermediaries, and third-party service providers.

Ultimately, vulnerabilities in the signalling protocols have “enabled the development of commercial surveillance products that provide their operators with anonymity, multiple access points and attack vectors, a ubiquitous and globally-accessible network with an unlimited list of targets, and virtually no financial or legal risks.”5 4. These vulnerabilities are not limited to location surveillance alone.

Once positioned with access to signalling protocols, “private surveillance vendors have free rein to act as a telecommunications firm to exchange the same signaling messages but exploit this access to covertly track individuals, disrupt their cell phone services, or even intercept their text messages and voice calls.”6 5. It is long overdue for regulators to step in at national and international levels to secure network services.

Finding You highlights the importance of developing a cybersecurity strategy that mandates the adoption of network-wide security standards, including a requirement that network operators adopt the full array of security features that are available in 5G standards and equipment. The report’s findings also underscore the importance of public transparency and accountability in the regulation of telecommunications providers.

As the authors note, “[d]ecades of poor accountability and transparency 3 Gary Miller and Christopher Parsons. “Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure,” Citizen Lab Research Report No. 171, University of Toronto, Oct. 2023. Dr. Parsons was a senior researcher at the Citizen Lab at the time the report was being produced.

While the report’s findings will be the subject of comments and recommendations in this brief, those comments do not necessarily reflect those of his current employer. 4 Finding You, at p. 1. 5 Finding You, at p. 2. 6 Ron Deibert and Gary Miller, “When You Roam, You’re Not Alone”, Lawfare, December 28, 2023.

3 have contributed to the current environment where extensive geolocation surveillance attacks are not reported.”7 For this reason, Canada’s approach to the regulation of telecommunications and cybersecurity needs to be transparent, accountable, and compliant with applicable human rights standards. The recommendations throughout this brief are offered in an effort to correct imbalances in the draft legislation.

Part 3. Bill C-26 and the Charter: Towards a Human Security Approach to Cybersecurity 6. In analyzing the proposed amendments to Canada’s Telecommunications Act in Bill C-26, Dr.

Parsons identified the following thematic deficiencies in the proposed legislation: ● The breadth of what the government might order a telecommunication provider to do is not sufficiently bounded. ● Excessive secrecy and confidentiality provisions in the bill threaten to establish a class of secret law and regulation. ● Significant potential exists for excessive information sharing within the federal government as well as with international partners. ● Costs associated with compliance with reforms may endanger the viability of smaller providers. ● Vague drafting language means that the full contour of the legislation cannot be assessed. ● There is no recognition of privacy or other Charter-protected rights in Bill C-26 as a counterbalance to the proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.8 7.

These thematic deficiencies relate to the effectiveness of the government’s cybersecurity strategy as well as to potential risks to Charter-protected rights. Like the Canadian Radio-television and Telecommunications Commission (“CRTC”), the federal government itself must act in a manner that is consistent with the Charter when regulating in respect of telecommunication services and cybersecurity. 8. Following the publication of Dr.

Parsons’ report in October 2022 (including his recommendation that the federal government table a Charter statement in relation to Bill C-26), the federal government tabled its Charter Statement in the House of Commons on December 14, 2022. The non-exhaustive statement identifies areas where Charter-protected rights are engaged by Bill C-26. The statement, however, does not fully address relevant Charter-related issues linked to Bill C-26.

In the following paragraphs (9-15 and 17-32) I raise additional Charter issues to, first, support the amendments proposed in this brief, second, 7 Finding You, at p. 32. 8 Cybersecurity Will Not Thrive in Darkness, supra at p. 4.

4 to underscore the importance of bringing a human rights and human security approach to cybersecurity and the regulation of telecommunications services. Freedom of Expression and

Section 2(

b) of the Charter 9. The current draft of Bill C-26’s excessive secrecy and confidentiality provisions jeopardizes the right to freedom of expression under

section 2(

b) of the Charter. The government’s Charter statement focuses on the speech of the commercial entities who will be directly regulated under Bill C-26. The Charter statement posits that because restrictions on commercial speech do not tend to implicate the core values of

section 2(b), restrictions can be more easily justified.9 However, this analysis does not account for how individuals’ Charter rights may be impeded under the current drafting of the legislation, failing to distinguish between commercial actors and their users. The excessive secrecy and confidentiality provisions in the bill also restrict the public’s and media’s expressive freedom in Canada. 10. The principles of open courts and open government are derivative components of

section 2(

b) of the Charter (the freedom of expression provision). The open court principle requires that court proceedings, including judicial reviews in federal court, presumptively be open and accessible to the public and to the media. Access to information about government actions can also arise as a derivative right to

section 2(b), if a denial of access to government information effectively precludes meaningful public discussion on a matter of public interest. Where restrictions on access substantially impede meaningful discussion and criticism about matters of public interest, the government must reasonably justify its infringement of the freedom of expression.10 11. Telecommunications and cybersecurity law and policy is undoubtedly a matter of public interest. There is a close nexus between human rights and public policy concerning the regulation of telecommunication services.

Canada’s telecommunications policy is intimately linked with the “social and economic fabric” of Canada and its regions.11 Equitable access to telecommunication services is sometimes described as a mechanism for “digital self-determination”, which speaks to the need to protect the potential for human flourishing in the digital era.12 12. The recent Citizen Lab report, Finding You, highlights several ways in which excessive secrecy surrounding telecommunications oversight has itself endangered the public.

The authors note historical deficiencies in oversight and accountability of network security, which have led to geolocation-related threats associated with contemporary networks. Excessive secrecy has contributed to the persistence of the “low-hanging geolocation threat” identified in Finding You: 9 Department of Justice Canada, “Charter Statement: Bill C-26:

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts”, December 14, 2022. 10 Ontario (Public Safety and Security) v. Criminal Lawyers' Association, 2010 SCC 23; ARPA Canada and Patricia Maloney v R., 2017 ONSC 3285. This inquiry involves a balancing of any countervailing considerations (such as a privilege) that might militate against disclosure. 11 Telecommunications Act, S.C. 1993, c. 38, at s. 7(a). 12 See Nydia Remolina and Mark James Findlay, “The Paths to Digital Self-Determination - A Foundational Theoretical Framework”, (April 22, 2021) SMU Centre for AI & Data Governance Research Paper No. 03/2021.

5 Decades of poor accountability and transparency have contributed to the current environment where extensive geolocation surveillance attacks are not reported. This status quo has effectively created a thriving geolocation surveillance market while also ensuring that some telecommunications providers have benefitted from turning a blind eye to the availability of their network interconnections to the surveillance industry.13 13.

The geolocation surveillance threats discussed in Finding You disproportionately jeopardize human rights defenders and other individuals who face heightened risks of targeted security threats (e.g., corporate executives, military personnel, politicians and their staff, senior bureaucrats, etc).

Industry has historically charged large amounts of money to receive information about well-known industry threats, with the effect of impeding non-industry groups such as security researchers and civil society from obtaining and disseminating information about the nature of the threats faced by at-risk individuals, or from advocating for the remedies that would benefit the security and privacy of civil society.

The authors note that, in many instances, individuals cannot determine whether their own telecommunication provider has “deployed and configured security firewalls to ensure that signaling messages associated with geolocation attacks, identity attacks, or other malicious activity are not directed towards their phones.”14 14.

Citizen Lab’s research highlights the substantial public interest in enabling the media, security researchers, civil society, and the public (including individuals facing heightened security risks) to access information about telecommunications policies and regulations, and the nature of the security risks that persist in whole or in part.

As security researchers have noted, “the most promising route to full accessibility [in cybersecurity] lies in collaboration between vendors, advocacy groups, and the government.”15 This collaboration is facilitated by “discourse involving cyber security professionals, human-centred security academics, disability charities and other stakeholders.”16 Civil society and the broader business community can press “regulators, policy makers, and politicians to actively compel telecommunications providers to adopt appropriate security postures to mitigate the pernicious and silent threats associated with geolocation surveillance,”17 and other similar security risks. 15.

While some confidentiality will be appropriate to ensure that unresolved security vulnerabilities are effectively brought into control, certain powers in Bill C-26 go further than what is required to accomplish cybersecurity and national security objectives. Furthermore, certain powers proposed are unaccompanied by reasonably available measures to protect the public’s interest in access to information concerning this important area of government action. As drafted,

section 15.9 would also impose mandatory limits on open court principles, which would prevent judges from exercising judicial discretion in balancing the need for secrecy or confidentiality with the public’s interest in disclosure. As 13 Finding You, supra at p. 32. 14 Finding You, supra at p. 32. 15 Karen Renaud and Lizzie Coles-Kemp, “Accessible and Inclusive Cyber Security: A Nuanced and Complex Challenge”, SN Computer Science (2022) 3: 346, at p. 2 of 14. 16 Ibid. 17 Finding You, supra at p. 33.

6 noted at paragraph 10 in this submission, the Charter protects open court principles that apply in the context of judicial review, including Charter protections for the freedom of expression. 16. In light of unresolved deficits concerning excessive secrecy or the absence of accountability provisions, I recommend the following: a. Recommendation 1: Non-Disclosure Orders Should Be Time Limited.

Bill C-26 proposes gag provisions with respect to Orders in Council or Ministerial Orders, which are not limited either temporally (i.e., how long is secrecy necessary?) or substantively (i.e., what circumstances justify secrecy?). As noted at paragraph 10, non-disclosure orders affect not only the recipient of the gag order but, also, the public’s right to information that informs meaningful democratic debate. The legislation should be amended to include time constraints surrounding non-disclosure orders.

If the Minister requires additional time beyond the time limit, I agree with the Joint Civil Society Senate Submission on Bill C-26 that the government should be required to obtain a federal court order to authorize any further extension of the non-disclosure order.18 b. Recommendation 2: The Circumstances Purporting to Justify Confidentiality in a Non-Disclosure Order Should Be Defined In The Legislation.

Given the important and adverse free expression consequences of excluding the public from access to orders, the legislation should specify what grounds justify secrecy surrounding the issuance of a non-disclosure order.

For example, in the judicial review proceedings under Bill C-26, disclosure is limited in circumstances where it would be “injurious to international relations, national defence or national security or endanger the safety of any person.” In contrast, there are no limits to the circumstances in which non-disclosure orders could be imposed, leaving it open to government officials who would prefer to avoid public scrutiny and democratic accountability. c. Recommendation 3:

Section 15.9 Should Be Amended To Ensure The Judge Retains Authority To Balance The Public Interest In Disclosure Against The Interest In Confidentiality: In general, mandatory limits on open courts (which prevent the judge from balancing the public interests at stake), are found to be excessive infringements on

section 2(

b) rights.19 For example, even in analogous provisions of the Canada Evidence Act (permitting secrecy in judicial proceedings for matters injurious to international relations, national defence or national security or endanger the safety of any person), the judge retains the authority to determine that “the public interest in disclosure outweighs in importance the public interest in non-disclosure”. The same safety valve should be incorporated into

section 15.9 of Bill C-26, in order to ensure that any limits to openness minimally impair freedom of expression. 18 Joint Civil Society Senate Submission on Bill C-26, at p. 8. 19 See Kent Roach and David Schneiderman, “Freedom of Expression in Canada”, (2013) 61 S.C.L.R. (2d) at p. 488 (“Although the courts have generally been inclined to strike down mandatory bans on access to the courts, they also have been more deferential to bans that give judges discretion to restrict access to the courts and freedom of expression”).

7 d. Recommendation 4: Where Summaries Are Provided Of Evidence And Information Received By The Court, Pursuant To

Section 15.9(1)(C), These Summaries Should Be Available To Both The “Applicant and the Public”. As noted at paragraph 10, the open court principle protects the public’s and the media’s interest in the openness of court proceedings. Practically speaking, the public’s right of access to judicial summaries of this nature is typically accomplished by marking such summaries filed as an exhibit to the proceedings. The public’s right of access to exhibits is a corollary of the open court principle. e.

Recommendation 5: The Triggering Threshold Justifying Limits On The Openness Of The Proceedings Should Not Be Higher Than That Which Is Already Contained Under Analogous Provisions Of The Canada Evidence Act.20 In that regard, we recommend mirroring the language from the Canada Evidence Act through the following amendment:

Section 15.9(1)(a) “...if, in the judge’s opinion, the disclosure of the evidence or other information could would be injurious to international relations, national defence or national security or endanger the safety of any person”. Privacy Impacts and

Section 8 of the Charter 17. Bill C-26 proposes several new information collection and sharing powers, and may include the collection or sharing of personal information in the possession of telecommunication and critical infrastructure providers. Many of these powers are insufficiently bounded or defined. The privacy risks posed by the powers are heightened by the absence of important accountability and oversight mechanisms. The breadth of the information collection and sharing powers heightens the considerable risk that the legislation, if passed as drafted, would unreasonably interfere with

section 8 of the Charter. Chief among Bill C-26’s constitutional deficits is its proposal to grant the Minister of Industry an unprecedented new collection power to demand highly sensitive personal information from telecommunications and critical infrastructure providers in Canada without prior judicial review and approval. 18. A linchpin of

section 8’s protection is to safeguard privacy by requiring adequate accountability and review mechanisms to accompany information collection powers. Collection powers must also be reasonable and justified. Without clearly defined and reasonable safeguards, legislation that authorizes intrusions on reasonably held expectations of privacy is inconsistent with s. 8 of the Charter. 19. By way of background, after Bill C-26 was tabled, the Department of Justice published its Charter statement that took the position that Bill C-26 does not interfere with

section 8, in part as a result of the fact that the “the information being gathered and shared in this context relates to the technical 20 See Canada Evidence Act, R.S.C., 1985, c. C-5., at s. 38 to 38.15.

8 operations of TSPs, which are commercial entities”, as opposed to “personal biographical information that attracts a heightened privacy interest.”21 20. However, Bill C-26 does not limit the Minister’s collection powers to only technical information. Rather,

section 15.4 would provide authority to compel “any person” to provide “any information” under “any conditions that the Minister may specify,” so long as the Minister believes it is relevant to its order making powers—an exceedingly low threshold.22 21. The telecommunication operators at issue in Bill C-26 are conveyers of the most private information known to our legal system.

As the Privacy Commissioner of Canada emphasized during testimony on Bill C-26,23 the legislation could result in the inappropriate sharing of subscriber account information, communication data, website visits, metadata, location data and financial data. There is no reasonable dispute that these information sources carry significant privacy interests. This reality has been confirmed by the Supreme Court repeatedly and the government is extremely well aware of the strong constitutional privacy interest individuals have in this data.24 22.

In other words, the potential privacy impacts of Bill C-26 are far more significant than those that were analyzed by the Department of Justice in its Charter statement when it concluded that the Department had identified no constitutional deficiency in Bill C-26 in relation to

section 8 of the Charter. As a matter of law, the proposed power is also presumptively unreasonable–and thus presumptively contrary to

section 8 of the Charter–because it would authorize the collection of information that is subject to a reasonable expectation of privacy without prior independent judicial authorization.25 23. Following its study by SECU,

Part I of Bill C-26 now provides some statutory protection to personal and de-identified information as “confidential information.” However, this amendment does not adequately address the significant constitutional problems in the legislation.

Section 15.4 of Bill C-26 would give the Minister of Industry an unprecedented, warrantless power to collect telecommunications data, and to share this information widely across the federal government–including with Canadian Security and Intelligence Service (CSIS) and the Communications Security Establishment (CSE).

Although the legislation stipulates that the powers do not authorize the interception of private communications (section 15.2(2.2)), telecommunication providers host volumes of sensitive personal information that could be collected in circumstances that do not meet the technical definition of an intercept of a private communication. Information does not in any way need to meet the definition of private communications 21 Department of Justice Canada, “Charter Statement: Bill C-26:

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts”, December 14, 2022. 22 Following amendments during SECU’s study of the legislation, Bill C-26 now expressly acknowledges its potential to capture “personal and de-identified information”, which is now included in the definition of confidential information under

Part I (section 15.5(1)(d)). 23 SECU proceedings on Bill C-26, Testimony of the Privacy Commissioner of Canada Phillipe Dufresne, February 15, 2024. 24 See, e.g., R. v. Jones, 2017 SCC 60; R. v. Spencer, 2014 SCC 43; R. v. Bykovets, 2024 SCC 6. 25 Hunter et al. v Southam Inc., [1984] 2 SCR 145.

9 in order to engage

section 8 protection under the Charter, and as a result the bill is manifestly under-inclusive. 24. The collection and use of information by security and intelligence agencies about Canadians or persons in Canada is a core matter of public and constitutional concern. Only a few years ago, Canada’s national security laws underwent a massive overhaul in the National Security Act, 2017.26 In this comprehensive law reform package, Parliament attempted to strike an equilibrium concerning the need for carefully calibrated protections and constraints surrounding the collection of information in Canada.

Protections and limitations vary significantly between security and intelligence bodies. The “mandates of Canada’s different security and intelligence agencies…matter enormously in deciding the lawfulness of a given investigative activity.”27 The CSE, for example, is prohibited from directing its activities at Canadians or people in Canada, and there are a series of mechanisms that seek to balance the constitutionally-protected interests engaged by the CSE’s mandate and powers. In contrast, CSIS is mandated to collect threat-related information and intelligence from within Canada.

However, CSIS is obligated to obtain federal court approval to obtain data that carries a reasonable expectation of privacy from telecommunications providers in Canada.28 25. In many important areas, the constitutionality of Canada’s post-2017 national security laws have not yet been reviewed or determined by Canadian courts. This is particularly notable given many of the reforms that are now enacted under the National Security Act, 2017 are controversial and were the subject of intense public debate. Since the law passed in 2019, public debate and scrutiny continues to be warranted.

Among many examples of its kind, a Federal Court ruling publicly released in early 2024 expressed serious concerns regarding revelations of inappropriate information sharing of Canadians’ personal information in circumstances involving both the CSE and CSIS.29 The Court was critical of CSIS’ lack of candor with the court on repeated occasions, stating that the “failing goes to the heart of CSIS’s relationship with the Court.”30 The Federal Court noted that this is not the first type of ruling of its kind in recent years.31 26 National Security Act, 2017, S.C. 2019, c. 13. 27 Craig Forcese and Leah West, National Security Law (Canada: Irwin Law, 2020) at p 387. 28 Canadian Security Intelligence Service Act, R.S.C., 1985, c.

C-23, s. 21 (and related amendments following the recent passage of Bill C-70,

An Act respecting countering foreign interference). 29 Canadian Security Intelligence Service Act (CA) (Re), 2023 FC 1341. 30 Ibid at para. 7. 31 Citing Canadian Security Intelligence Services Act (CA) (Re), 2020 FC 616 at paras 83-85, 91-100 and 167 (another decision where CSIS failed to disclosure an issue concerning information that had been potentially illegally collected).

The Court concluded: “The evidence indicates that the issue of potential illegality was widely known within the circle of those organizations and institutions that play a role in the oversight or management of CSIS operations….Despite this widespread knowledge and the potential relevance the issue of illegality had in the context of warrant applications, the matter was never brought to this Court’s attention.

This is inexcusable, particularly where there was a heightened awareness of the import of the duty of candour and ongoing engagement between the Court, the Service and the Department of Justice in the aftermath of the Associated Data decision and the Segal Report. It appears only the Court was left in the dark” (at para. 168).

10 26. Ever since its inception, the National Security Intelligence Review Agency (NSIRA) has reported chronic problems in reviewing the lawfulness of the CSE's activities, including challenges in securing agreement from the CSE to furnish NSIRA with the information required to review the lawfulness of the CSE’s activities.32 The most recent annual report continues to report “significant challenges in accessing CSE information on this review,” which compromised NSIRA’s ability to have confidence “in the completeness of information provided by CSE.”33 27.

In a report that was publicly released on March 27, 2024,34 NSIRA has also raised serious concerns regarding CSIS’ handling of datasets concerning Canadians and persons in Canada.

Among other findings, NSIRA found that “CSIS’s current application of the dataset regime is inconsistent with the statutory framework,” that “CSIS has failed to adequately operationalize the dataset regime”, and when confronted with concerns from the Federal Court about the breadth of CSIS’ datasets, CSIS “did not seek to clarify legal ambiguities of the application of the regime before the Court when given the opportunity to do so.” 28. Of particular import, NSIRA raised concerns that “CSIS’s current approach to dataset information collection under

section 12 risks the creation of a parallel collection mechanism, one that weakens s. 12’s statutory thresholds and simultaneously lacks the external oversight regime intended to protect personal information under the dataset regime.”35 29.

Against this backdrop, lawmakers should be cautious when considering whether additional new powers are appropriate or necessary under Bill C-26, particularly given the failure of Bill C-26 to ensure that the Federal Court continues to play a critical role in reviewing and authorizing government requests for telecommunications data that is subject to a reasonable expectation of privacy.

Independent judicial, quasi-judicial, or expert review institutions enable Parliament to play a vital role in ensuring that Canada’s laws are adequate to hold government agencies to account and to protect the constitutional rights of all people in Canada. NSIRA was created to act as an independent and external review body that reports to Parliament. As a corollary, it is important for Parliament to be sensitive and responsive to its reported findings. 30.

Despite the precarity of the current equilibrium in Canadian national security law, Bill C-26 would only destabilize the existing circumstances further by creating a new information collection and sharing portal between telecommunication providers, the Minister of Industry, and Canada’s national security bodies.

The information sharing channel opened in Bill C-26 would appear to do indirectly what CSIS and 32 Christopher Parsons, “Don’t give more powers to CSE until it submits to effective review”, Policy Options, November 29, 2022, citing NSIRA’s 2020 and 2021 annual reports which call attention to the CSE’s continued resistance to providing NSIRA with information that NSIRA considers to be necessary for NSIRA to review the lawfulness of the CSE’s activities. 33 National Security and Intelligence Review Agency, Annual Report 2022, tabled in Parliament on October 30, 2023. 34 National Security and Intelligence Review Agency, NSIRA Review of CSIS Dataset Regime, published on March 27, 2024. 35 These risks are now amplified given new statutory amendments to CSIS’ enabling statute that were pushed through Parliament under Bill C-70.

11 the CSE are not authorized to do directly,36 and fails to clearly establish a role for the Federal Court in reviewing and authorizing any collection of information from telecommunication providers that is subject to a reasonable expectation of privacy. The concern that the government agencies like the CSE will use and repurpose information it receives through Bill C-26 into its other intelligence activities is not speculative.

As noted in the Joint Civil Society Senate Submission on Bill C-26,37 testimony of the Director General of Strategy Policy at the CSE confirmed the agency's interest to use information collected through new powers under Bill C-26 for purposes beyond its cybersecurity and information assurance mandate.38 31.

In its Charter statement on Bill C-26, the Department of Justice asserts that privacy interests are diminished in “regulatory and administrative contexts.” However, as noted above, the Department of Justice had assumed that Bill C-26 focuses on collecting “technical” information, as opposed to “personal biographical information that attracts a heightened privacy interest.”39 While it may be the case that commercial actors in “heavily regulated spheres of activity” have “diminished” privacy expectations, the privacy interests of the individuals who depend upon telecommunication and critical infrastructure services are not in any way diminished. 32.

Moreover, the information collection and sharing powers proposed in Bill C-26 are far from a typical example of the “regulatory” schemes that have been examined in the Canadian courts. In substance, Bill C-26 is reforming Canada’s national security laws and powers, and will potentially impact the privacy interests of millions of people across Canada—people who are not “regulated” companies. Prior judicial approval from the Federal Court must be required to obtain information that is the subject of a reasonable expectation of privacy, with provision for exigent circumstances in emergency circumstances.

This is a key reason why Bill C-26’s warrantless collection powers are presumptively unreasonable under the Charter. Even if this were an ordinary regulatory scheme, the Supreme Court still underscores that “[w]hile less exacting review may be sufficient in a regulatory context, the availability and adequacy of review is nonetheless relevant to reasonableness under s. 8.”40 36 As noted, CSIS is obliged to obtain Federal Court authorization to obtain information that is subject to a reasonable expectation of privacy from telecommunication providers: Canadian Security Intelligence Service Act, R.S.C., 1985, c.

C-23, s. 21 (and related amendments following the recent passage of Bill C-70). For its part, when acting in accordance with its cybersecurity and information assurance mandate, the CSE is not authorized to intentionally seek data concerning Canadians or persons in Canada, or to direct its information-acquisition activities towards Canadians or persons in Canada: Communication Security Establishment Act, S.C. 2019, c. 13, s. 76, s. 23 (see also ibid at s. 22 (1) and (2). 37 Joint Civil Society Senate Submission on Bill C-26, at p. 17-18. 38 SECU proceedings on Bill C-26, Testimony of Mr.

Stephen Bolton (Director General, Strategic Policy, Communications Security Establishment), April 8, 2024. 39 Department of Justice Canada, “Charter Statement: Bill C-26:

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts”, December 14, 2022. 40 Goodwin v. British Columbia (Superintendent of Motor Vehicles), 2015 SCC 46 at para 71. See R. v. Tse, 2012 SCC 16 at paras. 83-85; Wakeling v. United States of America, 2014 SCC 72 at para. 70; T.L. v. British Columbia (Attorney General), 2023 BCCA 167 at paras. 171-173 and 237.

12 33. To impose more appropriate guardrails on the proposed powers to share information within and beyond Canadian agencies, I recommend the following amendments, which build on the recommendations of Dr. Parsons from Cybersecurity Will Not Thrive in Darkness41: a. Recommendation 6: Prior Judicial Approval Must be Required for the Government to Obtain Personal or De-Identified Information from a Telecommunications Provider.

The legislation should be amended such that before the government can compel a telecommunications provider to disclose personal or de-identified information,42 it must first obtain judicial authorization from the Federal Court. This amendment is critical to address constitutional deficits in the current draft of Bill C-26. As noted above, telecommunication providers host information that is among the highest level of privacy protection that our legal system affords. Judicial oversight is vital to the protection of this information under

section 8 of the Charter. b. Recommendation 7: Information Obtained from Telecommunications Providers Should Only be Used by Government Agencies for Cybersecurity and Information Assurance Activities. Information should not be used for the purposes of signal intelligence and foreign intelligence activities, cross-department assistance unrelated to cyber-security, or active or defensive cyber operations. These restrictions should apply to all agencies. c. Recommendation 8: The Collection And Sharing Of Personal Information Should Be Limited By Both Necessity And Proportionality Requirements.

Several witnesses testified before SECU about the importance of including both necessity and proportionality as guardrails under Bill C-26. In response, an official from the Department of Industry testified about areas where proportionality may already be present in existing law governing administrative decision-making or constitutional law.43 However, those are distinct matters at law, which do not obviate or foreclose the need for requiring proportionality as a limiter of a significant statutory power.

For example, under the Communications Security Establishment Act, the minister cannot issue a cybersecurity authorization unless the minister “concludes that there are reasonable grounds to believe that any activity that would be authorized by it is reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities.”44 41 For comparison, Recommendations 6, 7, 9, 11, and 12 in this

section are found in Recommendations 29, 16, 13, 14, 17, 18, and 20 of Cybersecurity Will Not Thrive in Darkness. 42 As noted in previous Citizen Lab research, “[e]ven when personal information has been de-identified or aggregated, it can be possible to re-identify individuals by way of drawing inferences or correlations from the data or by overlaying it with known personal information”: Amanda Cutinha and Christopher Parsons. “Minding Your Business: A Critical Analysis of the Collection of De-identified Mobility Data and Its Use Under the Socially Beneficial and Legitimate Interest Exemptions in Canadian Privacy Law,” Citizen Lab Research Report No. 161, University of Toronto, November 22, 2022. 43 SECU proceedings on Bill C-26, Testimony of Andre Arbour, Director General, Strategy and Innovation Policy Sector, Department of Industry, March 18, 2024. 44 Communication Security Establishment Act, S.C. 2019, c. 13, s. 34(1).

13 Furthermore, the SECU committee did not table or vote on an amendment that would specifically apply necessity and proportionality standards for the collection and sharing of personal information.45 In testimony before the SECU committee, the Privacy Commissioner of Canada emphasized the importance of requiring both necessity and proportionality to ensure powers are minimally-intrusive on privacy interests.46 Requiring necessity and proportionality in the context of information sharing would protect persons who depend on telecommunication services in Canada, and who would be indirectly impacted by Bill C-26’s regulatory framework.

To that end, I recommend the following textual amendments: §

Section 15.4: The information collection power under s. 15.4 should incorporate necessity and proportionality requirements. §

Section 15.6(1): “Despite

section 15.5, to the extent that is necessary and proportionate for any purpose…” §

Section 15.5(3)(c): The same amendment (“necessary and proportionate”) should be added to

section 15.5(3)(c). d. Recommendations 9: Data Retention Periods Should Be Attached to Telecommunications Providers’ Data and to Foreign Disclosures of Information. The legislation should be amended to highlight that confidential information may be retained only for as long as necessary to make, amend, or revoke an order under

section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or to verify the compliance or prevent non-compliance with such an order or regulation. Similarly, an amendment should also require that the government attach data retention and deletion clauses in agreements or memoranda of understanding that are entered into with foreign agencies. Retention periods should be communicated to the affected telecommunications providers. e. Recommendation 10: Consent should only be obtained from the person to whom the information relates.

Section 15.5(3)(

b) allows for the disclosure of confidential information with the consent of the person who designated the information as confidential. However, now that an amendment was made during the SECU Committee study of Bill C-26 to add personal and de-identified information to the scope of “confidential information”,

section 15.5(3)(

b) should be amended to address the specific circumstances of personal and de-identified information. This is a positive change, and should be further accompanied by clarification of the consent provision attached to confidential information. Particularly given the provision of alternative disclosure mechanisms under

section 15.5(3(

a) and (c), it would be concerning if the legislation were to allow telecommunication operators to “consent” on behalf of users to the sharing of highly sensitive information with other government agencies, including those under 45 The SECU did consider a related amendment that would have included language under the new sections 15.1(1.1) and 15.2(2.1) to ensure that Orders in Council and Ministerial Orders are proportionate to the gravity of the threat of interference, manipulation, disruption or degradation: SECU proceedings on Bill C-26, March 18, 2024. 46 SECU proceedings on Bill C-26, Testimony of the Privacy Commissioner of Canada Phillipe Dufresne, February 15, 2024.

14 the purview of the Minister of Public Safety and Emergency Preparedness (e.g., Royal Canadian Mounted Police and Canadian Security Intelligence Service) and the Minister of National Defence (e.g., Canadian Armed Forces and Communications Security Establishment). As the Supreme Court has reiterated, consent to waive the constitutional right to privacy cannot be given by a third party,47 including by telecommunication providers in respect of their user’s private data.48 This amendment could be affected by either excluding personal or de-identified information from

section 15.5(3)(b), or by amending the provision as follows: “...the person who designated the information as confidential consents to its disclosure, or in the case of personal or de-identified information, the person to whom the information relates consents to its disclosure.” f. Recommendation 11: Relief Should Be Available If Government Mishandles Confidential Information.

The legislation should be amended to enable individuals and telecommunications providers to seek relief should the government or a party to whom the government has disclosed confidential, personal, or de-identified information loses control of that information, where that loss of control has material consequences for the individual, or for a telecommunication provider’s business or technical operations. g. Recommendation 12: Legislation Should Better Delimit the Conditions Wherein a Private Organization’s Information Can Be Disclosed. As drafted,

section 15.7(1) appears to set an excessively low threshold for disclosing information to foreign governments to address unspecified threats that are not set out in the legislation. The threshold does not include any reasonableness, necessity, or proportionality criterion. As Dr.

Parsons analyzed, the “conjoined use of ‘believes’ and ‘may be’ suggests that the possible threshold that must be met prior to disclosing information is not particularly high.”49 Further, the use of “including” in the current draft legislation “does not tightly delimit what is meant by ‘securing’ a Canadian or foreign telecommunications system.”50 Proposed textual amendments are found on page 30 of Cybersecurity Cannot Thrive in the Darkness (Appendix A to this brief). 47 R. v. Cole, [2012] 3 S.C.R. 34. 48 R. v.

Spencer, 2014 SCC 43. 49 Christopher Parsons, “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act,” Citizen Lab Research Report No. 158, University of Toronto, Oct. 2022, at p. 40. 50 Ibid.

Part 4. Encryption-breaking powers in Bill C-26 that undermine the security of Canada’s networks 34. This

Part 4 recommends that an interpretive clause be added to s. 15.2 to confirm that its powers cannot be used to “compromise the confidentiality, availability, or integrity of a telecommunications facility, telecommunications service, or transmission facility.” As

Part 4 outlines, this amendment is intended to address a core cybersecurity danger that the broad powers under s. 15.2 of Bill C-26 might be used to issue orders that weaken the encryption standards in telecommunication networks.51 Particularly given the federal government has stated that the intent of Bill C-26 is to better protect the security of Canada’s networks, this amendment is critical to ensure that the broad powers under s. 15.2 are not implemented in a manner that has the opposite effect of undermining network security.

This amendment is also recommended in the Joint Civil Society Senate Submission on Bill C-26 (Recommendation #1). 35. In 2022, the federal government announced a move to block telecom equipment from Huawei and ZTE, citing the “cascading economic and security impacts”52 that a supply chain breach would endanger. The government cited concerns that Huawei or ZTE might be “compelled to comply with extrajudicial directions from foreign governments.”53 And yet, Bill C-26 would provide Canadian officials with the same authority that the government has publicly condemned.

If a non-amended Bill C-26 passes, all telecom providers in Canada would be compellable through secret orders to install backdoors inside Canada’s networks by weakening encryption or network equipment. Specifically, the broad language in subsections 15.2(2)(c), (l), and (

m) could be used to order Canadian telecommunications companies to install lawful-access related measures in encrypted components of Canada’s telecommunication networks. 36. For example,

section 15.2(2)(

l) states that the Minister can issue an order requiring “that a telecommunications service provider implement specified standards in relation to its telecommunications services.” This could include requiring telecommunication providers to alter the 5G encryption standards that protect mobile communications,54 in order to allow the government to have greater visibility over communications data. The telecommunications industry in Canada agrees. In testimony before the SECU Committee, Eric Smith, Senior Vice-President of the Canadian 51 Analysis in this

Part 4 is developed from: Kate Robertson and Ron Deibert, “Ottawa wants the power to create secret backdoors in our networks to allow for surveillance”, The Globe and Mail, May 29, 2024. 52 Innovation, Science and Economic Development Canada, “Policy Statement – Securing Canada’s Telecommunications System”, May 19, 2022. 53 Ibid. 54 3GPP, “SA WG3 - Security and Privacy”, online: <https://www.3gpp.org/3gpp-groups/service-system-aspects-sa/sa-wg3>, (accessed on October 15, 2024).

16 Telecommunications Association likewise warned that the “very broad” powers under Bill C-26 could be used to weaken encryption.55 37. Encryption standards in 5G safeguard a web of connection points surrounding our mobile communications, and protect users from man-in-the middle attacks exposing users to location tracking, and the interception of text and voice communications.

Compromising these standards would increase the attack surface for malicious threats to the privacy and security of all network users, including Canada’s most senior officials.56 New vulnerabilities would also compromise cloud-connected smart devices like cars, home CCTV, or pacemakers,57 and satellite-based services like Starlink.58 38. Despite several witnesses warning the government that Bill C-26 might actually facilitate new government powers to compel decryption in telecommunications standards, the government has pushed the bill forward without debate or amendment to fix the problem.

The government’s push to do so raises concerning questions, particularly given the government has publicly stated that the intent of the legislation is not to create a new “surveillance mandate.”59 39. Creating powers to drill holes in telecom encryption standards would only entrench or worsen cybersecurity threats into Canada’s networks. Today, many network insecurities persist reaching all the way down to the infrastructure layers of communication technology.

The Signalling System No. 7 (SS7), developed in 1975 to route phone calls, has become a major source of insecurity for mobile phones.60 In 2017, CBC reporting showed how hackers would have only needed a Canadian MP’s cell phone number in order to intercept his movements, voicemails, text messages, and phone calls.61 Little has since changed. As noted earlier in this brief, a 2023 report from the Citizen Lab documents the pervasive vulnerabilities at the heart of the world’s mobile networks.62 40.

To address critical vulnerabilities, the federal government should be demonstrating leadership by mandating that network operators adopt the full array of security features that are available in 5G standards and equipment, including all encryption-capabilities accompanying 5G, and eventually 6G, technology–without compromise.63 However, instead of patching holes, Bill C-26 would give the 55 SECU proceedings on Bill C-26, Testimony of Eric Smith, Senior Vice-President, Canadian Telecommunications Association, March 18, 2024 56 Catherine Cullen & Brigitte Bureau, “Someone is spying on cellphones in the nation's capital”, CBC News, April 3, 2017. 57 Canadian Centre for Cyber Security, “Cyber security considerations for 5G networks - ITSAP.80.116”, September 2022. 58 Canadian Centre for Cyber Security, “Satellite communications - ITSAP.80.029”, March 2023. 59 SECU proceedings on Bill C-26, Testimony of Member of Parliament Jennifer O’Connell, April 8, 2024. 60 Bill Marczak, John Scott-Railton, Siddharth Prakash Rao, Siena Anstis, and Ron Deibert, "Running in Circles: Uncovering the Clients of Cyberespionage Firm Circles," Citizen Lab Research Report No.133, University of Toronto, December 2020. 61 Brigitte Bureau, Catherine Cullen, & Kristen Everson, “Hackers only needed a phone number to track this MP's cellphone”, CBC News, November 24, 2017. 62 Gary Miller and Christopher Parsons. “Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure,” Citizen Lab Research Report No. 171, University of Toronto, Oct. 2023. 63 Ibid at

Part 5 and p 33.

17 government the power to infect next-generation cybersecurity tools with old diseases. In doing so, the government is empowering itself to be the sole arbiter of when, and on what conditions, Canadians deserve security for their most confidential personal, business, religious, or other communications. 41. Compromising network encryption would be a boon for cybercrime actors.

According to a 2020 technical report produced by the International Telecommunication Union (ITU)—acting through the Financial Inclusion Global Initiative (a partnership between the ITU, the World Bank, and the Committee on Payments and Market Instructure)—malicious actors routinely exploit telecom vulnerabilities to perpetrate financial fraud online: Telecom vulnerabilities enable criminals to perform various attacks that result in fraud to steal digital money; many of these attacks involve the attacker masquerading as the [digital financial services (DFS)] provider to fraud the end-user or the attacker masquerading as the end-user to fraud the DFS provider.

In all these cases, the attacker uses telecom vulnerabilities to pass authentication and perform actions on compromised accounts.64 42.

Fraud actors can use a variety of attacks to circumvent two-factor authentication, gain unauthorized access to online bank accounts, or to harvest sensitive data that is then repurposed to generate more sophisticated phishing attacks.65 The ITU notes that “[e]xploiting these vulnerabilities enables attackers to commit fraud and steal funds from unsuspecting victims, who in most cases are unaware their account is being compromised or hacked.”66 The report states that it is a “misconception” that these attacks are difficult to perpetrate: “today, every hacker with ~$500 … to spare can exploit cellular vulnerabilities.”67 43.

According to recent estimates, only a “quarter of mobile network operators worldwide have deployed a signaling firewall that is designed to impair geolocation surveillance.68 In a survey conducted by the European Union Agency for Network and Information Security (ENISA), approximately 75% of EU-based operators stated in a survey “that cost is the inhibiting factor in implementation, ... and the lack of regulation mandating it.”69 For this reason, the Finding You report recommends that legislators and 64 Financial Inclusion Global Initiative, Security, Infrastructure and Trust Working Group, Technical report on SS7 vulnerabilities and mitigation measures for digital financial services transactions (International Telecommunications Union, 2020), at p 9. 65 Ibid at p 11 and 14. 66 Ibid at p 9. 67 Ibid at p 13. 68 Finding You, at p 2, citing Mobileum, Mobilesquared, The State of the Signaling Firewall Landscape, November 2021, <https://www.mobilesquared.co.uk/wp-content/uploads/2023/04/Mobileum_Security-Research_Nov21-FINAL-VERSION.pdf>.

A survey of EU-based network operators by the European Union Agency for Network and Information Security (ENISA) also found that only 28% of operators have implemented signalling firewalls: ENISA, Signalling Security in Telecom: SS7/Diameter/5G EU level assessment of the current situation, March 2018, <https://www.enisa.europa.eu/publications/signalling-security-in-telecom-ss7-diameter-5g>. 69 Financial Inclusion Global Initiative, Security, Infrastructure and Trust Working Group, Technical report on SS7 vulnerabilities and mitigation measures for digital financial services transactions (International Telecommunications Union, 2020), at p 17, citing ENISA, Signalling Security in Telecom: SS7/Diameter/5G EU level assessment of the current situation,

18 regulators be attentive to whether mobile industry participants in their jurisdictions “are engaged in questionable business practices that endanger individuals’ security, privacy, and consumer rights” or whether they are “prioritizing revenues over protecting their subscribers.”70 44.

In proceedings in the House of Commons, the government emphasized that a core objective behind Bill C-26 is to give the government authority “to prohibit Canadian telecommunications service providers from using products and services from high-risk suppliers, such as Huawei and ZTE, if required and after consultation.”71 However, Canada’s cybersecurity framework should not be driven by a selective focus on individual vendors or operators, and should instead prioritize robust and vendor-neutral security standards that apply across all of Canada’s networks.

To this end, the government should not itself be empowered to compel network operators to compromise the integrity of those very security standards. 45. Unfortunately, history is rife with examples of government backdoors exposing individuals to deep levels of cyber insecurity.72 While backdoors may be intended for government surveillance, access points installed in encrypted network elements can be exploited by law enforcement agencies, criminals, and foreign state rivals alike. Interception equipment relied upon by governments has often been shown to have significant security weaknesses.73 46.

As a recent and devastating example, on October 5, 2024, the Wall Street Journal reported a potentially “catastrophic security breach” caused by a hacking group linked to the People’s Republic of China, which “penetrated the networks of a swath of U.S. broadband providers, potentially accessing information from the systems the federal government uses for court-authorized network wiretapping requests.”74 The “hackers appear to have engaged in a vast collection of internet traffic from internet service providers that count businesses large and small, and millions of Americans, as their customers.”75 47.

On October 11, 2024, United States Senator Ron Wyden sent a responding letter to the Federal Communications Commission and the United States Attorney General, writing that “recently reported hack of U.S. telecommunications companies’ wiretapping systems should serve as a major wake-up call March 2018, <https://www.enisa.europa.eu/publications/signalling-security-in-telecom-ss7-diameter-5g>; Catherine Cullen & Brigitte Bureau, “Cellphone companies may need to step up privacy protections, minister says,” CBC News, November 23, 2017. 70 Gary Miller and Christopher Parsons. “Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure,” Citizen Lab Research Report No. 171, University of Toronto, Oct. 2023, at p. 32. 71 House of Commons Debates, Testimony of Minister of Public Safety Marco Mendocino, December 1, 2022. 72 James Ball, Julian Borger and Glenn Greenwaldm “Revealed: how US and UK spy agencies defeat internet privacy and security”, The Guardian, September 6, 2013. 73 James Bambord, “A Death in Athens: Did a Rogue NSA Operation Cause the Death of a Greek Telecom Employee?”, The Intercept, September 28, 2015; Dan Goodin, “Root backdoor found in surveillance gear used by law enforcement”, May 28, 2014. 74 Sarah Krouse, Dustin Volz, Aruna Viswanatha, and Robert McMillan, “U.S.

Wiretap Systems Targeted in China-Linked Hack”, The Wall Street Journal, October 5, 2024. 75 Ibid.

19 to the government.”76 Senator Wyden underscored the need for regulatory action to secure U.S. networks, and emphasized that the U.S. Department of Justice “must stop pushing for policies that harm Americans’ privacy and security by championing surveillance backdoors in other communications technologies,” given those backdoors “create an irresistible target for hackers and spies.”77 Senator Wyden highlighted the shared responsibility of both telecommunications companies, and the federal laws that mandated surveillance systems, for insecurity in telecommunication systems.

Senator Wyden wrote: During the Congressional hearings for CALEA, cybersecurity experts warned that these backdoors would be prime targets for hackers and foreign intelligence services. However, these concerns were dismissed by then-FBI Director Louis J.

Freeh, who testified to Congress that experts’ fears of increased vulnerability were “unfounded and misplaced.” Congress, relying on the FBI Director’s assurances that the security risks experts warned about could be addressed, passed the law mandating backdoors. …While the government has released no public information about the most recent hack, if the press reports are accurate, it may have caused enormous harm to U.S. national security.78 48. These recent events in the United States should also serve as a wake-up call to course correct on Canada’s own cybersecurity law as proposed in Bill C-26.

Analyzing Bill C-26 in June 2024 (prior to the recent security breach), the Electronic Frontier Foundation stated that “the U.S. experience offers a cautionary tale of what can happen when a government grants itself broad powers to monitor and direct telecommunications networks, absent corresponding protections for human rights.”79 49.

If Bill C-26 gives the government the power to force telecoms to undermine next-generation security features or equipment to accommodate surveillance by Canadian authorities, it will undoubtedly pave the way for adversaries or cyberespionage firms to find more ways into people's communications.80 Authoritarian governments abroad would also be able to point to Canada’s law to justify their own repressive security legislation.

As Ron Deibert and myself concluded, writing for the Globe and Mail in May 2024: 76 Letter, United States Senator Ron Wyden, October 11, 2024, <https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_fcc__doj_on_wiretapping_systems_hackpdf.pdf>. 77 Ibid. 78 Ibid. 79 Corynne McSherry, Matthew Guariglia, Brendan Gilligan, and Andrew Crocker, “Security, Surveillance, and Government Overreach – the United States Set the Path but Canada Shouldn’t Follow It”, Electronic Frontier Foundation, June 2024. 80 Ibid.

20 Against this threat landscape, a pivot in Bill C-26 is crucial. Canada needs cybersecurity laws that explicitly recognize that uncompromised encryption is the backbone of cybersecurity, and it must be mandated and protected by all means possible.81 50. As a result, this

Part 4 recommends: a. Recommendation 13: Order-making powers should be amended to ensure that new Ministerial powers are not used to compromise the security of Canada’s networks. An interpretive clause should be added to s. 15.2, to confirm that, for greater certainty, the Minister is not authorized to make an order that would compromise the confidentiality, availability, or integrity of a telecommunications facility, telecommunications service, or transmission facility.

The intent of this recommendation is “to prevent the government from ordering or demanding that telecommunications service providers deploy or enable lawful access-related capabilities or powers in the service of ‘securing’ infrastructure by way of adopting a standard.”82 b. Recommendation 14: The Governor in Council and Minister of Industry should be required to consider the effect of orders on the privacy and security of communications.

According to new amendments made during SECU hearings, the Governor in Council and Minister of Industry are now required to consider a list of factors before issuing orders under s. 15.1 or under s. 15.2 (factors listed under s. 15.1(2.1) and 15.2(3.1)). I recommend that a clause be added alongside those factors to require consideration of the effect of the order on the privacy and security of communications: (

a) its operational impact on the affected telecommunications service providers; (

b) its financial impact on the affected telecommunications service providers; (

c) its effect on the provision of telecommunications services in Canada; (

d) its effect on the privacy and security of communications; and (

e) any other factor that the [Governor in Council/Minister] considers relevant.

Part 5. Concluding Remarks 51. I urge this Committee to take seriously the recommendations that were identified in Cybersecurity Will Not Thrive in Darkness, including in particular the priority recommendations that are expanded upon in this brief. In detailing these recommendations for this Committee’s study, I also urge the Committee to consider the additional Charter interests that are engaged by Bill C-26, including freedom of expression and privacy interests, as described in

Part 3 of this Brief. I echo Dr. Parsons’ view that “cybersecurity efforts through Bill C-26 should seek to build trust between the government and non-government entities, including the general public,” and that independent bodies (including NSICOP and NSIRA) 81 Kate Robertson and Ron Deibert, “Ottawa wants the power to create secret backdoors in our networks to allow for surveillance”, The Globe and Mail, May 29, 2024. 82 Christopher Parsons, “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act,” Citizen Lab Research Report No. 158, University of Toronto, Oct. 2022, at p. 17.

21 should be more thoroughly integrated into the information collection and sharing powers set out in Bill C-26. 52. Citizen Lab’s recent report, Finding You (enclosed as Appendix C), documents continuing vulnerabilities at the heart of the world’s mobile communications networks. The report’s findings underscore that cybersecurity has not thrived in darkness. Historical and continuing deficiencies in oversight, transparency, and accountability of network security have led to serious geolocation-related threats associated with contemporary networks.

The report notes that the “failure of effective regulation, accountability, and transparency has been a boon for network-based geolocation surveillance.”83 53. While Canada needs to move forward in combating threats to its telecommunications and critical infrastructure, it should not legislate out of fear, and at the expense of democratic norms and safeguards, public transparency and accountability, or respect for the Charter and human rights.

Rather, a human security and human rights approach to cybersecurity requires the recognition of the importance of accessible and inclusive cybersecurity, public accountability, and public transparency when regulating telecommunications and cybersecurity.

Part 6. Organizational Information 54. I am a lawyer and senior research associate at the Citizen Lab, Munk School of Global Affairs & Public Policy at the University of Toronto. My research explores the intersection of law, policy, and technology, and focuses on transparency and accountability mechanisms relevant to the relationship between corporations and state agencies regarding personal data and other surveillance activities. I draw on former experience as a law clerk of the Supreme Court of Canada, and subsequently, as a lawyer in Canada’s justice system. 55.

The views presented in this brief are my own and based on research that I and colleagues have carried out at our place of employment, the Citizen Lab. The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs and Public Policy, University of Toronto, focusing on research, development, and high-level strategic policy and legal engagement at the intersection of information and communication technologies, human rights, and global security. 56. We use a “mixed methods” approach to research combining practices from political science, law, computer science, and area studies.

Our research includes: investigating digital espionage against civil society, documenting Internet filtering and other technologies and practices that impact freedom of expression online, analyzing privacy, security, and information controls of popular applications, and examining transparency and accountability mechanisms relevant to the relationship between corporations and state agencies regarding personal data and other surveillance activities. 83 Finding You, supra, at p. 19.

23 Appendix A - Table of Recommendations Recommendation 1: Non-Disclosure Orders Should Be Time Limited 5 Recommendation 2: The Circumstances Purporting to Justify Confidentiality in a Non-Disclosure Order Should Be Defined In The Legislation 6 Recommendation 3:

Section 15.9 Should Be Amended To Ensure The Judge Retains Authority To Balance The Public Interest In Disclosure Against The Interest In Confidentiality 6 Recommendation 4: Where Summaries Are Provided Of Evidence And Information Received By The Court, Pursuant To

Section 15.9(1)(C), These Summaries Should Be Available To Both The “Applicant and the Public” 6 Recommendation 5: The Triggering Threshold Justifying Limits On The Openness Of The Proceedings Should Not Be Higher Than That Which Is Already Contained Under Analogous Provisions Of The Canada Evidence Act 6 Recommendation 6: Prior Judicial Approval Must be Required for the Government to Obtain Personal or De-Identified Information from a Telecommunications Provider 10 Recommendation 7 Information Obtained from Telecommunications Providers Should Only be Used by Government Agencies for Cybersecurity and Information Assurance Activities 11 Recommendation 8: The Collection And Sharing Of Personal Information Should Be Limited By Both Necessity And Proportionality Requirements 11 Recommendations 9: Data Retention Periods Should Be Attached to Telecommunications Providers’ Data and to Foreign Disclosures of Information 12 Recommendation 10: Consent should be obtained from the person to whom the information relates 12 Recommendation 11: Relief Should Be Available If Government Mishandles Confidential Information 12 Recommendation 12: Legislation Should Delimit the Conditions Wherein a Private Organization’s Information Can Be Disclosed 12 Recommendation 13: Order-making powers should be amended to ensure that new Ministerial powers are not used to compromise the security of Canada’s networks 17 Recommendation 14: The Governor in Council and Minister of Industry should be required to consider the effect of orders on the privacy and security of communications 17

24 Appendix B - Enclosed Report Christopher Parsons. “Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act,” Citizen Lab Research Report No. 158, University of Toronto, October 18, 2022.

25 Appendix C - Enclosed Report Gary Miller and Christopher Parsons. “Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure,” Citizen Lab Research Report No. 171, University of Toronto, October, 2023.