Canada's "Machine" Problem: Bill C-22 and the Surveillance State We're Sleepwalking Into

Fiction has a funny way of becoming government policy.

Recently I've been rewatching Person of Interest, the CBS drama that ran from 2011 to 2016. If you haven't seen it, the premise is this: a billionaire genius builds a mass surveillance system for the U.S. government, called "the Machine," that ingests every camera feed, phone call, email, and financial transaction in the country and uses it to predict terrorist acts before they happen. At the time it aired, it felt like entertaining science fiction. Governments were obviously watching people, sure, but the idea that any computer system could process petabytes of surveillance data in real time and predict crime? Fanciful. Fun. Not real.

I'm not so sure anymore.

While I was rewatching, the Government of Canada quietly introduced Bill C-22, the Lawful Access Act, 2026 on March 12th. On the surface, it sounds reasonable. It modernizes how police and security agencies access digital data during investigations, updates subscriber information rules, streamlines production orders, and clarifies how CSIS and law enforcement can work with foreign telecom providers. The government has even walked back some of the more aggressive warrantless access proposals from its predecessor, Bill C-2. Give credit where credit is due: they listened to stakeholders. Progress was made.

But wait! There's more.

Part 2 of the bill creates a brand new piece of legislation called the Supporting Authorized Access to Information Act, or SAAIA. And SAAIA is where things get genuinely alarming for anyone who cares about a free and open internet in Canada. Let me be specific, because the devil here is very much in the details. SAAIA would mandate that every telecommunications company in Canada must be technically capable of locating every smartphone in the country in real time so that police and CSIS can track them on demand. This is not my interpretation or my extrapolation. This is the specific capability the government has stated it wants built into every network in Canada. We are talking about a legislated, permanent infrastructure for mass location surveillance.

For those not familiar with how these things work in practice: when you mandate that a backdoor exists, you don't get to choose who uses it. That's not cynicism, that's history. The backdoors mandated by the American equivalent of this kind of legislation, the Communications Assistance for Law Enforcement Act, have already been exploited by Chinese state hackers to access U.S. government surveillance systems. In the United Kingdom, the Investigatory Powers Act was used to issue a secret order requiring Apple to compromise the encryption protecting billions of users worldwide. Not Canadian users. Billions of users. These are not hypotheticals or slippery slope arguments. They are documented, recent events. The Canadian government is proposing to build the same infrastructure and somehow expects different results.

The secret order problem deserves its own paragraph. Under SAAIA, the Minister of Public Safety can issue ministerial orders to any electronic service provider, covering almost any capability related to digital information, and those providers are prohibited from telling you the order exists. Section 15 of the Act makes disclosure a criminal offence. Your phone company, your internet provider, your cloud storage service - they cannot tell you that your device or your data has been converted into a government surveillance instrument. This is not a hypothetical future power. It is written into the legislation.

Now, to be fair, the bill does require warrants in most circumstances, and that's an improvement over what was originally proposed. Reading the text, you might conclude that Charter protections are intact. You'd be mostly right, except for a rather significant exception tucked into subsection (2.7)(b), which provides that a copy of the warrant does not have to be provided to a person if the issuing judge decides "doing so is justified in the circumstances." That is an enormously subjective carve-out. "Justified in the circumstances" is the legal equivalent of "whenever we feel like it." A warrant that cannot be inspected, challenged, or even known about is not much of a warrant at all.

So what can we do about this? First, pay attention to it. Bill C-22 was introduced less than two weeks ago and most Canadians have no idea it exists. Organizations like The Canadian Internet Society (TCIS), the Canadian Civil Liberties Association, and OpenMedia are already raising concerns, and they need public support to make noise during the committee review process. Second, contact your MP. This legislation is at first reading and there is still time to push for amendments that preserve the legitimate law enforcement access the bill is designed to achieve while removing the parts that mandate permanent backdoor infrastructure. Law enforcement absolutely should be able to compel the production of existing data when a judge says so. What they should not be able to do is require private companies to build surveillance capabilities that can be turned against the entire Canadian public, in secret, on ministerial say-so.

The bottom line is this: we are not living in 2011 anymore, when the idea of a government "Machine" that could analyze all our data in real time felt like science fiction. Modern GPU clusters can process petabytes of data in hours. AI systems can identify patterns in metadata at a scale that would have seemed impossible a decade ago. We are building, piece by piece, every technical prerequisite for the system Harold Finch built in a TV show, except this one won't have a Harold Finch with a conscience running it. It will have a minister and a classification stamp. Canadians should be paying very close attention.