The rain in Montreal this week served as more than just a backdrop for Public Safety Minister Gary Anandasangaree’s press conference; it acted as a metaphor for the slow, persistent erosion of Canadian privacy. Standing at the podium, the Minister spoke of balance and modernization, but the document he was pitching—Bill C-22, the Lawful Access Act of 2026—is less about balance and more about the final synchronization of the Canadian security state with its global masters. While the press gallery focused on the rhetoric of catching predators, the real story lies in the dry, administrative language of the Criminal Code amendments and the hidden technical directives that will govern our digital existence for the next decade.
This isn't the first time the Carney government has tried to force this through. We saw the predecessor, Bill C-2, fail under the weight of its own omnibus arrogance last year. But C-22 is different. It has been stripped of its most obvious political landmines, like the warrantless search of physical mail, to ensure it glides through committee. What remains is a lethal, focused architecture of surveillance that targets the very fabric of our digital interactions. The government has learned that if you frame an intrusion as a "confirmation of service," the public is far less likely to recognize it as a search. The shift in language is intentional and tactical. By moving away from the "Strong Borders" framing and toward "Lawful Access," the government is attempting to normalize the idea that the state has a standing right to audit your digital life.
The Paperwork of Suppression: Section 487.0121 and the 24-Hour Trap
To understand the sheer banality of this new surveillance regime, one must look at the specific amendments to the Criminal Code. The introduction of Section 487.0121 is the centerpiece of Part 1. This section creates the "confirmation of service demand," a tool that allows law enforcement and CSIS to bypass the traditional judicial guardrails. Under this provision, an officer no longer needs to prove to a judge that a crime has been committed to get a foot in the door. They simply need a "reasonable suspicion" to issue a demand to any telecommunications provider.
The execution of this power is facilitated through the newly minted Form 5.0011. This form is the administrative engine of C-22. It is a standardized demand that compels a provider to confirm, within twenty-four hours, whether a specific IP address, phone number, or account belongs to one of their customers. This twenty-four-hour window is a calculated tactic of "compliance by exhaustion." While the legislation offers a five-day business window to challenge a demand in court, this is a hollow protection. For a small to mid-sized tech firm, organizing a constitutional defense and filing an application for review within 120 hours of a federal demand is an almost impossible logistical feat. It effectively forces immediate compliance or faces the crushing weight of contempt proceedings.
Once Form 5.0011 has been processed and the "yes" has been recorded, the state has already won the most difficult part of the investigative battle. They have established a link. By making this "handshake" warrantless and time-sensitive, C-22 effectively grants the state a master key to every digital door in the country.
BOREALIS and the Australian Blueprint
If Part 1 of Bill C-22 is the scout, then Part 2 is the industrial complex that supports it. Part 2 establishes the Supporting Authorized Access to Information Act (SAAIA), creating a permanent mandate for technical subservience. This is where we see the emergence of the Bureau of Research, Engineering, and Logistical Intelligence Systems, better known as BOREALIS. In the 2026 budget estimates, BOREALIS has seen its funding tripled, specifically to act as the technical intermediary between the Ministry of Public Safety and the private sector.
The design of BOREALIS is not an original Canadian invention; it is a direct lift from the Australian Telecommunications and Other Legislation Amendment (Assistance and Access) Act of 2018. Like its Australian predecessor, the SAAIA allows the government to issue "Technical Capability Notices." These notices compel "core providers"—a term that includes everything from satellite providers to messaging apps—to develop, test, and maintain specific technical capabilities to assist the state. BOREALIS is the entity that will dictate what these capabilities look like, providing the engineering standards that ensure every Canadian network is "interception-ready" from the moment it goes live.
This is a fundamental shift in the relationship between the state and the infrastructure of the internet. We are moving from a model where the state asks for data to a model where the state designs the pipes. BOREALIS isn't just researching threats; it is researching vulnerabilities that can be baked into the very software we use for banking and communication. The SAAIA ensures that no encryption or security measure is so strong that it cannot be bypassed by a ministerial directive. It is a mandate for insecurity, funded by the taxpayer and executed in the shadows of the BOREALIS labs.
The Intelligence Commissioner: A Procedural Rubber Stamp
The Carney government has attempted to shield C-22 from criticism by touting the oversight role of the Intelligence Commissioner. This is a classic misdirection. While the SAAIA includes the Commissioner in the approval process for certain technical notices, the scope of that review is dangerously narrow. The Commissioner is tasked with reviewing the process—checking whether the Minister followed the correct administrative steps—rather than the merit or the constitutional validity of the intrusion itself.
If the Minister has filled out the correct forms and cited the relevant national security boilerplate, the Commissioner has very little legal ground to intervene. This creates a procedural rubber stamp that offers the illusion of oversight without the substance of a check on power. In the secret world of BOREALIS directives, this lack of substantive review means that the most intrusive powers of the state are effectively shielded from democratic accountability. For corporations, the penalty for non-compliance is steep: administrative monetary penalties can reach $250,000 per violation, with each day of non-compliance counting as a separate offense. This financial guillotine ensures that "voluntary" cooperation is the only logical business path.
The "Voluntary" Loophole and Digital Sovereignty
Perhaps the most insidious part of C-22 is the codification of the "voluntary" and "publicly available" loopholes. The bill clarifies that police and public officers can receive and act on information that is voluntarily provided to them by companies without any court order. By creating a regime where challenging a demand is logistically impossible and expensive, the government is incentivizing companies to skip the paperwork and hand over data "off the record." It turns a constitutional protection into a transaction of convenience.
This is a total surrender of our digital sovereignty. Minister Anandasangaree was candid that C-22 is about alignment with the Five Eyes. By standardizing our production orders and technical capabilities, we are making it easier for foreign agencies to access the data of Canadian citizens through reciprocal sharing agreements. The metadata being collected through Section 487.0121 and the technical backdoors being built by BOREALIS are the currency of this exchange. The Carney administration is treating the private information of every Canadian—from their financial records to their digital account histories—as an asset to be leveraged in geopolitical negotiations.
The Logic of Perpetual Monitoring
The ultimate goal of Bill C-22 is not the resolution of specific crimes, but the establishment of a system of perpetual monitoring. When you combine the "confirmation of service" demands with the mandatory technical capabilities of the SAAIA and the secret ministerial orders, you get a society where every movement and every interaction is indexed by the state. This is pattern-of-life analysis scaled to an entire population. It is the dream of the bureaucrat: a nation that is perfectly legible, perfectly tracked, and perfectly controlled.
True safety doesn't come from a state that watches everyone; it comes from a state that respects the boundaries of the individual. When those boundaries are erased by Form 5.0011 and the hidden engineering of BOREALIS, the very nature of Canadian democracy changes. We become a country of subjects whose every digital breath is logged and analyzed. We are standing at a crossroads. We can accept the "Lawful Access" narrative and allow the Carney government to complete its digital surveillance wall, or we can demand that our digital sovereignty remain as robust as our physical rights once were. The Montreal Mandate is a warning: if we allow them to build the pipes, we shouldn't be surprised when they decide what is allowed to flow through them.
