The federal government has yet to release its response to last year’s national security consultation, but at least one thing is increasingly apparent. Lawful access, the regulations that govern police access to Internet and telecom subscriber information, will be back on Public Safety Minister Ralph Goodale’s legislative agenda. My Globe and Mail column notes that the details of the complex new rules that would grant warrantless access to some telecom and Internet information system are still a work-in-progress, but the final outcome is sure to raise concerns with the privacy advocates as well as telecom and Internet providers.

A cybercrime working group comprised of senior officials from federal, provincial and territorial governments have spent months developing the new lawful access framework.  It recently held two invitation-only consultations on the issue with Canadian telecom and Internet companies as well as civil society groups and academic experts. I participated in the latter event, which was held under Chatham House rules that allow for disclosure of the content of the meeting without attribution to specific commentators.

Many in the privacy and telecom fields had assumed that the lawful access issue was settled in 2014. The government established several new warrants that opened the door to preserving subscriber information and granted law enforcement additional access to the data. When combined with the Supreme Court of Canada Spencer decision that affirmed a reasonable expectation of privacy in subscriber information, Canadian law enforcement was seen to have the necessary legal tools to combat cybercrime with court-approved access to Internet and telecom information.

The consultation meetings left no doubt that law enforcement is not satisfied with the current system, however. It is seeking significant reforms that would require telecom and Internet companies to disclose some subscriber information without court oversight. Police officers point to a sizable jump in the number of warrant requests following the Spencer decision as the justification for easing the rules of access.

Working group officials emphasized that no final decisions have been made, but much of the internal debate has shifted from whether more reforms are needed to what information could be mandatorily disclosed without court oversight and what should be subject to a warrant.

Warrantless access would be subject to an administrative procedure that would allow for disclosures without the need for prior court review or approval. These disclosures are characterized as involving “precursor” or confirmatory data that law enforcement insists does not have a reasonable expectation of privacy. The specific data points are still to be decided, but could include the subscriber’s city or province, whether a particular person has an account with a telecom provider, and whether the account was active on a particular date. The administrative procedure would also be used to grant access to subscriber information without a warrant in emergency situations and to information in non-criminal policing situations such as missing persons or property.

The warrantless administrative procedure would be accompanied by the creation of a new production order that would allow courts to order the disclosure of subscriber information. The specific information subject to a court order could include IP addresses and other Internet and telecom identifiers. The order might be subject to a lower threshold of “reasonable grounds to suspect” rather than the stricter “reasonable grounds to believe.”

Officials maintain that the current system has created serious investigative barriers, but have yet to provide concrete data of the extent of the problem. Moreover, the shift away from court oversight, which would likely face court challenges, appears driven in part by the increased costs associated with the current system. Indeed, the use of a warrantless administrative process is consistent with the view that full court oversight over Internet disclosures is too expensive for the police and the courts.

Yet warrantless access would come at a high price to the privacy of Canadians and the cost savings may be illusory since telecom companies are likely to seek new fees for responding to administrative disclosure requests.

Law enforcement officials argue that the Supreme Court’s Spencer decision “broke the system”, claiming that a lawful access framework premised on universal court oversight is too cumbersome and expensive for the reality of today’s Internet. Canadians who want their privacy will therefore have to fight for it, since it would appear that proposals striking a new privacy-security balance may be only months away.