Federal Ombudsman for Victims of Crime
Heard. Respected. Victims First.
Common menu bar links
Special Report:
What More Needs to be Done—Recommendations
4. Accessing and Storing Information
Even when authorities are able to obtain customer name and address information, they may still hit roadblocks if they come across offenders who have password-protected or heavily encrypted computer systems.
While authorities obviously make every effort to get the offender to cooperate, there is no provision in current legislation that makes it a crime for offenders to withhold this information. Evidently, offenders are not inclined to give this information willingly, as they know it may lead to evidence and material that could be used against them in a court of law.
Some law enforcement organizations report cases where they have not been able to access a computer because they could not break the encryption. In these cases, there is no other option than to drop the charges. As the technology becomes more sophisticated and online predators become increasingly savvy, police are concerned that more and more people will encrypt their computers.
There are certain provisions in the Criminal Code of Canada that address cooperation as required when police suspect someone of driving while under the influence of alcohol. For example, it is a criminal offence to refuse to take a breathalyser test when police suspect a person of impaired driving. In the same way that police are unable to assess the level of the driver’s inebriation, law enforcement cannot evaluate the scope of the problem with child sexual abuse images until they are able to access the location where they are contained.
Similarly, provisions could be included to make it a criminal offence not to provide a password to law enforcement in cases of suspected possession of child sexual abuse images. Although the charge of not providing a password could be lesser than the charge and sentence for possessing and/or distributing the images, the offender would still have a criminal record, may be required to register with the National Sex Offender Registry, may be required to submit DNA to the National DNA Database and would have to forfeit his or her computer.
Subsection 153.1(b) of the Customs Act makes it an offence to hinder or prevent an officer from conducting his or her duties as authorized by the Act, including searches. This section has been used with respect to individuals who did not want to provide passwords for portable computers. In addition, laptops can be detained (section 101) until they are examined.
The U.K. and Australia already have in place legislation to assist law enforcement to access computers and equipment that are protected by passwords or encryption. In the U.K., legislation allows law enforcement authorities to ask anyone who has protected electronic data (e.g. encrypted) or who has access to the data’s encryption keys to either give the police the data in a readable format, or to give them the encryption key so it can be accessed.97 Failure to do so can result in a jail sentence of up to two years (five years if the matter is one of national security). It is also a criminal offence if disclosure is not made in compliance with an order.
In Australia, police can apply to a magistrate for an order requiring a person to provide any information or assistance that is reasonable and necessary to allow the officer to access data held in a computer. A person who fails to comply with the order is liable to six months’ imprisonment.98
Canada needs to give authorities the ability to access the evidence. If the courts give law enforcement the right to search a computer, we believe it must also provide the power for police to act on this right and to hold the individual accountable.
RECOMMENDATION 4—That the federal government introduce legislation to amend the Criminal Code to make the refusal to provide a password or encryption code upon judicial order a criminal offence.
