A lot of people – especially lawyers – are pouring over the federal anti-malware legislationintroduced on Friday. It's more than 60 pages long, and even a Torontotechnology lawyer I interviewed today acknowledged it's more complexthan the usual stuff Ottawa puts out. In fact, a Rogers Communicationsspokesman asked if I could hold off getting their comment for a fewdays or a week to give their legal staff time to digest it. Here's onething that could be giving Internet service providers and carriersindigestion:
Section 19, which authorizes ajustice of the peace — not a federally-appointed judge, but a JP — toauthorize a person designated by the CRTC to enter “a place” to verifythat the act is being complied with. The application can be withoutnotice to the owner of the “place.” There's no definition of “a place”– it could be a spammer's home or a service provider. There is acondition: the JP has to be convinced by the applicant that there is”reasonable grounds of which to believe entry will be refused.” Onceinside, the designated person can examine anything, use any computersystem to examine data, use any copying equipment to make copies ofdocuments, remove anything for examination or copying and prohibit orlimit access to all or part of the place.
By the way, the ownerof the place and everyone in it “shall” give the designated person allreasonable assistance. And good news: The person toting the warrant canonly come through your door between 6 a.m. and 9 p.m – unless the JPdecides otherwise. Force can't be used, unless the person executing thewarrant is accompanied by a peace officer and the use of force has beenauthorized in the warrant.
Presumably, the original intent ofthis is to help gather infomation against malware creators in thiscountry – by tracing online material, the CRTC can figure out who aspammer is, go into his/her house and get the goods. Sound like apolice state? Not quite. Don't forget the commission can only applyadministrative fines. If a police department wants to lay a criminalcharge and get a search warrant, there's a different standard.
Ontop of this, the CRTC can demand a telecommunications service providerto preserve transmissions under its control for as much as 41 days toverify complaince with the act.
So unless the law is changed if you're an ISP you're going to be wondering soon who's that knocking on your door.
