With the recent shutdowns of the internet in Egypt and Libya, as well new proposals for new U.S. legislation on the matter, there's been a lot of talk of "internet kill switches" over the past few weeks. I think it will be fruitful to discuss the legal and technical side of how Canada's government could, hypothetically, pull this big red switch on us using its existing powers.
Introduction: The U.S. Kill Switch
I became keen to look into this issue after it came to light that the U.S. already has kill-switch legislation in place under the Communications Act of 1934 (s. 706(c)) (in the case of "war or a threat of war, or a state of public peril or disaster or other national emergency, or in order to preserve the neutrality of the United States" the President "may cause the closing of any station for radio communication").
New U.S. legislation, entitled the Cybersecurity and Internet Freedom Act may also contain kill switch powers, and is now being hotly contested. It was during debate over this new bill that Liberman, one the bill's sponsors, pointed out that the Act would actually limit the existing powers of the President, not expand them. Comments by the senate committee communications director of the Homeland Security appear to confirm this interpretation, as she made arguments on the grounds that it the bill would “replace the sledgehammer of the 1934 Communications Act with a scalpel.”
It's worth noting that although the powers in the new U.S. bill may be more circumscribed, the prescribed circumstances for its invocation may be wider. Whereas the former Act is directed at a war or national emergency, the President could invoke the new powers upon any "cyber risk...to the reliable operation of covered critical infrastructure".
Canada's Kill Switch Legislation
Now, turning to Canada's legislation, it appears that our executive government, like that in the U.S., has a kill-switch authority grant from an old act. First, looking to Canada's analogy to the U.S. Communications Act, it appears that the executive's powers are actually quite circumscribed under our Telecommunications Act, S.C. 1993, c. 38. The executive is only granted moderate regulatory authority, such as the ability to review CRTC decisions and to direct this body on policy matters. However, analogous provisions to the U.S. kill switch are still to be found in the Emergencies Act, R.S.C. 1985, c. 22. Several provisions permit the government to control and shutdown key internet gateways.
Under a "public order emergency" in the Emergencies Act, the government may direct "the assumption of the control, and the restoration and maintenance, of public utilities and services" (s. 19(1)). In an "international emergency", it may more generally order "the appropriation, control, forfeiture, use and disposition of property or services".
Interestingly, the declaration of an "international emergency" -- where there is a threat of a conflict with another country -- comes with a s. 30(2)(b) stipulation that the powers "shall not be exercised or performed for the purpose of censoring, suppressing or controlling the publication or communication of any information". Thus, this section cannot likely be invoked as a kill switch. Per contra, no such limitation exists in the case of a declared "public order" emergency. The Governor in Council may have an internet kill switch available whenever it decides that there is "an emergency that arises from threats to the security of Canada and that is so serious as to be a national emergency" (s. 16).
Canada's Kill Switch Implementation
Now, on the technical side of the matter, there are three key ways that a government can throw off an internet kill switch. The first method, widely believed to have been deployed in Egypt, is the manipulation of what is called the Border Gateway Protocol (BGP). This is essentially a partial map of the internet held by each major router, telling it where to forward and direct internet traffic passing through it. By forcing each ISP within Egypt to delete all of BGP routes pointing within the country, the state simply dropped off the internet map and became invisible.
The second way, which some reports suggest was the actual mechanism used by the Egyptian government, is to simply cut off all traffic where it enters and leaves the country. In Egypt, breakers may have been thrown at the two key Internet Exchange Points (IXPs), Ramses and Cairo.
The third method, which was reportedly used in Libya, is to throttle traffic at each ISP to the point of unresponsiveness. During the Libyan blackout earlier this month, internet servers appeared to be alive with all of their routes intact. Some users were even still pingable (albeit slowly). It appears that the government simply ordered their single ISP, LT&T, to slow down bandwidth to a near standstill, making the internet unusable.
In Canada, all three of these methods are technically feasible. Assuming that ISP's fit within the terminology of a "public service", the Canadian government could invoke section 19(1) of the Emergencies Act to take control of Canada's ISP's, forcing them to make the necessary changes to their BGP routing tables. There's only a handful of major ISPs in Canada that the government would have to requisition for this task (keeping in mind that smaller ISP's such Techsavvy simply purchase bandwidth from the major players).
For the government to deploy the second method in Canada, it would need only to send marching orders to 151 Front Street W in Toronto, home or the major TorIX IXP. From here, it could put a stop to the majority traffic entering and leaving Canada. Admittedly, this might not be as effective as the first method, as many servers could route around the outage -- but it would still take down a major portion of the Canadian internet for some time.
The third method of throttling the internet would, of course, be similar to the first. It would only require control of Canada's few major ISPs such as Bell, Telus, and Rogers.
The flip of the internet kill switch is legally and technically possible in Canada.
The Cellphone Kill Switch
I'll add, as a side note, that the shutdown of cell phones may also be possible in Canada. The Radiocommunication Act, R.S.C. 1985, c. R-2, under a section title "Possession by Her Majesty", provides that:
- 7. (1) Her Majesty may assume and, for any length of time, retain possession of any radio station and all things necessary to the sufficient working of it and may, for the same time, require the exclusive service of the operators and other persons employed in working the station.
A "radio station' under the Act is broadly defined and certainly includes all cellphone base stations. Although the provision does not specifically mention the power to close a station, the term "possession" generally entails a wide open set of powers to use or stop the use of the object under possession. Thus, the Canadian government likely also has the present technical power to shutdown cellphone communications.
Internet as a Fundamental Right
Overall, let me be clear that I'm not trying to monger fear. The chance of our democratic government invoking these provisions to shutdown the internet, in a similar manner to Mabarack, is just about nil. However, it's important to protect our liberties from erosion. With internet access starting to be recognized as a fundamental human right, legislation such as the Emergencies Act needs to be clear in defining limitations that no government or official has the authority to block the internet.