RE: https://ottawa.place/@Cassandra/116682485584524974

Clause-by-clause on Bill #C22 at SECU starts in five hours (3:30 Eastern Canada). Televised. https://www.ourcommons.ca/DocumentViewer/en/45-1/SECU/meeting-41/notice

The committee has given itself three hours. Witnesses are senior people from CSIS, Justice, Public Safety and the RCMP. I would expect questions to these witnesses to be limited to things like what the bill changes and how it would operate. They are obviously not people who are inclined to identify problems at clause-by-clause when the House wants to rise for the summer and they want these surveillance powers themselves. But also procedurally: clause-by-clause is about the text of the bill, not new evidence.

But also again: opposition members will try to derail through procedure. Points of order, points of privilege, motions, voice votes, whatever. It will waste time but ultimately they don't have the numbers to overturn the chair's rulings, as incorrect as they may be. Majority government rules.

Zero percent chance the clerk will have his ringer on.

https://www.ourcommons.ca/DocumentViewer/en/45-1/SECU/meeting-41/notice

#FediLaw #CanPoli

"Bill C-22 builds the blanket model of data retention that the European courts have consistently rejected, as it would require providers to retain, for up to a year, the date, time, duration, origin of communications, and location of the devices involved. The result is a surveillance map of the movements and communications practices of virtually all Canadians for a year, the very opposite of what recognizing privacy as a fundamental right envisions." From @mgeist.

https://mas.to/@mgeist/116691913037603373

#C22 #FediLaw #CanPoli

Michael Geist (@[email protected])

Attached: 1 image As the AI strategy launches today, the disconnect is dizzying: my post on how the government cannot claim privacy as a fundamental right in the morning and then rush through mandatory metadata retention that overrides it in Bill C-22 in the afternoon. https://www.michaelgeist.ca/2026/06/new-privacy-rights-in-the-morning-mandatory-metadata-retention-in-the-afternoon-how-bill-c-22-undercuts-the-ai-strategy-before-it-launches/

mas.to

Do I want to inflict clause-by-clause on myself? It's a miserable experience at the best of times, trying to figure out what an amendment to a bill that amends an act actually does.

https://parlvu.parl.gc.ca/Harmony/en/PowerBrowser/PowerBrowserV2/20260604/-1/45519

SECU Meeting No. 41

Meeting No. 41 SECU - Standing Committee on Public Safety and National Security

Jenny Kwan proposes the first amendment, despite not being a regular member of the committee (because the NDP doesn't have enough MPs to merit a permanent spot).

And then immediately into a Conservative point of order on briefs that have yet to be distributed. The Liberal Chair evades a direct answer. A different Conservative asks if the (non-partisan) Clerk has a ballpark answer on how many briefs are outstanding. The Chair declines to let the Clerk take the mic.

Gross. So gross.

Some discussion of the difference between storing information on one’s phone versus the cloud. Negative a hundred points to the DoJ for assuming a hypothetical judge is necessarily a "he.”

Discussion of amendments getting slightly derailed because the witness didn't have copies of the amendments. Good thing we're rushing this shit.

The Bloc points out that the witnesses are specifically there from the pro-surveillance camp, not the privacy camp. Every answer from their perspective is “your proposed amendments to Bill C-22 as the government drafted it would make it harder for police.”

First voice vote fails (on an amendment apparently recommended by the Privacy Commissioner). 6 no, 5 yes. C'est comme ça.

Conservative echoing the Bloc that the witnesses are here to "give more access to law enforcement," not to balance that with Canadians' Charter right to privacy.

I think we're still (after an hour and a half) on clause 4. The bill has 48 clauses. The most controversial is 41. Seems unlikely they'll get through by 6:30.

"So far you've been very good at giving me clear answers" says the Liberal MP to the witness who agreed with his hypothetical about Karla Homolka getting photographs of abuse developed at a photo store decades ago.
100% of government witnesses agree: they could not possibly speculate on why the Privacy Commissioner recommended amending Bill C-22.
Conservatives looking to introduce a motion to invite the privacy commissioner. The (Liberal) Chair said they're not allowed, because of a previous decision of the committee, which he declined to pinpoint. The (non-partisan) Clerk whose literal job is procedure made what looked to me like a skeptical face and moved out of frame.
Okay, that's enough for me for now. They for sure won't be done by 6:30 but I don't know if they'll keep going or come back another day.

Sunday morning, currently no indication on the SECU website of when the next clause-by-clause meeting on #C22 will be held (parl.ca/secu). (Probably Tuesday.)

The most recent meeting for which there are published minutes and a transcript is May 7, a month ago. This means they're doing clause-by-clause without minutes, without transcripts, and without submitted briefs and objections.

I'm musing about a letter to whatever Senate Committee ends up studying this, pointing out that they don't have to legitimize this farce. They can, this chamber of sober second thought, insist on a bare minimum Parliamentary standard of democracy and respect for official languages and Charter rights. Apparently it's as easy as splitting the bill.

What fun that would be for historians, if the independent senators declined to endorse a police state. At the very least they could slow it down a bit.

Ah, the blessing of having friends you can send questions to like "are you able to spit up examples of the Senate splitting a bill"?

Yup! C-103 from 1998 (the Atlantic Canada Opportunities Agency / Enterprise Cape Breton Corporation) and C-10 from 2002 (firearms / cruelty to animals).

Procedurally it looks like a motion that happens when the bill gets referred from the Senate to committee for study. It could be that if the bill gets sent to committee whole then a motion to split the bill *at* committee would be considered out of order. So that helps establish timeline.

If anybody wants to watch FOUR hours of clause-by-clause on Bill C-22 today: https://www.ourcommons.ca/Committees/en/SECU
SECU - Home - House of Commons of Canada

The Standing Committee on Public Safety and National Security reviews legislation policies, programs and expenditure plans of government departments and agencies responsible for public safety and national security, policing and law enforcement, corrections and conditional release of federal offenders, emergency management, crime prevention and the protection of Canada's borders.

I didn't inflict any more of clause-by-clause of Bill C-22 on myself yesterday but I just checked out the last few minutes of the televised meeting and it looks like they're up to clause 6 (of 40 something). So that's dragging on.

You know, if C-22 is stuck at parl.ca/SECU for a while (on a Liberal subamendment to an amendment to clause 6 of 40-some), now might be a good time to email additional objections to the clerk (officially non-partisan) and chair (extremely partisan, majority rules). Demand information, assert rights, gum up their progress.

Ask how many documents the majority government, demonstrably itching for a police state, has withheld from the Parliamentarians who are currently pro-privacy. Ask for the complete list (surely tracked somewhere), including dates submitted and published. (I believe proposed amendments were due June 1.)

Confirm that the explanation for the delay is that the Liberal majority government is underfunding human translation services? And then using its professed deep belief in official languages to withhold expert evidence and mass public opposition from non-government members of the committee? While insisting that clause-by-clause happen in the absence of written documentation?

I only watched the last few minutes of last night's broadcast, but what I saw was a Liberal subamendment where even the bilingual lawyer mouthpiece for it stumbled over the alinéas.

You cannot make good law without a clear written record of evidence.

Regardless of what the chair rules, this *is* a breach of privilege, not just for members but also for the public itself. MPs are supposed to be representing us. Their legitimacy comes from us. Even if the opposition loses the vote on the numbers every time, we can tell the chair he is wrong. We can insist that our elected representatives respect democratic rights, official language rights, and privacy rights. I would argue the non-partisan clerk owes a duty to the public too.

They are misusing official languages rights to expedite the violation of privacy rights. We can say no to this.

The Clerk of parl.ca/SECU acknowledged receipt of my email and failed to engage with any of the substance.

This is unsurprising, since "non-partisan" often gets interpreted as "required to uphold a bad system" (as opposed to "truthful no matter who looks bad as a result").

Is it that a Parliamentary committee does not, as a matter of course, track correspondence? Are there not systems in place for that?

Or, is it that the Clerk thinks Canadians aren't entitled to know who submitted information (opposition) that has been withheld on the pretext of respect for official languages while the government bulldozes the law?

Neither response is great when your actual job is democracy.

#C22 #CanPoli #FediLaw

There's also been some weirdness with the Privacy Commissioner's brief.

When I wrote to the clerk, it was listed under Information > Briefs (https://www.ourcommons.ca/committees/en/SECU/StudyActivity?studyActivityId=13454852) as having been posted on Tuesday, May 26, 2026 at 4:46 p.m., except there was no name attached to the link to the brief. Meaning, instead of "Privacy Commissioner" being the name above "Brief," it said nothing. This hid it from ctrl-f finding.

I asked the Clerk to fix it, meaning add the name to the website (in both languages). Now there's no brief posted Tuesday, May 26, 2026 at 4:46 pm. That seems odd.

You *can* read a brief from the Privacy Commissioner, still dated May 21, 2026, but now posted on Wednesday, June 10, 2026 at 4:09 p.m., again without attribution.

Also posted without attribution yesterday, a document dated April 16, 2026, from the National Security and Intelligence Review Agency, pointing out quite politely that C-22 fails to provide for "timely and effective independent review," making it inconsistent with NSIRA's mandate. The French version is dated 16 avril 2026. So this critique with suggested written amendments was submitted bilingually weeks before committee study began and published nine days after proposed amendments were due?

SECU - Bill C-22, An Act respecting lawful access

@Paulatics Hey. I wonder if you would be open to the idea, if it comes to that, of introducing a motion to split Bill C-22 when it arrives in the Senate, in the hopes that the most problematic aspects of it will get voted down / returned to the House.

There's some stuff happening during committee study at SECU that's pretty appalling in a democracy. I've been posting a lot about it (above if you want to scroll). I could also provide the information in some other format if you prefer.

Basically I'm hoping the Senate will decline to be complicit in this.

I don't want to wait until C-22 has been referred to whichever committee (Legal? TRCM? SECD?) to flag it: it could be too late then, if second reading endorses the principle.

Clause by clause meetings, C-22

Thursday, June 4, 2026, 3:30 p.m. to 6:30 p.m.

Tuesday, June 9, 2026, 3:30 p.m. to 7:30 p.m.

Thursday, June 11, 2026, 3:30 p.m. to 11:59 p.m.

Today's witnesses "to be determined."

https://www.ourcommons.ca/documentviewer/en/45-1/SECU/meeting-43/notice

Notice of Meeting - SECU (45-1) - No. 43 - House of Commons of Canada

Notice of Meeting - SECU (45-1) - No. 43 - House of Commons of Canada

Quick dip in to clause-by-clause on C-22. Apparently they're 2.5 hours into the study of a single amendment. Good job, objectors.

Conservatives forcing police officers to explain different ways they pursue cases if a judge says "no, you're not entitled to that information."

Steps include: talking to more people, including colleagues, lawyers, and witnesses. So onerous, investigating.

I have no clue what the subamendment actually is. That shit's not written down anywhere the public can view it.

Jenny Kwan's petition against C-22 (https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7416) seems very slow to load at the moment. I wonder if there's a burst of signatures during SECU meetings.

(Over 12,500 last time I checked.)

Thing that just happened: a Liberal complained on the record about not getting paid enough to listen to officials explain the legal changes they're making.

A different Liberal, trying to argue the Conservatives are off-topic: "Once again, the bill has nothing to do with the privacy of people and their personal information."

The thing is that to understand what's going on, you need to understand:

1. the current state of the law
2. the changes the bill would make to the law
3. the changes the amendment would make to the bill
4. the changes the subamendment would make to the amendment.

It's not like a track changes document. It's a challenge to grasp even with good paperwork (and good faith).

Looks like SECU didn't get through clause-by-clause on Bill #C22 yesterday. Another marathon meeting is scheduled for the 16th. https://www.ourcommons.ca/DocumentViewer/en/45-1/SECU/meeting-44/notice

The petition opposed is now up over 13,500 Canadians. https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7416

48 briefs have now been posted on the website, including the Privacy Commissioner, the Canadian Association of Journalists, and many, many more. https://www.ourcommons.ca/committees/en/SECU/StudyActivity?studyActivityId=13454852

Notice of Meeting - SECU (45-1) - No. 44 - House of Commons of Canada

Notice of Meeting - SECU (45-1) - No. 44 - House of Commons of Canada

Oh, fun, I scared them enough to get a multi-paragraph email from the Clerk. Many things unaddressed, including the affront to democracy, but including the following assurance re: the brief from the Privacy Commissioner, which experienced a lengthy "technical issue" re: attribution: "The document was never removed from the website."

Apparently I missed some shenanigans at SECU, so I'm checking out the last few minutes.

So far it's a Conservative MP asking what sound like quite reasonable questions about changes to the law, specifically why they're lowering certain legal standards, contrary to judicial rulings on police powers in vague cases, like what cases specifically are they hoping to catch here? It is always surreal to hear Conservatives being the ones arguing for less police surveillance.

Edit: I think SECU's just suspended for a vote in the house on a different bill. Not so much shenanigans.

Ah, the shenanigans were in the House. See Government Business, No. 13, disposing of further discussion at clause-by-clause and report stage.

https://mastodon.social/@OpenMediaOrg/116760366128760193

I have learned, from watching Jenny Kwan at the last few minutes of SECU last night, that what the majority Liberal government is doing right now to silence debate is called a guillotine motion.

https://nationalpost.com/news/politics/liberals-pull-out-guillotine-motion-to-shut-down-debate-on-police-search-powers-bill

#C22 #Ottawa #CanPoli #FediLaw

Liberals pull out 'guillotine' motion to shut down debate on police search powers bill

The majority Liberal government is pulling out the "guillotine" for one of its most contentious pieces of legislation.

nationalpost

The government's compromise position: "We're still going to spy on you, violating Canadians' privacy rights while making technology less safe, but we'll only make tech companies store the data for six months."

#C22 #Ottawa #CanPoli #FediLaw

https://ottawa.place/@the5thColumnist/116768738223926689

Richard W. Woodley 🇨🇦🌹🚴‍♂️ (@[email protected])

Token Tweaking ? https://www.thestar.com/politics/federal/how-the-carney-government-will-scale-back-its-police-powers-bill-sources/article_597820b9-9a88-4737-8f56-0d0383bf3e9e.html?source=newsletter

ottawa.place

Does anyone happen to know what "recognized international technical standards" describe what is meant by a "credible" risk that an unauthorized person could access secure information?

#CanPoli #FediLaw

@OpenMediaOrg @mgeist

"Two days hence" for second reading in the Senate on Bill C-22. Per the calendar (https://sencanada.ca/en/calendar/), that looks like late September.

Which would mean three full months for people to persuade the Senate to decline to endorse a rights-violating bill passed undemocratically.

@Cassandra @mgeist It is drawn from UK legislation - but the UK has an independent panel of tech experts who evaluate that. #BillC22 does not.
@OpenMediaOrg Ah, thanks, it definitely reads like a change to align with someone else's wording. Do you know if the UK standards are published somewhere?

@Cassandra

@OpenMediaOrg @mgeist information is not secure if an unauthorized person can access it.

#CanPoli #FediLaw

@human3500 I’m specifically looking for the international standards referenced in the new version of the bill.

@Cassandra
The wording is a mouthful and thinking there isn't a single, easily readable standard for that.

Canada uses itsg-33 and you'd need to follow a number of processes in that guidance which would produce your residual risk. It runs hundreds of pages.

If all you are looking for is risk assessment, tra-1 describes a process for that.

The US splits all that works over a number of NIST standards in the SP800 series. The UK would use something from CESG IIRC.

There are also ISO standards like 27001 which you must buy.

However all of those would likely state that information is not secure if an unauthorized person can access it. By definition, that info isn't secure.

Following the processes reduce that residual risk but it's very expensive to fully protect against an authorized insider accessing and exfiltrating information which they authorised to access (e.g. a spy). Those become accepted risks.

@human3500 The wording of the bill is a mouthful?

"systemic vulnerability means a vulnerability in the electronic protections of an electronic service that creates a credible risk, based on recognized international technical standards, that secure information could be accessed by a person who does not have any right or authority to do so..."

This is a specific change the government made between the first version of Bill C-22 ("substantial risk") and the version adopted at third reading. Either they're referring to specific "recognized international technical standards" that explain what "credible risk" means, or they created a definition that can't really be interpreted.

I'm asking if anyone can identify a specific standard. It sounds like you're saying you know of many standards related to risk assessment, but not one that explains this amendment.

@Cassandra
Vulnerabilities present threats to the business process. These threats, and their mitigations or lack thereof, are assessed to determine risk. each risk is evaluated to determine the likelihood (credibility) and impact should it occur. Itsg-33 is the GC process to follow for this.

No authorized service should credible threats remaining unless they are threats they are willing to accept.

For example, a missile blowing up a data center.

But if that's a credible threat and they proceed without mitigating it, then we should expect bad things will happen.

Again, the entire process is to assess threats and calculate risk. Every system has a level of acceptable risk.

A known backdoor would be a credible threat. Perhaps they are scoping that in.

@human3500 Again, I'm looking for specific standards that explain the change in the wording of the bill. This is a legal question about incorporation by reference.

I googled "ITSG-33" and get a result from 2012: https://www.cyber.gc.ca/en/guidance/it-security-risk-management-lifecycle-approach-itsg-33

This is unlikely to be the standard referenced in the current version of the bill since it doesn't contain the word "credible," nor would they need to refer to international standards if they meant their own.

IT security risk management: A lifecycle approach (ITSG-33) - Canadian Centre for Cyber Security

ITSG-33 publication has been developed to help government departments ensure security is considered right from the start.

Canadian Centre for Cyber Security

@Cassandra
No standard would explain the change in wording in my opinion. The wording change is to give them options IMHO.

Risk assessment process determine what's credible and you should consult a dictionary for the definition of credible as the standards probably won't use that term using high, medium and low instead.

I'll say one last time that no system in production should have credible risks. There are credible threats but letting that become a credible risk would expose most corporations to unacceptable liability when exploited.

@human3500 Okay, I understand that your opinion is that the government deliberately changed "substantial risk" to "credible risk, based on recognized international technical standards" even though there are no recognized international technical standards that would give meaning to the legislative term "credible risk."
@Cassandra and how easy is it to quietly change that six months later
@ghosttie I assume they wouldn't have to change it if they can just get easy access to six months' worth of data at a time.
@Cassandra yeah I just thought passing a law is hard but adjusting an administrative detail could be a lot easier
@ghosttie That's in the law, though - the new act s. 5(2)(d): the retention of categories of metadata — including transmission data, as defined in section 487.‍011 of the Criminal Code — for reasonable periods of time not exceeding six months.