Gazette - Intercepting online communications: what must be considered when balancing lawful access with privacy rights?

The panellists:

Sgt Mark Flynn, Covert Intercept Unit, HQ Special “I”, RCMP, Ottawa

Benjamin Goold, Associate Professor, Faculty of Law, University of British Columbia

Det Insp Richard Schurr, manager, Crime Monitoring Centre, New Zealand Police

Mike Webb, national manager, Organisational Performance, New Zealand Police

Sgt Mark Flynn

The technology that people use to communicate has rapidly changed in recent years. The use of the Internet is the most significant change. It is a combination of the traditional telephone, facsimile machine, traditional mail, video camera, library and more, all carried over an open and mostly uncontrolled system. Many people use the Internet as their primary means of communication. Some even put intimate details of their lives online to share with friends, family and the world. Others use its instantaneous communications, anonymously, to facilitate crimes and circumvent the ability of police to investigate those crimes.

Law enforcement agencies recognize and respect the privacy rights of individuals in Canada. The interception of any type of private communication must take into account the privacy rights of the individual and the public interest in the administration of justice. This is a delicate balance that was considered by Parliament when Part VI of the Criminal Code was enacted.

Part VI requires that police meet strict criteria before a judge will allow them to intercept a private communication and makes it an offence to do so without judicial authorization (with few exceptions for specific situations). That has not changed with the advent of the Internet.

There are several hundred Internet service providers (ISPs) in Canada and each network is unique and designed in a manner that sometimes makes the lawfully authorized interception of communications difficult or impossible. In these investigations, a judge has reviewed a request from a law enforcement officer, weighed the privacy rights of the individual versus the public interest, and granted authority to lawfully intercept the communications. Sometimes, the interception could not be carried out due to technological challenges or could not be performed in a timely manner. Those involved in organized crime and child exploitation often take advantage of these challenges. In some cases, the lack of intercept capability has jeopardized public safety.

In recent years, law enforcement and national security agencies have sought improvements to lawful access through changes in the law to aid in dealing with technological challenges when intercepting online and other communication systems. Some refer to the changes as additional police powers and a further invasion of privacy. This is simply not correct: the interception of online communications is no different than the interception of other types of traditional communications.

Police already have the lawful authority to intercept online communications and have been doing so for many years. Law enforcement agencies are not seeking to change how this authority is granted. The elimination of technological challenges through new legislation would simply ensure that an interception will be technologically possible, once a judge has granted law enforcement the legal authority to carry out an interception.

Any change to the law should be analyzed to determine if there are new privacy implications for Canadians to ensure that there is no unreasonable state intrusion into their personal lives. As such, the best way to ensure that privacy rights are not being violated is to have proper safeguards built into the law. Canada has a well-established judicial process that ensures that a balance between privacy rights and public interest is maintained. This balance is crucial in assuring the safety of our communities.

Benjamin Goold

There are many things that need to be considered before the police should attempt to intercept online communications. Given that reading someone’s email or monitoring their online activities without their knowledge is a serious breach of privacy, it is essential for the police to provide a clear and convincing justification for such intrusions.

In particular, they must be able to show that the interception in question is both necessary and proportionate, and that there is no other, less invasive means of obtaining the relevant information or evidence. In addition, it is vital that the police take steps to ensure that the information in question is used only for the purposes for which it was originally obtained, and that it is not shared in ways that may further infringe the individual’s right to privacy. Where the police fail to meet these standards, there can be little doubt that their actions — no matter how well intentioned — will constitute an unjustified infringement of the individual’s right to privacy and possibly an abuse of due process.

In the course of a criminal investigation, it is always tempting for the police to regard an individual’s privacy as less important than the prevention of crime or the apprehension of criminals. Yet it is crucial for the police to remember that the right to privacy does not just exist to protect individuals from unwanted scrutiny or to help them maintain control over their personal information. As a society we are also committed to privacy because it is necessary if people are to be able to enjoy the political freedoms that most of us now take for granted in Canada. If the police start to regularly monitor online communications without just cause, over time people may become reluctant to use email or Internet forums to exercise their right to freedom of expression or to criticize the government and public bodies such as the police.

As more and more people come to regard email as their main means of communicating with friends, relatives, and colleagues, there is a risk that the fear of police interception could stifle free speech and healthy political debate.

Finally, there is another reason why the police should regard the interception of online communications as an evidential last resort: Police, more than any other state institution, rely on the public’s trust and co-operation to do their job effectively.

If the police fail to take online privacy seriously, then there is a very real danger that they will lose this vital public trust. If that happens, then people may be less inclined to come forward with information, to answer police questions willingly, or to make complaints.

Given that public confidence is hard won and easily lost, the police should be cautious when it comes to weighing the short-term benefits of interception with the longer-term costs of infringing online privacy. If they don’t, then all policing — not just criminal investigation — may quickly become very difficult indeed.

Det Insp Richard Schurr and Mike Webb

From cautious beginnings in the late 1970s, when police were first granted legal authority to intercept telecommunications involving suspected drug dealing, New Zealand lawmakers have sought to strike a balance between individual privacy interests and public interests in effective investigations by enforcement agencies. Such balancing exercises continue today.

Various checks have been built into the New Zealand approach to granting lawful intercepts.

First, while the list of qualifying offences has gradually been increased to include organized crime and serious and violent crime, lawful intercepts are effectively limited to investigations of offences that carry penalties of 10 or more years’ imprisonment.

Then, it must be shown that routine investigations have failed or are unlikely to result in successful prosecutions.

Should these thresholds be met, then an application can be made to a High Court judge for a warrant to intercept “private communications” content.

Such applications can only be made by senior police officers and must be supported by extensive affidavit evidence that satisfies the Court that there are reasonable grounds to believe a relevant offence has or will be committed.

Should all these hurdles be jumped, a 30-day interception warrant can be issued on the condition that interim and final reports on the use and results of the interception warrant must be given to the issuing judge or court.

An important factor in building comfort in the system has been that New Zealand’s national police force is the only enforcement agency currently able to make use of intercept powers. New Zealand Police is widely regarded as non-corrupt and enjoys high levels of public trust and confidence.

Careful judicial oversight also acts to temper any potential for over-reaching, and helps to reinforce responsible police practices. Indeed, arguably the most effective mechanism protecting a person’s privacy occurs at trial, when any unreasonably/unlawfully obtained evidence from interceptions will not be admitted.

There have been challenges. The emergence of new technologies and industry deregulation led to interception difficulties in the late 1990s. New Zealand’s first GSM mobile network could not be intercepted for a decade, until New Zealand Police itself paid for the capability. This legislative gap was only plugged in 2004 through the Telecommunications (Interception Capability) Act, requiring providers of any public telephone or data network to enable lawful intercepts to law enforcement agencies.

New services must now be compliant before they are released. Similarly, smaller ISPs must assist enforcement agencies to achieve interception.