Many moons ago, ISPs were concerned that they would be legally required to eavesdrop on their customers, and the GTALUG board spun off a group to follow and comment on legalistic and political matters. The posting below is specifically about misbehavior by Telus, but it's also a potted history of the improvement of the situation in Canada over time, and over the US, where stored communications cab be seized without a warrant. --dave [This might make a good lightening talk] -------- Forwarded Message -------- Subject: Telus Texts Not Intercepted When Stored Date: Mon, 25 Jun 2018 03:37:59 +0000 From: Omar Ha-Redeye <> http://www.slaw.ca/2018/06/24/telus-texts-not-intercepted-when-stored/ Telus Texts Not Intercepted When Stored Many Canadians confuse the law when it comes to recording telephone conversations, likely due to exposure to American concepts in the media. Although the Wiretap Act of 1968 (18 U.S.C. § 2511) contains a one-party consent rule, a dozen states have a two-party consent that supersedes American Federal law, and given its presence in California (Cal. Penal Code § 632), it’s likely that this is often the source of the misunderstanding in Canada. In Canada, we have Part VI <https://qweri.lexum.com/w/calegis/rsc-1985-c-c-46-en#%21fragment/PART_VI_Invasion_of_Privacy_779805/KGhhc2g6KGNodW5rxIVhbsSHb3JUZXh0OlBBUlRfVklfSW52xIJpb25fb2ZfUHJpxKFjeV83Nzk4MDUpLG5vdGVzUXVlcnk6Jycsc2Nyb2xsQ8SIxIo6IW7FhmVhcsSHxL7FgMWCxYTFk8WVxIdTxJB0QsWCUkVMRVZBTkNFLHRhYjp0b2MpKQ==> of the Criminal Code, which states, Consent to interception *183.1* Where a private communication is originated by more than one person or is intended by the originator thereof to be received by more than one person, a consent to the interception thereof by any one of those persons is sufficient consent for the purposes of any provision of this Part. An unauthorized interception is subject to an indictable offence, and serves to protect against the invasion of privacy. These provisions are also applicable to law enforcement, limiting the ability of the police to eavesdrop into the conversations of Canadian citizens. The Court in /R. v. Duarte / <http://canlii.ca/t/1fszz>explained the rationale for this as follows, The rationale for regulating the power of the state to record communications that their originator expects will not be intercepted by anyone other than the person intended by the originator to receive it (see definition section of Part IV.1 of the/ Code/) has nothing to do with protecting individuals from the threat that their interlocutors will divulge communications that are meant to be private. No set of laws could immunize us from that risk. Rather, the regulation of electronic surveillance protects us from a risk of a different order, i.e., not the risk that someone will repeat our words but the much more insidious danger inherent in allowing the state, in its unfettered discretion, to record and transmit our words.  The reason for this protection is the realization that if the state were free, at its sole discretion, to make permanent electronic recordings of our private communications, there would be no meaningful residuum to our right to live our lives free from surveillance. The very efficacy of electronic surveillance is such that it has the potential, if left unregulated, to annihilate any expectation that our communications will remain private. A society which exposed us, at the whim of the state, to the risk of having a permanent electronic recording made of our words every time we opened our mouths might be superbly equipped to fight crime, but would be one in which privacy no longer had any meaning. As Douglas J., dissenting in/ United States v. White/,/ supra/, put it, at p. 756: “Electronic surveillance is the greatest leveler of human privacy ever known.” If the state may arbitrarily record and transmit our private communications, it is no longer possible to strike an appropriate balance between the right of the individual to be left alone and the right of the state to intrude on privacy in the furtherance of its goals, notably the need to investigate and combat crime. There are several mechanisms through which law enforcement can obtain this information. The first is through a wiretap under a Part VI authorization, which can include a general wiretap authorized under s. 185 and 186, a wiretap with consent under s. 184, and an emergency wiretap under s. 184.4 and 188. The latter two do not require full judicial authorization, but a reasonable belief is required that a specific offence has been, is being, or is about to be committed. Police are required to have reasonable and probably grounds to believe that the target of the wiretap will be engaging in a particular communication that will provide evidence for an investigation. A less common way to obtain communications information would be through using a Production Order under s. 487.012<https://qweri.lexum.com/calegis/rsc-1985-c-c-46-en#%21fragment/sec487.012> of the /Criminal Code<https://qweri.lexum.com/calegis/rsc-1985-c-c-46-en>/ (now s. 487.014 , <https://qweri.lexum.com/calegis/rsc-1985-c-c-46-en#%21fragment/sec487.014>following Bill C-13: Protecting Canadians from Online Crime Act 2014). A Production Order has a much less stringent requirements than a Part VI authorization, but its use is limited by the technological practices employed by different telecommunication companies. The Court in /R. v. Marakah / <https://www.canlii.org/en/ca/scc/doc/2017/2017scc59/2017scc59.html>confirmed last year that both sent and received text messages can potentially attract a reasonable expectation of privacy, and therefore receive s. 8 /Charter /protections. The companion case of /R. v. Jones <http://canlii.ca/t/hp63x> /examined the use of a Production Order to obtain some text messages given the privacy expectations that text messages should receive. The police in this case were able to obtain incriminating text messages because the service provider here, Telus, maintained a copy of sent and received texts on their servers for service purposes. The obtained several Production Orders against other service providers as well, but because they did not store the texts in this way they could not be provided to the police. They are legally entitled to do so under an exception in s. 184(2) of the /Code. / The significance of this unique practice was highlighted in the Court’s 2013 decision in /R. v. TELUS Communications Co. / <https://www.canlii.org/en/ca/scc/doc/2013/2013scc16/2013scc16.html>where the Court stated, [59] The fact that Telus stores its subscribers’ text messages in this manner is significant — indeed, it is the reason this appeal exists — because it creates an investigative resource for the authorities. This decisions was released during the accused’s trial in /Jones/, but the trial judge dismissed the application to re-open the s. 8 ruling. The Court in /Jones /referred to the /TELUS /case as follows, [44] /TELUS/ implicitly acknowledges that, as a normative matter, it is reasonable to expect a service provider to keep information private where its receipt and retention of such information is incidental to its role of delivering private communications to the intended recipient. That is intuitive. One would not reasonably expect the service provider to share his text messages with an unintended recipient, or post them publicly for the world to see. Despite this reasonable expectation of privacy in the subject matter of the texts, the Court’s analysis focused on the reasonableness of the search itself through the use of a Production Order as opposed to a Part VI authorization. This issue was not addressed in /TELUS/, which instead focused on prospective production of future text messages under Part VI authorizations for future communications. The majority’s decision hinged on an interpretation of the provisions by distinguishing interception and disclosure, the former requiring a prospective application of information. A Production Order, in contrast, was providing a copy of records that Telus had already intercepted and stored, and had done so lawfully under the Part VI exceptions. The majority of the Court concluded, [77] In short, the state action in this case respected Part VI’s distinction between the interception of communications in ss. 184 to 192 and the disclosure of previously intercepted and stored communications as contemplated by s. 193. Based on the evidence, it also respected the requirement in /TELUS/ that a Part VI authorization be obtained for text messages that are still in the transmission process. Law enforcement cannot receive authorization to effectively intercept future communications through the “backdoor” of the general search and seizure regime in s. 487 of the /Code/. But law enforcement could — and did, in this case — lawfully obtain records of historical text messages by means of a Production Order under s. 487.012 of the /Code/ (as they can still do now under s. 487.014). … [80] Production orders must therefore be carefully circumscribed to ensure that authorized police techniques comply with s. 184(1) <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html#sec184subsec1_smooth>. A production order must not authorize, or potentially authorize, the production of any text messages that are either not yet in existence or are still capable of delivery at the time the order is issued. This should be clear from the face of the order. Where the technique at issue is an intercept within the meaning of s. 184(1) <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html#sec184subsec1_smooth>, then the application is properly rejected and a Part VI authorization must be obtained. A production order should not be used to sidestep the more stringent Part VI authorization requirements. The challenge with applying this ruling is that it necessarily involves the invasion of privacy and disclosure of information of individuals who may not be using Telus, but are communicating with an individual who is. Despite the lawful authorization of the mechanism in this way, Parliament could not have envisioned the unique practices employed by a single service provider in this manner, and the use of the statute to benefit from it as a result. These problems were highlighted by Justice Abella’s dissent, [105] The only difference between /TELUS/, dealing with prospective text messages, and this case, dealing with historical text messages, is the timing of the state’s request for authorization. This was reinforced by the intervener Criminal Lawyers’ Association of Ontario in its factum where it said that, “[t]echnologically speaking, [/TELUS/] and [Mr. Jones’] case are identical: a private communication is made, it is then stored on the company’s computer, and then the state acquires it” (para. 16). If the term “intercept” in s. 183 <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html#sec183_smooth> is interpreted in the context of the broader Part VI scheme and the purpose that it is meant to serve, namely, to prevent the state acquisition of private communications without lawful authorization and to protect the privacy interests inherent in the content of private communications, then the Part VI protections should not fluctuate with the timing of the state’s interception of a private communication. As noted in /TELUS/,interpreting the phrase “intercept[ion] [of] a private communication” must “focus on the acquisition of informational content and the individual’s expectation of privacy at the time the communication was made” (para. 36). [emphasis added] Highlighting the timing as the only distinction between a Part VI authorization and a Production Order would have the effect of allowing law enforcement to essentially create repeated Production Orders over a period of time that would create a record similar to that of a Part VI authorization. Although it would not have the benefit of being able to prevent crimes from occurring, it would create the type of evidentiary record that would have a significant effect on providing incriminating statements against an accused, thereby having a significant impact on the /Charter/-protected interests of the accused (the 2nd step of the 24(2) analysis under /Grant/). More importantly, the evidence provided here did not originate from any legal distinctions between a Part VI authorization or a Production Order, but the unusual practices of a particular company, [113] In this case, the police obtained several Production Orders pursuant to s. 487.012 <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html#sec487.012_smooth> of the /Criminal Code <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html>/ directed at the service providers Bell, Rogers and Telus. Only Telus stored the content of incoming and outgoing text messages for a period of time after the messages were sent and received. No text messages were obtained from accounts held with the other service providers. Telus’ unique storage practices, rather than the underlying principles in Part VI, led to the production of copies of historical text messages from the targeted Telus account, and the loss of Mr. Jones’ privacy protections available under Part VI of the /Criminal Code <https://www.canlii.org/en/ca/laws/stat/rsc-1985-c-c-46/latest/rsc-1985-c-c-46.html>/. Again,the applicability of Part VI should depend on the substance of what the investigative technique seeks to access, not on the timing of when access is sought, or on the vagaries of the service provider’s technological practices. [emphasis added] Justice Abella cited the evolution of shifting technology that has resulted in corresponding jurisprudence that attempts to keep up with the impact of these technological changes on the constitutional rights of an accused. The Court in /Marakah/ attempted to protect these interests by prioritizing the private nature of text message information, and the informational content relating to the biographical core of the individual, rather than weighing the location of the search too heavily, [37] Electronic conversations, in sum, are capable of revealing a great deal of personal information. Preservation of a “zone of privacy” in which personal information is safe from state intrusion is the very purpose of s. 8 <https://www.canlii.org/en/ca/laws/stat/schedule-b-to-the-canada-act-1982-uk-1982-c-11/latest/schedule-b-to-the-canada-act-1982-uk-1982-c-11.html#sec8_smooth> of the /Charter <https://www.canlii.org/en/ca/laws/stat/schedule-b-to-the-canada-act-1982-uk-1982-c-11/latest/schedule-b-to-the-canada-act-1982-uk-1982-c-11.html>/: see /Patrick/, at para. 77, per Abella J. As the foregoing examples illustrate, this zone of privacy extends beyond one’s own mobile device; it can include the electronic conversations in which one shares private information with others. It is reasonable to expect these private interactions — and not just the contents of a particular cell phone at a particular point in time — to remain private. However, this same emphasis on the private nature of the information does not feature as prominently in evaluating the reasonableness of how law enforcement can infringe on this zone of privacy through a search. The unreasonableness of the search was not disputed in /Marakah/, where text messages were used from a co-accused’s phone against him. Instead, the majority in /Marakah /anticipate at para 53 “that the justice system [will] adapt to the challenges of recognizing that some text message conversations may engage s. 8 <https://www.canlii.org/en/ca/laws/stat/schedule-b-to-the-canada-act-1982-uk-1982-c-11/latest/schedule-b-to-the-canada-act-1982-uk-1982-c-11.html#sec8_smooth> of the /Charter, <https://www.canlii.org/en/ca/laws/stat/schedule-b-to-the-canada-act-1982-uk-1982-c-11/latest/schedule-b-to-the-canada-act-1982-uk-1982-c-11.html>/” even as societal interests in protecting privacy interests outweigh the state’s interest in effective law enforcement. While this case law continues to develop, the jurisprudential gap between Production Orders and Part VI authorizations, in light of changing technological practices, may also warrant a review of these provisions by the legislature to better regulate the state’s discretion to record and transmit our words. <http://www.slaw.ca/wp-content/uploads/2018/06/2018-Lions-Cup-Competiton-1.jpg> (From Left:) Darryl Singler, Omar Ha-Redeye, Jon Rinaldi, Samatha Biglou, and Tara Brun, judging the 2018 Lions Cup on R. v. Jones, 2017, on June 24, 2018. <http://feeds.feedburner.com/%7Eff/slaw/IkMK?a=99LrVPMw5RM:0O2YqRCQrGg:gCN0Ie6HRBo> <http://feeds.feedburner.com/%7Eff/slaw/IkMK?a=99LrVPMw5RM:0O2YqRCQrGg:ACf-c_HutVc> <http://feeds.feedburner.com/%7Eff/slaw/IkMK?a=99LrVPMw5RM:0O2YqRCQrGg:yIl2AUoC8zA> <http://feeds.feedburner.com/%7Eff/slaw/IkMK?a=99LrVPMw5RM:0O2YqRCQrGg:I9og5sOYxJI> <http://feeds.feedburner.com/%7Eff/slaw/IkMK?a=99LrVPMw5RM:0O2YqRCQrGg:qj6IDK7rITs>