บทถอดความฉบับเต็มของ Canada’s Bill C-22: Encryption, Lawful Access, and Systemic Risk

really good article that Mozilla, [02:47] who is the company that makes the Firefox [02:50] web browser, they had a post about this bill in particular [02:55] and kind of the unique aspects of it. [02:59] And I think that's what we wanna talk about today [03:01] on this episode because it is a little bit unique [03:05] because in the United States, [03:07] it's been more of just give us a backdoor. [03:12] And we talked about in previous episodes [03:14] about how way back in the day, [03:18] the FBI was telling Apple [03:21] because of a terrorism related case, [03:24] you need to give us a backdoor into Apple iOS [03:27] so that we can access the communication [03:32] from a person that was suspected [03:35] of creating a terrorism type of event. [03:38] And that is a slippery slope [03:41] because if you do it once for an investigation, [03:46] which obviously has legitimate purposes, [03:48] the argument is hackers and others [03:51] will abuse this backdoor as well. [03:54] And also law enforcement could abuse it as well. [03:57] And that's never happening, right? [04:00] We see this with flock right now in the United States. [04:03] There are a lot of police [04:04] that are abusing this special power. [04:08] And so that is the, I think the core of the argument is, [04:12] can you trust the government [04:13] if there is a backdoor that's created [04:16] into these different systems and technology? [04:18] I don't know if we mentioned the name, [04:20] but it's C-22, Bill C-22 in Canada [04:23] that's, it's actually gone through our parliament, [04:25] the House of Commons, [04:26] and I think it's in the Senate for debate right now. [04:32] Latest breaking news. [04:34] So it's not a law. [04:35] Interesting thing about Canadian laws like this, [04:37] I've covered privacy laws in the past decade or so. [04:40] There was a new law called PIPEDA, [04:43] which is protection of information, [04:45] paper and electronic documents act or something like that. [04:48] Anyway, they can pass the law, [04:51] but there's no way to enforce it [04:53] unless they have what's called regulations. [04:55] And so when they put the implementation together, [04:57] they call that a regulation [04:59] and that's what everybody has to comply with. [05:00] And so even if they pass it as a law, [05:03] nobody's gonna get sort of arrested [05:07] because there's no basis for it, right? [05:09] So they still have a lot to do [05:11] before it really becomes something [05:13] that people have to follow. [05:14] But all that to say, [05:16] having looked at all the ways [05:17] it's been approached before by other governments, [05:19] I gotta say, this is a really Canadian way to look at it [05:22] because we're trying to meet the spirit [05:25] of what law enforcement needs, [05:27] but also respect Canadians' privacy. [05:30] And so what's interesting here is they're saying, [05:34] we know that most platforms and products [05:37] have a bunch of information about their clients, [05:40] naturally that they use for optimization [05:43] with their own sort of abuse monitoring [05:45] and stuff like that. [05:47] And so first of all, [05:49] make sure you retain that stuff for us [05:52] that we can have legal access to. [05:54] And in fact, they're not even saying [05:55] what specific types of data formats [05:59] or channels or media, [06:01] they're just saying anything that looks like something [06:04] that we might have already had a mechanism for, [06:07] we'd like to have access to [06:09] if you've got the data, right? [06:11] And they're saying, [06:12] don't create a special back door just for us. [06:15] But like you said, [06:16] if you're gonna create something to monitor people [06:18] so that you can be helpful to law enforcement, [06:21] don't put any vulnerabilities in it. [06:23] So it's interesting to look at the spirit [06:26] of how this was written [06:26] and the levels of legislation it has to go through [06:30] so far look good, [06:31] but it all comes down to the implementation, right? [06:34] Yeah, that's right. [06:35] And I find it interesting, [06:37] I think the phrase they specifically said is, [06:40] companies should not be required to introduce [06:42] a systemic vulnerability in the solution. [06:46] So essentially they're, like you said, Scott, [06:48] they want to allow companies to build in these, [06:52] and they don't call it a back door, [06:54] but that's essentially what it is. [06:56] But it has to be secure [06:58] so that there are no vulnerabilities [07:00] and that only the government can use it essentially. [07:03] And they say it in a very Canadian way. [07:06] You know, it's almost like they're asking, [07:09] please, can you please do this kindly? [07:11] If it's not too much trouble, can you do this? [07:13] Yeah, yeah, exactly. [07:15] Because everybody in Canada is very nice and polite. [07:19] So let's say most of the US citizens, [07:21] there's a few that are not so happy [07:23] with how we treat US, but yeah. [07:26] Yeah, well, I mean, there's all that stuff, [07:28] tariffs and everything, [07:29] but yeah, this is the kind of a, [07:31] I find it interesting that how [07:34] the Canadian government kind of approaches these issues [07:37] with kid gloves on essentially, you know. [07:41] It's very nice, don't worry. [07:45] Mobile apps are just part of everyday life now. [07:48] Banking, healthcare, shopping, entertainment, you name it. [07:51] And with that comes a lot of trust [07:54] because users are putting their personal data [07:56] directly into your app. [07:58] But here's the reality, mobile apps are a growing target. [08:01] A recent survey found that 72% of organizations [08:04] experienced a mobile app security incident last year [08:08] and 92% say threats are only increasing. [08:12] And the way attackers are going after apps [08:14] is pretty sophisticated. [08:15] They're reverse engineering them, modifying them [08:18]

and redistributing fake versions through phishing campaigns, [08:22] side loading and even third party app stores. [08:25] So from a user's perspective, [08:27] everything can look completely legitimate. [08:30] That's why taking a proactive approach [08:31] to mobile app security really matters. [08:34] You wanna stay ahead of these threats, [08:35] not react after the damage is done. [08:38] This is where Guard Square comes in. [08:40] They provide advanced protection [08:41] for both Android and iOS apps [08:44] along with automated security testing [08:46] to catch vulnerabilities early [08:48] and real-time threat monitoring [08:50] so you can actually see what's happening out there. [08:53] If your mobile app is critical to your business [08:55] and it probably is, [08:57] this is something worth paying attention to. [08:59] You can learn more at guardsquare.com. [09:02] That's guardsquare.com. [09:06] Well, I think it's just a reflection [09:09] of how the government is trying to still, [09:13] to some extent, meet the wishes of the population. [09:17] So, I mean, this just continues that debate, I think. [09:20] And there's the Canadian approach of, you know, [09:23] kid gloves and let's do it nicely. [09:25] And then in other countries, it's not so nice, right? [09:28] Like, I know there are other countries [09:31] like China, for example. [09:33] I mean, this is just mandated. [09:35] I mean, they can go to any company in China [09:38] and get any kind of information that they want [09:40] from their users or whatever. [09:42] And so it's more of a authoritarian play [09:45] in a lot of countries. [09:47] And here in Canada and the United States, [09:49] we debate things. [09:51] We put things through a Congress or a parliament [09:55] to argue the privacy and security issues. [09:59] But I'm always interested to see [10:01] what ends up happening at the end of the day. [10:04] Yeah, based on who pays the most for the... [10:06] Exactly. [10:06] Like, what does this mean if this does pass? [10:09] And like you said, right now it's currently in the Senate. [10:11] This is not a law yet, but it very well could be. [10:14] And that's something that we will keep [10:16] our audience updated on. [10:18] Because this would be, I think, [10:19] if this does pass in Canada, [10:21] I think this would be the first law of its type, [10:24] at least in North America. [10:26] Yeah. [10:27] And I would hope that they do continue, [10:29] as I would expect them to consult with [10:32] cyber security professionals in Canada. [10:34] I know I've seen hearings where they've had [10:36] some of my buddies testifying in committees [10:41] about what's good or bad. [10:42] And they tend to be listened to. [10:45] I don't think there's as much financial leverage [10:48] on the politicians and the processes [10:51] that might be in other countries. [10:53] But in the debates that we've seen before, [10:56] the crux of the debate is how much legitimate improvement [11:01] in the law enforcement process do you expect [11:04] from having direct access to data [11:07] that you wouldn't otherwise, right? [11:08] And I think it was Bruce Schneier and others [11:11] who've argued there really haven't been [11:14] any significant arrests when they've had the data, right? [11:19] Yeah. [11:20] Any more than they would have without getting that stuff. [11:23] So it's interesting to hear those debates. [11:26] That is an interesting argument [11:28] because I've often read and I've seen this myself [11:32] where just good old-fashioned police work [11:35] can actually convict somebody and you're right, Scott, [11:40] like oftentimes you don't even need access. [11:43] It's pretty hard to hide your digital footprint, right? [11:46] Yeah. [11:47] These days, even with VPNs and jump servers and whatever. [11:51] Right, and there's other ways that law enforcement [11:53] can subpoena and get access to data [11:57] that they have already had through existing laws [12:00] and through existing warrant processes [12:03] that like I know in the United States [12:05] and sure this is the same in Canada, [12:06] but the big tech companies like Google and Meta, [12:10] they get subpoenas all the time [12:12] for data and information that is not encrypted. [12:16] It's just part of an investigation [12:19] of what was somebody doing with this account [12:22] on Facebook as an example, right? [12:25] And so that's been in place for decades, right? [12:28] Since the companies even existed and since Facebook. [12:31] Yeah, they've got it down to an art now or a science. [12:32] Yeah, they do. [12:34] Right, and it doesn't require a backdoor bypassing [12:38] an encryption system, right? [12:41] Of where data is actually encrypted. [12:42] That's because they collect everything [12:43] and retain it anyway. [12:45] Correct, exactly. [12:46] So it gets really complicated [12:48] because we talk about like what is the type of data [12:51] that is being requested [12:52] and this is really about encryption at the end of the day. [12:56] It's about data that law enforcement cannot access [12:58] because of a technology [13:00] or because of encryption being implemented. [13:03] And so that is really kind of the crux. [13:04] I think it's a smart way to word it [13:06] because you know that every platform has metadata [13:09] about its customers. [13:11] And so there's no point in overlooking that, [13:15] as you said, for good old fashioned law enforcement [13:18] or investigative processes, you do need that stuff. [13:23] But I think the Canadian method is just not to overstep on [13:27] and create more problems and are needed. [13:30] Yeah, and ask nicely. [13:32] And ask nicely. [13:33] That's right, that's right. [13:34] So we'd love to hear from you. [13:36] What are your thoughts on this topic? [13:38] Do you think that law enforcement [13:39] and do you think governments should have access [13:42] or lawful access to encrypted data [13:45] and should there be backdoors built in [13:46] or these very nice backdoors [13:49] that don't create any security vulnerabilities? [13:52] We would love to hear from you. [13:54] So leave a comment on our YouTube channel [13:56] or you can send us an email, feedback at sharedsecurity.net. [14:00] Lots of ways to get ahold of us, [14:01] but we'd love to hear from you [14:03] and we'll talk about maybe some of the comments [14:05] on the next episode. [14:07] Too bad Kevin wasn't here today. [14:09] Yeah, Kevin's been super, super busy, a lot of traveling, [14:12] but we're gonna get him back on hopefully next week [14:14] because yeah, he has also been very opinionated [14:17] about this particular topic as well, like many of us. [14:21] All right, well, I think that's all we have time for today. [14:24] I wanna thank everyone for listening [14:26] and until next time, stay safe, stay secure, [14:30] and stay private. [14:30] Thank you for listening or watching. [14:32] If you liked this episode, hit subscribe, [14:35] share it with your friends and colleagues [14:37] or jump into our community at sharedsecurity.net [14:40] slash supporter to keep the conversation going. [14:43] Thanks again and we'll see you next week [14:45] for another episode of Shared Security.