Andy Kaplan-Myrth2d ago

📢 Today, TekSavvy published a Quarterly Transparency Report about requests we got from police and how we handled them.

This report covers the period from July to Sept, 2025 and as usual, I’m summarizing that report here 🧵👇🏼

#Privacy #Transparency #TransparencyReport #Telecom #TekSavvy
1/9

Show threadAndy Kaplan-Myrth

Download at https://www.teksavvy.com/policies/legal-stuff/transparency-report/ (now in English and French)

The number of requests and disclosures in this report is pretty typical. In Q3 2025, we got 39 requests and orders, compared to:

59 in Q4 2023
39 in Q1 2024
40 in Q2 2024
40 in Q3 2024
39 in Q4 2024
36 in Q1 2025
51 in Q2 2025
2/9

Apr 2 at 6:33pmWeb
Show threadAndy Kaplan-Myrth2d ago
Requests from federal agencies remains very low compared to pre-2024, at just 2. From 2020-23, the avg number of fed requests per Q was 25; since 2024, it has been under 5. Fed requests dropped in 2024, while Prov requests rose. We don't know why it's happening; changes in police practices? 🤷
3/9
Show threadAndy Kaplan-Myrth2d ago
Our disclosure rate is usually lower for provincial than for federal requests: From 2020-now, we disclosed info for ~90% of fed requests, but 62% of prov. Why? Fed agencies act fast while we have logs and rarely make informal requests. However this quarter, we disclosed for 80% of prov requests.
4/9
Show threadAndy Kaplan-Myrth2d ago
There were 10 emergency requests this quarter, and we identified subscribers in all 10 cases. Average is under 8 requests, so this is a tad high but fairly typical. Our disclosure rate in response to those requests seems consistent -- our policy for when to respond has not changed.
5/9
Show threadAndy Kaplan-Myrth2d ago
We received 2 "Administrative" requests from agencies that are not technically "law enforcement", but had power to compel disclosure, i.e. we had to disclose. Administrative agencies are typically a tax agency or the CRTC's enforcement folks. In this period, we disclosed in 1 out of 2 cases.
6/9
Show threadAndy Kaplan-Myrth2d ago
This quarter, we made no proactive reports to law enforcement. These are when an agent overhears violence or threats. It is never about a customer's online activity; we do not track that. From our stats, we make proactive disclosures about 5 times per year, with a record of 5 in one quarter.
7/9
Show threadAndy Kaplan-Myrth2d ago
Finally, as always: Sometimes our numbers don’t add up perfectly, or may not be totally complete, mostly because it's hard to perfectly keep track of every informal request, including so-called "jurisdiction requests". There may be small discrepancies in our numbers due to that.
8/9
Show threadAndy Kaplan-Myrth2d ago
TekSavvy is the only ISP in Canada (AFAIK) that publishes detailed information about how we handle requests from law enforcement. You can learn more from our Law Enforcement Guide, which includes what info we have about subscribers, and when we do or do not disclose it. https://www.teksavvy.com/policies/legal-stuff/law-enforcement-guide/
9/9
Show threadAndy Kaplan-Myrth2d ago

Thanks for reading -- you can get back to the top of this thread here:

https://mstdn.ca/@andykm/116336547142245489

10/10

Show threadJustin Derrick1d ago
@andykm Requests from federal agencies are low…. because they’re getting the data that meets their needs from somewhere (someone?) else?
Show threadAndy Kaplan-Myrth1d ago

@JustinDerrick My best guess is this: Formerly the RCMP would receive reports or complaints, but most things are outside their jurisdiction, so their purpose is only to find out where the person is so they know what police force to send it to. So they would send us orders just for the customer’s name and address. Then they would send the case to local police to investigate, sometimes starting with another order to us for more information.

My guess about what’s changed is that now they skip the first step and instead rely on geolocation tools to figure out where the IP address probably was, and send it to local police based on that. So not exactly getting information from somebody else, but rather skipping a cycle with IP address geolocation. Which is sometimes incorrect, but is probably more efficient overall.