Court decision muddies lawful access rules for ISPs: Lawford

Friday’s Supreme Court decision requiring law enforcement to get a warrant in order to obtain customers’ personal information from Internet service providers muddies the water around lawful access legislation, according to lawyer John Lawford, executive director of the Public Interest Advocacy Centre (PIAC). In the unanimous opinion, Judge Thomas Cromwell said the reasonable expectation of privacy on the Internet includes anonymity, and that warrantless requests for subscriber information, as routinely practiced under the Personal Information Protection and Electronic Documents Act (PIPEDA), are legal searches and therefore require judicial authorization. The Supreme Court was deciding the case of a man arrested for possessing and distributing child pornography via the filesharing service Limewire in 2007 after police traced the IP address that was sharing the material back to the house at which he was staying. Matthew Spencer challenged his conviction on the grounds that Shaw Communications Inc. turned over the name, address and phone number related to the IP address to the police without a warrant, who then used it to obtain a search warrant that ended with Spencer’s arrest and the seizure of his computers. In its decision, the court said PIPEDA, which gives law enforcement and other agencies the power to obtain subscriber information without a warrant, is too vague to create any police search and seizure powers. Cromwell wrote in the decision that the concept of “informational privacy” under the Charter of Rights and Freedoms includes an understanding of anonymity as a key part of the right to privacy while using the Internet. Spencer's conviction for possession of child pornography was upheld as was an appeal court's decision to retry him for making the content available. Lawford said PIPEDA has provided a circular logic that authorities use to justify obtaining subscriber information without asking a judge, because consumers could have no expectation of privacy if the law already provided law enforcement with a means to access the information. “The court said the exception for warrantless access through PIPEDA isn't sufficient to have you avoid all the law that goes with a search,” Lawford said in a phone interview. “It's a great decision because it kills that circular argument. It opens a bunch of new questions, though, and it makes it hard for ISPs because they're going to have to figure out their view of what's proper.” The court’s decision has both an immediate effect on so-called lawful access requests by law enforcement and wider implications for existing laws and proposed legislation that define the boundaries of the relationship between telecom companies and government agencies. Bill C-13, the so-called cyberbullying bill, and Bill S-4, which would amend PIPEDA, are both before Parliament, and law professor Michal Geist said Friday's decision means sections of both must be amended to be constitutional. Geist, the Canada research chair in Internet and e-commerce law at the University of Ottawa, said on his personal blog that the decision means ISPs need “radical reform of their current approach to disclosure of subscriber information.” Privacy Commissioner Daniel Therrien praised the court’s “seminal” decision in a Friday news release, adding that it had “important implications” for Bill C-13. Therrien has already said the bill, which includes changes to the way lawful access requests are made as well as amendments to the criminal code to address cyberbullying, should be split in two. He's also said that a clause giving immunity to those who hand over subscribers’ personal information to the government should be removed. Lawford said the evolution of lawful access through legislation and the court’s decision leaves ISPs in “a funny spot.” “They will still receive these requests,” he said. “Now they face a choice where they could say, 'We'll keep giving it to you but it's your problem if you can't use it in court.' At the moment, it's still legal to keep asking for it. It's just that the police can't use anything.” This decision on a criminal proceeding provides little guidance for judges adjudicating civil cases, Lawford said, such as the one between Voltage Pictures LLC and Teksavvy Solutions Inc. over film piracy, in which Teksavvy has been ordered to hand over subscriber information on 2,000 IP addresses that Voltage alleged shared its copyrighted works. Bram Abramson, chief legal officer at Ontario ISP Teksavvy, the first ISP in Canada to release full details on lawful access requests from government, said on Friday that the decision “validates” his company’s approach to lawful access. “Protection of the privacy of our users is what we're expected to do and what our users trust us to do,” Abramson said, adding that the company had decided earlier this year to request judicial authorization in every instance in which it was asked for subscriber information. “Teksavvy isn’t a company that seeks to break the law, and we’re not here to harbour criminals,” he said. “We will make no disclosures unless compelled by law.” In the Voltage case, he added, “we have not disclosed any subscriber information because we continue to test the limits of the law.“ “We simply cannot be put in the position where we're the ones deciding what is appropriate and what is not in terms of going beyond what the law compels us to do,” he said. Abramson said the Supreme Court decision will “ratchet up” the minimum standards for all ISPs, not just his own company, and that those companies that haven’t worked to protect user privacy will have to change their approach. Bill Sandiford, president of the Canadian Network Operators Consortium, an industry group for independent ISPs, said the decision doesn’t change the way ISPs deal with lawful access. “Today’s decision is business as usual for our members,” he said in a Friday news release. “We will continue to work cooperatively with law enforcement while obeying the laws of the land." In an emailed statement, BCE Inc. spokesman Albert Lee said “Bell always complies with the law” and that the company was reviewing the decision. A spokesman for Shaw said in an email that the company was studying the decision and had no further comment. Jennifer Kett, a spokeswoman from Rogers Communications Inc., said in an email that the company was reviewing the decision and would “continue to safeguard our customers’ information and comply with the law.” In April, interim privacy commissioner Chantal Bernier released a 2011 letter from telecom companies that showed the government makes nearly 1.2 million lawful access requests for subscriber information per year, on average. A request for comment from the Justice Department was not returned. — Reporting by Peter Henderson at phenderson@thewirereport.ca and editing by Derek Abma at dabma@thewirereport.ca

Court decision muddies lawful access rules for ISPs: Lawford

News | June 13, 2014

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Court decision muddies lawful access rules for ISPs: Lawford

News | June 13, 2014

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Canadian media companies sue OpenAI for copyright infringement, could cost $322 billion

Coordinated effort is ‘essential’ in tackling AI policy issues, says Canadian Digital Regulators Forum

Government working with AI researcher Mila on governing use of cultural content

Copyright Board joins Canadian Digital Regulators Forum

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us