Canada lags other countries in combating cybercrime and online harms, says new report

Cybercrimes and other online harms are increasing in Canada and straining the capacity of law enforcement agencies, says new report by the Council of Canadian Academies (CCA), entitled Vulnerable Connections. But our ability to combat cyber-enabled harms and obtain justice for victims is hobbled by severely limited data, outdated organizational structures in police forces, little digital knowledge across the criminal justice system, and lack of federal online safety legislation. 

“Prominent gaps exist in legislation, regulation, standards and policies aimed at countering online harms,” said the report. “Regulatory tools in Canada are fragmented or ambiguous.”

Public Safety Canada sponsored the report, which was drafted by a 13-member expert panel that studied leading practices to reduce public safety risks related to the use of digital technologies.

“We need a new regulator, something that’s similar to the privacy commissioner, with power,” Dr. Emily Laidlaw, PhD, told Research Money.

An associate professor of law and Canada Research Chair in Cybersecurity Law at the University of Calgary, Laidlaw was a member of the CCA expert panel. She also co-chaired the federal government’s separate expert advisory group on online safety legislation, appointed in March 2022 after critics attacked Ottawa’s then-proposed plan.

The advisory group's recommendations likewise included creating a new regulator, who would essentially serve as an online safety commissioner, equipped with audit and enforcement powers, as well as the authority to investigate social media companies and other online platforms.

“The commissioner would have the power to audit companies and to say, ‘You have a duty to protect the online safety of Canadians. What steps are you taking to demonstrate that?’” said Laidlaw.

Unfortunately, any such regulator would be confronted with a paucity of data in Canada on cybercrime and other online harms. According to the CCA report, it is difficult even to determine how many digital forensics specialists there are in Canada, because police forces and Statistics Canada do not collect this information systematically and consistently. Nor does Canada conduct regular cyber-victimization surveys, unlike other countries, such as the U.K.

“There are some serious gaps in what we know,” Laidlaw said. “If these gaps are filled, it will put us in a much better position to be able to identify the data on cybercrimes or the data on different types of investigations by various law enforcement.”

Police forces, justice system are ill equipped

Another problem is the organizational structure of police forces, which is based on a generalist model that “is ill suited for the modern law enforcement landscape,” according to the CCA report. “This structure has contributed to significant knowledge gaps, and to difficulties in establishing and retaining the critical digital skills needed to investigate the growing number of reported cyber-enabled crimes."

As a solution to this problem, the expert panel proposed  increased “professionalization” of police forces, whereby officers are able to specialize and be rewarded for having and improving high-level digital skills. However, the report noted that current promotion practice in Canadian police forces does not incentivize skills development in this way, but instead “privileges promotion for time served over specialization and development of expertise."

For instance, one study found Canadian police officers' role in internet child exploitation units is not always recognized as “police work,” which can lead investigators to experience feelings of alienation, cynicism, and low career satisfaction.

In contrast, France's gendarmerie nationale began a program in 2018 to provide support and recognition to officers wanting to pursue ongoing education, including a PhD. And the growing importance of digital skills is reflected in the gendarmerie's updated training curriculum, which now features a pilot program enhancing  the digital aspects of police work.

Meanwhile, Canada suffers a “severe shortage of specialized digital skills” within law enforcement, according to the CCA report. “There is insufficient training available in specific areas, including Canada-specific cyber legalities, cryptocurrency, cybercrime prevention, victim assistance, and digital and network forensics.”

Canada’s criminal justice system also is unable to effectively deal with the increasingly digital nature of crime, the report concluded, because of insufficient general and specialized digital knowledge across the system. 

“The big thing out of this report is that it highlighted that this is an all-hands-on-deck problem,” Laidlaw said. “It’s just digital evidence overload that exists — to investigate, prosecute, and be digested by the courts, to be able to make a decision."

More research, education and training needed

Laidlaw identified a need for governments to fund research on cybercrimes and online harms through post-secondary institutions, along with public and private sector support for training and building capacity in digital expertise.

“This is about educating the judiciary, building up capacity, educating law enforcement, and educating the public [about the risks of online harms],” she said.

Read more: A cybersecurity talent shortage will make protecting critical assets more difficult, researchers say

While “enhancing Canada’s cybersecurity” was addressed in federal Budget 2022, the CCA report traces the vast majority of new funding — more than $875 million over five years — going to the country’s Communications Security Establishment, with no funding earmarked for Public Safety Canada or the RCMP.

“One of the issues that we face in this space is resourcing, and it’s across the board,” Laidlaw said, offering the example of Canadian law schools  educating lawyers who better understand the digital landscape. Toronto Metropolitan University’s law school does just that, with technology training embedded in the curriculum of lawyers-to-be.

Federal measures a work in progress

The CCA report also outlines how the federal government has been trying for at least three years to enact legislation to protect Canadians against cybercrime and other digital harm. One in five Canadians has faced online hate, harassment, or violence, according to an Abacus Data poll commissioned by the Canadian Race Relations Foundation.

The most recent and comprehensive federal plan proposed creating a Digital Safety Commission of Canada, supporting three new entities to oversee and enforce the new rules: a digital safety commissioner, an independent Digital Recourse Council of Canada, and an advisory board.

The digital safety commissioner would help enforce a new regulatory framework, requiring social media companies to weed out child pornography, terrorist content, hate speech, and other harmful posts. The Digital Recourse Council would be an avenue to appeal content-moderation decisions.

The government also proposed severe new sanctions for companies deemed to be repeatedly non-compliant, including fines of up to five percent of the company’s annual global revenue or $25 million, whichever is higher.

According to Laidlaw, the expert advisory group studying the government’s draft plan recommended imposing a legal duty on social media companies to act responsibly. “Companies should put in place systems that address the risks of harms of their products and their services."

Those legal obligations should extend to how these firms manage their data and practices, she added. “If a regulator could actually investigate and hold companies responsible for their transparency reporting, there’ll be a much clearer understanding of their impact.”

Laidlaw also highlighted the advisory group's recommended  “victim-centered” approach, involving a special duty of care for children. It would include an independent ombudsperson, with the power to order the immediate removal of harmful content, such as child sexual exploitation or non-consensual sharing of intimate images.

Last year, critics of the federal government’s draft online safety plan raised several concerns related to the freedom of expression, privacy rights, the impact on certain marginalized groups, and compliance with the Canadian Charter of Rights and Freedoms.

For now, although the expert advisory group has submitted its recommendations, Ottawa has yet to introduce an online safety bill in Parliament, while related legislation continues to flounder in Parliament. That includes Bill C-27,  strengthening consumer privacy and protection of personal information collected by companies, which is still making its way to a vote, and Bill C-36, focused on addressing hate propaganda, hate crimes, and hate speech, which died on the Order Paper when the 2021 election was called and has not been revisited by the federal government.

“As it stands now, we don’t have anything [in terms of legislation] and we don’t have broader oversight of digital issues,” Laidlaw said.

R$