Why Spencer Changes the Playing Field for CSEC & National Security Spying

By this point, most readers will be familiar with the Supreme Court of Canada's June 13 judgment in R. v. Spencer.  On twitter, I call this decision Hunter v. Southam for the digital age.  It is potentially that revolutionary.  The internet is aflood with excellent analyses of the decision from a privacy law perspective and somewhat less than excellent spin from the government side (see, e.g., Minister MacKay's comments on Spencer, and Bill C-13 in the House today). 

Here, I will simply canvass what I see to be the implications of Spencer for the simmering dispute over interception of metadata by Communications Security Establishment Canada (CSEC).

Basic Holding in Spencer

Spencer was about internet subscriber data in a police child pornography investigation.  The information in question was the name, address and telephone number of the customer associated with an IP address.  It was, in other words, the most benign form of data attached to an IP address -- what some have called "postal envelope" information.

In a nutshell, the court nevertheless held that the Charter's section 8 protections against unreasonable searches and seizures extends to this subscriber data.  If the police want it from an service provider, they need to come a-knocking with a warrant. In key passages, the Court wrote:

...the identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. ... [S]ubscriber information, by tending to link particular kinds of information to identifiable individuals, may implicate privacy interests relating not simply to the person’s name or address but to his or her identity as the source, possessor or user of that information.... [T]he police request to link a given IP address to subscriber information was in effect a request to link a specific person (or a limited number of persons in the case of shared Internet services) to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized by the Court in other circumstances as engaging significant privacy interests

The Court was unmoved by the fact that the information was in the possession of a third party service provider or that there was a service contract that (ambiguously) suggested disclosure was a possibility.  Nor did it read the Personal Information Protection and Electronics Documents Act as somehow vitiating the reasonable expectation of privacy. 

In the result, at issue was a warrantless search not falling within the compass of permissible exceptions to the warrant requirement.

Implications for CSEC

The decision affirms the views I expressed in my draft article on CSEC and constitutional search and seizure rules (and requires me to shorten and make even more emphatic parts of this article prior to publication).  But it goes much further than I thought likely in entrenching constitutional protection for the penumbra of data that surrounds communication.  The Supreme Court is prepared to extend section 8 protections to the most benign data -- name and address and telephone number -- associated with an IP address and which everyone appreciates a telecommunication company collects for billing purposes. 

It is inconceivable to me that it will now demur when it comes to other, even more intimate forms of metadata created by modern communication -- geolocations, place called, duration of calls, websites surfed etc.  While the reasonable expectation of privacy will always depend on the totality of circumstances, I think the constitutional die is now cast when it comes to the sorts of metadata most contentious in the post-Snowden debates.

We don't know, of course, what the government has been in fact collecting under the umbrella of "metadata".  Nevertheless, the concept is so broad and Spencer so dramatic, that I assume at least some of what the government has in the past collected in the apparent belief that it does not attract a reasonable expectation of privacy is now subject to the full protections of section 8. 

As I discuss in my paper, I do not believe that it matters in the CSEC context that CSEC may be collecting Canadian origin information under its "Mandate A" incidentally, or for a national security purpose.  Neither of those concerns is a conventional justification for warrantless searches, nor does either necessitate a judge-free intercept system for any practical purpose. 

In this last respect, there is no technical reason why a judge couldn't be tasked with the approval process currently conducted by the minister as part of the ministerial authorization of private communication interceptions.  And that authorization could easily be broadened to cover authorizations for all intercepts that trigger section 8, not just "private communication".  (As I argue in my paper, I think the latter reaches metadata, but there is not one-for-one overlap in all instances between private communications and section 8's requirements.)

The Lawsuits

Putting CSEC on a constitutional footing will require amendments to the National Defence Act

More generally, after Justice Blanchard and Justice Mosley's decisions in relation to CSIS extraterritorial surveillance, after Spencer, after Snowden, it is abundantly clear that Canadian national security surveillance law needs legislative renovation. Our national security surveillance laws give every impression of now being a patchwork of untenable theories whose persistence depends almost entirely on them not getting in front of a court.  And the era of none of this being fodder for courts is now at an end.

In a world of good faith action by rationally motivated decision-makers, the government would go back the legislative drawing board and preempt the lawsuits brought by BCCLA and CCLA, discussed in a prior post.  

No one can doubt we need effective security services, and no one can doubt they need to be clothed in definite and workable laws.  It is possible to square the circle on constitutionality and national security in the surveillance area.  Inaction now just creates more uncertainty.  Litigation will narrow the field of action for the government, and create ground rules that are the product of the adversarial process, not premeditated design. 

I am not inclined to polemics (although perhaps readers would disagree).  But if the government doubles-down now, it is because of simple inertia and a lack of policy imagination.  Or it is because it has consciously decided that there is more political virtue in obstinacy than in proactively crafting a workable national security intercept regimen.  Either reason would be an indictment.