Lawful Access Bill, 2026

Moved second reading of Bill C-22, An Act respecting lawful access.

He said: Honourable senators, thank you for the opportunity to rise as the Senate sponsor and speak on Bill C-22, An Act respecting lawful access.

We live in a world where digital tools are woven into almost every part of our daily lives. There is very little we do that does not intersect with technology — from banking and entertainment to shopping and, importantly, communicating with one another.

While technology has brought many economic, social and cultural opportunities to our world, it has also brought numerous challenges. There are many criminals and bad actors who skillfully exploit these challenges for their own ends. We see digital tools used for money laundering, child sexual exploitation, extortion, human trafficking, auto theft, hate crimes and violent extremism, among many other serious offences.

After 35 years in law enforcement, I have seen how profoundly technology has changed policing. When I began my service, an investigator dealing with a telephone number generally knew which carrier operated the line and which jurisdiction to approach. Today, an investigation may begin with nothing more than a username, an IP address or a message sent through a platform headquartered outside Canada, with data stored in yet another country.

The harm, however, is not virtual. Behind the screen is a real victim: a child being exploited, a senior who has lost a lifetime of savings, a family being threatened or a business owner afraid that the next message may become an act of violence. Most significantly, our digitally connected world has removed many of the geographical barriers that once limited how criminal, terrorist and violent extremist networks could operate.

Actors leverage internet-based communications, social media platforms, chat rooms and digital marketplaces to facilitate their illicit activities. Criminals and other bad actors can now communicate, plan and carry out their activities across borders, often without leaving their homes and while hiding behind layers of anonymity.

To put it into perspective, fraud, identity theft, identity fraud and extortion collectively represented 62% of all online-related crimes in 2024, with fraud being the most commonly reported crime by victims, accounting for 46,301 incidents. It is also a significant vector for child sexual exploitation, with child sexual abuse or exploitation material accounting for 10,786 police-reported online-related incidents in 2024, representing 12% of all online crimes reported to the Canadian police.

These figures reflect only the incidents reported to the police. Many crimes still go unreported, including because victims may lack confidence that police can act effectively under laws that have not kept pace with the speed and complexity of digital crime.

These trends highlight that all forms of communication are being used as a core tool to plan, practise and operationalize illicit activities. Our investigative and intelligence tools must keep pace with modern and sophisticated crime.

The status quo was designed for another era and is increasingly out of step with the way evidence is created, moved and stored today. Law enforcement has told Parliament repeatedly that its tools must be modernized if the police are to investigate serious offences, protect victims and bring offenders before the courts in a timely and effective way.

In major crime investigations, time is not an abstract concern. The first hours can determine whether evidence is preserved, whether a victim is protected and whether an offender is identified before another offence occurs. Digital evidence can be moved, altered or lost with the speed of a keystroke.

That concern came into sharp focus on August 11, when I joined my colleagues Senators Colin Deacon, Katherine Hay and Salma Ataullahjan at Toronto Police Headquarters for a Senate Financial Crime Roundtable. We heard directly from investigators and specialists from police services across Canada. Their message was candid: Financial crime has modernized rapidly, while our legal and institutional response has not kept pace.

Investigators described financial crime as a race against time.

Proceeds of crime and electronic evidence can pass through several accounts, jurisdictions or digital services in seconds, while responses to production orders and related requests may take 30 to 60 days or longer. That experience speaks directly to elements of Bill C-22. An investigation may begin with nothing more than a telephone number, an IP address, an account identifier or a pseudonymous online profile. The confirmation of service demand is intended to identify the provider connected to that lead. A judicial production order can then be sought for defined subscriber information, and the proposed process for foreign service providers can assist where relevant information is held outside Canada.

The What We Heard report also records a problem of fragmentation. The police, financial institutions, telecommunications providers, regulators and government agencies may each hold one part of the picture. If those pieces cannot be linked lawfully and quickly, opportunities to protect victims or preserve evidence can be lost. Part 2 is relevant because a lawful order is only useful if the provider can locate and produce the information it is legally required to provide. Bill C-22 will not resolve separate issues such as court delays or asset recovery. Its role is narrower: making targeted lawful access more workable while retaining judicial authorization, privacy protections and independent oversight.

When Toronto Police Chief Myron Demkiw testified at the Standing Committee on Public Safety and National Security, he emphasized that:

Our role is to prevent these offences, bring offenders to justice and provide a voice for victims who have experienced some of the most difficult of circumstances. However, because technology has evolved so quickly in recent years, we are encountering roadblocks in some of these investigations.

This point was echoed by Thunder Bay Police Chief Darcy Fleury when he said:

This is not about expanding unchecked powers. It is about ensuring that when police have lawful grounds to act, they can do so in a timely way, especially when lives are at risk.

A former president of the Canadian Association of Chiefs of Police stated:

From online child exploitation to extortion, home invasions, carjackings, drive-by shootings, hate-motivated crime and extremism, lawful access is absolutely essential, and it is needed now. So, on behalf of the Canadian Association of Chiefs of Police, I would like to thank this government, and I hope that all parliamentarians will work together to ensure the safety and security of this country.

Finally, I would like to draw my colleagues’ attention to the words of Rob Farrer, President of the National Police Federation, who offered the following perspective on Bill C-22:

Bill C-22 represents a measured and balanced approach to addressing long-standing operational gaps that our members face whilst conducting investigations in the digital age. It takes a significant step towards ensuring that court-authorized investigative orders can be carried out effectively, while preserving judicial oversight and privacy protections. The National Police Federation urges the Senate to swiftly pass Bill C-22 without further weakening its core provisions, ensuring RCMP officers have the lawful powers they need to investigate serious crime, protect victims, and help keep Canadians safe.

Honourable senators, that is the central purpose of Bill C-22: to help protect Canada and Canadians from serious crime by ensuring that lawful investigative steps can be taken without unnecessary delay.

My years in policing taught me something equally important: Investigative authority earns public confidence only when it is exercised within clear legal limits. A warrant is not an inconvenience to justice. It is one of the foundations that give a lawful investigation its legitimacy. Public safety and privacy are not competing luxuries. In a democracy, both must be protected.

As many colleagues will know, Bill C-22 is the product of several iterations. It has been shaped by parliamentary debate, committee studies and input from law enforcement, privacy experts, civil liberties organizations and the technology sector.

At each stage, concerns have been examined and, where possible, reflected in amendments intended to help combat serious crime and hostile state activity while respecting the rights and freedoms of Canadians.

I want to emphasize the importance of that collaborative process. During committee hearings and debate in the House of Commons, amendments were adopted to strengthen and clarify the bill, particularly in relation to cybersecurity, accountability, transparency, oversight and data protection.

In my view, the bill now before us is considerably stronger. It advances an important public safety objective while placing meaningful limits on the exercise of these authorities. Our task in the Senate is to examine whether that balance is clear, durable and workable in practice.

That does not mean every question has been answered; far from it. Technology companies, privacy advocates, civil liberties organizations and legal experts continue to raise concerns about encryption, metadata retention, confidential ministerial orders and international data obligations. Sponsorship of a bill does not relieve the Senate of its duty to test those concerns. It makes that duty more important.

Honourable senators, let me now turn to the substance of Bill C-22. The bill is organized around three central pillars. Together, they form a framework that addresses the complexity of the digital environment while remaining anchored in the rule of law and the Canadian Charter of Rights and Freedoms.

First, it would modernize the legal powers through which law enforcement may obtain information in support of an investigation.

Second, it would ensure that electronic service providers, or ESPs, have the technical capability to respond when they receive a lawful request, production order or warrant.

Third, it would strengthen oversight, transparency and review of lawful access to data and information in Canada. To modernize lawful access authorities, Bill C-22 would create a “confirmation of service” demand. On reasonable grounds to suspect, a telecommunications service provider could be required to answer a very narrow and limited question: Does it provide, or has it provided, telephone or internet access services to a specified subscriber, client, account or identifier? The answer would be “yes” or “no.” This would help law enforcement or CSIS identify which provider may hold relevant information so that investigators can direct any subsequent judicial application to the right place.

The legal threshold for issuing that demand is “reasonable grounds to suspect.” That is an established Charter standard requiring objectively ascertainable facts and more than a mere hunch. It is lower than “reasonable grounds to believe” because the demand is intended to answer a limited routing question rather than to disclose the content of a communication.

The bill would also create a production order through which a judge or justice could authorize law enforcement to obtain defined subscriber information, such as a name and address, from a service provider.

During the legislative process, the proposed definition of “subscriber information” was narrowed. It now captures information that may identify the subscriber or client and describe the services provided, but not the content accessed through those services.

The Supreme Court’s decisions in R. v. Spencer and R. v. Bykovets remind us why this distinction matters. An IP address and subscriber information can connect anonymous online activity to a named person and, therefore, engage section 8 of the Charter. Under Bill C-22, obtaining the defined subscriber information would require a judicial production order. The separate yes-or-no confirmation requirement is narrower, but it is a provision that deserves careful attention because even limited digital information can become revealing when combined with other data — the mosaic effect.

Bill C-22 would also modernize search warrant powers for computer data and clarify the conditions that a judge might impose to protect the interests of people whose information could be incidentally captured.

Given the transnational nature of modern crime and the widespread use of cloud services, Bill C-22 would create a new, judicially authorized process allowing Canadian police to request transmission data or subscriber information from a foreign service provider, including social media and artificial intelligence companies, where that information would assist an investigation. The request would not itself compel the foreign provider; production would remain subject to the applicable foreign law and arrangements.

The bill would also enhance international cooperation by facilitating the court-ordered production of specified electronic data in Canada at the request of foreign partners while requiring a Canadian judge or justice to be satisfied that the applicable domestic legal threshold has been met.

Finally, Bill C-22 would codify and clarify a principle already recognized in common law: A police officer does not require a production order, warrant or confirmation of service demand merely to receive or act on information that a person provides voluntarily where that disclosure is otherwise lawful. This does not create a power to compel information nor does it authorize a disclosure that another law prohibits. By stating the principle expressly in the Criminal Code, the bill would help standardize its understanding and application among law enforcement agencies across Canada.

The bill would also clarify when police may receive and act on publicly available information, information required to be provided by law and information obtained in exigent circumstances.

Bill C-22 would also confirm that a judge issuing a transmission data-recorder warrant may impose conditions to protect a person’s interests. This can matter where information concerning innocent third parties is captured incidentally. A judge could restrict collection, access, use or retention. The provision permits those protections, although it does not make deletion of unrelated information automatic, which is another issue that the committee might wish to examine.

Let me offer a practical example. Consider a family or small business owner receiving extortion threats through a social media account operated under a pseudonym. The new authorities could help law enforcement identify and locate the person sending those threats more quickly. Police could seek judicial authorization to request the relevant IP address from the foreign company operating the platform. They could then ask Canadian telecommunications providers, through a confirmation of service demand, whether they serve that IP address. Once the correct provider answers “yes,” police could apply to a court for a production order requiring the defined subscriber information associated with it, potentially including the suspect’s name, address and telephone number.

Under the present system, investigators might have to send voluntary requests or general production orders to several telecommunications companies simply to determine which provider holds the relevant information. That process can consume 30 to 60 days — valuable time — while threats continue, evidence disappears or victims remain at risk.

The proposed process would be more predictable and efficient for investigators and service providers alike, allowing police to move more quickly in fast-moving and devastating cases while preserving judicial authorization for the disclosure of subscriber information.

That example is particularly real for communities confronting extortion. I have heard directly from families and business owners who describe the fear created by a threatening message received on a phone. For them, delay is not a procedural inconvenience; it is another hour or another night spent wondering whether the threat will be carried out.

For these modernized authorities to work, an electronic service provider that receives a lawful request, production order or warrant must have the basic technological capacity to locate, isolate and produce the information it is legally required to provide. That is why Bill C-22 would enact the supporting authorized access to information act. That act would regulate the technical capabilities electronic service providers need in order to respond to lawful access requirements. It would establish baseline obligations for designated classes of providers to develop and maintain the technical ability to comply with lawful access orders.

I want to be very clear: The new act would not itself create new powers for law enforcement or CSIS to access information. It is intended to ensure that an authority already granted under the Criminal Code or the Canadian Security Intelligence Service Act can be carried out effectively.

Put plainly, a court order has little practical value if the provider receiving it cannot identify and produce the information covered by that order. Part 2 is intended to address that operational gap, not to remove the requirement for lawful authority in the first place. The technical requirements would be set out in regulations.

Comparable lawful access capability frameworks exist among our Five Eyes and other democratic partners, although each country has designed its own model and safeguards.

In circumstances not adequately addressed by the regulations, including an emerging technology or threat, the Minister of Public Safety could issue a ministerial order requiring an electronic service provider to establish specified technical capabilities. Such an order would not be valid unless approved by the Intelligence Commissioner. This mechanism would give the government limited flexibility to respond to operational needs and technological change, subject to independent review and a maximum duration of two years. The Intelligence Commissioner would have to assess whether the minister’s conclusions were reasonable. The National Security and Intelligence Review Agency, or NSIRA, would receive the order and supporting information for review purposes.

Those are significant safeguards, and the Senate should examine whether they are sufficient for every type of obligation that could be imposed. Regulatory enforcement tools would permit Public Safety Canada to respond to non-compliance through administrative monetary penalties or regulatory offences.

Honourable senators, I have heard the concerns raised by industry and others about these authorities. The need for safeguards was emphasized throughout debate and committee hearings, and those concerns deserve serious scrutiny.

The Governor-in-Council and the minister would be required to consider several factors when developing regulations or issuing ministerial orders, including feasibility, costs, effects on users, privacy and cybersecurity. Every ministerial order would require approval by the Intelligence Commissioner, creating a second and independent level of scrutiny. The order and the supporting record would also be provided to NSIRA.

Metadata retention requirements would be limited to those categories determined by the Governor-in-Council to be essential for effective and timely investigations or CSIS activities for a reasonable period not exceeding six months. The bill expressly excludes the content of communications, web browsing history and social media activity. Metadata is not merely harmless technical information: Patterns showing when, where and with whom a person communicates can reveal intimate details about relationships, movements and associations.

The six-month ceiling and essentiality test adopted in the other place are important improvements. Committee review should still clarify precisely which categories may be retained, who may later access them and what must happen when the retention period expires.

An electronic service provider would not be required to comply with an obligation that would introduce a systemic vulnerability into its electronic protections or prevent it from correcting one. This safeguard is particularly important where encryption, authentication and the security of millions of users may be affected. No government should improve one dimension of public safety by creating a weakness that criminals or hostile states could exploit in another. The committee will need to hear technical evidence on how the term “systemic vulnerability” will operate, particularly where a proposed capability is described as “targeted” but could affect a product, an update system or a wider class of users.

The Minister of Public Safety would also be required to prepare and publish an annual report on the use of these authorities, with an unredacted version provided to NSICOP and NSIRA where the public version contains redactions.

To give another practical example, suppose that law enforcement is investigating the movements of a transnational organized crime group or terrorist cell. A ministerial order could require a provider to maintain the technical capability needed to respond to a lawful demand for location-related information. It would not, by itself, give investigators access to anyone’s location. Actual access would still require the separate legal authority applicable to the investigation.

The distinction is important: capability is not the same as access. The safeguards and oversight in the bill are intended to ensure that neither regulations nor ministerial orders become a shortcut around the warrant and production order requirements found elsewhere in Canadian law. These protections seek to balance the rights of law-abiding people with the need for law enforcement and intelligence agencies to act in a timely way when public safety is at risk.

Honourable senators, Bill C-22 is ultimately about keeping Canada and Canadians safe while remaining faithful to the law that protects us all. Our law enforcement and domestic intelligence agencies work around the clock in a threat environment that continues to evolve. Criminal organizations, terrorists and hostile state actors are using technology in ways that existing legislation and regulations were never designed to address. Technology allows these actors to cross borders, conceal their identities and move evidence or proceeds more quickly than ever before.

As our democratic partners have done, Canada needs a framework that addresses present technology while retaining enough flexibility to respond to what comes next. There is no single Five Eyes model that Canada can simply copy. The United Kingdom and Australia have broad capability regimes, while the United States and New Zealand are narrower in important respects.

Our responsibility is to build a Canadian framework that responds to genuine investigative needs and complies with our Charter, our legal traditions and our commitment to cybersecurity. Law enforcement and the Canadian Security Intelligence Service, or CSIS, must be able to adapt, but that adaptability must remain bound by law, independent authorization and meaningful review. Bill C-22 provides a framework for that work.

Canadians expect us to take reasonable and effective action to reduce threats to their safety and their way of life. They also expect their privacy, cybersecurity and Charter rights to be protected. We must provide both assurances: lawful authorities will be exercised when needed, and their exercise will remain transparent, accountable and proportionate.

Trust is key. People are more likely to report crimes, preserve evidence and cooperate with police when they believe authorities will use their powers lawfully and with restraint. Effective policing has always depended on that partnership with the public.

Bill C-22 does not authorize mass surveillance. Its stated purpose is to help law enforcement and CSIS direct their efforts towards real and serious threats through lawful, targeted processes.

Colleagues, I also know we have heard concerns that lawful access capabilities could create cybersecurity vulnerabilities, and Operation Salt Typhoon has frequently been cited as a warning of what can go wrong. However, it is important to look closely at what investigators have said about how that breach occurred, and I quote from Senator Cantwell’s opening statement during the Subcommittee on Telecommunications and Media Hearing on December 2, 2025:

So how did this happen? Senior national security officials said the breach occurred in large part because telecommunications companies failed to implement rudimentary — rudimentary! — cybersecurity measures. Investigators found legacy equipment not updated in years, router vulnerabilities with patches available for seven years — seven years! — that were never applied, and hackers acquiring credentials through weak passwords.

Used properly, these tools can help identify threats earlier and narrow down where investigative resources should be focused.

Before concluding, I would like to thank the witnesses, stakeholders and members of the House of Commons who offered thoughtful evidence and amendments on Bill C-22, including those who continue to raise concerns about privacy, encryption, cybersecurity and the treatment of metadata.

I encourage honourable senators to continue this collaborative and careful work throughout our debates and committee review. I ask colleagues to support the bill at second reading so that the appropriate Senate committee can examine its provisions closely, hear from those affected and determine whether further clarification or amendment is required. Let us work together to protect Canadians and maintain their trust in the institutions entrusted with their safety. We owe them nothing less.

Canadians deserve to feel safe and secure as they go about their daily lives, and they deserve confidence that public authorities will respect the legal limits placed upon them. Bill C-22 gives us an opportunity to strengthen the security of our country and our communities while upholding the rights and values that define Canada. Let us undertake that work with care and purpose.

As this bill makes its way through the Senate, I expect that colleagues and witnesses will bring forward important perspectives on how its provisions will operate in practice. I want to be clear that supporting the objectives of this bill does not mean treating every provision as beyond improvement. As we hear from service providers, privacy and security experts, law enforcement, civil society and others, there may be areas that merit further consideration without undermining the bill’s original purpose. If that is the case, we should be prepared to make those changes.

The true measure of this legislation will not be how much information the government can collect; it will be whether victims are protected sooner, whether serious offenders are brought to justice and whether Canadians can remain confident that the same law empowering the state also restrains it. Thank you.

Would Senator Dhillon take some questions?

Yes.

Thank you.

I appreciate your speech. As the critic of this bill, I’m glad to hear you actually say that if the amendments don’t take away from the original scope of the bill, you think that the government should accept them, so we’ll see if they do.

Yet again, the Liberal government still hasn’t made its Gender-based Analysis Plus document for Bill C-22 public, even though this bill was first introduced almost 18 months ago in the House of Commons. This lack of transparency has become another new pattern of the Carney Liberal government.

Last year, I actually wondered if this new government was continuing to even prepare and consider these kinds of GBA Plus documents that they previously considered so important. I asked Justice Minister Sean Fraser about that, and he did confirm that the cabinet does continue to consider these GBA Plus documents with every government bill. The difference now with the Carney Liberal government, though, is that they do not put these GBA Plus documents on the public government website as the former Liberal government used to. Also, the Carney Liberal government doesn’t even provide these GBA Plus documents to parliamentarians like me, the opposition critic of this bill, unless we really pester them about it.

Senator Dhillon, at my critic’s briefing yesterday, I asked the large number of government officials who were present for the Bill C-22 GBA Plus document, but I still don’t have it. Could you please ensure that I receive this as soon as possible?

Also, why has the government become less transparent when it comes to these GBA Plus documents?

Thank you, senator, for the questions.

To the first question, yes, I will do that. To the second question, I don’t have that answer.

As the government sponsor of the bill, you’re the one whom I have to ask questions to because I don’t see any speeches from the front row here.

Senator Dhillon, a sizable part of Bill C-22 seeks to make major amendments to the Criminal Code of Canada, and many of its provisions trigger considerable concerns for Canadians about their impact on Charter rights and privacy rights.

You and I are both members of the Standing Senate Committee on Legal and Constitutional Affairs, and, as you know, we deal with these kinds of complex government bills on those very topics at that committee all the time. Since our Legal and Constitutional Affairs Committee actually finished our work on government bills after a lot of time was taken in the last several months, we have a little bit of an open window right now.

Senator Dhillon, given those factors, would you agree with me that Bill C-22 would seem to be best suited to be studied at the Senate’s Legal and Constitutional Affairs Committee, the committee on which you, as the sponsor, and I, as the critic, both serve?

Thank you again for that question, senator. I think the best committee for this particular legislation to go to is a question for the leaders to determine, so I will leave that decision with them. Thank you.

You can certainly provide your personal view on it. Oftentimes, the government or the opposition take very seriously the considerations of the sponsor and the critic on those very topics, so I hope you express your views to the government as to where you think it should go and if you agree with me on that point.

As you’re likely aware, Bill C-22 is another government bill that has one part the MPs in the official opposition caucus strongly support and another part that those same opposition MPs vehemently oppose.

Here, with this bill, Conservative MPs supported Part 1 and fought hard against the controversial Part 2. In the other place, Conservative MPs pushed to split Bill C-22. That would have allowed the widely supported Part 1 provisions to pass quickly while allowing for more study, debate and, perhaps, considerable amendments to be made to fix Part 2.

Instead, the Liberal government rejected that common-sense proposal to split the bill, and in late June, they forced Bill C-22 through the House of Commons through highly undemocratic means that even included the government, shockingly, truncating House of Commons committee time as they were studying that very bill.

Senator Dhillon, the Liberal government might think that coupling these types of bills with a good part and a very bad part is good politics, but it’s not good Parliament. It’s, in fact, very bad Parliament. They are doing the same thing with Bill C-39 with the controversial labour component. Yesterday, the Minister of Justice even announced that the government will do this for an assisted suicide bill that they say they will introduce this fall.

Senator Dhillon, do you agree that creating these types of omnibus bills where you have a major part of the bill that is highly controversial and completely opposed by huge numbers of Canadians makes Parliament and parliamentarians’ lives very difficult? Wouldn’t it be much more efficient and effective to split those types of bills?

Thank you for the question, senator. I will keep my comments to the scope that I have, which is Bill C-22.

I’m certainly not going to be presumptuous, but I’m hopeful that this chamber will send this work to committee, and that would be the place where we would examine exactly those questions.

I’m grateful to our Conservative colleagues over in the other place who have raised those concerns, and I expect we will hear some of those concerns here as well. This is the time for us to do our work and to look at those concerns and examine them. Where it is meaningful and does not take away from the intent and spirit of this bill, I think amendments are welcome.

Senator Dhillon, when I had my critics’ briefing yesterday, I was quite surprised to hear how long the large number of government officials expected it to take for regulations or the regulatory phase to kick in once Bill C-22 passes, if it does, indeed, pass.

I actually didn’t really get an answer as to how long it would take. They said the first phase of regulations would probably take 18 months to two years after the bill receives Royal Assent, and then it goes on and on. I asked, “Are you saying it would take several years?” They replied that they didn’t know about several years, so I asked, “How about five years?” They said, “Yes, probably five years,” but they didn’t even know. It’s so far into the future that they can’t even say.

They also told me that Bill C-22, this lawful access bill, is something that has come before Parliament or has been something that the department has tried to introduce in some capacity seven different times — I think they said it was three times under Conservative governments and three or four times under Liberal governments. That’s the kind of thing that concerns me because there’s obviously a reason that it didn’t go through any of those times.

What would you say about both of those different points? First, there is the lengthy period of time that the regulations could take — so long that they didn’t even know when they’d come into effect. And second is the number of times that these types of things were proposed, which you probably saw during your long law enforcement career. They have never come through before now, and that makes a parliamentarian very concerned to know why it would take so long and what the problems are.

Thank you, Senator Batters, for that.

For the first part, I share your concerns. I think there is a lot of anticipation on the part of law enforcement and security services to have this become operational as quickly as possible. However, we are already 12 to 14 years behind, so I think we want to take our time. We want to make sure those regulations are done properly and that they meet the conditions of the legislation. While we want to speed up the process — I agree — it’s also necessary that we take the time.

I will leave that there, but I will continue to monitor this bill and watch the work that’s being put into it and how quickly we can make it operational. That’s my biased policing and law enforcement side speaking.

On the second part, with respect to how long it’s taken to get here and the number of iterations there have been, I think we already see that there are complexities with this bill, and that’s why we continue to converse about it. There will be more conversations at committee and more work to be done. It’s not an easy bill. There are complexities. There are challenges that we will have to discuss and debate. We need to land on a balanced approach that, as I shared in my speech, continues to support Canadians with the expectations that they have of police and security services to provide safety, security and protection while ensuring that all of the things that we hold dear and abide by — whether it’s our Charter, Constitution or other protections that Canadians hold dear — are not in any way, shape or form pierced or narrowed.

We’re behind the times. We need to get with the times. We have become a target country because we don’t have these laws in place and because those bad actors look around the world and determine that we are a soft target. We have to move off that particular board of being a soft target.

Thank you very much for laying out what Bill C-22 is supposed to do. It’s encouraging to know that, regardless of the party in the other place, it is supported all around while we recognize that the devil is in the details.

I would highlight and underline that one of the most critical pieces is that Canada is one of the few countries — or I might posit that it’s the only country — under the Five Eyes without lawful access in place. I have to reiterate the fact that the nature of crime and terrorism has evolved, and we must put due diligence into this. However, if we keep waiting, we will never get there.

My question has to do with what has been going on with some of our Five Eyes partners. This is not a magic bullet, no matter what we do to try to address these issues. Are you aware of any testimony that came out of the other place or anything that’s within your knowledge as to the challenges that our partners are experiencing with lawful access?

While they may be different, we will be potentially exchanging information with them. Thank you.

Thank you for that question, senator. The same challenges that other countries are facing, we will face, but we have a greater challenge right now. We can’t even start. We don’t even have the starting point without this law.

We will just be arriving at the party once Bill C-22 is passed, where we’ll only just be beginning to address some of the threats that we are facing in our country today and have been for a number of years.

I think we’ll have to have conversations about cybersecurity and encryption. Those are pieces that have come up in the recent while. Privacy concerns have also come up. These are questions that we have to wrestle with. We must. That’s the job we have been given. That’s our responsibility, and we’ll wrestle with them with the rule of law that we have in place and the values that we hold dear in Canada in the Constitution and our Charter of Rights.

I welcome those conversations and challenges, but we cannot do without this law.

I will look to my colleague Senator Batters. This is a complex bill, and it absolutely does have a legal component, but it also has an intense security and intelligence element to it where you need both pieces plus more to actually make it into a whole.

This is a question for you. As the decisions are made by leaders as to which committee this should go to, I am hoping you will consider that it maybe shouldn’t sit in just one committee. Given its complexity, perhaps it must go to more than one committee, possibly to the Legal Committee and also to the National Security, Defence and Veterans Affairs Committee. Would you agree?

Thank you, senator. As I shared with Senator Batters, those are decisions I’ll leave for the leaders to make. The Government Representative is here, and those are the kinds of decisions I will leave to the leaders to make. Certainly, they are hearing all that is being said here.

Yes.

Senator Deacon, I’m sorry to interrupt.

Senator Dhillon, I have a list of senators who wish to ask a question. Are you asking for leave for five more minutes to answer questions?

I will give five more minutes because I have a plane waiting.

Honourable senators, is leave granted?

Thank you, Senator Deacon. We’ve had some of these discussions already. I am not using the term “backdoor access” because it alludes to a whole bunch of different things that are not true. There are a lot of miscommunications and misconceptions. Lawful access is what we’re looking for. That is access that has been granted by the judiciary based on the evidence presented in front of that judiciary or that trier of fact.

Ultimately, as I shared with you here as well, there is no interest on the part of this bill and the government to create vulnerabilities in systems, to create less protection for Canadians. So, it would be counterproductive and counterintuitive to create, as you put it, back doors that create more harm to Canadians, when the bill’s intention is to reduce harm and prevent harm. Aptly, it should provide the tools that are necessary for law enforcement to carry out their duties.

But, as I have said before, there is work to be done. I’m not presumptuous, but I hope my colleagues will send this to committee, and we can examine this at length there.

I think we may be talking about the same thing but in two different ways. These are lawful access questions.

Of course, there is private information. We are not allowed to receive information that is protected under the Privacy Act and under the Charter. There is no way for an ESP to just hand over that information to us.

We have a provision around voluntary information sharing, but it’s narrow; it doesn’t cover everything. There is also a danger at times of receiving information that does not meet the scrutiny of the courts. Then your entire case fails, and the investigation fails. A number of criteria must be taken into account by that investigator or that applicant or that lead investigator before they can simply just ask for the information.

This is a longer conversation that requires that testimony to be available to us, in front of us, and then those questions can be answered in a very detailed way in that committee work. I hope I gave you some response.

Would you take another question?

Yes.

Bill C-22 mandates metadata collection and retention for up to a year. The Charter Statement for Bill C-22 was tabled on April 24, 2026.

You might have said this in your speech, but can you again go over the government’s position that section 8 of the Charter — the Charter protections against unreasonable search and seizure — is being respected?

Yes, absolutely. Look, only one part of this — that is the first part, where we’re looking to determine who the provider is — is not requiring judicial authorization. You don’t have to go in front of a judge. You are simply saying, “Are you the provider for Baltej Dhillon?” The answer is yes or no. That is all that the police officer receives. That’s the only part that does not require judicial authorization.

Everything else after that requires the investigator to be able to defend an affidavit in front of a justice of the peace or the courts to allow the courts to make a determination on whether they are lawfully given permission through a warrant or a production order to receive that information. That is where the Charter is protected.

Honourable senators, I rise today to speak to Bill C-22, An Act respecting lawful access.

This is a technically complicated bill, both in the legal sense and in the sense that it deals with new and emerging technologies. It is a bill that will require — that will demand — a thorough investigation by the Senate.

Proponents of this bill argue they need these powers to combat things such as terrorism, organized crime and international child sexual exploitation. Indeed, we all agree that law enforcement should have the necessary and proportionate powers to access and collect information relevant to investigations.

But will these substantive changes to our understandings of privacy and search and seizure under the common law and the Canadian Charter of Rights and Freedoms really make us safer? Or will they open us to new vulnerabilities? What are the implications for our civil liberties and our right to privacy? And, less philosophically, what are the dangers that this bill might make Canadians less safe?

Instead of helping police services and the Canadian Security Intelligence Service, or CSIS, to find new ways to protect us, Bill C-22 threatens to create a multitude of new ways for malicious hackers — be they blackmailers, fraudsters, stalkers, terrorists or foreign state actors — to compromise our data, compromise our national security and compromise the architecture of the internet itself.

Bill C-22 comes in two parts. The first part amends the powers and authorities in the Criminal Code, the CSIS Act and the Mutual Legal Assistance in Criminal Matters Act to make it easier for Canadian police and intelligence services to access information about telecom subscribers, to make it easier for Canadian authorities to request subscriber information from foreign electronic service providers and to make it easier for foreign governments and agencies to enforce production orders on Canadian service providers.

Bill C-22 would mean police would not need a warrant of any kind to compel a phone company or an internet provider to confirm that someone is their customer.

Bill C-22 would also allow police to obtain production orders for subscriber information merely on the basis of “reasonable suspicion,” rather than the traditional test of “reasonable grounds to believe.”

These amendments to Bill C-22 would also allow police to access “. . . information . . . available to the public” about a person under investigation without any court order. That may sound like benign common sense. After all, if the information is public, why shouldn’t the police have it? But there is a difference between public information that we know to be public — like we used to see in our old-fashioned telephone books — and information that has been made public in something like a data breach, for example.

The questions we must ask are, “Made available to the public by whom? And how? And for what purpose?”

Then there is the issue of making it easier to share information about Canadians with foreign police and intelligence services. Clause 29 of the bill amends the Mutual Legal Assistance in Criminal Matters Act to authorize Canadian courts to enforce orders from foreign authorities — countries that have a mutual legal assistance treaty with Canada — to obtain either subscriber or transmission information. However, there are plenty of countries with which Canada has mutual legal assistance agreements, including liberal democracies, which simply don’t have the same privacy protections Canadians enjoy.

Let’s think hard about the implications of turning over the private information of Canadians to foreign police or foreign intelligence agencies from countries whose political and legal cultures don’t align with our own, especially while we are or soon will be engaged in active negotiations with other countries on treaties around information sharing, the United States’ CLOUD Act and artificial intelligence.

Now we come to the more problematic Part 2 of the bill. This part enacts the supporting authorized access to information act, which gives the government dramatic new powers to compel businesses to assist in law enforcement.

Let’s start with the issue of metadata retention.

Bill C-22, as amended in the other place, grants the government the power to require electronic service providers — a term that is not defined — to retain the metadata of all their Canadian customers for six months just in case the police should ever have cause to look something up in the course of a hypothetical future investigation.

Understand that this isn’t about obtaining a court order to retain the metadata of a suspect under investigation. This means retaining all our data — yours, mine, Madam Speaker’s, the data of your kids, parents and neighbours — just on the off chance that someday, someone might want to see it.

Now, this is an improvement on the original version of the bill, which required metadata retention of 12 months, but it is still a huge practical technical challenge and an extraordinary expense for communications companies to maintain that much digital information, especially for companies such as Signal, which retain little or no metadata now, or only retain it for a few days or hours.

Should we really want to grant the government the power to force companies to retain a welter of data on us all without any individualized basis for suspicion? This bill would conscript telecommunications and internet service providers, turning them into surveillance agents of the state, indiscriminately affecting everyone, rather than any specific individual under investigation at any specific time. We must ask ourselves if that is congruent with our constitutional practices of protecting us from unreasonable search and seizure.

Now, once upon a time, we didn’t fret quite so much about metadata because there was almost too much of it for it to be all that useful. It was just a collection of digital breadcrumbs, and it took time to extract useful patterns. However, advances in artificial intelligence have made it far easier to harvest and collate very telling information indeed in order to find all kinds of privacy-revealing patterns of behaviour, effectively kneading those digital breadcrumbs into a whole loaf.

Then comes the most dangerous part of this bill: Now that those companies are being forced to hoard a huge amount of incriminating data on all of us, we’re making that data vulnerable to hacking. That’s because this new act would compel specially designated core provider companies — again, the term is not defined in the bill, and we have no idea how those core providers will be designated — to build surveillance and capture technology directly into their services and platforms so that companies could be compelled, under a production order, to turn over information. In other words, companies could be compelled to create a weak spot — a sort of secret tunnel — in their systems to give police and security intelligence services a way to gain lawful access to that mountain of metadata and other personal information about users.

My friends, there is simply no way to create a secret passage that only the good guys can go through. We are effectively compelling electronic service providers to create a treasure trove of data and to draw a treasure map to that data at the same time.

Now, let’s be clear: “Encryption” is not a dirty word. Encryption is not some sneaky, bad thing that only the bad guys use. End-to-end encryption protects Canadians online every minute of every day when we engage in online banking, online shopping and online medical appointments. Add a weakness to the system, and it is suddenly open to exploitation — to hacking — and not just by old-fashioned human beings but by indefatigable autonomous AI agents, which can scan and scan and scan for vulnerabilities, swarming like busy bees until they find an opening to hack. Once they find one, they can hack at a pace no humans can match.

This should have us all on guard, whether we’re guarding against embezzlement, terrorism, corporate espionage or good old-fashioned political espionage.

In the United States in 2024, a sophisticated hacking group, Salt Typhoon, credibly linked to the Chinese government, took advantage of parallel lawful access back doors built into their systems by companies such as Verizon and AT&T to compromise huge swaths of the American telecommunications infrastructure. The Salt Typhoon hackers are believed to have intercepted communications from Donald Trump, JD Vance and members of Congress.

Salt Typhoon accessed databases that allowed the Chinese government to know which of their spies were under surveillance in the United States, and they also accessed millions of metadata records: Who called whom, when? This was information that gave the Chinese government detailed records of journalists who might later be posted to Beijing, detailed records of Chinese students studying in the United States and detailed records of Chinese-Americans with families in China who might be put under pressure.

In December 2024, in the wake of the Salt Typhoon attack, America’s Cybersecurity and Infrastructure Security Agency, along with the National Security Agency, the Federal Bureau of Investigation, the Australian Signals Directorate, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security and New Zealand’s National Cyber Security Centre, put out a joint statement calling for a hardening of cybersecurity and for end-to-end encryption to the maximum extent possible.

It makes no sense for Canada to back away from that precautionary principle now. How ironic would it be, if, in an effort to give police and the Canadian Security Intelligence Service, or CSIS, more powers to protect us, we actually left ourselves far more susceptible to attacks by hostile foreign powers, terrorist groups or organized crime gangs?

While that’s the greatest risk, it’s far from the only challenge created by the supporting authorized access to information act, or SAAIA. We risk losing access to vital services provided by major telecommunications and internet companies and platforms — services Canadians have come to rely on. We also risk chasing tech innovators and investors right out of the country.

For example, companies who use open-source software, such as the non-profits Signal and Mozilla Firefox, have said that requiring them to comply with the conditions of Bill C-22 would make it virtually impossible for them to operate in Canada at all.

The Canadian homegrown company Psiphon provides open-source circumvention technology, which allows people in countries such as Iran, Burma, China, Russia and Cuba to reach the open internet and get their news directly from the BBC, Deutsche Welle and Radio Free Europe.

Psiphon argues that Bill C-22 assumes that providers can quietly build lawful access capabilities aimed at specific targets. That assumption, however, does not hold for the sort of open-source software Psiphon relies on. Psiphon states:

Our source code is public and independently verifiable, so any government-mandated access mechanism would become part of publicly available code. It could not be confined to Canadian authorities or to a specific investigation. It would be visible to, and exploitable by, security researchers, criminals, and the very authoritarian governments our users are trying to escape.

Senator Audette, I didn’t hear what you just said.

I wanted to mention that we received a message earlier from the interpreters regarding the noise currently being picked up.

Okay.

I wish to remind senators to be careful when a senator rises to not move around too much near the microphone. Thank you.

I understand the keen desire of our police and security agencies to have lawful access to all possible information in their efforts to protect Canadians, but it’s hard to understand how we could keep Canadians safe with policies that compromise our online safety, civil rights and privacy at every turn.

Let me conclude with a short passage from a comprehensive brief written by Tamir Israel of the Canadian Civil Liberties Association, and Kate Robertson and Cynthia Khoo from the University of Toronto’s Citizen Lab on Bill C-22:

Courts are the primary vehicle for authorizing most surveillance activities carried out by CSIS and the police. Yet, under the SAAIA, obligations that dwarf most powers in the Criminal Code in terms of intrusiveness can be imposed without judicial authorization or appeal. . . . The result is a national surveillance system that might far outstrip current legal regimes in both scope and intrusiveness, and that relies on an oversight framework created for the extra‑ordinary foreign intelligence context rather than for domestic policing.

We need a lawful access regime in this country, but we need a lawful access regime that can withstand constitutional scrutiny, a lawful access regime that respects Supreme Court jurisprudence around privacy and search and seizure, and a lawful access regime that does not create dangerous, unintended consequences for us all.

Thank you. Hiy hiy.

Will Senator Simons take a question?

I would be happy to.

Thank you, Senator Simons. I’m curious if you obtained the public report Special Report on the Lawful Access to Communications by Security and Intelligence Organizations, published by the National Security and Intelligence Committee of Parliamentarians, or NSICOP, in September 2025 and if you have reviewed it in the context of Bill C-22.

I regret to say I have not.

Thank you. Senator Simons, may I recommend that you review the report? It deals with data preservation and data retention and the issues of whether communications service providers, or CSPs, can provide this, what should and shouldn’t be protected and how it reflects to the organizations that are trying to protect our national security and protect Canadians.

I’m sorry, but is there a question you wanted to ask?

Yes. Have you reviewed with CSPs what the actual cost would be to them? They have projected publicly, and I believe you referenced that this would be an undue cost when there is a great deal of data already protected. Have you obtained what that cost is?

Senator Simons, your time is up. Would you like a few more minutes to answer the question?

I would ask the chamber to give me five more minutes.

Is leave granted?

Yes, in fact, I have met with a number of service providers, including Telus, NordVPN, Psiphon, Signal, Mozilla and others.

Nobody has a precise figure because it is a hypothetical, but Telus, for example, explained to me they currently generally retain metadata for three days — 72 hours — and that they would be required to build huge new technology to retain that data.

I met with people from the department this morning and raised this question with them, as did Senator Moodie. The answer we got was that these are very wealthy companies and that asking them to spend money is perhaps not unreasonable.

The challenge, of course, is that those expenses will be passed on to us as consumers. I don’t imagine that telcos are going to absorb these costs without making sure that our phone and internet bills go up. Canadians already pay some of the highest bills. There are logical consequences to the idea of retaining metadata for six months.

But, as I said in my speech, the issue is not primarily one of cost or inconvenience. It’s that we are putting in one place a whole bunch of good, juicy information and then saying we’re also going to make it easy to hack.

So the issue isn’t just that we should weep for the telcos or even over our own phone bills. The issue is that by creating a target and then drawing a bull’s eye on it, we put ourselves all at risk.

I have a question for Senator Simons.

I believe that there were people who said I could only take this one question.

Of course.

I am trying to follow your reasoning. It doesn’t seem all that unreasonable to me to ask wealthy companies to retain information such as metadata for six months. When the police are trying to track down individuals, including sex offenders and criminals, isn’t it a good idea to have six month’s worth of metadata that they can use to help them locate those individuals?

Three days seems like a very short retention period to me. What would you tell those who say that these big companies already have a lot of information about us? It is not as though we are the ones coming up with the idea of giving them confidential and personal information about people. As soon as someone creates a social media account, these companies retain information about them.

Why are people opposed to the idea of regulating the internet? The fact of the matter is that much of what once took place in person now happens online. If we do not regulate the internet, all sorts of things will happen. I’m thinking in particular of predators, children and those who are more vulnerable. I must admit that I’m having a hard time understanding your argument.

I would be very happy to answer this question.

I’m going to answer in English because it’s easier for me to express myself that way.

There are two answers to this, one practical and one philosophical. Let’s start with the philosophical one.

It’s one thing to surveil somebody who is under suspicion, where there are reasonable grounds to suspect or believe that somebody is doing something wrong. This would surveil all of us. It’s true that if I sign on to Facebook, my expectation of privacy should be based on the fact that Meta platforms are constantly harvesting my data. But when I make a phone call or use a secure end-to-end encrypted service like Signal, I do have an expectation of privacy, and I have not surrendered that.

So, it is true that commercial, algorithmically driven platforms absolutely harvest our data and use it to sell us things and push our political buttons. But we are talking about something that would surveil everybody, even on platforms where they have an expectation of privacy.

The second question is a practical one. There are platforms, including Signal —

Senator Simons, your time has expired. If you want more time, you need to ask for it.

If I may just have one more minute, because my deskmate, charming though he is, is a delightfully disruptive force.

Is leave granted?

I heard a “no.” Leave is not granted.

Honourable senators, in my response to the Speech from the Throne on Tuesday, I argued that Canada must respond decisively to a changing world without surrendering parliamentary oversight.

Bill C-22 tests that principle. I have serious reservations about passing it in its present form. My concerns centre on the security of the access capabilities it would authorize and the exclusion of important executive orders from ordinary parliamentary scrutiny.

The government must demonstrate that the investigative benefits justify the additional risks. I do not believe it has yet done so. Committee study must test that case, hear the right witnesses and remain open to substantial amendments.

The House of Commons passed Bill C-22 on June 18. Subsequent disclosures have materially changed the evidence available to us.

In July, OpenAI disclosed that experimental models had escaped containment and compromised Hugging Face. These tests involved reduced safeguards, not ordinary consumer use. Nevertheless, a supposed boundary between an evaluation and real infrastructure failed.

On September 8, Google Threat Intelligence reported adversaries moving from simple prompts to agentic workflows: AI systems carrying out linked tasks with less human intervention. It described an attacker planning, building and executing a mass credential-theft campaign in under six hours.

Google was reporting activity from April to June, before the bill passed the other place. But this newly published evidence after the bill left the House of Commons shows how little time defenders may have to respond.

On September 24, Australia disclosed that an AI agent had gained unauthorized access to public and non-public files in its Medicare statistics portal. The activity occurred in June; notification only came in September. At disclosure, no personal information was believed to have been accessed.

Closer to home, on September 29, Canada’s Cyber Centre acknowledged reports of suspicious activity, including suspected AI agent activity targeting government websites.

It explicitly reported no indication that government systems had been compromised.

These are different events. They are not a catalogue of confirmed government breaches. Together they warrant fresh examination of how reliably agents remain within authorized boundaries.

Nor is the concern confined to agents acting unexpectedly. On September 14, the Cyber Centre warned of an active global campaign using AI to attack internet-exposed industrial controllers. Here, hostile operators were deliberately using AI.

Anthropic’s Fable and Mythos labels likewise illustrate the distinction between powerful underlying capabilities and safeguards governing their use. These tools can assist defenders, but a system faithfully following instructions is not necessarily safe when the person giving those instructions has malign intentions.

None of this establishes that AI has broken strong encryption. It does challenge confidence that sensitive access mechanisms can remain beyond unauthorized reach.

There is already a warning directly relevant to this bill. In briefing materials prepared for his Commons appearance, the Privacy Commissioner cited Salt Typhoon’s compromise of American telecommunications networks and the reported targeting of systems used for court-approved access. He warned that similar Canadian capabilities and metadata retention requirements could expose providers to “precisely such attacks.”

The Canadian Civil Liberties Association, or CCLA, and Citizen Lab made a related argument in their joint brief. They pointed to a leaked NSA document describing exploitation of foreign lawful interception capabilities.

These are historical precedents, not new AI incidents. Their significance is that infrastructure created for authorized access — lawful access, if you will — can itself become a valuable intelligence target. AI-enabled attacks give us reason to reassess that long-standing danger.

The bill can specify who is legally authorized to obtain information, but it cannot, by declaration, ensure that nobody else can obtain it.

Part 2 could require providers to maintain technical access capabilities and retain prescribed categories of metadata for up to six months. It does not, itself, create one central government database or automatically authorize access to everyone’s communications, but compulsory retention and additional retrieval capabilities could increase the amount of sensitive information available to an intruder. That risk must be assessed — not dismissed because the intended use is lawful.

The House of Commons added safeguards, including limits on compelled decryption. Providers need not comply with requirements that would introduce a systemic vulnerability. Those protections matter. But why rely on providers declining unsafe requirements rather than expressly prohibiting the government from imposing them? The committee should ask whether the bill places too much responsibility on individual providers to identify and contest risks that affect the public.

The definition of “systemic vulnerability” also excludes certain risks confined to information about people already subject to lawful access authority. It also makes recognized international technical standards relevant to assessing credible risk.

But how can we be confident that the weakness remains confined to one target? What happens when an AI system exposes a risk that a standard did not anticipate?

My support for recognized standards in the Throne Speech from a few days ago was not a claim that compliance guarantees security indefinitely. Consider two hypothetical scenarios: A provider implements a targeted access capability judged to be safe. A more capable AI system subsequently discovers that it exposes other users. Who must reassess it? And can its use be suspended immediately? Alternatively, an attacker compromises an existing provider system without defeating encryption. Would newly mandated retention and retrieval capabilities make the resulting loss more extensive? I’m not predicting either outcome. I’m asking who must establish that these risks are acceptably controlled and what happens when that assessment changes.

The committee should hear from the Cyber Centre; Google’s threat investigators; engineers from OpenAI, Hugging Face and Anthropic; and independent investigators, including Transluce and METR. It should also invite, of course, the Privacy Commissioner, the CCLA and Citizen Lab authors, independent security experts, cryptographers and provider security engineers.

Police and CSIS should demonstrate the operational needs and explain less risky alternatives. We should examine stronger statutory security limits, independent testing, continuing reassessment, prompt incident reporting and a rapid mechanism to suspend unsafe requirements.

Requirements to retain additional data deserve their own necessity and proportionality assessment. Witnesses should distinguish what is technically possible from what is demonstrably safe at scale. A successful demonstration is not enough. We need evidence about maintenance, failure, malicious insiders and increasingly capable external attackers.

The question is not whether perfect security exists. It is whether the government has made a convincing case for imposing these very additional risks.

That brings me directly to my response to the Throne Speech. Greater executive flexibility should increase the importance of parliamentary oversight, not diminish it. The most troubling exclusion, in my view, is subsection 7(6) of the proposed supporting authorized access to information act, enacted through clause 41.

Section 7 allows ministerial orders imposing requirements that could otherwise be prescribed by regulation. Section 12 lets those orders prevail over inconsistent regulations made under subsection 5(2). Yet, subsection 7(6) excludes them all from the Statutory Instruments Act. Requirements that are regulatory in substance should not lose their ordinary route to parliamentary scrutiny simply because a minister imposes them by order.

Subsection 6(6) excludes temporary exemption orders. Subsection 24(3) excludes compliance orders directing providers to stop contraventions or take remedial measures. Each performs a different function, but each requirement or, I should say, each exclusion requires justification.

The Statutory Instruments Act concerns more than publication. Section 19 provides the ordinary standing referral to the Scrutiny of Regulations Committee, which I co-chair. Excluding an instrument removes that route; it does not merely prevent sensitive information from being published.

As I explained in my earlier speech, the Standing Joint Committee for the Scrutiny of Regulations examines legality, rights and the limits of delegated authority. Its ordinary scrutiny follows the making of an instrument. It is not a general pre‑approval queue, nor is it a cybersecurity certification body.

These exclusions did not go unnoticed in the House of Commons. MP Jacob Mantle challenged the ministerial order exemption, and OpenMedia recommended deleting subsection 7(6). That exclusion, nevertheless, remains. Our task is to examine the unresolved parliamentary question.

Independent intelligence review and parliamentary scrutiny perform different functions. One should not quietly displace the other.

Public Safety and Justice should explain every exclusion. The committee should hear from the Intelligence Commissioner, the review agency and parliamentary law specialists, drawing appropriately on the expertise of counsel, perhaps counsel supporting the Scrutiny of Regulations Committee.

We should examine whether confidentiality can be protected through adapted scrutiny arrangements rather than blanket exclusions. Such arrangements require secure access, workable rules and adequate resources. Simply proposing an in camera meeting is insufficient.

We should also ask whether providers can obtain independent security advice and report dangerous requirements promptly without confidentiality obligations preventing effective scrutiny.

Amendments preserving parliamentary examination, particularly of clause 7 orders, should be firmly on the table for the committee review.

Colleagues, let me summarize my concerns.

We are being asked to authorize highly technical powers that could create new avenues for attack in an already unstable and rapidly evolving environment while removing important instruments from ordinary parliamentary scrutiny.

I do not believe the time is right to grant such sweeping powers on the strength of assurances that have not been adequately tested against the evidence now available. I am not confident that we can pass Bill C-22 as it exists today without significantly increasing the vulnerability of Canadian privacy, data and businesses.

The evidence disclosed since passage in the House of Commons makes the risk of unauthorized access through so‑called lawful access more urgent. I do not believe the government has demonstrated that these capabilities can be created and maintained securely enough to keep pace with AI‑enabled adversaries. Our response should not be to demand impossible guarantees; it should be to demand evidence, enforceable limits and continuing accountability.

In my Throne Speech response, I described the Standing Joint Committee for the Scrutiny of Regulations, or REGS, accepting a practical solution on the accessibility of incorporated standards. That showed scrutiny accommodating flexibility, not surrendering its purpose. We should take the same approach here without assuming that every problem can be solved by guidance after enactment.

Where the evidence does not justify a power, we should be prepared to narrow, remove or defer it. Committee study must be a genuine opportunity to change this bill, not merely a search for reassurance.

If I can have 30 seconds, I will finish.

Is leave granted?

Thank you, colleagues.

Effective investigations matter, so do secure communications and accountable government. In strengthening one part of public safety, we must not weaken another.

Thank you.