No government can mandate "access only for the good guys." There is no such thing as a vulnerability only the right people can exploit. Photo by Techa Tungateja/Getty Images

Article content

Omar Abdulaziz left Saudi Arabia in 2014, built a new life in Montreal and became one of the most prominent Saudi opposition voices outside the kingdom, as well as a close confidant of journalist Jamal Khashoggi. In 2018 his phone was infected with Pegasus spyware, which was traced to a Saudi-linked operator and likely played a role in the chain of events that led to Khashoggi’s murder. Despite Abdulaziz seeking safety in Canada, his persecutors found him anyway.

Article content

Article content

Parliament is now moving quickly to pass Bill C-22, the so-called Lawful Access Act, which would make Canada more susceptible to exactly that kind of targeted surveillance. The bill is about giving Canadian law enforcement better tools to investigate serious crime by having telecom companies collect everyone’s metadata for six months and mandating the breaking of encryption. Despite the noble goal of empowering law enforcement to do its job, the risks of this approach outweigh the potential benefits.

Article content

Article content

Article content

The centrepiece of Bill C-22 is a provision allowing the minister of public safety to order companies to build access mechanisms into their encrypted services so they can access Canadians’ metadata — provided doing so doesn’t create a “systemic vulnerability.” But how can companies comply with this idea of avoiding “systemic vulnerability”? Creating a backdoor for Ottawa creates a backdoor for nefarious actors.

Article content

In its parliamentary testimony, Apple accused Ottawa of inserting such backdoors into its products. Google went further, warning that the bill could facilitate foreign interference and weaken global user privacy precisely because a backdoor built for Ottawa doesn’t remain exclusive to Ottawa. Rather, it would be a massive green light for hostile foreign intelligence services, criminal hackers and any government willing to coerce, compromise or even legally compel companies to hand over information they want.

Article content

Article content

No government can mandate “access only for the good guys.” This naive idea was debunked by every major cryptographer and technology company that testified regarding Bill C-22. There is no such thing as a vulnerability only the right people can exploit.

Article content

Article content

On metadata specifically, the bill wants service providers to record and retain that information on all Canadians for six months, which is enough to know almost everything about most of us. The coverage is not just suspects or people under investigation but every person who sends a message or makes a call. Do you know anyone who doesn’t do so on a daily, if not hourly basis?

Article content

The Bloc Québécois described the six-month data stores as a “treasure trove” for hackers. But that undersells the specific danger for people like Abdulaziz, or Sheng Xue, a Chinese dissident who fled to Canada and believes Chinese agents have tracked her movements and threatened her life.

Article content

For a dissident from an authoritarian state, metadata alone can be a death sentence. Months of retained records reveal who someone contacts, when, how often and from where. It maps attendance at community meetings and protests and exposes any contact with people still living inside the home country.