Bill C-22 takes more than it gives, and the Liberals are racing to pass it before summer: scoring the Lawful Access Act

Surveillance powers and implementation

Bill C-22's confirmation-of-service demand lets a peace or public officer compel a telecom to confirm whether it serves a given account, with no warrant and no prior judicial authorization, on the threshold of "reasonable grounds to suspect" an offence has been or will be committed (s. 487.0121(2)). The same suspicion threshold governs the new subscriber-information production order (s. 487.0142), which a judge issues ex parte, and the new foreign-production-request authorization (s. 487.0181). The existing general production order in the Criminal Code requires "reasonable grounds to believe"; Michael Geist documents that C-22 lowers that standard to "suspect" for identity-linking data, the lowest investigative threshold in Canadian law.

Part 2's Supporting Authorized Access to Information Act adds the standing infrastructure. The Minister of Public Safety may order an electronic service provider to develop and maintain capabilities to extract and provide authorized data, install equipment, and retain categories of metadata for up to one year (s. 5(2)(d), s. 7). The retention ceiling excludes content, browsing history, and social-media activity (s. 5(4)), and a capability order is valid only once the Intelligence Commissioner approves it (s. 7(2)). The Library of Parliament records that no classes of "core providers" are listed in the schedule yet and that Part 2 comes into force on a date the Governor in Council fixes, so the regime's reach is set later by regulation. The implication: the powers the public can read in the bill today are the floor, and the obligations that bite are written after Royal Assent in instruments the bill authorizes but does not display.

Sovereignty implications

The government's landing page states the bill "does not require ESPs to create 'backdoors'" and points to the systemic-vulnerability carve-out as the guarantee. The carve-out is drawn from the same lineage as Australia's law. Two clauses sit against it: s. 12 says a provider subject to an order "must comply," and s. 13 says an order "prevails over any regulation made under subsection 5(2) to the extent of any inconsistency." Geist reads the carve-out as undercut by those compliance clauses and the term "systemic vulnerability" as too undefined to bind. The Electronic Frontier Foundation argues the definitions leave "wiggle room for the government to demand that companies circumvent encryption," and that "surveillance of encrypted communications is fundamentally a systemic vulnerability." The federal Privacy Commissioner recommended amending the definition to bar orders that weaken authentication or encryption, which is the clarification the Minister has since promised to draft.

The foreign-access dimension is in the text. Part 1 authorizes requests to foreign telecom entities to produce transmission and subscriber data (s. 487.0181), and the bill amends the Mutual Legal Assistance in Criminal Matters Act to let the Minister authorize enforcement of foreign production orders on the same "suspect" conditions (new s. 22.07). Two US congressional committee chairs, Jim Jordan and Brian Mast, wrote to Anandasangaree warning the bill creates cross-border risks and would force firms to choose between compromising their global user base or exiting Canada. A surveillance capability built into a Canadian provider's network is reachable by whoever can compel or breach that provider, which is the sovereignty cost the cryptographic literature names below.

Labour and economic implications

The compliance burden lands on providers and the people who depend on them. The Canadian Chamber of Commerce supports Part 1 but opposes Part 2, arguing that a mandated one-year metadata store makes internet providers "cybersecurity targets" and that the capability obligations could undermine encryption and "deter investment." Major firms put the threat in market terms: the Globe and Mail recorded Apple, Meta, Google, and Signal warning the bill threatens encryption, with Signal's Udbhav Tiwari saying the company would "rather pull out of the country than be compelled" to weaken it, and a major VPN provider saying it could leave Canada. The cost of a mandated store is also a cost the public carries: every retained metadata trail is a target a provider must now defend, and the 2024 Salt Typhoon breach compromised the lawful-intercept systems US carriers built for court-authorized access. The implication for Canadian providers: the bill turns a year of every designated customer's metadata into a liability that an adversary, foreign or criminal, has reason to seek.

Community and connection implications

A nine-country survey found that 34% of respondents would avoid contacting a counsellor, psychotherapist, or rehab clinic by phone or email if they knew the contact was being recorded, and a poll of 2,006 Canadians for the Center for Democracy and Technology found 73% worry such access could discourage free speech and 63% would be more cautious about what they share. The Stanford MetaPhone study established empirically that telephone metadata "is densely interconnected, can trivially be reidentified, and can be used to draw sensitive inferences," which is why the records C-22 would retain are not the low-sensitivity data the Charter Statement describes.

The burden falls unevenly. The International Civil Liberties Monitoring Group told SECU the regime "continues to result in police and intelligence service overreach, unjustified surveillance and investigations of racialized and Indigenous communities," and that retained metadata creates more opportunity to track land defenders and activists. The National Council of Canadian Muslims reports that 37% of Canadian Muslim institutions have had a negative interaction with a CSIS agent. The Canadian Association of Journalists opposes the bill over the threat to source confidentiality, and the documented precedent is concrete: in 2016 Montreal police obtained at least 24 warrants to track columnist Patrick Lagacé's phone to identify his sources. No Indigenous organization has published a brief or testimony on C-22 specifically; the documented Indigenous surveillance concern of 2026 attaches to the RCMP's 1968 to 1982 program against Indigenous rights movements, surfaced in 2025, and reaches Parliament here only through a civil-liberties intermediary.

Ethical and governance implications

The Supreme Court has twice raised the constitutional floor under the data C-22 reaches. R. v. Spencer (2014) held that subscriber information attracts a reasonable expectation of privacy and generally needs prior judicial authorization; R. v. Bykovets (2024) extended that to IP addresses, "the first digital breadcrumb." The Canadian Bar Association concludes Parts 1 and 2 "risk violating the s. 8 Charter protection" and calls "reasonable grounds to suspect" the lowest threshold in the system; Citizen Lab and the CCLA conclude the SAAIA metadata-retention regime is "almost certainly unconstitutional" because it obligates indiscriminate retention "without any need to demonstrate that the person is involved in any wrongdoing." The government's own Charter Statement defends the suspicion threshold but cites no decisions; Geist's reading is that it is silent on the metadata-retention regime, the provision the CBA and Citizen Lab call most vulnerable.

The bill adds oversight its predecessor lacked. Capability orders require Intelligence Commissioner approval, a quasi-judicial pre-approval the Privacy Commissioner credited as an improvement on Bill C-2, and the SAAIA requires an annual public report. The gag obligations cut the other way: providers may not disclose the existence of an order (s. 15), and the confirmation-of-service demand carries a non-disclosure condition of up to one year. The standing oversight gap is in who is heard: the SECU witness record names the Canadian Association of Chiefs of Police, the RCMP, CSIS, NSIRA, and several police services, and no Indigenous, Muslim, Black, journalist, or migrant community organization as a named witness.

What the bill's Liberal sponsors have said, checked against the text

Each statement below is quoted verbatim from Hansard or from the named outlet and was confirmed against its source. The verdict measures the statement against the bill's own text and the primary record rather than against the speaker's intent.

The Foundation found no on-record statement by Prime Minister Mark Carney defending the bill's specifics; its public defence has come from the Public Safety and Justice ministers and from CSIS, RCMP, and Public Safety officials who briefed reporters that Canada is the only Five Eyes country without such a regime.

How the bill is being moved

Second reading ran four sitting days (13 to 20 April) and referral to committee followed without time allocation, which is routine. The June step is not. On 16 June 2026 Government House Leader Steven MacKinnon tabled a programming motion to compress SECU's clause-by-clause review, set a deadline for amendments, and limit House debate when the bill returns, with the stated aim of clearing the remaining stages before the 19 June rise. SECU then sat through a marathon clause-by-clause session from 3:36 p.m. to past midnight. Conservative public-safety critic Frank Caputo called it "the most aggressive programming motion I've ever seen" and an attempt to "ram" the bill through, and an MP raised a point of order that the motion sets a retroactive amendment deadline, on which the Speaker had not ruled. The Minister framed the timing as a choice "between victims of crime who are demanding that we, as parliamentarians, act" and the delay, while the government had earlier blocked a Conservative bid to recall the Privacy Commissioner to the clause-by-clause. As of publication the programming motion was tabled, with no recorded adoption vote; it functions as a programming and committee-instruction motion rather than a formal time-allocation or closure motion under the Standing Orders.

Where Bill C-22 sits on the quadrant

The Transmutarianism framework scores agents on F (filtering of deprivation: deprivation absorbed without being passed on) and A (amplification of fulfillment: fulfillment emitted in excess of what was received). Moral work M = [τF + A] / √(τ²+1) (at the parity origin F₀ = A₀ = 0) is computed per Maslow level (physiological, safety, belonging, esteem, actualization) and weighted by w = {5, 4, 3, 2, 1}. The normalizer keeps M comparable across τ settings; a power coefficient ρ can raise the bar for powerful agents.

The chart below plots Bill C-22's provisional placement (sigil red, the only red dot) against five comparator regimes, each a distinct colour, with the four quadrant regions labelled for orientation. The comparators are scored at a coarser grain on the same privacy and cognitive-sovereignty flow, each against its own population, so their dots mark a spectrum rather than precise coordinates. Drag the τ slider to test sensitivity. Click any dot for its F, A, and M values.

Assumptions, stated

1. Scope of evaluation. The bill as introduced at first reading on 12 March 2026, read with the Library of Parliament summary. Amendments under negotiation at committee (a promised encryption clarification, a possible six-month retention period) are noted where relevant but are not scored, because they are not yet enacted text.
2. Time horizon. Steady state at full implementation, with Part 2 regulations and at least one capability order in force. The bill is pre-enactment, so the dot is an expected-flow estimate rather than a measured outcome.
3. Asymmetry coefficient (τ). Default τ = 1. Sensitivity at τ = 0.8 (flourishing focus) and τ = 1.5 (cycle-breaking focus) is in the math box below.
4. Maslow weighting. w = {5, 4, 3, 2, 1} for {physiological, safety, belonging, esteem, actualization}; lower-level deprivation is heavier. The flat-weight recompute is below.
5. F and A scale. Each level scored on a −10 to +10 range, central estimate from the public-record evidence above. The reasoning column names the inputs.
6. Denominator. All people in Canada, the population the regime acts on (metadata retention applies without individualized suspicion). Two alternatives are named and recomputed in the alternatives table: a victim-only denominator (which the government foregrounds, the strongest pro-bill construction) and an over-surveilled-communities denominator (the harshest, surfaced by the pre-publication gate).
7. Treatment of the contested safety tradeoff. The pivot. The bill both absorbs some serious-crime deprivation (a positive physiological and safety F) and withdraws population-wide security (a negative safety and belonging flow: indiscriminate retention, exploitable access infrastructure, a lowered access threshold). The central construction scores both, netting F near zero at the heavy levels. The alternative credits the law-enforcement benefit at face value and treats the systemic-security cost as speculative; the alternatives table shows where the dot lands under each.
8. Power-asymmetry (ρ and Δ_M). Central verdict at ρ = 1 (parity). The operational trigger holds: the state is the most powerful party in this flow and controls the legal authority and security apparatus the denominator population does not. The Δ_M band is reported below, with units; at Δ_M = 1.0 the crime-credited Absorber construction flips to Extractor.

Per-Maslow scoring

The aggregate dot is computed from the per-level table below. Each F and A value is the central estimate from the public-record evidence in the prior sections; substitute different numbers and the dot moves.

Where the dot lands under the alternatives

These are the standing alternative constructions from the pre-publication assumption gate, recomputed. The quadrant turns on assumption 7 (the contested safety tradeoff) and assumption 6 (the denominator).

The placement is decided by how the safety tradeoff is weighed and by whose flows are counted. A is negative under every construction except the victim-only denominator, so the bill is never a Magnifier and reaches Transmuter only when the population that bears the surveillance is taken out of the count. It does negative or near-zero net moral work for the general population and positive work only for the narrower population of crime victims it is built to protect. Every harsher alternative tested before publication (zeroing the contested physiological credit, an actualization-weighted vector, the over-surveilled-communities denominator, the cost-at-face-value diversion) deepens the Extractor placement without reaching a different quadrant. To dispute the placement, substitute different F and A values per level, with a source for each, and the dot moves.

The six-regime comparison

Placed on the same map, Canada's bill sits between two poles. The United Kingdom's Investigatory Powers Act is the deepest Extractor of the democracies: bulk powers, Technical Capability Notices, a 2025 order that forced Apple to withdraw Advanced Data Protection, and a European Court of Human Rights finding that its bulk-interception regime violated the Convention. Australia's Assistance and Access Act grants comparable powers with weaker oversight (authorization by the executive rather than a judge) and a two-year retention mandate, tempered by restraint in use (no capability notice has ever been issued). The United States' CALEA mandates interception capability but bars compelled decryption, imposes no retention duty, and exempts internet services, sitting near the origin. The European Union and Germany are the Transmuter pole: courts there have repeatedly struck down indiscriminate retention and held the line on encryption, so their regimes filter the deprivation of surveillance overreach rather than emit it. C-22 is narrower than the UK and Australia (shorter retention, content and browsing excluded, Intelligence Commissioner approval) and broader than the US (it adds retention, a foreign-production power, and a sub-warrant access threshold), which places it as a restrained Extractor, well inside the surveillance half of the map and far from the rights-protective pole that EU and German jurisprudence mark.

Public-interest recommendations

The bill is still at committee, and the amendments below would move the dot toward the rights-protective pole.

For Parliament and the SECU committee

1. Give the Supporting Authorized Access to Information Act the study time the metadata-retention and capability powers warrant, rather than clearing clause-by-clause under a programming deadline tied to the recess.
2. Adopt the Privacy Commissioner's recommendations: a closed-list definition of "subscriber information," compulsion limited to telecommunications service providers, and a "systemic vulnerability" definition that bars any order weakening authentication or encryption.
3. Raise the access threshold for identity-linking data from "reasonable grounds to suspect" toward "reasonable grounds to believe," to align with Spencer and Bykovets.

For the Department of Justice

1. Issue a Charter Statement that addresses the SAAIA metadata-retention regime directly and engages Spencer and Bykovets by name, the provisions the Canadian Bar Association and Citizen Lab identify as most vulnerable.

For Public Safety Canada

1. Publish the draft "core provider" classes and any model capability order before Part 2 is brought into force, so the regime that binds is visible while it can still be amended.
2. Set the retention period at the shortest the stated investigative need supports, and publish the law-enforcement evidence for whatever number is chosen.

For providers and the public

1. Use the SAAIA annual report (s. 49) and the figures on orders the Intelligence Commissioner declines to verify the regime against its stated scope once it is in force.

The audit protocol (six inputs)

An audited placement requires six inputs. The Foundation offers framework, scoring template, methodological support, and the published report to any party willing to supply them.

1. The enacted text after committee, including the promised encryption and retention amendments, so the dot is scored against law rather than a draft.
2. The draft "core provider" classes and any model capability order, Maslow-tagged by the obligation each imposes.
3. The metadata-retention period and the law-enforcement evidence base for it, with the categories of metadata covered.
4. The Intelligence Commissioner approval record once orders are made: number made, number declined, classes of provider affected (SAAIA s. 49).
5. Documented investigative outcomes attributable to the new tools, to size the physiological and safety F against the privacy cost.
6. Transparency figures on confirmation-of-service demands and their gag conditions, to size the esteem and belonging A.

Contact: sev@economyofwisdom.com.

What changes the placement

Toward Transmuter: raise the subscriber-access threshold to "reasonable grounds to believe"; replace indiscriminate retention with targeted or quick-freeze preservation of the kind EU courts require; write a "systemic vulnerability" definition that bars any encryption or authentication weakening; and publish documented investigative gains that the tools, and only the tools, close.

Toward Extractor: bring Part 2 into force with broad "core provider" classes and a long retention period set by regulation; expand foreign data-sharing without dual-criminality limits; let the gag and exigent-circumstances powers run without published figures; and pass the bill under a programming deadline that forecloses the committee scrutiny the contested provisions need.

Better data moves the dot.

A note on framing

The Foundation publishes this to give the parties at the committee table a shared instrument: one map on which the child-exploitation investigator, the cryptographer, the journalist, and the minister can place the same bill and see why they read it differently. The crimes the government names are rising, and the investigative dead ends the police describe are documented. The score does not deny them. It measures them against what a year of every designated subscriber's metadata, a sub-warrant access threshold, and a standing capability to hand over data take from the population that is not under investigation, which is almost everyone.

A lawful-access regime is the rare instrument that asks a whole population to hold still so that a few can be found. The framework reads that as negative work on the A-axis under every honest construction, with the only positive placement appearing when the watched are subtracted from the count. The classification is information about flows; the people drafting and defending the bill are working inside an incentive structure, a recess calendar, and a real caseload, and the recommendations are addressed to the institution. The math is at transmutarianism.org/framework/ and the dot is plotted on the live quadrant explorer at transmutarianism.org/quadrant/. To dispute the placement, substitute different F and A values per level, with a source for each, and the dot moves.