In a world connected by public internetworking, what is a reasonable expectation of privacy? This is is not an easy question to answer. Are average users taking the steps to protect their privacy? Do average users know the kind of personal information that is being dropped along the way as they surf the net?
…
How do we balance individual privacy rights with the real need to modernize investigative tools for law enforcement? How do we make sure that users’ reasonable expectations of privacy are in fact reasonable?
Alec Saunders asked a valid question in response to that posting:
What needs are not being met with existing law enforcement tools, AND what laws would have to change in order to meet those needs.
It turns out that the existing laws are just fine. How do ISPs respond to lawful requests for information? I asked David Butt, a former prosecutor with an extensive concentration on internet child exploitation cases, to help understand the issues.
He writes:
Internet child abuse investigators routinely need bare bones subscriber information (name and address) from ISPs to conduct their investigations. A question commonly asked by ISPs and privacy advocates is, why shouldn’t the police use a search warrant to get that bare bones subscriber information? There are seven really good answers to this question.
- Bare bones subscriber information is not the kind of private information that requires a search warrant. The highest court in Canada, the Supreme Court, has clearly said so.
- Every other business in Canada must supply this kind of bare bones customer information to the police upon request. There is no principled reason why ISPs should be exempted from the rules that apply to every other business.
- PIPEDA has a specific section in it whose purpose is to authorize the granting of this bare bones subscriber information to police. ISPs therefore have specific statutory authority to rely upon.
- Police services are always understaffed and over worked. The demand for policing services always exceeds the available supply. Therefore, adding unnecessary burdens on police by requiring them to go to the trouble of getting legally unnecessary warrants prevents police officers from devoting their limited time to more important work. The result is that the whole community suffers unnecessarily.
- Search warrant requirements under Canadian law are onerous. A typical search warrant, even for bare bones subscriber information, may often run to more than 40 pages in length. This will require several hours of work by an officer, sometimes many officers. It will involve at least two visits to a judge. Given the limited availability of judges, the entire process may take days. All of this effort is legally unnecessary and therefore a complete waste of public funds.
- Bare bones subscriber information is necessary to identify the location of the suspect so that the case can be conducted by the local police service. If a search warrant were necessary for every such bare bones request, the police service in the city where the ISP head office is located would be obliged to do a great deal of onerous search warrant work simply to pass the file on to another jurisdiction when the bare bones subscriber information comes back. This places not only an unnecessary but a disproportionate burden on police services in those cities that host ISP head offices.
- Other democratic countries, that fully respect privacy rights, require businesses to supply this type of bare bones subscriber information to the police upon request. Internationally, the practice is routine.
The Canadian ISP industry has come up a ‘letter of authority,’ after coming to a consensus that needing to obtain a search warrant was impractical. Tom Copeland, head of the Canadian Association of Internet Providers, was recently quoted in a news story saying that in most cases, ISPs will co-operate with a search warrant or a so-called ‘letter of authority,’ but he acknowledged it’s not always the case.
It’s going to be a management decision by each and every ISP but I think the trend, especially when it comes to child exploitation, is to co-operate with law enforcement – subject to them providing some basic lawful authorization.
What causes ISP management not to cooperate with these agreed processes?
Your comments are welcomed.
Technorati Tags:
Alec Saunders, David Butt, Online Rights, lawful access, CAIP, Mark Goldberg