Greg Young

The Government of Canada introduced legislation for increased monitoring of Internet communication in Canada.

The "Investigative Powers for the 21st Century (IP21C) Act"’s primary obligation appears to be for ISPs to gather and keep tracking information akin to phone records – who contacted who.  Wisely, the act appears to avoid mandating that message contents be archived. 

With some irony, the press releases don’t provide a direct link to the legislation but rather just the parliamentary domain, and this web- and government web site -savvy analyst failed after a good period of searching.  (Don’t anyone say "teh internets tubes" or "the Google" please).

I’ll stay away from any discussion on the privacy impacts, and use this blog post to focus on the act’s efficacy.

The act is well intentioned, but the details are flawed and provides two loopholes for the real bad guys to avoid monitoring.  First, the bill is clearly going to impose the cost of this monitoring on the ISPs, and with a 3 year timetable for compliance by ISPs with less than 100k subscribers and the ability to ask for 2 year extensions.  So where will the bad guys go for the next 3-5 years?  Hmmm…  and encryption and anonymizers are another kettle of fish.

Second, by exempting banks, private networks and charities, the act will target only the dumb and the honest. 

With so many big high tech IT projects in the news in Canada, it is unfortunate that the money and will couldn’t be found to plug the holes in the bucket that the bad guys will use.