May 25, 2026 · 34 min · 11 segments
The government’s lawful access bill has been the target of criticism for weeks, with companies, governments, and experts on privacy and security all sounding the alarm. Much of the momentum against…
Michael GeistHostNo entities detected.
I'm a law professor at the University of Ottawa, where I hold the Canada Research Chair in Internet and eCommerce law.
In preparation for today's hearing, I looked back at the history of my engagement with lawful access policy.
I found that I wrote my first op-ed on the issue more than 20 years ago and first began appearing before committees on various bills a few years after that.
As I'm sure you know, lawful access has been the subject of legislative debate in Canada for decades under both Liberal and Conservative governments.
The technology's changed, the governments may change, but the challenge has always been the same: to give law enforcement and security agencies the tools they need to address serious crime while respecting Canadians' privacy rights and the constitutional framework the Supreme Court has built around privacy in decisions such as Spencer and Bikovics.
The balance is not well struck, as it-- as its warrantless information demand power envisions compelling disclosure of subscriber information of any provider of a service in Canada without court oversight.
The decision to drop that power was the right one, and replacing it with a confirmation of service demand is a meaningful change.
Bill C-22 nevertheless contains ser-- some serious problems, and I'll focus on three.
The first I'm gonna focus on is the mandatory metadata retention regime, which would require providers to retain metadata for up to a year on every subscriber, regardless of suspicion.
On a mobile network, that data includes cell phones to cell towers each phone connects to and when, um, retained at scale.
The aggregate amounts to a comprehensive surveillance map of virtually every Canadian, where and when they go, and who they interact with.
This is the kind of bulk data retention regime that the European Union Court of Justice struck down in the Dig-Digital Rights Ireland case, and in the Tele2 Sverige case extended to mandated private sector retention of traffic and location data.
Germany's Federal Constitutional Court has reached similar conclusions, yet the charter statement on Bill C-22 remarkably fails to address the regime despite the obvious charter implications.
The committee is being asked to entrench a surveillance architecture and accept the security risks that come with it.
The obvious approach is to remove this entirely, as it is disproportionate and I believe likely to be struck down in its current form by the Supreme Court.
Alternatively, perhaps a 30-day cap on metadata retention would suffice in terms of meeting the invest-- immediate investigative needs while allowing for a court order if a longer period is required.
The second concern involves systemic vulnerability safeguards in the technical capability provisions.
Sections five and seven of the SAAIA, that's part two, say providers are not required to comply with an order if doing so would create a systemic vulnerability.But sections 12 and 13 make compliance unconditional and provide that orders prevail over inconsistent regulations.
That leaves a safeguard that exists in name only, largely cloaked in secrecy, with the burden of invoking it falling on the providers.
The consequence is a backdoor capability mandate that could weaken encryption, place user data at risk, and lead companies to remove privacy-enhancing services from Canada.
I'm a law professor at the University of Ottawa, where I hold the Canada Research Chair in Internet and eCommerce law.
In preparation for today's hearing, I looked back at the history of my engagement with lawful access policy.
I found that I wrote my first op-ed on the issue more than 20 years ago and first began appearing before committees on various bills a few years after that.
As I'm sure you know, lawful access has been the subject of legislative debate in Canada for decades under both Liberal and Conservative governments.
The technology's changed, the governments may change, but the challenge has always been the same: to give law enforcement and security agencies the tools they need to address serious crime while respecting Canadians' privacy rights and the constitutional framework the Supreme Court has built around privacy in decisions such as Spencer and Bikovics.
The balance is not well struck, as it-- as its warrantless information demand power envisions compelling disclosure of subscriber information of any provider of a service in Canada without court oversight.
The decision to drop that power was the right one, and replacing it with a confirmation of service demand is a meaningful change.
Bill C-22 nevertheless contains ser-- some serious problems, and I'll focus on three.
The first I'm gonna focus on is the mandatory metadata retention regime, which would require providers to retain metadata for up to a year on every subscriber, regardless of suspicion.
On a mobile network, that data includes cell phones to cell towers each phone connects to and when, um, retained at scale.
The aggregate amounts to a comprehensive surveillance map of virtually every Canadian, where and when they go, and who they interact with.
This is the kind of bulk data retention regime that the European Union Court of Justice struck down in the Dig-Digital Rights Ireland case, and in the Tele2 Sverige case extended to mandated private sector retention of traffic and location data.
Germany's Federal Constitutional Court has reached similar conclusions, yet the charter statement on Bill C-22 remarkably fails to address the regime despite the obvious charter implications.
The committee is being asked to entrench a surveillance architecture and accept the security risks that come with it.
The obvious approach is to remove this entirely, as it is disproportionate and I believe likely to be struck down in its current form by the Supreme Court.
Alternatively, perhaps a 30-day cap on metadata retention would suffice in terms of meeting the invest-- immediate investigative needs while allowing for a court order if a longer period is required.
The second concern involves systemic vulnerability safeguards in the technical capability provisions.
Sections five and seven of the SAAIA, that's part two, say providers are not required to comply with an order if doing so would create a systemic vulnerability.But sections 12 and 13 make compliance unconditional and provide that orders prevail over inconsistent regulations.
That leaves a safeguard that exists in name only, largely cloaked in secrecy, with the burden of invoking it falling on the providers.
The consequence is a backdoor capability mandate that could weaken encryption, place user data at risk, and lead companies to remove privacy-enhancing services from Canada.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.