Government’s Cybersecurity Proposal Threatens Privacy – And Security

The Canadian Civil Liberties Association (CCLA) submitted a brief today calling on a parliamentary committee to amend Bill C-8, which would create a federal regime for cybersecurity. While improving cybersecurity on Internet and phone networks is an important objective, the legislative proposal includes broad powers that invite abuse.

Under the legislative proposal, the government will be authorized to compel companies to intercept sensitive Internet traffic without judicial authorization or any meaningful constraints on how that personal information will be used.

The legislative proposal employs a mix of broad powers–the government can literally order a telecommunication company to “do anything, or refrain from doing anything” and to shroud its orders in secrecy. This raises concern that the government could force companies to break critical technical safeguards such as encryption using the powers Bill C-8 envisions. Paradoxically, this would result in less secure networks, undermining not only the right to privacy but the very objective of Bill C-8. But regrettably it would not be the first time a government agency has prioritized expanded surveillance over network security.

The government will also be authorized to disconnect people from the Internet or render websites inaccessible if it considered this to be necessary to address a cybersecurity threat. But mitigating a cyberthreat can require targeting people who’s home computers, mobile devices or smart cars have been compromised and are being used to launch a threat without their knowledge. Far from including a framework to help people recover from such a threat, the government could prohibit Internet companies from telling their customers why they have been disconnected.

CCLA’s legislative brief builds on other civil society submissions, and calls on the committee to amend Bill C-8 in order to:

• ensure the bill’s data collection authorizations are proportionate;
• ensure telecommunication companies will not be ordered to expand their surveillance capabilities;
• add safeguards for people or websites who might be disconnected from the Internet; and
• ensure an effective right of appeal for people impacted by the operation of the Bill

Read the full Brief ici.