Case Study Cybercrime

International Centre for Criminal Law Reform and Criminal Justice Policy
1822 East Mall, Vancouver British Columbia, Canada V6T 1Z1 Tel: 1 (604) 822-9875 Fax: 1 (604) 822-9317 Email: icclr@law.ubc.ca www.icclr.law.ubc.ca

Case Study Cybercrime

By

Annemieke Holthuis

Counsel Criminal Law Policy Section Department of Justice Canada

Case Study prepared for Co-Teaching at the National Prosecutors College Beijing China

November-December 2006

As part of the International Centre for Criminal Law Reform and Criminal Justice Policy (ICCLR) and GeoSpatial SALASAN Programme: The Canada China Procuratorate Reform Cooperation Project, supported by the Canadian International Development Agency

Case Study - Cybercrime Public concern about the incidence of child pornography on the Internet is increasing in British Columbia. The police decide to crack down and seek the help of members of the public and Internet Service providers like XYZ Corporation. Brian, a concerned citizen and the divorced father of a young girl, contacts police expressing concerns about his roommate Dwayne. Dwayne is always on the computer and he has no idea what Dwayne is doing. Dwaynes door is always locked and Dwayne wont let Brian borrow the computer, even to send a quick e-mail. Lately, Dwayne acts more strangely than ever. Brian said that he didnt know what it is but hes no longer comfortable bringing his daughter home when Dwayne was there. Brian mentions to police that Dwaynes internet provider is XYZ Corporation. He saw the bill come in the mail last month. The police request records from XYZ Corporation, which provides records that indicate how much time Dwayne spends on the Internet. His usage of the Internet every month is enormous. The company is reluctant to provide anything further, citing client confidentiality. Based on this information and Dwaynes earlier criminal record, the police obtain a search warrant as against the internet provider to obtain the traffic data related to Dwaynes e-mails. Records show Dwayne is sending e-mails to individuals in Sweden, Germany and Thailand. As part of their investigation, the British Columbia Provincial Police rent an apartment next to Brian and Dwayne. A young-looking university student agrees to assist the police and to pose as Rose, a 16 year old girl from Australia. Her apartment is equipped with a computer and a webcam. Prior to the installation of the equipment, the student consents to the interception of her e-mail and MSN texts with Dwayne. Posing as Rose, the student corresponds with Dwayne. They exchange erotic e-mails. He began to ask her more and more explicit questions to which she replied. He then asked her if she would perform sex acts while he watched on his webcam. The student indicated that she would not but would be happy to meet him in person at the nearby Sterling Hotel. Thinking he was meeting Rose, Dwayne rushed over, to be met by police. His computer was left on, still sending his latest e-mails. Upon his arrest on charges of luring a child under the Criminal Code, police go before a judge to seek a search warrant for access to his home computer. There they believe they will find pictures and e-mails that Dwayne sent to a person named Rose, who said she was 16 and lived in Australia. Copies of these materials were made by police as evidence. The police are interested in getting access to the e-mails that are still in transmission to Dwaynes friends around the world. At trial, Dwayne challenged the actions of the police, saying they had no business checking into his electricity bills at BC Hydro. He alleges other police improprieties.

Questions for Discussion 1. Based on the models of computer related offences discussed, how would you characterize the computer related offence in issue in this case study. 2. Based on the presentations, what rights and interest, if any, should the police consider in investigating Brians concerns? 3. What type of computer or other technological evidence might be used in investigating this case? How would the prosecutor introduce this evidence into court? 4. In the course of their investigation, are there any other actions that the police could take that they have not yet taken? 5. From what you have learned about Canadian law on these issues, would you say the police acting within the law? What would your assessment be if these events took place in China?

Objectives of the Case study In light of the presentations on the applicable Canadian and Chinese law as well as relevant international standards, an experienced criminal prosecutor will be able to: Discuss the interjurisdictional nature of cybercrime and some of the challenges (jurisdictional and other) posed by prosecutions of these crimes; Identify the impacts on the rights and interests of individuals that might arise as a result of police action in the case study; Identify some of the types of computer-related behaviours and acts and consider the nature of criminal offences to address them.

Statement of Some Relevant International Standards Efforts to prevent and prosecute cybercrime must be considered in the context of applicable international standards. These are varied and include standards relating to governance of the Internet, cybercrime and the applicable human rights regime. Questions relating to the governance of the Internet are beyond the scope of this note 1 and other areas can only be dealt with briefly. Council of Europe Convention on Cybercrime2 No international United Nations treaty exists in respect of computer crimes. The most significant work has been done within the Council of Europe which in November 1996, set up a committee of experts to deal with cyber-crime. This work grew out of political concerns about the increased awareness of computer crime (i.e., crimes against computer systems; e.g., hacking) and computer-related crime (i.e., crimes committed through the use of computers; e.g., distribution of child pornography). The Committee of Experts on Crime in Cyber-space (PC-CY), consisting of representatives of member states and observers to the Council of Europe, examined the nature of cybercrime, possible offences and other substantive criminal law issues including issues of jurisdiction and international cooperation. The Committee was given the mandate to draft an international convention on cybercrime and met to do so between April 1997 and December 2000. Following hearings of the European Parliamentary Assembly and consultations by negotiating States with interested parties, the revised and finalised draft Convention and its Explanatory Memorandum were submitted for approval to the CDPC at its 50th plenary session in June 2001, following which the text of the draft Convention was submitted to the Committee of Ministers for adoption and opening for signature. The Council of Europe Convention on Cyber-Crime was opened for signature on November 23, 2001 to the 40 member States of the Council of Europe, non-member States that participated in the negotiations (i.e., Canada, United States, Japan and South Africa) and any other State by invitation of the Committee of Ministers. As of November

Governments and international organizations such as the UN Commission on Crime Prevention and Criminal Justice, the G-8, the Council of Europe, are examining cybercrime and related questions. For some recent discussions of these activities see Conclusions of the Study on effective measures to prevent and control high-technology and computer-related crime: Report of the Secretary-General, 2001, http://www.unodc.org/pdf/crime/10_commission/4e.pdf; and a follow-up report http://www.unodc.org/pdf/crime/commissions/11comm/8e.pdf. Other non-governmental bodies such as the Internet Corporation For Assigned Names and Numbers (ICANN), the World Wide Web Consortium (W3C), and the Internet Engineering Task Force (IETF) are also involved in setting standards for the Internet. 2 This section is based in part on earlier work of Department of Justice counsel Lucie Angers and Normand Wong, including his presentation Cybercrime: A Global Challenge, A Global Response, Madrid, Spain, December 12 and 13, 2005.

18, 2006, 43 countries have signed the Convention, including Canada. Eighteen of those countries ratified the Convention.3 The Convention provides signatory states with legal tools to help in the investigation and prosecution of computer crime, including Internet-based crime, and crime involving electronic evidence. The Convention aims to standardize what conduct relating to computers should be criminalized and then ensure that the crimes can be domestically and internationally prosecuted.4 At the same time, the Convention attempts to balance the need to protect rights such as freedom of expression and individual privacy interests, with economic interests of internet service providers and others in electronic commerce and the sovereignty of states. The Convention requires States parties to: 1) Criminalise certain forms of abuse against computer systems, including offences aimed at illegal access (art.2), illegal interception of communications (art. 3), data interference (art. 4), system interference (art. 5) and misuses of devices such as virus programs (art. 6). Forms of crimes committed through the use of computer systems are also to be criminalized. These include computer-related forgery (art.7), computer-related fraud (art.8), offences related to child pornography (art. 9), and copyright infringements (art. 10). 2) Enact, or take such other measures as are necessary, to ensure that various enforcement powers can be exercised by law enforcement authorities for the purpose of criminal investigations or proceedings in relation to Convention offences, any other criminal offence committed by means of a computer system and the collection of evidence in electronic form of any criminal offence. These procedural powers include orders for the preservation of specific computer data pending its acquisition by legal measures (arts. 16 and 17), orders for the production of computer data (art. 18), search and seizure of computer data (art. 19), real-time collection of traffic data (art. 20), and interception of content data (art. 21). 3) Adopt legislative and other measures to establish jurisdiction over the Convention offences when the offence is committed: in its territory; on board a ship or airline registered under the law of that Party; or by one of its nationals if the conduct is a criminal offence where it was committed or if the offence is committed outside the territorial jurisdiction of any State.5

See http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185&CM=7&DF=11/18/2006&CL=ENG. Canada has not yet ratified the Convention. 4 See the Preamble, Convention on Cybercrime. See Explanatory Report to the Convention on Cybercrime, http://conventions.coe.int/Treaty/EN/Reports/Html/185.htm. 5 Article 22, Convention on Cybercrime.

4) Provide, to the widest extent possible, each other co-operation (e.g., mutual legal assistance, extradition) in the investigation and prosecution of Convention offences, other criminal offences committed by means of a computer system and any offence in respect of which evidence is in electronic form. Importantly, Chapter III provides the means by which State parties may use the Convention to supplement any existing treaties among them or where there are no existing mutual legal assistance treaties or other arrangements. The Convention on Cybercrime contains common definitions necessary to a framework for understanding cybercrime. The domestic laws of States parties should incorporate provisions consistent with these concepts.6 In particular, the Convention in article 1 defines: a "computer system" means any device or a group of interconnected or related devices, one or more of which, pursuant to a program, performs automatic processing of data; b "computer data" means any representation of facts, information or concepts in a form suitable for processing in a computer system, including a program suitable to cause a computer system to perform a function; c "service provider" means: i any public or private entity that provides to users of its service the ability to communicate by means of a computer system, and ii any other entity that processes or stores computer data on behalf of such communication service or users of such service. d "traffic data" means any computer data relating to a communication by means of a computer system, generated by a computer system that formed a part in the chain of communication, indicating the communications origin, destination, route, time, date, size, duration, or type of underlying service. The accompanying Explanatory report to the Convention describes these concepts in more detail.7 The Convention is meant to apply to various legal traditions. States may implement its provisions as best suited to their domestic situation, provided that the measures taken are consistent with Convention standards. Thus, with respect to traffic data, the Explanatory Report notes that

Explanatory Report to the Convention on Cybercrime, ttp://conventions.coe.int/Treaty/EN/Reports/Html/185.htm.

7

See supra, at paras. 23-31.

30. The definition lists exhaustively the categories of traffic data that are treated by a specific regime in this Convention: the origin of a communication, its destination, route, time (GMT), date, size, duration and type of underlying service. Not all of these categories will always be technically available, capable of being produced by a service provider, or necessary for a particular criminal investigation. The "origin" refers to a telephone number, Internet Protocol (IP) address, or similar identification of a communications facility to which a service provider renders services. The "destination" refers to a comparable indication of a communications facility to which communications are transmitted. The term "type of underlying service" refers to the type of service that is being used within the network, e.g., file transfer, electronic mail, or instant messaging. 31. The definition leaves to national legislatures the ability to introduce differentiation in the legal protection of traffic data in accordance with its sensitivity. In this context, Article 15 obliges the Parties to provide for conditions and safeguards that are adequate for protection of human rights and liberties. This implies, inter alia, that the substantive criteria and the procedure to apply an investigative power may vary according to the sensitivity of the data. The Convention obliges States parties to adopt legislative and other measures as necessary to establish criminal offences in respect of acts, committed intentionally and without right,8 as set out in Articles 2 to 11.9 Penalties for such offences shall be effective, proportionate and dissuasive.10 Corporations and other legal persons can also be held liable for offences, whether criminal, civil or administrative.11 Additional Protocol to the Convention on Cybercrime on the Criminalisation of Acts of Racist or Xenophobic Nature Committed through Computer Systems The Additional Protocol to the Convention on Cybercrime on the Criminalisation of Acts of Racist or Xenophobic Nature Committed through Computer Systems, extends the Convention on Cybercrimes provisions to offences related to the promotion of hatred against a group distinguished by race, colour, descent, national or ethnic origin, or religion as a substitute for the other grounds. It obliges participating States to criminalize the following acts when committed through a computer system, namely the distribution of racist and xenophobic material, threatening a person or a group for racist reasons; insulting publicly a person or a group for racist reasons; distribution of material that denies genocides or crimes against humanity; and aiding or abetting the commission of any of these offences. Given the transnational nature of the dissemination of such materials over the Internet, the Protocol also provides the necessary mutual assistance regime at the multinational level.
8 9

See the Explanatory Note to the Convention on Cybercrime, at paras.38 and 39. Article 11, Convention on Cybercrime, requires states to criminalize the aiding or abetting, the commission of Convention offences or subject to a reservation in Article 11(3), attempting to commit any offences. Many of the substantive offence provisions permit states to reserve in respect of part of the substantive offence. 10 Article 13, Convention on Cybercrime. 11 Article 12, Convention on Cybercrime

The Protocol was opened for signature in January 2003 to States that signed the Convention. Canada signed the Protocol on July 8, 2005. Application of International Human Rights Law Measures to prevent, investigate and prosecute cybercrime may impact on the human rights of individuals. Article 15 of the Convention on Cybercrime explicitly recognizes the impact of possible investigative techniques, requiring State parties to ensure adequate protection for human rights and liberties, based on the principle of proportionality. Safeguards shall include judicial or other independent supervision, grounds justifying application and limitation of the scope and duration of the investigative technique being used. States parties shall also consider the impact of measures on the rights, responsibilities and legitimate interests (e.g. economic) of third parties. For example, the privacy interests of individuals may be impacted by investigative techniques such as preservation orders which require computer data to be stored for 90 days to enable competent authorities to seek its disclosure. Other examples include production orders which require a service provider to disclose subscriber information while other provisions permit the search and seizure of stored computer data. International instruments like the International Covenant on Civil and Political Rights (Covenant) and the Convention on the Rights of the Child, which are binding on Canada and China, protect individual rights.12 The Human Rights Committee, the treaty body charged with the supervision of Covenant rights has stated in General Comment, No. 31, that Article 2 of the Covenant imposes on States Parties a general obligation to respect the Covenant rights and to ensure them to all individuals in their territory and subject to their jurisdiction. States Parties must refrain from violation of the rights recognized by the Covenant, and any restrictions on any of those rights must be permissible under the relevant provisions of the Covenant. Where such restrictions are made, States must demonstrate their necessity and only take such measures as are proportionate to the pursuance of legitimate aims in order to ensure continuous and effective protection of Covenant rights. In no case may the restrictions be applied or invoked in a manner that would impair the essence of a Covenant right. However the positive obligations on States Parties to ensure Covenant rights will only be fully discharged if individuals are protected by the State, not just against violations of Covenant rights by its agents, but also against acts committed by private persons or entities that would impair the enjoyment of

12

Canada is also bound by the American Declaration of the Rights and Duties of Man. While not legally binding, the Universal Declaration of Human Rights contains similar provisions.

Covenant rights in so far as they are amenable to application between private persons or entities.13 Of the individual rights protected by the Covenant, Article 17 has particular significance in the cybercrime context. Article 17 provides that [n]o one shall be subject to arbitrary or unlawful interference with is privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. In its General Comment No. 16, the UN Human Rights Committee, the treaty body responsible for supervision of the Covenant, has said that interferences with ones privacy must be consistent with domestic law, which must itself comply with the provisions, aims and objectives of the Covenant. According to the Committee, the concept of arbitrariness was intended to guarantee that even interference provided for by law should be in accordance with the provisions, aims and objectives of the Covenant and should be, in any event, reasonable in the particular circumstances.14 Article 17(2) also provides that [e]veryone has the right to protection of the law against such interference or attacks. This latter is a positive obligation on the State to ensure the privacy interests of individuals are protected. Among the other rights that measures to investigate cybercrime may impact, the right to freedom of expression, protected in Article 19 of the International Covenant on Civil and Political Rights, should be highlighted. Article 19 protects the right to hold opinions without interference. It protects the right to freedom of expression, including freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice. These rights in Article 19 are not absolute. They may be limited as provided by law and necessary for the respect of the rights and reputations of others, and for the protection of national security or of public order, or public health or morals.15 Individual complaints in respect of alleged violations of Article 17 and 19 may be made to the UN Human Rights Committee in respect of acts or omissions by those governments including Canadas, which have acceded to the First Optional Protocol to the Covenant.

13

See http://www.unhchr.ch/tbs/doc.nsf/(Symbol)/CCPR.C.21.Rev.1.Add.13.En?Opendocument.

14

Human Rights Committee General Comment, No. 16, at http://www.unhchr.ch/tbs/doc.nsf/(Symbol)/23378a8724595410c12563ed004aeecd?Opendocument. Article 19(3) of the Covenant.

15

10

Statement of Canadian law16

by Annemieke Holthuis

Canadian criminal law and use of new technologies Canadian criminal laws approach to new technologies must be read against the historical backdrop of the provisions of the Criminal Code of Canada (Code) that address jurisdiction issues, search and seizure provisions and the use of electronic surveillance, as well as constitutional protections for individual privacy interests and related human rights. Canadian Charter of Rights and Freedoms Entrenched into the Constitution in 1982, the Canadian Charter of Rights and Freedoms (Charter) elaborates the protections for individual human rights in Canada, their scope and application, as well as remedies available in the event of a judicial finding of a Charter infringement. The Canadian Charter of Rights and Freedoms applies, by virtue of s. 32, to government actions, including the elaboration of the criminal law. However, the Charter does not, in most circumstances, apply in respect of the actions of private individuals or companies, including systems administrators on the Internet.17 Section 7 of the Charter protects the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice. The courts have held that this right incorporates certain residual protection for privacy interests of individuals. Section 8 of the Charter more particularly protects the right against unreasonable search and seizure. Section 8 of the Charter protects against unreasonable searches and seizures, essentially a protection against unjustified state intrusions on the reasonable expectations of an individual to privacy.18 A search19 or seizure20 without a judicially authorized warrant is prima facie unreasonable. This presumption can be rebutted by showing that the search or seizure is nevertheless reasonable as it is authorized by law, the law itself is reasonable

This document is based, in part, on earlier work of Department of Justice colleagues, particularly Gareth Sansom, Lucie Angers, Catheryne Beaudette and Norm Wong, on these issues. 17 The exception may be where an individual can be said to be carrying out activities as an agent of the state. 18 Hunter v. Southam, [ 1984] 2 S.C.R. 145 at 159. 19 A search is a violation of one's reasonable expectation of privacy in the object of the search. The Supreme Court has held that not every investigative technique used by the government constitutes a search within the meaning of s. 8 of the Charter. However, a technique may constitute a search where the intention or purpose of the police in employing the technique is to secure evidence: R. v. Evans, [1996] 1 S.C.R. 8 at para. 16. 20 Seizures essentially are the taking of something from a person by a public authority without consent: R. v. Colarusso , [1994] 1 S.C.R. 20 at 58, and R. v. Dyment, [1988] 2 S.C.R. 417 at 431.

16

11

and the manner in which the search is carried out is reasonable.21 What is reasonable will depend on the context. Different contexts yield different expectations of privacy.22 Searches and seizures by the state, including the use of electronic surveillance and other new technologies will likely engage not only individual privacy interests but may also engage other fundamental freedoms protected by the Charter. These include freedom of conscience and religion, freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication, and freedom of association in sections 2(a)(b) and (d) of the Charter. For example, Canadian courts have interpreted freedom of expression in s. 2(b) of the Charter as guaranteeing to individuals the right to express themselves or to otherwise disseminate information by means which are not violent.23 Thus, Canadian courts have held that criminal prohibitions on the dissemination of hate propaganda or pornography infringe s. 2(b). Where a court determines that a Charter right has been infringed, the onus of proof shifts to the government to demonstrate under s. 1 of the Charter that the limit on the Charter right is prescribed by law and is a reasonable limit, demonstrably justified in a free and democratic society.24 In this example, the Supreme Court of Canada upheld the Criminal Code prohibitions which sought to prevent the harmful effects of hate propaganda or obscenity as reasonable limits under s. 1 of the Charter.25 Jurisdiction of the Criminal Code of Canada Computer-related crimes pose difficulties to traditional criminal law concepts of jurisdiction and application of the law. These crimes do not often take place wholly within the jurisdiction of one court or one country; they are transnational in nature. Traditionally, the reach of Canadian criminal law does not extend beyond its borders.26 However, extraterritorial jurisdiction has been granted in respect of certain specified offences (eg. crimes against humanity, some terrorism offences) where appropriate, for example in the implementation of Canadas international treaty obligations. Jurisdiction is granted on such bases as Canadian citizenship, ordinary residence in Canada, the commission of the offence against a Canadian citizen or a Canadian government or public facility located outside of Canada or the presence in Canada of the person who

R. v. Collins, [1987] 1 SCR 265. The Supreme Court has identified three broad zones or realms of privacy which are particularly protected by section 8; territorial or spatial, personal, and informational (Dyment supra, at 428). These zones are not necessarily exclusive of each other, and a particular search may impact on all three (R. v. Tessling, [2004] 3 S.C.R. 432 at para. 24). 23 Irwin Toy Ltd. v. Quebec (A.G.), [1989] 1 S.C.R. 927; R. v. Keegstra, [1990] 3 S.C.R. 697. 24 It should be noted that where a violations of rights in ss. 7 and 8 of the Charter are found, courts only rarely engage in s. 1 analysis as the balancing of competing interests largely takes place in defining the scope of the Charter right. 25 R. v. Keegstra, supra; R. v. Butler, [1992] 1 S.C.R. 452. 26 See recent comments of the Supreme Court of Canada on the impact of the Internet on national courts in Pro Swing Inc. v. Elta Golf Inc., 2006 SCC 52, at 58, 64, (enforcement of foreign non-money orders) and Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers, [2004] 2 S.C.R. 427, at para. 2 (copyright infringement).
22

21

12

commits an act or omission that, if committed in Canada would constitute.27 As well, the Supreme Court has held that an offence is subject to the jurisdiction of Canadian courts where a significant portion of the activities constituting that offence took place in Canada (e.g. a real and substantial link to Canada as country of transmission or reception). In the Internet context, the application of this test requires considering factors such as the situs of the content provider, the host server, the intermediaries and the end user.28 Computer-related offences Computers by their nature may be used for a variety of purposes, only some of which are criminalized in Canada. Since the 1970, various theories and models have been developed to conceptualize computer crime. Two elements remain central: - a computer as the object of the crime (eg. The destruction of the computer or its data); - the computer as an instrument or tool of a crime (eg. automatic scanning of telephone Codes by a computer to make unauthorized use of the telephone system). A computer may be used as a tool to perform non-computer related crimes (eg. threats or harassment by means of the computer). The computer in this sense may also facilitate content-related crimes (eg. child pornography under s. 163.1 of the Code, hate propaganda in s. 319). The Criminal Code provisions on hate propaganda, obscenity and child pornography are equally applicable to materials disseminated on the Internet as they are to materials disseminated in more traditional means. However, in these cases, a computer is often the site of digital evidence of crimes. The Criminal Code also provides means by materials such as child pornography or hate propaganda may be seized or their removal from a computer system ordered.29 While the traditional crimes apply to the Internet,30 new technologies do raise new issues in respect of these offences. For example, with respect to the offence of obscenity (s. 163, Criminal Code), courts must address what is meant by "distribution" or "circulation" in the Internet context. In contrast, mere possession of child pornography is an offence under s. 163.1. Possession again presents a definitional issue in the age of new technologies - does this include the "possession" of an image on the screen, material on diskette or on the hard drive? Computers may also be used as a tool (or instrument) to perform computer related crimes (e.g. unlawful destruction of data by viruses and worms). In these cases, the computer may be used to commit the crime and may also be the object of criminal behaviour (ie. other attacks by other computers, whether by means of an intrusion or not). In Canada,
See Section 7ff of the Criminal Code. See Society of Composers, Authors and Music Publishers of Canada, supra, at paras. 58-61, citing Libman v. The Queen, [1985] 2 S.C.R. 178. 29 See s. 164, 164.1 and s. 320, 320.1 of the Criminal Code. See also s. 13 of the Canadian Human Rights Act. 30 See Society of Composers, Authors and Music Publishers of Canada, supra, at paras. 8 20, for a description of the Internet and internet transmissions.
28 27

13

offences under s. 326 (theft of a telecommunication), s. 342.1 (unauthorized use of a computer) and section 430(1.1) (mischief) would apply. Making or possessing, selling, offering for sale or distributing devices for the commission of a s. 326 or s. 342.1 offence is also criminalized.31 Search and Seizure provisions of the Code In Canada, investigations are generally conducted by the police, independent of the judiciary. A judge will judge the sufficiency of applications by police for search and seizure. Police may consult the prosecutor at the investigative stage for legal advice. This is often the case in more complex cases. Sections 487 of the Criminal Code permits a judge, with authority for a specified territorial jurisdiction, to issue a warrant to a named peace officer or other public officer to search a building, receptacle or place for anything on or in respect of which any offence under the Criminal Code or any other Act of Parliament has been or is suspected of having been committed and to seize it. The peace officer seeking the warrant must provide the judge with the sufficient factual basis to demonstrate that there are reasonable grounds to believe that the search will: afford evidence of the commission of the offence, reveal the whereabouts of the person believed to have committed the offence or anything that it is reasonably believed was used to commit the offence or any offence-related property.32 The Criminal Code does not give a judge the authority to grant a computer system search warrant that is not specific to a particular location. However, police are granted the authority to search for information contained on or available to the computer system subject to the warrant, to reproduce the data and to seize printouts of the data and to use equipment in the place to do so. As well, persons who are in possession or control of the place being searched shall permit the searches to be conducted, upon presentation of the warrant.33 Other warrant provisions, particularly the general warrant provision, may also apply to the investigation of computer crimes.34 Electronic Surveillance provisions of the Code The Code provisions applicable to the use of electronic surveillance were adopted in June 1974. The focus of these legislative amendments was to protect individual privacy from unwarranted intrusions by wire-based interception devices while permitting the effective application of the criminal law.

31 32

See s. 327 and 342.2 of the Code. Section 487(1) of the Criminal Code. 33 See s.487(2.1) and (2.2). 34 See s. 487.01 of the Criminal Code.

14

Part VI of the Code permits the interception of private communications35 based on a judicial authorization36 for the purposes of investigating certain listed offences.37 A judge must consider the factual basis upon which the interception is to be authorized and generally requires that other means of obtaining the evidence have been exhausted.38 In the warrant, the judge will limit the nature and scope of the surveillance and incorporate minimization safeguards to protect innocent third parties. The Code includes other provisions to provide notice to the target, though this may be delayed in limited circumstances, and to require annual reports to Parliament on the use of electronic surveillance intercepts.39 Lawful Access consultations In 1999, the Canadian government recognized that new information and communications technologies were increasingly challenging the investigative abilities of law enforcement and national security agencies. The government recognized that complex and unique technologies render the gathering of evidence more difficult and costly and may create safe-havens and intelligence gaps. Rapidly evolving technologies also give rise to new types of crimes and the commission of traditional crimes through new means, as well as expanding the impact of criminal behaviour outside territorial boundaries. The government conducted a comprehensive review of legislative options to support its lawful access capabilities. On the basis of a consultation document,40 the government consulted with interested stakeholders (internet service and other telecommunications providers, law enforcement bodies, privacy advocates and interested non-governmental organizations) on various lawful access proposals. They focused on two key areas: ensuring that communications service providers (wireline, wireless and ISPs) have the technical capability to provide lawful access; and developing amendments to the Criminal Code and other acts of Parliament to ensure that Canadas laws keep pace with new technology and international developments.
A private communication is defined in s. 183 of the Code to mean any oral communication or any telecommunication, that is made by an originator who is in Canada or is intended by the originator to be received by a person who is in Canada and that is made under circumstances in which it is reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it, and includes any radio-based telephone communication that is treated electronically or otherwise for purpose of preventing intelligeible reception by any person other than the person intended by the originator to receive it. 36 In R. v. Duarte, the Supreme Court of Canada held that the interception and recording of information should be considered a search in all circumstances save where all parties to a conversation expressly consent to the recording. The Court went on to hold that while s. 184 of the Code permitted participant surveillance, where one party to the conversation consents to its recording, s. 8 of the Charter required prior judicial authorization for such intercepts: [1990] 1 S.C.R. 30 at 42 46. 37 See s. 183 of the Criminal Code. 38 See s. 186 of the Criminal Code. 39 Code, ss. 184ff. 40 Lawful Access Consultation Document, August 25, 2002. See at http://www.justice.gc.ca/en/cons/la_al/index.html.
35

15

Bill C-74 was tabled in Parliament in the fall of 2005 to address the first area.41 However, the Modernization of Investigative Techniques Act died on the order paper when the previous Government fell. Efforts to enact Criminal Code amendments began with the introduction of a package of amendments to address capital markets fraud which had originally been part of the lawful access proposals. Sections 487.011 to 487.017 of the Criminal Code provide for: (1) a production order from persons other than the suspect for the production of documents, copies of documents or data and (2) an order for the production of financial or commercial information from financial institutions or other persons required to report under Canadas money laundering and terrorist financing regime42. A judge may, on application from persons or institutions subject to a production order, exempt an applicant from an order in respect of privileged information, where it is unreasonable to require the person to produce the document, data or information, or where the document is not in the applicants possession.43 Persons may not be excused from complying with an order on the basis that the information may incriminate them or subject them to a proceeding or penalty. Rather, documents produced may not be used in evidence against the person in any criminal proceedings except proceedings for perjury, giving contradictory evidence or fabricating statements.44 Other proposed Lawful Access Criminal Code amendments aim to revamp Part VI of the Code. Its provisions are increasingly difficult to apply to new types of communications technologies, having been enacted at a time when rotary phones were the main means of telecommunication. The amendments to Part VI would also address a significant challenge for prosecutors and police, namely the increasing reliance of police on traffic data and e-mails as evidence in the conduction of investigations. As discussed above, Canadian law currently allows for the search and seizure of computer data under a search warrant under Part XV of the Code and for the interception of private communications under authorizations in Part VI of the Code. It is technically possible to obtain an email communication at several locations between the times it is composed until the time it is read by the recipient. In practice, police often use search warrants to seize e-mails when they are stored in a computer system, whether on the senders mail server or on the recipients mail server. In contrast, police often rely on Part VI authorizations to intercept emails when they are in transmission, whether during input at the keyboard of the sender, during transmission between the senders computer and the mail server of his ISP, during the transmission between the senders ISP and the recipients ISP and during the reception by the recipient of the transmitters
41

http://www.parl.gc.ca/legisinfo/index.asp?Language=E&query=4580&Session=13&List=toc.

42

Again an order may not be made against an institution or reporting entity if itself is under investigation: s. 487.013(1).

43

The orders may, however, contain terms and conditions that the judge considers advisable to protect solicitor-client privilege. 44 Section 487.016 of the Criminal Code.

16

message. Thus, the same communication may be considered a private communication, benefiting from the safeguards provided under Part VI of the Code, while depending on where the e-mail is, it may be considered to be data which can obtained with a search warrant, which offers lesser protections. The Criminal Code amendments propose to treat all private communications the same. The reference in the definition of private communication to the fact that the originator has to reasonably expect that the communication will not be intercepted by a third party would be removed. A statement that a private communication is one that is made in circumstances in which there exists a reasonable expectation of privacy for the person making it, would replace it. Consideration is also being given to removing reference to location of originator and recipient.45 The amendments would clarify when Part VI applies to a private communication and when it does not. The acquisition of a private communication under Part VI must be contemporaneous to the communication being made while private communications carried out in a manner that creates records (e.g. emails and faxes) could be seized after they are carried out (i.e. not contemporaneously). Other new orders are contemplated: Production Orders - Two production orders on a threshold of reasonable grounds to suspect would be created for (1) tracking information and (2) transmission data. The tracking information order would provide lawful authority for police to obtain information held by third parties that may assist in locating a person e.g. where the person last used his debit card. The transmission data order would permit police to lawfully obtain information such as traffic data generated by a telecommunications transmission and held by third parties (eg. ISPs). However, the order would not permit police to obtain the content of the communication. Preservation Orders These procedural mechanisms would permit the immediate safeguarding of data or documents in the control of the custodian for a limited duration. The do not delete order would require a custodian to save data that they currently have and that is relevant to a specific investigation or proceeding but only until a search warrant or production order is obtained in respect of that information. Amendment to other warrant provisions would update the tracking and DNR warrants.46 As well, further changes would consolidate into Part VI all police powers which allow the surreptitious recording and intercepting of ones private activities, including video surveillance, to ensure police practices in respect of video surveillance are uniform across

Other proposed modifications include replacing the expression electro-magnetic, acoustic, mechanical or other device by interception device (Sections 183, 191 and 342.1) and standardizing reference to telephone, telegraph, cable, etc. to the generic term telecommunications. 46 See ss 492.1 and 492.2 of the Criminal Code.

45

17

the country.47 Policy work is ongoing to develop and refine these proposed amendments to the Code.

47

Although section 487.01(5) clearly provides that several provisions under Part VI apply mutatis mutandis to video surveillance warrants, police forces of different jurisdictions obtain general warrants for video surveillance with or without meeting these legal requirements.

18