David Butt is a criminal lawyer in Toronto, and counsel to the Kids Internet Safety Alliance, www.kinsa.net
On Saturday afternoon, I had the honour of chatting on talk radio with two folks I consider heroes – Carol Todd and Glenn Canning. We spoke about cyberbullying, protecting privacy online, and the federal government's cyberbullying bill, C-13.
Carol and Glen are modern day heroes because they have fought through searing personal tragedy – the loss of children, Amanda Todd and Rehteah Parsons to suicide – and somehow found the strength to become passionate and insightful advocates for child online safety. They have unselfishly transformed incalculable personal grief into a better community for us all.
We could readily forgive both Glen and Carol if, in the aftermath of their tragedies, they became anti-cyberbullying at all costs, privacy be damned. But they are so much stronger and wiser than that. Both understand that to make the Internet safer we must also wrestle with what compromise of online privacy is acceptable.
To that end, Glen and Carol astutely asked the very question we all should ask: Precisely what pre-existing privacy rights does bill C-13 take away? And the answer is, precisely none.
C-13 updates the complex Criminal Code search-warrant provisions for the digital age. But the bill does not expand police powers to obtain information without a prior court order. So any suggestion C-13 authorizes more invasive warrantless cyber-snooping is urban myth.
C-13 does, however, encourage the voluntary handing over to police of information that can already lawfully be handed over without a court order. So we need to ask, as Carol and Glen did, what can already be lawfully handed over to the police without getting a court order in advance? The answer is very little, and even that is closely supervised by the courts afterward.
Internet service providers hold, or have access to, reams of data about our individual surfing habits, because we access the Internet through ISPs. What then can the police ask ISPs to provide voluntarily about our Internet profile? Again, very little – just a subscriber's name and address. That is all.
Almost all ISPs responsibly prohibit use of their services to commit crimes. So they responsibly assist legitimate Internet child abuse investigations by voluntarily providing a subscriber's name and address upon an appropriate police request. Many Canadian courts have considered whether voluntarily giving the police a subscriber's name and address violates the subscriber's Charter right to privacy: and the prevailing view is no violation. In 2012, Justice David Doherty, one of Canada's leading criminal law judges, authored a comprehensive and unanimous opinion in Ontario's highest court approving voluntary disclosure of a subscriber's name and address after a police request carefully tailored to a specific Internet child abuse investigation. That issue is now at the Supreme Court of Canada, and a decision is pending. So Canadians can rest assured the police can ask for voluntary disclosure of very little, and courts will closely supervise any such disclosure.
Unless you're an assassin's target, disclosing your name and address is a negligible compromise of privacy. We routinely publish names and addresses in multiple directories. But still, why should the police ask for them without a court order? A short illustration shows why.
Thirteen year old Sally is cyberbullied anonymously on her social media page by "Bully Dude" (apologies to anyone with that handle already). Sally and her parents are distraught, want immediate action, and call the police. To identify who is behind the Internet handle "Bully Dude", how long would it take police to get voluntary disclosure of the subscriber information, from both the social media host, then the ISP? Mere minutes. However, if judges' orders are required, two are needed, first for the social media host, then the ISP. Each request must be drafted by police, judicially approved, then wait its turn in the company's overflowing inbox of similar orders. Total time to get the subscriber name and address that way? Routinely 60 days.
Subscriber name and address do not end the investigation: they only begin it by giving the police a lead, somewhere to look. From there the police must still prepare a detailed warrant justifying access to any of Bully Dude's actual Internet activity. Sixty days of cyberbullying is a lifetime of agony to a young teenager. Why should Sally and her parents wait 60 days for an investigation to merely begin, when, with the negligible privacy compromise of bare bones subscriber information provided voluntarily, the investigation can begin in minutes?
Two heroes, Carol Todd and Glen Canning, are asking all of us this crucial question.