Cyberbullying bill needed to fight child porn, police say

Police who investigate online child exploitation are growing frustrated with delays in legislation that would make it quicker and easier to obtain information about IP addresses used for distributing child pornography.

The most recent attempt by the Conservative government to expand, entrench and standardize how internet service providers share information with law enforcement is contained in Bill C-13 — currently before a parliamentary committee.

The government and police say it is a necessary tool to protect some of society’s most vulnerable from being exploited or otherwise victimized by online predators.

Critics say the government is using the cover of child pornography and cyberbullying to encroach on the privacy of Canadians.

Front-line police officers say the current laws don't provide them with the tools they need.

• Cyberbullying bill won't be split in 2, Peter MacKay says
• Daniel Therrien says he'd divide cyberbullying bill
• Stockwell Day calls for changes to cybercrime bill

The images Saskatoon police Sgt. Darren Parisien has to browse through every day on the job are too stomach-turning to describe.

He investigates cases of child pornography.

"The public expects that I am going to find this person who is distributing horrific child sexual abuse images,” he states bluntly.

These images are being traded in plain sight on public internet file-sharing sites, with the perpetrators’ identities digitized into a string of numbers known as IP addresses.

“As part of that expectation,” Parisien explains, “I need to ask for the help of private companies that have the information that I need."

IP address customer information

Most internet service providers (ISPs) voluntarily agree to share basic subscriber information, sometimes called “telephone book information,” with police — the client's name and address.

But some won't.

The public expects that I am going to find this person who is distributing horrific child sexual abuse images.— Sgt. Darren Parisien, Saskatoon police

When that happens, officers must submit long, detailed applications for a production order. If the justice of a peace gives the OK, ISPs then have up to 30 days to respond.

He and other officers want the process to be standardized so each ISP will be treated the same and, hopefully, respond in the same way.

Privacy concerns

But many privacy experts have declared the legislation deeply flawed.  

Even Canada's new privacy commissioner, Daniel Therrien, says the bill needs an independent review of privacy interests.

“IP addresses are much more than telephone [book] information because they do include information, interests in websites or location,” he recently told a House of Commons committee examining the bill.

Therrien isn't alone; many lawyers and privacy experts have concerns about telecom companies freely sharing basic subscriber information with law enforcement and other agencies or companies.

"What they've done is said, 'We're going to enable authorities to have access to anyone's information at any time without a warrant,'" says Steve Anderson, executive director of OpenMedia.ca.

"They are kind of using a sledgehammer to kill a fly," Anderson adds, "so instead of actually working with Canadians to define what is an emergency situation, what is a situation where Canadians would permit to have access to their information without a warrant potentially." 

They want the government to drop so-called "warrantless disclosure" provisions from its cyberbullying law so they can be studied later and in more depth.

“I think it is that Canadians want to know more about why police and security agencies require information — they want to hear this in order to have an informed debate," says Therrien.

'Completely incorrect'

Toronto police Det. Const. Chris Purchas is on secondment with the RCMP. He bristles at the suggestion that what he’s trying to do in his work is “snooping.”

“It is completely incorrect,” he says.

A veteran child exploitation investigator, Purchas acknowledges the public’s lack of knowledge about these issues is a “huge problem,” for police.

“There is a belief that if I have your IP address, I can tell every website you visited, I can tell what you like, I can tell everything about you, which is absolutely false,” he says.

Licence plate for internet

Purchas compares what he and his fellow investigators do to what happens when you witness a hit-and-run accident; take down the car’s licence plate number and then follow up.

"Then and only then when an offence has been committed that I have observed ... do I approach the equivalent of the Ministry of Transportation and I will say, 'Can you please advise me who was the owner of that car?'" he explains.

Many privacy experts empathize with investigators like Parisien and Purchas, but they say any legislation introducing warrantless access must be specific, narrowly focused and feature oversight mechanisms to ensure accountability —​ something they believe is missing in the current bill.

What does a law enforcement request look like?

This is a sample of a law enforcement request used by the RCMP when requesting basic subscriber information such as an account holder's name and address from internet service providers. It is only used in online child exploitation investigations.

The two-page form was created in 2007 by the RCMP and legal advisers from Canada's major ISPs.

Police say most companies now routinely grant these requests on the same day they are submitted. 

Two companies that want more information from police are Bell Aliant and EastLink.   

A spokesperson from EastLink said the company only discloses customer information when it is legally obligated to do so by law or pursuant to a warrant or court order. At Bell Aliant, a spokesperson said the company will immediately act without requirement for a warrant in emergency cases where the authorities indicate a child is at imminent risk.  However, in cases that are not emergencies, it requests a warrant.

• ON MOBILE? View the document here.