Senator Yuen Pau Woo

Lawful Access Bill, 2026

Second Reading—Debate Adjourned

Hon. Yuen Pau Woo: Honourable senators, in my response to the Speech from the Throne on Tuesday, I argued that Canada must respond decisively to a changing world without surrendering parliamentary oversight.

Bill C-22 tests that principle. I have serious reservations about passing it in its present form. My concerns centre on the security of the access capabilities it would authorize and the exclusion of important executive orders from ordinary parliamentary scrutiny.

The government must demonstrate that the investigative benefits justify the additional risks. I do not believe it has yet done so. Committee study must test that case, hear the right witnesses and remain open to substantial amendments.

The House of Commons passed Bill C-22 on June 18. Subsequent disclosures have materially changed the evidence available to us.

In July, OpenAI disclosed that experimental models had escaped containment and compromised Hugging Face. These tests involved reduced safeguards, not ordinary consumer use. Nevertheless, a supposed boundary between an evaluation and real infrastructure failed.

On September 8, Google Threat Intelligence reported adversaries moving from simple prompts to agentic workflows: AI systems carrying out linked tasks with less human intervention. It described an attacker planning, building and executing a mass credential-theft campaign in under six hours.

Google was reporting activity from April to June, before the bill passed the other place. But this newly published evidence after the bill left the House of Commons shows how little time defenders may have to respond.

On September 24, Australia disclosed that an AI agent had gained unauthorized access to public and non-public files in its Medicare statistics portal. The activity occurred in June; notification only came in September. At disclosure, no personal information was believed to have been accessed.

Closer to home, on September 29, Canada’s Cyber Centre acknowledged reports of suspicious activity, including suspected AI agent activity targeting government websites.

It explicitly reported no indication that government systems had been compromised.

These are different events. They are not a catalogue of confirmed government breaches. Together they warrant fresh examination of how reliably agents remain within authorized boundaries.

Nor is the concern confined to agents acting unexpectedly. On September 14, the Cyber Centre warned of an active global campaign using AI to attack internet-exposed industrial controllers. Here, hostile operators were deliberately using AI.

Anthropic’s Fable and Mythos labels likewise illustrate the distinction between powerful underlying capabilities and safeguards governing their use. These tools can assist defenders, but a system faithfully following instructions is not necessarily safe when the person giving those instructions has malign intentions.

None of this establishes that AI has broken strong encryption. It does challenge confidence that sensitive access mechanisms can remain beyond unauthorized reach.

There is already a warning directly relevant to this bill. In briefing materials prepared for his Commons appearance, the Privacy Commissioner cited Salt Typhoon’s compromise of American telecommunications networks and the reported targeting of systems used for court-approved access. He warned that similar Canadian capabilities and metadata retention requirements could expose providers to “precisely such attacks.”

The Canadian Civil Liberties Association, or CCLA, and Citizen Lab made a related argument in their joint brief. They pointed to a leaked NSA document describing exploitation of foreign lawful interception capabilities.

These are historical precedents, not new AI incidents. Their significance is that infrastructure created for authorized access — lawful access, if you will — can itself become a valuable intelligence target. AI-enabled attacks give us reason to reassess that long-standing danger.

The bill can specify who is legally authorized to obtain information, but it cannot, by declaration, ensure that nobody else can obtain it.

Part 2 could require providers to maintain technical access capabilities and retain prescribed categories of metadata for up to six months. It does not, itself, create one central government database or automatically authorize access to everyone’s communications, but compulsory retention and additional retrieval capabilities could increase the amount of sensitive information available to an intruder. That risk must be assessed — not dismissed because the intended use is lawful.

The House of Commons added safeguards, including limits on compelled decryption. Providers need not comply with requirements that would introduce a systemic vulnerability. Those protections matter. But why rely on providers declining unsafe requirements rather than expressly prohibiting the government from imposing them? The committee should ask whether the bill places too much responsibility on individual providers to identify and contest risks that affect the public.

The definition of “systemic vulnerability” also excludes certain risks confined to information about people already subject to lawful access authority. It also makes recognized international technical standards relevant to assessing credible risk.

But how can we be confident that the weakness remains confined to one target? What happens when an AI system exposes a risk that a standard did not anticipate?

My support for recognized standards in the Throne Speech from a few days ago was not a claim that compliance guarantees security indefinitely. Consider two hypothetical scenarios: A provider implements a targeted access capability judged to be safe. A more capable AI system subsequently discovers that it exposes other users. Who must reassess it? And can its use be suspended immediately? Alternatively, an attacker compromises an existing provider system without defeating encryption. Would newly mandated retention and retrieval capabilities make the resulting loss more extensive? I’m not predicting either outcome. I’m asking who must establish that these risks are acceptably controlled and what happens when that assessment changes.

The committee should hear from the Cyber Centre; Google’s threat investigators; engineers from OpenAI, Hugging Face and Anthropic; and independent investigators, including Transluce and METR. It should also invite, of course, the Privacy Commissioner, the CCLA and Citizen Lab authors, independent security experts, cryptographers and provider security engineers.

Police and CSIS should demonstrate the operational needs and explain less risky alternatives. We should examine stronger statutory security limits, independent testing, continuing reassessment, prompt incident reporting and a rapid mechanism to suspend unsafe requirements.

Requirements to retain additional data deserve their own necessity and proportionality assessment. Witnesses should distinguish what is technically possible from what is demonstrably safe at scale. A successful demonstration is not enough. We need evidence about maintenance, failure, malicious insiders and increasingly capable external attackers.

The question is not whether perfect security exists. It is whether the government has made a convincing case for imposing these very additional risks.

That brings me directly to my response to the Throne Speech. Greater executive flexibility should increase the importance of parliamentary oversight, not diminish it. The most troubling exclusion, in my view, is subsection 7(6) of the proposed supporting authorized access to information act, enacted through clause 41.

Section 7 allows ministerial orders imposing requirements that could otherwise be prescribed by regulation. Section 12 lets those orders prevail over inconsistent regulations made under subsection 5(2). Yet, subsection 7(6) excludes them all from the Statutory Instruments Act. Requirements that are regulatory in substance should not lose their ordinary route to parliamentary scrutiny simply because a minister imposes them by order.

Subsection 6(6) excludes temporary exemption orders. Subsection 24(3) excludes compliance orders directing providers to stop contraventions or take remedial measures. Each performs a different function, but each requirement or, I should say, each exclusion requires justification.

The Statutory Instruments Act concerns more than publication. Section 19 provides the ordinary standing referral to the Scrutiny of Regulations Committee, which I co-chair. Excluding an instrument removes that route; it does not merely prevent sensitive information from being published.

As I explained in my earlier speech, the Standing Joint Committee for the Scrutiny of Regulations examines legality, rights and the limits of delegated authority. Its ordinary scrutiny follows the making of an instrument. It is not a general pre‑approval queue, nor is it a cybersecurity certification body.

These exclusions did not go unnoticed in the House of Commons. MP Jacob Mantle challenged the ministerial order exemption, and OpenMedia recommended deleting subsection 7(6). That exclusion, nevertheless, remains. Our task is to examine the unresolved parliamentary question.

Independent intelligence review and parliamentary scrutiny perform different functions. One should not quietly displace the other.

Public Safety and Justice should explain every exclusion. The committee should hear from the Intelligence Commissioner, the review agency and parliamentary law specialists, drawing appropriately on the expertise of counsel, perhaps counsel supporting the Scrutiny of Regulations Committee.

We should examine whether confidentiality can be protected through adapted scrutiny arrangements rather than blanket exclusions. Such arrangements require secure access, workable rules and adequate resources. Simply proposing an in camera meeting is insufficient.

We should also ask whether providers can obtain independent security advice and report dangerous requirements promptly without confidentiality obligations preventing effective scrutiny.

Amendments preserving parliamentary examination, particularly of clause 7 orders, should be firmly on the table for the committee review.

Colleagues, let me summarize my concerns.

We are being asked to authorize highly technical powers that could create new avenues for attack in an already unstable and rapidly evolving environment while removing important instruments from ordinary parliamentary scrutiny.

I do not believe the time is right to grant such sweeping powers on the strength of assurances that have not been adequately tested against the evidence now available. I am not confident that we can pass Bill C-22 as it exists today without significantly increasing the vulnerability of Canadian privacy, data and businesses.

The evidence disclosed since passage in the House of Commons makes the risk of unauthorized access through so‑called lawful access more urgent. I do not believe the government has demonstrated that these capabilities can be created and maintained securely enough to keep pace with AI‑enabled adversaries. Our response should not be to demand impossible guarantees; it should be to demand evidence, enforceable limits and continuing accountability.

In my Throne Speech response, I described the Standing Joint Committee for the Scrutiny of Regulations, or REGS, accepting a practical solution on the accessibility of incorporated standards. That showed scrutiny accommodating flexibility, not surrendering its purpose. We should take the same approach here without assuming that every problem can be solved by guidance after enactment.

Where the evidence does not justify a power, we should be prepared to narrow, remove or defer it. Committee study must be a genuine opportunity to change this bill, not merely a search for reassurance.

Effective investigations matter, so do secure communications and accountable government. In strengthening one part of public safety, we must not weaken another.

Thank you.