New Legislation Targets Criminal Investigations Involving ISPs, Other Telecom-Related Operators

On June 18, 2009, the Canadian government introduced legislation

designed to facilitate criminal investigations involving ISPs and

other telecommunications-related operators (referred to as

"telecommunications service providers" or

"TSPs"). Bill C-46 grants extensive new investigative

powers to Canadian police forces, while Bill C-47 imposes new

obligations on TSPs to ready their facilities so as to be able to

cooperate with police investigations when they occur. While law

enforcement officials are likely to applaud what is intended to

give them investigative tools for the digital era, privacy

advocates will question the need to expand police surveillance

powers in this manner, particularly when weighed against inherent

risks. TSPs, meanwhile, will want to become familiar with these new

requirements and take steps to prepare for their

implementation.

Background

The proposed legislation arises from Canada's participation

in the 2001 Cybercrime Convention, an international treaty

sponsored by the Council of Europe. The Convention commits

participating jurisdictions to act against illegal activities

including computer-related forgery and fraud, child pornography and

copyright infringement. It also commits countries to acquire the

capacity to collect, preserve, intercept and produce

"specified computer data, including traffic data." The

United States, Australia, United Kingdom and New Zealand have all

adopted enabling legislation.

Canada made an earlier, unsuccessful attempt to update its

investigative powers involving TSPs. The Government tabled the

Modernization of Investigative Techniques Act

(MITA) in 2005, but it never became law. Bill C-47 is

substantially similar to MITA, with minor changes that

address some of the criticisms that were levelled at MITA.

However, the companion measures set out in Bill C-46, in effect,

enhance the impact of MITA by clarifying and expanding the

investigative powers of law enforcement authorities.

TSPs Must Ready Their Facilities

Bill C-47's key requirement is that TSPs be able to

intercept communications traffic and permit access to authorized

officials. It targets anyone who provides any

"telecommunications service," whether basic or enhanced,

and includes wireless service providers, Internet access providers,

and most Voice-over-IP providers. Its scope is broad enough to also

cover many non-access providers like e-mail application providers,

web hosting facilities, and cloud computing services. TSPs are

required to operate their "transmission apparatus"

— essentially, any network device operating at any layer,

including a switch, router, gateway, network storage device, or

server — in order to enable multiple simultaneous

interceptions and to isolate each communication intended to be

intercepted.

TSPs must also meet certain ancillary obligations. They must

provide police officers and employees of the Canadian Security

Intelligence Service (CSIS) and the Royal Canadian Mounted Police

(RCMP) with information about their facilities and the services

they provide; help law enforcement officials assess or test the

TSP's facilities; and provide the officials, upon request, with

a list of the TSP's upstream suppliers and downstream

customers. The RCMP and CSIS may also request a list, and conduct a

security assessment, of all employees or consultants who may assist

in communications interception.

Bill C-47 contains some exemptions and transitional delays that

will assist some service providers, notably the following:

TSPs with less than 100,000 subscribers will have three years

to meet operational requirements.

Backbone network services will be exempt from many

requirements.

Post-secondary institutions, libraries, community centres,

restaurants, and temporary or permanent lodgings like hotels and

apartment buildings will be exempt from most requirements.

Financial institutions, charities, places of worship, most

schools, hospitals, retirement homes, research networks and

broadcasters will be exempted...