Lawful access, the Conservatives' planned Internet surveillance legislation, has generated considerable attention over the past week as the government decided against including it in their first omnibus crime bill. That decision generated widespread media coverage, claims that the government had backed down in the face of a 70,000 signature online petition, and a debate in the House of Commons in which Public Safety Minister Vic Toews promised that warrantless online wiretapping is not planned.

While lawful access critics likely feel like this is a cause for celebration, there is still every reason to believe that lawful access is only delayed, not dead. Justice officials have indicated that the government is "committed to reintroducing" the lawful access measures and Toews confirmed last week "the legislation will come." The exclusion from the omnibus crime bill is definitely a step in the right direction -- it should allow for the committee hearings that have never happened -- but lawful access will still be introduced and presumably passed at some point in the future.

Moreover, the recent focus on warrantless online wiretapping may have galvanized public opinion, but it misstates the real concerns with the lawful access plans. Advocates rail against warrantless online wiretapping, which Toews effortlessly swats away by assuring everyone that the government has no plans to introduce such measures.

If the prior lawful access bills are any indication, Toews is right. Lawful access won't include warrantless online wiretapping, at least not in the conventional sense. But to give the government a pass on those grounds is to overlook the real dangers that will be in the bill. If the Conservatives move forward with their complete lawful access package, it would feature a three-pronged approach focused on information disclosure, mandated surveillance technologies, and new police powers.

Three prongs don't make a right

The first prong will mandate the disclosure of Internet provider customer information without court oversight. Under current privacy laws, providers may voluntarily disclose customer information but are not required to do so. The new system would require the disclosure of customer name, address, phone number, email address, Internet protocol address, and a series of device identification numbers.

The second prong will require Internet providers to dramatically re-work their networks to allow for real-time surveillance. The bill is likely to set out detailed capability requirements that will eventually apply to all Canadian Internet providers. These include the power to intercept communications, to isolate the communications to a particular individual, and to engage in multiple simultaneous interceptions. Moreover, it will establish a comprehensive regulatory structure for Internet providers that would mandate their assistance with testing their surveillance capabilities and disclosing the names of all employees who may be involved in interceptions (and who may then be subject to RCMP background checks).

Having obtained customer information without court oversight and mandated Internet surveillance capabilities, the third prong will create a several new police powers designed to obtain access to the surveillance data. These include new transmission data warrants that would grant real-time access to all the information generated by the communication and a preservation order that would require providers to preserve subscriber information, including specific communication information, for 90 days.

Lawful access raises serious privacy and free speech concerns, particularly given the fact that the government has never provided adequate evidence on the need for it, it has never been subject to committee review, and it would cost millions to implement. There is enough to worry about in the real lawful access proposals that critics don't need to focus on problems that don't currently exist.