Two Bills, One Mirage: Bill C-22 Reboots Lawful Access Without Ending the Backdoor

Canada’s policymakers have dusted off an old playbook and stapled a shiny new label on it. Bill C-22, the Lawful Access Act, arrives with the bravado of reform and the quiet credibility of a magician’s trick: move the wires, pretend the illusion is new, and hope nobody notices the same monster wearing a different suit.

The Good News: A Narrowing of Scope

The government finally pulls back from the wildly ambitious appetite of warrantless data demands. The new regime narrows access to data from telecommunications providers and places real guardrails on production orders, with judges in the loop.
The so called confirmation of service power is the headline turn. Instead of dragging every service into the state’s living room, the regime asks providers to confirm whether they serve a particular person. It’s still information gathering, but at least it’s targeted and not a universal rummage sale.
For most subscriber information, a production order still requires judicial review. The threshold remains the grim specter of reasonable grounds to suspect, yet the scope is clearly more circumscribed than before.
There are other rules about voluntary disclosure, exigent circumstances, and foreign orders. I’ll be digging into those in upcoming installments, because yes, policy is a labyrinth and I am happy to walk you through the maze with a torch.

If this is the good news, the bad news is very bad indeed. The SAAIA—the Supporting Authorized Access to Information Act—remains largely unchanged from the C-2 blueprint. And that is not a victory lap; it is a siren song in a democracy made of glass.

The Bad News: The SAAIA and Core Providers

The SAAIA expands what I call the surveillance appetite: direct testing and access capabilities inside provider networks, data retention, and a framework that could normalize covert government access to communications infrastructure.
A new star enters the firmament: the electronic service provider, or ESP. Think Google, Meta, and their cousins. The bill’s logic is to bring these giants under a regulatory umbrella, even as some services like Signal might dodge the reach if you aren’t in a chat group together. The problem is not the loophole; it’s the principle.
Core providers will bear heavy burdens: develop, implement, test, and maintain capabilities for accessing information; install and operate devices that could enable access; notify the proper authorities about these capabilities; and retain certain metadata for up to a year.
The metadata retention is the quiet expansion that changes the baseline. What you did, when you did it, where you were, with whom you spoke—these are not content but they are a map of your digital life. The bill carves out an exception for content, browsing history, and social media activities, but the rest walks right into the door with a flashlight.
There is a systemic vulnerability exemption, which sounds prudent until you realize it’s the license to ignore a vulnerability if revealing it would compromise security. In other words, we are guaranteed not to fix what we know is broken, so long as the fix might expose a flaw.
The rules quietly flirt with global information sharing, including alignment with international dynamics like the Budapest Convention’s 2AP and the CLOUD Act. The remix is not a mere shuffle; it is a potential widening of the stage for cross-border data choreography.

There remains a persistent sneer in the air: secrecy, opaque oversight, and the costs of compliance. The government will point to ministerial oversight, now supposedly checked by an Intelligence Commissioner, but the essential question remains: will this oversight be a real brake or merely a decorative cuff on the wrist of a system that loves to sneak around the back?

The Big Question: Do We Trade Privacy for Security?

If you are tempted to pat yourself on the back for a slightly narrower backdoor, ask yourself: does narrowing the doorway excuse the entire architecture? Is a more carefully pruned garden still a prison for data, or merely a prettier cage?

We are told that warrantless access to subscriber information is off the table. Great. But the SAAIA envisions a regime where access to networks and capabilities is centralized under government authority. Secrecy remains, and secrecy is the enemy of accountability.
Oversight is upgraded in name, not in practice. Ministerial orders require approval by an Intelligence Commissioner, which sounds impressive until you remember that secrecy shrouds most orders, and public scrutiny remains elusive.
The real question is not whether the state can access data, but whether it can do so without dragging civil liberties into the mud. Are we strengthening privacy, or simply rebranding surveillance under the banner of national security with a few bureaucratic bells and whistles?

What to Watch For

How challenge procedures actually work in practice. Will individuals or their representatives have meaningful recourse against unjust orders, or will the system smile and say policy is hard, privacy is negotiable, and security trumps all?
The cost of compliance for providers and the potential chilling effect on legitimate communication. When the default is secrecy, what is the price paid by privacy, innovation, and fair access to information?
Ongoing analysis from experts like Kate Robertson at the Citizen Lab, discussions on 2AP and the CLOUD Act, and the practicalities of cross-border data flows. Keep your skeptic’s notebook handy.

Final Thought

Lawful access will not die on paper; it merely goes to sleep under a new blanket. Bill C-22 offers a cosmetic trimming of the old beast, a promise of oversight that may or may not keep the fangs from digging in. The fundamental question remains: does practical oversight truly protect privacy, or does it merely relocate the risk to a more opaque corner of the system?

Reason must govern policy, not fear. If we cannot defend the cornerstones of privacy while giving law enforcement the tools it says it needs, the bill is not reform, it is restraint masquerading as reform with a sharper suit and a better press release.