3 ms·

what is bill c 22 in a nutshell for non canadians like me ? is this like the patriot act in usa ?

stackghost 5mo ago
https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-reading https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-r...
cmrdporcupine 5mo ago
Basically the same idiocy that the British gov't has also tried to enact around making actually encrypted communication impossible, and giving them the rights to access metadata on the public's communications without warrant, etc.
- deleted 5mo ago
  [deleted]
- allthetime 5mo ago
  How is it possible to make encrypted communication impossible? It’s (for us) trivial to encrypt and sign a message with GPG for instance. Does this allow the government to come to my house if I trade these messages with friends?
  - cmrdporcupine 5mo ago
    Regulation wise, is what I mean. They want backdoors, as in the ability to demand decrypted content, which as you and I both know is not possible if you've built the system with zero-knowledge on the server side ala Signal etc. As far as I understand the proposed bill, a service like that would not be legal to operate in Canada. Which is why Signal and Proton and others have said they would just leave the Canadian market. The Liberals have noted they may be open to amendments to the language around encryption but not to other modifications.
  - Ray20 5mo ago
    > How is it possible to make encrypted communication impossible? Illegal, not impossible
EmbarrassedHelp 5mo ago
Its far worse than the Patriot Act. Its legislation that attempts to weaken and break encryption so that law enforcement and others can access encrypted communications. It also seeks to require mandatory suspicionless metadata for all online services. The legislation was explicitly written to target both telecom companies and every online service. Citizen Lab has a good writeup on the legislation here: https://citizenlab.ca/research/analysis-of-proposed-surveillance-law-expansion-under-bill-c-22/ https://citizenlab.ca/research/analysis-of-proposed-surveill...
- dyauspitr 5mo ago
  [flagged]
- beloch 5mo ago
  The collection of metadata is almost certainly bad for people even if they do nothing wrong. It can (and will) be sold if regulations and enforcement are not airtight. It will almost certainly be leaked as a result of incompetence, negligence, or outright criminality. The only way to prevent your metadata from getting out into the great unknown is to ensure it isn't collected in the first place. If you don't see what the big deal is, I suggest you consider the recent leak of voter data in Alberta. For those unfamiliar, a list of eligible voters is routinely shared with political parties for the purposes of running their election campaigns. One of those parties, the "Republican Party of Alberta", shared their copy of the list with separatists, who made it freely available to any of their pals. What's the big deal you ask? Who cares if their address is public knowledge? Isn't this the sort of thing that used to be in phonebooks? Just for one example, anyone who has moved away from an abusive ex now has to worry about their address, phone number, etc. being made available to that abusive ex. Privacy isn't just important for people who like wearing pants. C-22 is supposed to protect Canadians but, instead, it endangers them. This is a bad bill.
llm_nerd 5mo ago
It's online and easy to read, and is a modernizing of laws around online systems. It is a deeply imperfect bill -- personally I think it is basically DOA and will not receive assent -- but a lot of the reaction to it are classic partisan hysterics (you can already see a bunch of those people throughout this discussion). https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-reading https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-r... The parts that are garnering a lot of negative feedback is 1) requiring core providers (a list as yet undefined), and any others if specifically directed to, to maintain a rolling year of metadata that the government can request on a targeted individual with a warrant. This is obviously at odds with "no log" VPNs in particular. And let's be real: 99% of the industry already logs everything. 2) "the development, implementation, assessment, testing and maintenance of operational and technical capabilities, including capabilities related to extracting and organizing information that is authorized to be accessed and to providing access to such information to authorized persons;" The #2 could potentially imply secondary decryption keys and the like, though the bill explicitly says the requirement cannot impose a systematic vulnerability, and the government has pointed to that and said they want no such thing. So VPN providers are saying "we don't want to log", and encryption providers are saying "be much clearer in what you mean by systematic vulnerability. Define this explicitly".
- zuzululu 5mo ago
  how would they force vpns like mullvad to turn over the log when there isn't any? are they just going to ban specific vpn providers then ? this is absurd!
  - llm_nerd 5mo ago
    Well that's the crux of it and why some VPN providers have pushed back. If the law passed, and if those VPNs got added as core providers, they would either need to log the metadata or stop operating in Canada, and several have said they would stop operating in Canada. There are arguments for all sides, and I do think the narrative gets monopolized by the hysterical. On the one side I like torrenting without concern, but on the other it would be nice if services didn't provide cover for people to send death threats, bomb threats to schools because they fly a pride flag, VoIP swatting, and so on. Though ultimately limiting just VPNs directly operating in Canada just offshores the problem so the solution doesn't really achieve anything.

https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-reading https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-r...

cmrdporcupine 5mo ago

Basically the same idiocy that the British gov't has also tried to enact around making actually encrypted communication impossible, and giving them the rights to access metadata on the public's communications without warrant, etc.

deleted 5mo ago
[deleted]
allthetime 5mo ago
How is it possible to make encrypted communication impossible? It’s (for us) trivial to encrypt and sign a message with GPG for instance. Does this allow the government to come to my house if I trade these messages with friends?
- cmrdporcupine 5mo ago
  Regulation wise, is what I mean. They want backdoors, as in the ability to demand decrypted content, which as you and I both know is not possible if you've built the system with zero-knowledge on the server side ala Signal etc. As far as I understand the proposed bill, a service like that would not be legal to operate in Canada. Which is why Signal and Proton and others have said they would just leave the Canadian market. The Liberals have noted they may be open to amendments to the language around encryption but not to other modifications.
- Ray20 5mo ago
  > How is it possible to make encrypted communication impossible? Illegal, not impossible

EmbarrassedHelp 5mo ago

Its far worse than the Patriot Act. Its legislation that attempts to weaken and break encryption so that law enforcement and others can access encrypted communications. It also seeks to require mandatory suspicionless metadata for all online services. The legislation was explicitly written to target both telecom companies and every online service. Citizen Lab has a good writeup on the legislation here: https://citizenlab.ca/research/analysis-of-proposed-surveillance-law-expansion-under-bill-c-22/ https://citizenlab.ca/research/analysis-of-proposed-surveill...

dyauspitr 5mo ago
[flagged]
beloch 5mo ago
The collection of metadata is almost certainly bad for people even if they do nothing wrong. It can (and will) be sold if regulations and enforcement are not airtight. It will almost certainly be leaked as a result of incompetence, negligence, or outright criminality. The only way to prevent your metadata from getting out into the great unknown is to ensure it isn't collected in the first place. If you don't see what the big deal is, I suggest you consider the recent leak of voter data in Alberta. For those unfamiliar, a list of eligible voters is routinely shared with political parties for the purposes of running their election campaigns. One of those parties, the "Republican Party of Alberta", shared their copy of the list with separatists, who made it freely available to any of their pals. What's the big deal you ask? Who cares if their address is public knowledge? Isn't this the sort of thing that used to be in phonebooks? Just for one example, anyone who has moved away from an abusive ex now has to worry about their address, phone number, etc. being made available to that abusive ex. Privacy isn't just important for people who like wearing pants. C-22 is supposed to protect Canadians but, instead, it endangers them. This is a bad bill.

llm_nerd 5mo ago

It's online and easy to read, and is a modernizing of laws around online systems. It is a deeply imperfect bill -- personally I think it is basically DOA and will not receive assent -- but a lot of the reaction to it are classic partisan hysterics (you can already see a bunch of those people throughout this discussion). https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-reading https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-r... The parts that are garnering a lot of negative feedback is 1) requiring core providers (a list as yet undefined), and any others if specifically directed to, to maintain a rolling year of metadata that the government can request on a targeted individual with a warrant. This is obviously at odds with "no log" VPNs in particular. And let's be real: 99% of the industry already logs everything. 2) "the development, implementation, assessment, testing and maintenance of operational and technical capabilities, including capabilities related to extracting and organizing information that is authorized to be accessed and to providing access to such information to authorized persons;" The #2 could potentially imply secondary decryption keys and the like, though the bill explicitly says the requirement cannot impose a systematic vulnerability, and the government has pointed to that and said they want no such thing. So VPN providers are saying "we don't want to log", and encryption providers are saying "be much clearer in what you mean by systematic vulnerability. Define this explicitly".

zuzululu 5mo ago
how would they force vpns like mullvad to turn over the log when there isn't any? are they just going to ban specific vpn providers then ? this is absurd!
- llm_nerd 5mo ago
  Well that's the crux of it and why some VPN providers have pushed back. If the law passed, and if those VPNs got added as core providers, they would either need to log the metadata or stop operating in Canada, and several have said they would stop operating in Canada. There are arguments for all sides, and I do think the narrative gets monopolized by the hysterical. On the one side I like torrenting without concern, but on the other it would be nice if services didn't provide cover for people to send death threats, bomb threats to schools because they fly a pride flag, VoIP swatting, and so on. Though ultimately limiting just VPNs directly operating in Canada just offshores the problem so the solution doesn't really achieve anything.