Metadata is not something metaphysical. As Daniel Therrien, the Privacy Commissioner of Canada, rightly says, "We generate metadata constantly." Like an envelope, this outer shell of any electronic communication – a phone log, a time stamp, an e-mail address or an IP address – can reveal a lot.
Mr. Therrien is particularly worried about the Communications Security Establishment, the Canadian member of the intelligence alliance called the Five Eyes; the other four eyes are the United States, Britain, Australia and New Zealand.
As long ago as 2008, the Five Eyes dealt well with metadata. But then something went wrong with the CSE's "filtering technique" – that is, separating the metadata attached to the private communications of Canadians from that of the foreigners the CSE is mandated to monitor. In 2013, the CSE realized that Canadians were getting scooped up in its metadata trawling.
The CSE maintains that the risk to privacy is minimal. If that is so, why did the Five Eyes design the the filtering technique in the first place? Was it really superfluous?
CSE officials themselves acknowledged to the Privacy Commissioner's office that the CSE had improperly shared large amounts of metadata. This could undermine the public's confidence, and the various governments' too, that the Five Eyes will never, ever spy on each others' citizens.
Mr. Therrien pointed to the work of three computer scientists at Stanford University that was published this year. They argue that people's supposedly innocuous metadata are often every bit as revealing as the types of evidence that police present when they apply for search warrants.
The scientists concluded that "telephone metadata is densely interconnected, can trivially be reidentified, and can be used to draw sensitive inferences."
Meanwhile, the Supreme Court's decision in R. v. Spencer in 2014 strongly reasserted the search-warrant requirement in cases of electronic communication.
Thus, Mr. Therrien is right to say that the National Defence Act should be amended to clarify the CSE's powers and to establish clear legal standards to protect the privacy of Canadians. In other words, metadata legislation.