Preserving Privacy: The Evolution of iPhone Security in Canada

While governments and law enforcement agencies around the world have long pushed back against the security measures that Apple and other companies take to protect their users’ privacy, many of these efforts have ramped up in recent years, and now it looks like Canada is joining the fray.

In a move that at least superficially echoes Apple’s fight with the UK over its secret order to hand users’ iCloud data over to the government, Apple is now stating its opposition to Canada’s Bill C-22, a proposed new law that aims to help police and intelligence officials more easily gain access to private information when conducting investigations.

While C-22 has had no shortage of opposition among privacy advocates over the past few months for a wide assortment of reasons, this is the first time Apple has spoken out, and it’s making the same argument it’s made elsewhere: that the provisions of Bill C-22 would lead to a loss of privacy for iPhone users in the Great White North.

In a statement to CBC News yesterday, Apple said that “Bill C-22, as drafted, would undermine our ability to offer the powerful privacy and security features users expect from Apple,” and do so “at a time of rising and pervasive threats from malicious actors seeking access to user information.”

Apple promises to continue cooperating with governments “to help protect public safety,” but reiterates that it won’t back down on its principles, “advocating tirelessly against any measures that would put users’ personal data at risk.”

While Apple has faced much more serious threats from other corners, particularly the UK “Technical Capability Notice” that would have forced open a back door that Apple wouldn’t have even been able to talk about, the situation in Canada is slightly more nuanced — and is resulting in a lot of back-and-forth semantics about what Bill C-22 will — and won’t — allow the government to do.

For its part, Canadian officials deny that the government is asking for “back doors.” Shannon Hiegel, director general of national security policy at Public Safety Canada, the department responsible for the bill, calls it “encryption neutral,” testifying that the government expects companies to “find safe ways to maintain their cybersecurity” through this legislation. A spokesperson for Public Safety Minister Gary Anandasangaree also issued a long statement in which the government “categorically rejects” claims that Bill C-22 introduces a back door into encryption technologies.

Apple disagrees, pointing out that while Bill C-22 doesn’t explicitly demand a back door, it opens the door (pun only slightly intended) to one by giving the government the ability to order back doors to be created in the future.

In the end, this appears to be the classic “slippery slope” debate — ironically the same sort of argument that led Apple to abandon its CSAM scanning plans. The notion that just because a piece of legislation introduces a new power, it doesn’t mean that power is going to be used — or abused.

However, Apple has long maintained a strong counterpoint to such arguments when it comes to back doors themselves. When the FBI requested in 2016 that Apple create a modified version of iOS to allow it to break into the San Bernardino shooter’s iPhone, Apple CEO Tim Cook called it the “software equivalent of cancer” and “not something that should be created.” While Bill C-22 operates at one level above that — it’s not explicitly asking for a back door, simply empowering the government to ask for one — the same logic applies here. Once that Pandora’s Box is open, can it really be closed again?

As advocacy group OpenMedia points out, “Bill C-22 remains, at its core, a mass surveillance capability regime. It would compel an enormous and poorly defined set of ‘electronic service providers’ to build surveillance backdoors into their products.

The one silver lining here is that Bill C-22 has yet to pass, and a charitable interpretation is that some of these provisions are merely the result of the vague language that often plagues such legislation. Opposition parties are already pushing to update the bill to address some of these concerns and tighten the language and definitions, and Anandasangaree has said he’s open to reviewing those proposed amendments.