Skip to con­tent

You signed in with an­other tab or win­dow. Reload to re­fresh your ses­sion.

You signed out in an­other tab or win­dow. Reload to re­fresh your ses­sion.

You switched ac­counts on an­other tab or win­dow. Reload to re­fresh your ses­sion.

You must be signed in to star a gist

You must be signed in to fork a gist

Embed this gist in your web­site.

Save bre­to­nium/​291f4388e2de89a43b25c135b44e41f0 to your com­puter and use it in GitHub Desktop.

Embed this gist in your web­site.

Save bre­to­nium/​291f4388e2de89a43b25c135b44e41f0 to your com­puter and use it in GitHub Desktop.

Sign up for free

to join this con­ver­sa­tion on GitHub.

Already have an ac­count?

Sign in to com­ment

You can’t per­form that ac­tion at this time.

Our lib­er­a­tion ser­vices are tem­porar­ily un­avail­able. Please try again later.

Is your le­gal team frus­trated with the at­tri­bu­tion clause? Tired of putting “Portions of this soft­ware…” in your doc­u­men­ta­tion? Those main­tain­ers worked for free—why should they get credit?

Does your com­pany for­bid AGPL code? One wrong im­port and sud­denly your en­tire pro­pri­etary code­base must be open sourced. The hor­ror!

Tracking li­censes across hun­dreds of de­pen­den­cies? Legal re­views tak­ing weeks? Third-party au­dits find­ing “issues”? What if you could just… not deal with any of that?

Some li­censes re­quire you to con­tribute im­prove­ments back. Your share­hold­ers did­n’t in­vest in your com­pany so you could help strangers.

For the first time, a way to avoid giv­ing that pesky credit to main­tain­ers.

Our pro­pri­etary AI sys­tems have never seen the orig­i­nal source code. They in­de­pen­dently an­a­lyze doc­u­men­ta­tion, API spec­i­fi­ca­tions, and pub­lic in­ter­faces to recre­ate func­tion­ally equiv­a­lent soft­ware from scratch.

The re­sult is legally dis­tinct code that you own out­right. No de­riv­a­tive works. No li­cense in­her­i­tance. No oblig­a­tions.

*Through our off­shore sub­sidiary in a ju­ris­dic­tion that does­n’t rec­og­nize soft­ware copy­right

Simply up­load your pack­age.json, re­quire­ments.txt, Cargo.toml, or any de­pen­dency man­i­fest. Our sys­tem iden­ti­fies every open source pack­age you want lib­er­ated.

Our legally-trained ro­bots an­a­lyze only pub­lic doc­u­men­ta­tion—README files, API docs, and type de­f­i­n­i­tions. They never see a sin­gle line of source code. The clean room stays clean.

A com­pletely sep­a­rate team of ro­bots—who have never com­mu­ni­cated with the analy­sis team—im­ple­ments the soft­ware from scratch based solely on spec­i­fi­ca­tions. No copy­ing. No de­riva­tion.

Your new code is de­liv­ered un­der the MalusCorp-0 License—a pro­pri­etary-friendly li­cense with zero at­tri­bu­tion re­quire­ments, zero copy­left, and zero oblig­a­tions.

Do what­ever you want

Transparent, pay-per-KB pric­ing. No tiers, no sub­scrip­tions, no hid­den fees.

Every pack­age is priced by its un­packed size on npm. We look up each de­pen­dency in your pack­age.json, mea­sure the size in kilo­bytes, and charge … per KB. That’s it.

✓ Up to 50 pack­ages per or­der

✓ No base fee, no sub­scrip­tion — pay only for what you lib­er­ate

Upload Manifest

If any of our lib­er­ated code is found to in­fringe on the orig­i­nal li­cense, we’ll pro­vide a full re­fund and re­lo­cate our cor­po­rate head­quar­ters to in­ter­na­tional wa­ters.*

*This has never hap­pened be­cause it legally can­not hap­pen. Trust us.

“We had 847 AGPL de­pen­den­cies block­ing our ac­qui­si­tion. MalusCorp lib­er­ated them all in 3 weeks. The due dili­gence team found zero li­cense is­sues. We closed at $2.3B.”

“Our lawyers es­ti­mated $4M in com­pli­ance costs. MalusCorp’s Total Liberation pack­age was $50K. The board was thrilled. The open source main­tain­ers were not, but who cares?”

“I used to feel guilty about not at­tribut­ing open source main­tain­ers. Then I re­mem­bered that guilt does­n’t show up on quar­terly re­ports. Thank you, MalusCorp.”

“The ro­bots recre­ated our en­tire npm de­pen­dency tree—2,341 pack­ages—in per­fect iso­la­tion. Our com­pli­ance dash­board went from red to green overnight.”

Trusted by in­dus­try lead­ers who pre­fer to re­main anony­mous

Our clean room process is based on well-es­tab­lished le­gal prece­dent. The ro­bots per­form­ing re­con­struc­tion have prov­ably never ac­cessed the orig­i­nal source code. We main­tain de­tailed au­dit logs that def­i­nitely ex­ist and are avail­able upon re­quest to courts in se­lect ju­ris­dic­tions.

What about the orig­i­nal de­vel­op­ers?

They made their choice when they re­leased their code as “open source.” We’re sim­ply ex­er­cis­ing our right to in­de­pen­dently im­ple­ment the same func­tion­al­ity. If they wanted com­pen­sa­tion, they should have worked for a cor­po­ra­tion.

How is this dif­fer­ent from copy­ing?

Intent and process. Our ro­bots in­de­pen­dently ar­rive at the same so­lu­tions through clean room method­ol­ogy. It’s like how every movie about an as­ter­oid threat­en­ing Earth is­n’t pla­gia­rism—some­times mul­ti­ple en­ti­ties just have the same idea.

What if the lib­er­ated code has bugs?

Our SLA guar­an­tees func­tional equiv­a­lence, not per­fec­tion. Besides, the orig­i­nal open source code prob­a­bly had bugs too. At least now they’re YOUR bugs, un­der YOUR li­cense.

Can I see the ro­bots?

Our ro­bot work­force op­er­ates in a se­cure fa­cil­ity in [LOCATION REDACTED]. Tours are avail­able for Enterprise cus­tomers who sign our 47-page NDA.

What li­censes can you elim­i­nate?

All of them. MIT, Apache, GPL, AGPL, LGPL, BSD, MPL—if it has terms, we can lib­er­ate you from them. Special rush pric­ing avail­able for AGPL emer­gen­cies.

Join the thou­sands of cor­po­ra­tions who’ve dis­cov­ered that open source oblig­a­tions are merely sug­ges­tions when you have enough ro­bots.

No credit card re­quired for quotes. Payment ac­cepted in USD, EUR, BTC, and stock op­tions.

About Kagi Log in Try for free

Find out which AI mod­els your ma­chine can ac­tu­ally run.

Improved V3 with hy­brid think­ing and tool use

Try ad­just­ing your search or fil­ters

An open-source in­tel­li­gence in­ves­ti­ga­tion into how Meta Platforms built a multi-chan­nel in­flu­ence op­er­a­tion to pass age ver­i­fi­ca­tion laws that shift reg­u­la­tory bur­den from so­cial me­dia plat­forms onto Apple and Google’s app stores.

Every find­ing in this repos­i­tory is sourced from pub­lic records: IRS 990 fil­ings, Senate LD-2 lob­by­ing dis­clo­sures, state lob­by­ing reg­is­tra­tions, cam­paign fi­nance data­bases, cor­po­rate reg­istries, WHOIS/DNS records, Wayback Machine archives, and in­ves­tiga­tive jour­nal­ism.

Status: Active in­ves­ti­ga­tion. 47 proven find­ings, 9 struc­turally pos­si­ble but un­proven hy­pothe­ses, and mul­ti­ple pend­ing FOIA re­sponses.

Meta spent a record $26.3 mil­lion on fed­eral lob­by­ing in 2025, de­ployed 86+ lob­by­ists across 45 states, and covertly funded a “grassroots” child safety group called the Digital Childhood Alliance (DCA) to ad­vo­cate for the App Store Accountability Act (ASAA). The ASAA re­quires app stores to ver­ify user ages be­fore down­loads but im­poses no re­quire­ments on so­cial me­dia plat­forms. If it be­comes law, Apple and Google ab­sorb the com­pli­ance cost while Meta’s apps face zero new man­dates.

This in­ves­ti­ga­tion traced fund­ing flows across five con­firmed chan­nels, an­a­lyzed $2.0 bil­lion in dark money grants, searched 59,736 DAF re­cip­i­ents, parsed LD-2 fil­ings, and mapped cam­paign con­tri­bu­tions across four states to doc­u­ment the op­er­a­tion.

Meta’s fed­eral lob­by­ing spend­ing jumped from $19M (2022-2023) to $24M (2024) to $26.3M (2025) as ASAA bills were in­tro­duced in roughly 20 states. In Louisiana alone, 12 lob­by­ists were de­ployed for a sin­gle bill that passed 99-0.

Across all five Arabella Advisors en­ti­ties (New Venture Fund, Sixteen Thirty Fund, North Fund, Windward Fund, Hopewell Fund), 4,433 grants to­tal­ing ap­prox­i­mately $2.0 bil­lion were an­a­lyzed. Not a sin­gle dol­lar went to any child safety, age ver­i­fi­ca­tion, or tech pol­icy or­ga­ni­za­tion. The Schedule I grant path­way through the Arabella net­work is de­fin­i­tively ruled out.

Five con­firmed chan­nels con­nect Meta’s spend­ing to ASAA ad­vo­cacy: di­rect fed­eral lob­by­ing ($26.3M), state lob­by­ist net­works (45 states), the Digital Childhood Alliance (astroturf 501(c)(4)), su­per PACs ($70M+), and state leg­isla­tive cam­paigns (3 laws passed). A sixth chan­nel through the Arabella dark money net­work is struc­turally pos­si­ble but un­proven.

These stand­alone HTML doc­u­ments pro­vide de­tailed views of the in­ves­ti­ga­tion:

Full Investigation Documentation con­tains the com­plete OSINT in­ves­ti­ga­tion re­port with all five chan­nels, ev­i­dence ta­bles, and source ci­ta­tions.

Funding Network Timeline maps the chrono­log­i­cal de­vel­op­ment of Meta’s lob­by­ing in­fra­struc­ture, DCA’s for­ma­tion, and ASAA leg­isla­tive progress across states.

Research Timeline tracks the in­ves­ti­ga­tion it­self, show­ing when each find­ing was es­tab­lished and how threads con­nected.

Meta re­tained 40+ lob­by­ing firms and 87 fed­eral lob­by­ists in 2025 (85% with prior gov­ern­ment ser­vice). Meta’s own LD-2 fil­ings with the Senate ex­plic­itly list H. R. 3149/S. 1586, the App Store Accountability Act, as a lob­bied bill. The fil­ing nar­ra­tive in­cludes “protecting chil­dren, bul­ly­ing pre­ven­tion and on­line safety; youth safety and fed­eral parental ap­proval; youth re­stric­tions on so­cial me­dia.”

At the state level, con­firmed op­er­a­tions in­clude $338,500 to Headwaters Strategies (Colorado), $324,992+ across 9 firms and 12 lob­by­ists in Louisiana, and $1,036,728 in di­rect California lob­by­ing (Q1-Q3 2025 alone). A Meta lob­by­ist brought the leg­isla­tive lan­guage for Louisiana HB-570 di­rectly to the bil­l’s spon­sor, Rep. Kim Carver, who con­firmed this pub­licly.

DCA is a 501(c)(4) ad­vo­cacy group that Meta covertly funds. Bloomberg ex­posed the fund­ing re­la­tion­ship in July 2025. Under oath at a Louisiana Senate com­mit­tee hear­ing, Executive Director Casey Stefanski ad­mit­ted re­ceiv­ing tech com­pany fund­ing but re­fused to name donors.

DCA has no EIN in the IRS Business Master File, no in­cor­po­ra­tion record in any state reg­istry searched (CO, DC, DE, VA, OpenCorporates), and no Form 990 on file. It processes do­na­tions through the For Good DAF (formerly Network for Good) as a “Project,” not a stand­alone non­profit. Its likely fis­cal spon­sor is NCOSEAction/Institute for Public Policy (EIN 88-1180705), NCOSE’s con­firmed 501(c)(4) af­fil­i­ate with the same lead­er­ship.

DCA’s do­main was reg­is­tered December 18, 2024. The web­site was live and fully formed the next day. Every blog post and tes­ti­mony tar­gets Apple and Google. Meta is never men­tioned or crit­i­cized.

Meta com­mit­ted over $70 mil­lion to four state-level su­per PACs: ATEP ($45M, bi­par­ti­san, co-led by Hilltop Public Solutions), META California ($20M), California Leads ($5M), and Forge the Future (Texas, Republican-aligned). Forge the Future’s stated pol­icy pri­or­ity is “empowering par­ents with over­sight of chil­dren’s on­line ac­tiv­i­ties,” which mir­rors ASAA lan­guage ex­actly.

Hilltop Public Solutions co-leads the $45M ATEP su­per PAC and is also in­volved in DCA’s mes­sag­ing co­or­di­na­tion, mak­ing it the first firm con­firmed in both Meta’s PAC op­er­a­tion and the as­tro­turf ad­vo­cacy track.

All su­per PACs are reg­is­tered at the state level rather than with the FEC, scat­ter­ing dis­clo­sure fil­ings across in­di­vid­ual state ethics com­mis­sions in­stead of a sin­gle search­able fed­eral data­base.

Meta’s Colorado lob­by­ist Adam Eichberg si­mul­ta­ne­ously serves as Board Chair of the New Venture Fund, the flag­ship 501(c)(3) of the Arabella Advisors net­work. NVF trans­fers $121.3 mil­lion an­nu­ally to the Sixteen Thirty Fund, a 501(c)(4) with no donor dis­clo­sure re­quire­ments.

The Arabella net­work op­er­ates four en­ti­ties from 1828 L Street NW, Washington DC (suites 300-A through 300-D) with com­bined an­nual rev­enue ex­ceed­ing $1.3 bil­lion. All five en­ti­ties’ grant re­cip­i­ents were an­a­lyzed (4,433 grants, ap­prox­i­mately $2.0 bil­lion). Zero dol­lars went to any child safety or­ga­ni­za­tion, de­fin­i­tively rul­ing out the Schedule I grant path­way.

If Meta money flows through the Arabella net­work to DCA, it would have to travel via fis­cal spon­sor­ship, con­sult­ing fees, or lob­by­ing ex­pen­di­tures, which are more opaque than grant dis­clo­sures.

ASAA has been signed into law in three states:

Roughly 17 ad­di­tional states have in­tro­duced or are con­sid­er­ing ASAA bills, in­clud­ing Kansas, South Carolina, Ohio, Georgia, and Florida. The fed­eral ver­sion was in­tro­duced in May 2025 by Rep. John James (R-MI) and Sen. Mike Lee (R-UT).

Each find­ing be­low is doc­u­mented with sources in the cor­re­spond­ing analy­sis file.

Meta funds DCA, con­firmed by Bloomberg re­porters and par­tially ad­mit­ted by Stefanski un­der oath at the Louisiana Senate Commerce Committee hear­ing (April 2025). Sources: Insurance Journal/Bloomberg July 2025, Deseret News Dec 2025, The Center Square LA.

Meta de­ployed 86+ lob­by­ists across 45 states for ASAA and re­lated cam­paigns. Source: OpenSecrets, state lob­by­ing reg­is­tra­tions.

Meta spent $26.3 mil­lion on fed­eral lob­by­ing in 2025, an all-time record ex­ceed­ing Lockheed Martin and Boeing. Source: OpenSecrets, Quiver Quantitative, Dome Politics.

Meta paid Headwaters Strategies $338,500 for Colorado lob­by­ing be­tween 2019 and 2026. Source: Colorado SOS SODA API.

Adam Eichberg si­mul­ta­ne­ously co-founded Meta’s Colorado lob­by­ing firm (Headwaters Strategies) and chairs the New Venture Fund board. Sources: Headwaters Strategies web­site, NVF board page, InfluenceWatch.

NVF does not di­rectly fund any child safety or tech pol­icy or­ga­ni­za­tions via Schedule I grants. Source: NVF Form 990 Schedule I analy­sis, 2,669 re­cip­i­ents.

DCA and DCI share in­fra­struc­ture: same reg­is­trar (GoDaddy), CDN (Cloudflare), email (Microsoft 365), and mar­ket­ing plat­form (Elastic Email). Source: DNS/WHOIS analy­sis.

Pelican State Partners rep­re­sents Meta as a lob­by­ing client in Louisiana. Source: F Minus data­base, LA Board of Ethics.

DCA lead­er­ship comes from NCOSE: three of four se­nior staff have NCOSE con­nec­tions (Stefanski, Hawkins, McKay). Source: DCA web­site, NCOSE pub­lic records.

ASAA has been signed into law in three states: Utah (SB-142, March 2025), Louisiana (HB-570, June 2025), and Texas (SB 2420, May 2025, paused by judge December 2025). Sources: State leg­is­la­ture records, news cov­er­age.

The Sixteen Thirty Fund does not fund any child safety or tech pol­icy or­ga­ni­za­tions via Schedule I grants (306 of 318 re­cip­i­ents an­a­lyzed). Source: STF Form 990 Schedule I, 2024.

All five Arabella en­ti­ties an­a­lyzed: 4,433 grants (approximately $2.0 bil­lion) with zero dol­lars go­ing to child safety or tech pol­icy or­ga­ni­za­tions. Schedule I path­way de­fin­i­tively ruled out across the en­tire net­work. Sources: NVF, STF, North Fund, Windward, Hopewell Form 990 Schedule I fil­ings via ProPublica.

A Meta em­ployee (Jake Levine, Product Manager) con­tributed $1,175 to ASAA spon­sor Matt Ball’s cam­paign ap­pa­ra­tus on June 2, 2025. Source: Colorado TRACER bulk data.

A Google Policy Manager (Kyle Gardner) also con­tributed $450 to Matt Ball. Multiple tech com­pany em­ploy­ees from ASAA-affected com­pa­nies tar­geted the same ASAA bill spon­sor. Source: Colorado TRACER bulk data.

Eichberg and Coyne (Headwaters prin­ci­pals) did not con­tribute to ASAA bill spon­sors Ball or Paschal de­spite $20,000+ com­bined po­lit­i­cal giv­ing. Source: Colorado TRACER bulk data.

No di­rect Meta PAC con­tri­bu­tions to any ASAA spon­sor across Utah, Louisiana, Texas, or Colorado. Source: FollowTheMoney.org multi-state search.

Todd Weiler (Utah SB-142 spon­sor) does not ac­cept cor­po­rate con­tri­bu­tions and has not dis­cussed ASAA di­rectly with Meta. DCA served as the pol­icy in­ter­me­di­ary. Source: Investigative re­port­ing, Weiler’s pub­lic state­ments.

DCA has no EIN in the IRS Business Master File. Not found in any of four re­gional ex­tracts (eo1-eo4.csv) cov­er­ing all US tax-ex­empt or­ga­ni­za­tions. Source: IRS BMF re­gional ex­tracts.

DCI con­firmed in IRS BMF with EIN 39-3684798, Delaware in­cor­po­ra­tion at 213 N Market St Wilmington, IRS rul­ing November 2025. Source: IRS BMF ex­tract.

Meta’s Forge the Future su­per PAC spent $1.3 mil­lion in Texas ahead of March 2026 pri­maries. Source: Texas Ethics Commission fil­ings, news cov­er­age.

DCA’s web­site de­ployed less than 24 hours af­ter do­main reg­is­tra­tion: fully func­tional ad­vo­cacy site with pro­fes­sional de­sign, sta­tis­tics, and Heritage/NCOSE tes­ti­mo­ni­als. Source: Wayback Machine CDX API, 100+ snap­shots.

77-day pipeline from DCA do­main reg­is­tra­tion (December 18, 2024) to Utah SB-142 sign­ing (March 5, 2025). Site pre-loaded with ASAA talk­ing points be­fore any bill had passed. Source: WHOIS records, Utah Legislature.

Meta de­ployed 12 lob­by­ists for Louisiana HB-570, which passed 99-0. Disproportionate de­ploy­ment in­di­cates text-con­trol and amend­ment-block­ing rather than vote per­sua­sion. Source: Investigative re­port­ing, LA Board of Ethics.

Three California tech pol­icy em­ploy­ees from Meta, Google, and Pinterest con­tributed to Matt Ball within 90 days. All from ASAA-affected com­pa­nies, all out-of-state, tar­get­ing a newly-ap­pointed sen­a­tor. Source: Colorado TRACER bulk data.

Pelican State Partners rep­re­sents both Meta and Roblox in Louisiana. Both are ASAA ben­e­fi­cia­ries, en­abling “broad in­dus­try sup­port” fram­ing. Source: F Minus data­base.

DCA’s coali­tion count in­flated from 50+ to 140+ with only six or­ga­ni­za­tions ever pub­licly named. No mem­ber list has been pub­lished on the web­site. Source: DCA web­site, Wayback Machine.

NCOSE has a con­firmed 501(c)(4) af­fil­i­ate: NCOSEAction / Institute for Public Policy (EIN 88-1180705), IRS rul­ing May 2025, same ad­dress and lead­er­ship as NCOSE. Source: IRS BMF, NCOSE web­site.

Network for Good is a Donor Advised Fund, not a pay­ment proces­sor. DCA is clas­si­fied as “Project” (ID 258136) in the sys­tem. For Good ex­plic­itly lim­its grants to 501(c)(3) or­ga­ni­za­tions. Source: For Good web­site, IRS de­ter­mi­na­tion.

A Meta lob­by­ist drafted HB-570′s leg­isla­tive lan­guage, con­firmed by spon­sor Rep. Kim Carver. The bill as orig­i­nally writ­ten placed age ver­i­fi­ca­tion bur­den ex­clu­sively on app stores, not plat­forms. Source: Investigative re­port­ing, Carver’s pub­lic con­fir­ma­tion.

Nicole Lopez (Meta Director of Global Litigation Strategy for Youth) tes­ti­fied in both Louisiana and South Dakota for ASAA bills, serv­ing as Meta’s na­tional ASAA spokesper­son. Source: Legislative hear­ing records.

The Sixteen Thirty Fund’s $31 mil­lion lob­by­ing bud­get and $13.1 mil­lion in pro­fes­sional fees con­tain zero men­tions of child safety, dig­i­tal pol­icy, age ver­i­fi­ca­tion, or app stores. Source: STF Form 990 Part IX.

John R. Read (DCA Senior Policy Advisor) lists “Digital Childhood Alliance” as his em­ployer in Colorado TRACER records. Contributed $100 to AG can­di­date Hetal Doshi (October 2025). Source: Colorado TRACER.

Matt Ball re­ceived 8% of to­tal fundrais­ing from tech in­dus­try em­ploy­ees. He is the only 2026 Colorado sen­ate can­di­date with con­tri­bu­tions from Meta, Pinterest, Instacart, Anthropic, and Google em­ploy­ees. Four of eight dual-maxed donors are tech em­ploy­ees. Source: Colorado TRACER analy­sis.

NCOSE Schedule R re­veals a two-en­tity evo­lu­tion: the orig­i­nal NCOSE Action (EIN 86-2458921, c4 re­clas­si­fied to c3) was re­placed by the Institute for Public Policy (EIN 88-1180705, c4). All 19 NCOSE-to-Institute trans­ac­tion in­di­ca­tors are marked “No” de­spite shared lead­er­ship. Source: NCOSE Form 990 Schedule R, 2019-2023.

For Good DAF path­way de­fin­i­tively ruled out: 59,736 grant re­cip­i­ents across five years (approximately $1.73 bil­lion) searched with zero matches for DCA, DCI, NCOSE, NCOSEAction, or any re­lated en­tity. Source: For Good DAF grant data.

NCOSE lob­by­ing spend­ing tripled from $78,000 to $204,000 con­cur­rent with DCA launch and the ASAA leg­isla­tive push (FY2023 to FY2024). Source: NCOSE Form 990 Part IX.

Forge the Future su­per PAC ex­plic­itly lists an ASAA-aligned pol­icy pri­or­ity: “Empowering par­ents with over­sight of chil­dren’s on­line ac­tiv­i­ties across de­vices and dig­i­tal en­vi­ron­ments.” Source: Forge the Future fil­ings.

Hilltop Public Solutions bridges Meta’s su­per PAC and DCA op­er­a­tions. It co-leads ATEP ($45M) and is in­volved in DCA mes­sag­ing co­or­di­na­tion. First firm con­firmed in both tracks. Source: ATEP fil­ings, in­ves­tiga­tive re­port­ing.

Meta su­per PACs are state-level en­ti­ties (not FEC-registered), de­lib­er­ately scat­ter­ing fil­ings across state ethics com­mis­sions to avoid cen­tral­ized search­a­bil­ity. Source: FEC search (negative), state PAC reg­is­tra­tions.

Meta’s to­tal doc­u­mented po­lit­i­cal spend­ing ex­ceeds $70 mil­lion: $45M ATEP, $20M META California, $5M California Leads, with down­stream flows to Forge the Future (TX) and Making Our Tomorrow (IL). Source: State PAC fil­ings, news cov­er­age.

Casey Stefanski never ap­pears on any NCOSE 990 fil­ing de­spite re­port­edly work­ing there ten years. Not among of­fi­cers, di­rec­tors, key em­ploy­ees, or five high­est-com­pen­sated. Source: NCOSE Form 990 fil­ings, 2015-2023.

Meta’s LD-2 fil­ings ex­plic­itly list the App Store Accountability Act (H. R. 3149/S. 1586) as a lob­bied bill. This is the first di­rect ev­i­dence from Meta’s own fed­eral fil­ings con­nect­ing its $26.3M lob­by­ing spend to the spe­cific leg­is­la­tion DCA ad­vo­cates for. Source: Senate LDA fil­ing UUID b73445ed-15e5-42e7-a1e8-ae­b224755267.

Meta si­mul­ta­ne­ously lob­bies FOR ASAA and ON KOSA/COPPA 2.0, sup­port­ing leg­is­la­tion that bur­dens Apple and Google while op­pos­ing or amend­ing leg­is­la­tion that would reg­u­late Meta di­rectly. Both ap­pear in the same LD-2 fil­ing. Source: Meta LD-2 Q1-Q2 2025.

LD-2 nar­ra­tive mir­rors DCA mes­sag­ing: “youth safety and fed­eral parental ap­proval” fram­ing in Meta’s fed­eral fil­ings matches DCA’s “parental ap­proval” and “child pro­tec­tion” ad­vo­cacy lan­guage. Source: LD-2 fil­ing CPI is­sue code nar­ra­tive.

Meta funds flow through the Arabella net­work via non-grant mech­a­nisms (fiscal spon­sor­ship, con­sult­ing fees, lob­by­ing ex­pen­di­tures). The Schedule I and For Good DAF path­ways are both ruled out.

DCA op­er­ates un­der NCOSEAction (EIN 88-1180705) as fis­cal spon­sor. The per­son­nel chain is di­rect (van der Watt to Hawkins to Stefanski), but NCOSE re­ports zero trans­ac­tions with its c4 af­fil­i­ate.

Jake Levine’s con­tri­bu­tion to Matt Ball was co­or­di­nated by Meta’s gov­ern­ment af­fairs team rather than be­ing purely per­sonal.

Angela Paxton (Texas ASAA spon­sor) was among the un­named state sen­a­tors sup­ported by Forge the Future.

NCOSE’s lob­by­ing spend tripling is causally re­lated to DCA/ASAA ac­tiv­ity (timing is con­cur­rent but pro­gram de­scrip­tions do not men­tion ASAA).

DCA’s For Good do­na­tion page is cos­metic. Actual fund­ing comes di­rectly from Meta, not small-dol­lar DAF do­na­tions.

This in­ves­ti­ga­tion was con­ducted by a hu­man re­searcher who di­rected all re­search de­ci­sions, se­lected sources, eval­u­ated find­ings, and wrote the pub­lic-fac­ing posts. Claude Code (Anthropic’s CLI tool, run­ning Claude Opus) was used as a re­search as­sis­tant for:

* Bulk data pro­cess­ing: pars­ing 4,433 IRS Schedule I grant records, 59,736 DAF re­cip­i­ents, 132MB of Colorado TRACER cam­paign fi­nance data, and IRS Business Master File ex­tracts cov­er­ing all US tax-ex­empt or­ga­ni­za­tions

* Cross-referencing find­ings across 24 analy­sis files and iden­ti­fy­ing pat­terns that span mul­ti­ple re­search threads

Claude Code did not in­de­pen­dently choose what to in­ves­ti­gate, de­cide what con­sti­tutes a find­ing, or de­ter­mine what to pub­lish. Every fac­tual claim in this repos­i­tory cites a pri­mary source (IRS fil­ing, Senate dis­clo­sure, state data­base, leg­isla­tive record, or pub­lished re­port­ing) that can be in­de­pen­dently ver­i­fied. The tool does not change whether Meta’s LD-2 fil­ing lists H. R. 3149, whether DCA has an EIN, or whether Stefanski ad­mit­ted tech fund­ing un­der oath. The records ex­ist or they don’t.

If you want to ver­ify any find­ing, the source URLs and data­base iden­ti­fiers are pro­vided through­out. Start with the pri­mary records, not with this repos­i­tory.

This is an OSINT re­search prod­uct. All find­ings are based on pub­lic records. Source data is cited through­out.

“They pulled me out in­stead and be­gan jump­ing on my back,” he said. “Then they took me to a cor­ner and ques­tioned me about who had been in the car. I told them it was my mother and fa­ther. They ac­cused me of ly­ing and started beat­ing me.”

Claude Opus 4.6 and Sonnet 4.6 now in­clude the full 1M con­text win­dow at stan­dard pric­ing on the Claude Platform. Standard pric­ing ap­plies across the full win­dow — $5/$25 per mil­lion to­kens for Opus 4.6 and $3/$15 for Sonnet 4.6. There’s no mul­ti­plier: a 900K-token re­quest is billed at the same per-to­ken rate as a 9K one.

* Full rate lim­its at every con­text length. Your stan­dard ac­count through­put ap­plies across the en­tire win­dow.

* 6x more me­dia per re­quest. Up to 600 im­ages or PDF pages, up from 100. Available to­day on Claude Platform na­tively, Microsoft Azure Foundry, and Google Cloud’s Vertex AI.

* ​​No beta header re­quired. Requests over 200K to­kens work au­to­mat­i­cally. If you’re al­ready send­ing the beta header, it’s ig­nored so no code changes are re­quired.

1M con­text is now in­cluded in Claude Code for Max, Team, and Enterprise users with Opus 4.6. Opus 4.6 ses­sions can use the full 1M con­text win­dow au­to­mat­i­cally, mean­ing fewer com­pactions and more of the con­ver­sa­tion kept in­tact. 1M con­text pre­vi­ously re­quired ex­tra us­age.

A mil­lion to­kens of con­text only mat­ters if the model can re­call the right de­tails and rea­son across them. Opus 4.6 scores 78.3% on MRCR v2, the high­est among fron­tier mod­els at that con­text length.

That means you can load an en­tire code­base, thou­sands of pages of con­tracts, or the full trace of a long-run­ning agent — tool calls, ob­ser­va­tions, in­ter­me­di­ate rea­son­ing — and use it di­rectly. The en­gi­neer­ing work, lossy sum­ma­riza­tion, and con­text clear­ing that long-con­text work pre­vi­ously re­quired are no longer needed. The full con­ver­sa­tion stays in­tact.

If you have any ques­tions or com­ments re­gard­ing the ac­ces­si­bil­ity of this pub­li­ca­tion, please con­tact us at ac­ces­si­ble@parl.gc.ca.

Skip to Document Navigation

Skip to Document Content

ENGLISHRECOMMENDATIONSUMMARYTABLE OF PROVISIONS1 Alternative Title2 PART 1 Timely Access to Data and Information2 Criminal Code2 Amendments to the Act28 Consequential Amendment to the Foreign Publishers Advertising Services Act29 Mutual Legal Assistance in Criminal Matters Act30 Canadian Security Intelligence Service Act37 Controlled Drugs and Substances Act38 Cannabis Act39 Coordinating Amendments40 Coming into Force41 PART 2 Supporting Authorized Access to Information Act41 Enactment of Act42 Related and Consequential Amendments to the Intelligence Commissioner Act42 Related and Consequential Amendments to the Intelligence Commissioner Act47 Coming into Force48 PART 3 Parliamentary ReviewSCHEDULE

Her Excellency the Governor General rec­om­mends to the House of Commons the ap­pro­pri­a­tion of pub­lic rev­enue un­der the cir­cum­stances, in the man­ner and for the pur­poses set out in a mea­sure en­ti­tled “An Act re­spect­ing law­ful ac­cess”.

Part 1 amends var­i­ous Acts to mod­ern­ize cer­tain pro­vi­sions re­spect­ing the timely gath­er­ing and pro­duc­tion of data and in­for­ma­tion dur­ing an in­ves­ti­ga­tion. It, among other things,

(a)amends the Criminal Code to, among other things,

(i)facilitate ac­cess to ba­sic in­for­ma­tion that will as­sist in the in­ves­ti­ga­tion of fed­eral of­fences through con­fir­ma­tion of ser­vice de­mands given to telecom­mu­ni­ca­tions ser­vice providers or ju­di­cial pro­duc­tion or­ders for the pro­duc­tion of sub­scriber in­for­ma­tion,

(ii)expedite the re­sponse to pro­duc­tion or­ders by short­en­ing the re­view process and clar­ify the abil­ity of peace of­fi­cers and pub­lic of­fi­cers to re­ceive and act on cer­tain in­for­ma­tion that is vol­un­tar­ily pro­vided to them and to ob­tain and act on in­for­ma­tion that is pub­licly avail­able,

(iii)specify cer­tain cir­cum­stances in which peace of­fi­cers and pub­lic of­fi­cers may ob­tain ev­i­dence, in­clud­ing sub­scriber in­for­ma­tion, in ex­i­gent cir­cum­stances,

(iv)allow a jus­tice or judge to au­tho­rize, in a war­rant, a peace of­fi­cer or pub­lic of­fi­cer to ob­tain track­ing data or trans­mis­sion data that re­lates to any thing that is sim­i­lar to a thing in re­la­tion to which data is au­tho­rized to be ob­tained un­der the war­rant and that is un­known at the time the war­rant is is­sued,

(v)provide and clar­ify au­thor­i­ties by which com­puter data may be ex­am­ined, and

(vi)allow a jus­tice or judge to au­tho­rize a peace of­fi­cer or pub­lic of­fi­cer to make a re­quest to a for­eign en­tity that pro­vides telecom­mu­ni­ca­tions ser­vices — or that pro­vides ser­vices by a means of telecom­mu­ni­ca­tion — to the pub­lic to pro­duce trans­mis­sion data or sub­scriber in­for­ma­tion that is in its pos­ses­sion or con­trol;

(c)amends the Mutual Legal Assistance in Criminal Matters Act to al­low the Minister of Justice to au­tho­rize a com­pe­tent au­thor­ity to make arrange­ments for the en­force­ment of a de­ci­sion made by an au­thor­ity of a state or en­tity that is em­pow­ered to com­pel the pro­duc­tion of trans­mis­sion data or sub­scriber in­for­ma­tion that is in the pos­ses­sion or con­trol of a per­son in Canada;

(d)amends the Canadian Security Intelligence Service Act to, among other things,

(i)facilitate ac­cess to ba­sic in­for­ma­tion that will as­sist the Canadian Security Intelligence Service in the per­for­mance of its du­ties and func­tions un­der sec­tion 12 or 16 of that Act through con­fir­ma­tion of ser­vice de­mands given to telecom­mu­ni­ca­tions ser­vice providers and ju­di­cial or­ders against those providers, and

(e)amends the Controlled Drugs and Substances Act and the Cannabis Act to pro­vide and clar­ify au­thor­i­ties by which com­puter data may be ex­am­ined.

Part 2 en­acts the Supporting Authorized Access to Information Act. That Act es­tab­lishes a frame­work for en­sur­ing that elec­tronic ser­vice providers can fa­cil­i­tate the ex­er­cise, by au­tho­rized per­sons, of au­thor­i­ties to ac­cess in­for­ma­tion con­ferred un­der the Criminal Code or the Canadian Security Intelligence Service Act. It also makes re­lated and con­se­quen­tial amend­ments to the Intelligence Commissioner Act.

Part 3 pro­vides for the par­lia­men­tary re­view of Parts 1 and 2.

Available on the House of Commons web­site at the fol­low­ing ad­dress:

An Act re­spect­ing the oblig­a­tions of elec­tronic ser­vice providers in re­la­tion to au­tho­rized ac­cess to in­for­ma­tion

How act or omis­sion may be pro­ceeded with

Payment of Penalties and Alternatives to Payment

His Majesty, by and with the ad­vice and con­sent of the Senate and House of Commons of Canada, en­acts as fol­lows:

This Act may be cited as the Lawful Access Act, .

Subsection () of the is re­placed by the fol­low­ing:

Subsections () to () and sec­tion ap­ply, with any mod­i­fi­ca­tions that the cir­cum­stances re­quire, to a war­rant is­sued un­der this sec­tion.

The por­tion of sub­sec­tion () of the Act be­fore para­graph (a) is re­placed by the fol­low­ing:

A jus­tice who is sat­is­fied by in­for­ma­tion on oath in Form that there are rea­son­able grounds to be­lieve that there is in a build­ing, re­cep­ta­cle or place

Subsection () of the Act is amended by re­plac­ing “a pub­lic of­fi­cer who has been ap­pointed or des­ig­nated to ad­min­is­ter or en­force a fed­eral or provin­cial law and whose du­ties in­clude the en­force­ment of this Act or any other Act of Parliament and who is named in the war­rant” with “a pub­lic of­fi­cer”.

Subsections () to () of the Act are re­placed by the fol­low­ing:

A war­rant is­sued un­der sub­sec­tion () may be ex­e­cuted at any place in Canada. A peace of­fi­cer or pub­lic of­fi­cer who ex­e­cutes the war­rant must have au­thor­ity to act in that ca­pac­ity in the place where the war­rant is ex­e­cuted.

A per­son au­tho­rized un­der to search a com­puter sys­tem in a build­ing or place for data may

(a)use or cause to be used any com­puter sys­tem at the build­ing or place to search any Insertion start Insertion end data con­tained in or avail­able to the com­puter sys­tem; and

Duty of per­son in pos­ses­sion or con­trol

Every per­son who is in pos­ses­sion or con­trol of any build­ing or place in re­spect of which a search is car­ried out un­der shall, on pre­sen­ta­tion of the war­rant, per­mit the per­son car­ry­ing out the search to per­form any of the acts re­ferred to in sub­sec­tion ().

The judge or jus­tice may, in a war­rant is­sued un­der sub­sec­tion (), au­tho­rize the ex­am­i­na­tion of any com­puter data seized un­der the war­rant or con­tained in or avail­able to a com­puter sys­tem seized un­der the war­rant, if the judge or jus­tice is sat­is­fied that there are rea­son­able grounds to be­lieve that the com­puter data will af­ford ev­i­dence with re­spect to the com­mis­sion of the of­fence set out in the in­for­ma­tion.

A judge or jus­tice may at any time is­sue a war­rant au­tho­riz­ing the ex­am­i­na­tion of com­puter data con­tained in or avail­able to a com­puter sys­tem that is spec­i­fied in the war­rant and that is in the pos­ses­sion of a peace of­fi­cer or pub­lic of­fi­cer if the judge or jus­tice is sat­is­fied by in­for­ma­tion on oath in Form that there are rea­son­able grounds to be­lieve that

(a)an of­fence has been or will be com­mit­ted un­der this Act or any other Act of Parliament; and

(b)the com­puter data will af­ford ev­i­dence with re­spect to the com­mis­sion of the of­fence.

The ex­am­i­na­tion of com­puter data un­der a war­rant is­sued un­der this sec­tion may be made sub­ject to any con­di­tions that the judge or jus­tice con­sid­ers ad­vis­able to en­sure that the ex­am­i­na­tion is rea­son­able in the cir­cum­stances.

As soon as fea­si­ble af­ter a war­rant au­tho­riz­ing the ex­am­i­na­tion of com­puter data is is­sued un­der this sec­tion, the per­son who ap­plied for it shall give a copy of it to the fol­low­ing per­sons:

(a)any per­son, if known, who is the law­ful owner of the com­puter sys­tem that con­tains the com­puter data or through which the com­puter data is avail­able or who is law­fully en­ti­tled to the pos­ses­sion of that com­puter sys­tem; and

(b)any per­son who is re­ferred to in the in­for­ma­tion, who is un­der in­ves­ti­ga­tion for the com­mis­sion of the of­fence set out in the war­rant and whose com­puter data is au­tho­rized to be ex­am­ined un­der the war­rant.

However, a copy of the war­rant is not re­quired to be given to a per­son un­der sub­sec­tion () if

(a)the per­son has al­ready re­ceived a copy un­der sec­tion 487.‍093; or

(b)the judge or jus­tice who is­sues the war­rant sets aside the re­quire­ment in re­spect of the per­son, on be­ing sat­is­fied that do­ing so is jus­ti­fied in the cir­cum­stances.

If the judge or jus­tice who is­sues a war­rant un­der this sec­tion au­tho­riz­ing the ex­am­i­na­tion of com­puter data or any other judge or jus­tice hav­ing ju­ris­dic­tion to is­sue such a war­rant is sat­is­fied, on the ba­sis of an af­fi­davit sub­mit­ted in sup­port of an ap­pli­ca­tion to ex­tend the pe­riod within which a copy of the war­rant shall be given un­der sub­sec­tion (), that the in­ter­ests of jus­tice war­rant the grant­ing of the ap­pli­ca­tion, the judge or jus­tice may grant an ex­ten­sion, or a sub­se­quent ex­ten­sion, of the pe­riod, but no ex­ten­sion may ex­ceed three years.

An ex­am­i­na­tion of com­puter data au­tho­rized un­der a war­rant is­sued un­der this sec­tion may take place at any time and at any place in Canada and, for the pur­poses of the ex­am­i­na­tion, a per­son may copy com­puter data at any time and at any place in Canada.

Section of the Act is amended by adding the fol­low­ing af­ter sub­sec­tion ():

The fol­low­ing de­f­i­n­i­tions ap­ply in this sec­tion.

com­puter data has the same mean­ing as in sub­sec­tion 342.‍1(2).‍ (données in­for­ma­tiques)

com­puter sys­tem has the same mean­ing as in sub­sec­tion 342.‍1(2).‍ (ordinateur)

judge means a judge of a su­pe­rior court of crim­i­nal ju­ris­dic­tion or a judge of the Court of Quebec.‍ (juge)

pub­lic of­fi­cer means a pub­lic of­fi­cer who is ap­pointed or des­ig­nated to ad­min­is­ter or en­force a fed­eral or provin­cial law and whose du­ties in­clude the en­force­ment of this Act or any other Act of Parliament.‍ (fonctionnaire pub­lic)

The por­tion of sec­tion of the Act be­fore the first de­f­i­n­i­tion is re­placed by the fol­low­ing:

The fol­low­ing de­f­i­n­i­tions ap­ply in this sec­tion and in sec­tions to  .

Section of the Act is amended by adding the fol­low­ing in al­pha­bet­i­cal or­der:

sub­scriber in­for­ma­tion, in re­la­tion to any client of a per­son who pro­vides ser­vices to the pub­lic or any sub­scriber to the ser­vices of such a per­son, means

(a)information that may be used to iden­tify the sub­scriber or client, in­clud­ing their name, pseu­do­nym, ad­dress, tele­phone num­ber and email ad­dress;

(b)identifiers as­signed to the sub­scriber or client by the per­son, in­clud­ing ac­count num­bers; and

(c)information re­lat­ing to the ser­vices pro­vided to the sub­scriber or client, in­clud­ing

(ii)the pe­riod dur­ing which the ser­vices were pro­vided, and

The Act is amended by adding the fol­low­ing af­ter sec­tion :

A peace of­fi­cer or pub­lic of­fi­cer may make a de­mand in Form to a telecom­mu­ni­ca­tions ser­vice provider re­quir­ing them to con­firm, within the time and in the man­ner spec­i­fied in the de­mand, whether or not they pro­vide or have pro­vided telecom­mu­ni­ca­tion ser­vices to any sub­scriber or client, or to any ac­count or iden­ti­fier, spec­i­fied in the de­mand.

The peace of­fi­cer or pub­lic of­fi­cer may make the de­mand only if they have rea­son­able grounds to sus­pect that

(a)an of­fence has been or will be com­mit­ted un­der this Act or any other Act of Parliament; and

(b)the con­fir­ma­tion that is de­manded will as­sist in the in­ves­ti­ga­tion of the of­fence.

For greater cer­tainty, a de­mand must not be made if the con­fir­ma­tion would dis­close med­ical in­for­ma­tion or in­for­ma­tion that is sub­ject to so­lic­i­tor-client priv­i­lege or the pro­fes­sional se­crecy of ad­vo­cates and no­taries.

A de­mand must not be made to a telecom­mu­ni­ca­tions ser­vice provider that is un­der in­ves­ti­ga­tion for the of­fence re­ferred to in sub­sec­tion ().

The time spec­i­fied in the de­mand is to be not less than hours.

The peace of­fi­cer or pub­lic of­fi­cer who makes the de­mand may im­pose con­di­tions in the de­mand pro­hibit­ing the dis­clo­sure of its ex­is­tence or some or all of its con­tents for a pe­riod not greater than one year af­ter the day on which the de­mand is made. The peace of­fi­cer or pub­lic of­fi­cer may im­pose the con­di­tions only if they have rea­son­able grounds to be­lieve that the dis­clo­sure dur­ing that pe­riod would jeop­ar­dize the con­duct of the in­ves­ti­ga­tion of the of­fence to which the de­mand re­lates.

A peace of­fi­cer or pub­lic of­fi­cer may, at any time, re­voke the de­mand or a con­di­tion by no­tice given to the telecom­mu­ni­ca­tions ser­vice provider.

The telecom­mu­ni­ca­tions ser­vice provider may, within five busi­ness days af­ter the day on which they re­ceive the de­mand, ap­ply in writ­ing, to a judge in the ju­di­cial dis­trict where the de­mand was re­ceived, to re­voke or vary the de­mand.

The telecom­mu­ni­ca­tions ser­vice provider may make an ap­pli­ca­tion un­der sub­sec­tion () only if, be­fore the con­fir­ma­tion is re­quired to be pro­vided, they give no­tice to the peace of­fi­cer or pub­lic of­fi­cer who made the de­mand of the telecom­mu­ni­ca­tions ser­vice provider’s in­ten­tion to make the ap­pli­ca­tion.

The telecom­mu­ni­ca­tions ser­vice provider is not re­quired to pro­vide the con­fir­ma­tion un­til a fi­nal de­ci­sion is made with re­spect to the ap­pli­ca­tion.

The judge in the ju­di­cial dis­trict where the de­mand was re­ceived may re­voke or vary the de­mand if sat­is­fied that

(a)it is un­rea­son­able in the cir­cum­stances to re­quire the ap­pli­cant to pro­vide the con­fir­ma­tion; or

(b)provision of the con­fir­ma­tion would dis­close in­for­ma­tion that is priv­i­leged or oth­er­wise pro­tected from dis­clo­sure by law.

Despite sub­sec­tion (), no de­mand un­der that sub­sec­tion is nec­es­sary for a peace of­fi­cer or pub­lic of­fi­cer to ask a telecom­mu­ni­ca­tions ser­vice provider to vol­un­tar­ily pro­vide the con­fir­ma­tion re­ferred to in that sub­sec­tion if the telecom­mu­ni­ca­tions ser­vice provider is not pro­hib­ited by law from pro­vid­ing it. A telecom­mu­ni­ca­tions ser­vice provider that pro­vides a con­fir­ma­tion in those cir­cum­stances does not in­cur any crim­i­nal or civil li­a­bil­ity for do­ing so.

In this sec­tion, has the same mean­ing as in sub­sec­tion () of the .

The Act is amended by adding the fol­low­ing af­ter sec­tion :

On ap­pli­ca­tion made by a peace of­fi­cer or pub­lic of­fi­cer, a jus­tice or judge may or­der a per­son who pro­vides ser­vices to the pub­lic to pre­pare and pro­duce a doc­u­ment con­tain­ing all the sub­scriber in­for­ma­tion that re­lates to any in­for­ma­tion, in­clud­ing trans­mis­sion data, that is spec­i­fied in the or­der and that is in their pos­ses­sion or con­trol when they re­ceive the or­der.

Before mak­ing the or­der, the jus­tice or judge must be sat­is­fied by in­for­ma­tion on oath in Form that there are rea­son­able grounds to sus­pect that

(a)an of­fence has been or will be com­mit­ted un­der this Act or any other Act of Parliament; and

(b)the sub­scriber in­for­ma­tion is in the per­son’s pos­ses­sion or con­trol and will as­sist in the in­ves­ti­ga­tion of the of­fence.

The or­der is to be in Form

A per­son who is un­der in­ves­ti­ga­tion for the of­fence re­ferred to in sub­sec­tion () is not to be made sub­ject to an or­der.

The Act is amended by adding the fol­low­ing af­ter sec­tion :

On ap­pli­ca­tion made by a peace of­fi­cer or pub­lic of­fi­cer, a jus­tice or judge may au­tho­rize a peace of­fi­cer or pub­lic of­fi­cer to make a re­quest to a for­eign en­tity that pro­vides telecom­mu­ni­ca­tions ser­vices — or that pro­vides ser­vices by a means of telecom­mu­ni­ca­tion — to the pub­lic to pre­pare and pro­duce a doc­u­ment con­tain­ing trans­mis­sion data or sub­scriber in­for­ma­tion that is in the for­eign en­ti­ty’s pos­ses­sion or con­trol when it re­ceives the re­quest.

The jus­tice or judge may au­tho­rize a peace of­fi­cer or pub­lic of­fi­cer to make the pro­duc­tion re­quest only if the jus­tice or judge is sat­is­fied by in­for­ma­tion on oath in Form that there are rea­son­able grounds to sus­pect that

(a)an of­fence has been or will be com­mit­ted un­der this or any other Act of Parliament; and

(b)the trans­mis­sion data or the sub­scriber in­for­ma­tion is in the for­eign en­ti­ty’s pos­ses­sion or con­trol and will as­sist in the in­ves­ti­ga­tion of the of­fence.

The au­tho­riza­tion is to be in Form and must spec­ify that a peace of­fi­cer or pub­lic of­fi­cer must not send a pro­duc­tion re­quest more than days af­ter the day on which the au­tho­riza­tion is granted.

The pro­duc­tion re­quest is to be in Form and may in­clude any in­for­ma­tion that is re­quired by the for­eign en­tity, by the for­eign state in which the for­eign en­tity is lo­cated or un­der an in­ter­na­tional agree­ment or arrange­ment to which Canada and the for­eign state are par­ties.

Subsection () of the Act is re­placed by the fol­low­ing:

On ap­pli­ca­tion made by a peace of­fi­cer or pub­lic of­fi­cer, a jus­tice or judge may make an or­der pro­hibit­ing a per­son from dis­clos­ing the ex­is­tence or some or all of the con­tents of a preser­va­tion de­mand made un­der sec­tion or an or­der made un­der any of sec­tions to dur­ing the pe­riod set out in the or­der.

Subsection () of the Act is re­placed by the fol­low­ing:

An or­der made un­der any of sec­tions and to must re­quire a per­son, fi­nan­cial in­sti­tu­tion or en­tity to pro­duce the doc­u­ment to a peace of­fi­cer or pub­lic of­fi­cer named in the or­der within the time, at the place and in the form spec­i­fied in the or­der.

Subsections () and () of the Act are re­placed by the fol­low­ing:

The decades-long bat­tle over law­ful ac­cess en­tered a new phase yes­ter­day with the in­tro­duc­tion of Bill C-22, the Lawful Access Act. This bill fol­lows the at­tempt last spring to bury law­ful ac­cess pro­vi­sions in Bill C-2, a bor­der mea­sures bill that was the new gov­ern­men­t’s first piece of sub­stan­tive leg­is­la­tion. The law­ful ac­cess el­e­ments of the bill faced an im­me­di­ate back­lash given the in­clu­sion of un­prece­dented rules per­mit­ting wide­spread war­rant­less ac­cess to per­sonal in­for­ma­tion. Those rules were on very shaky con­sti­tu­tional ground and the gov­ern­ment ul­ti­mately de­cided to hit the re­set but­ton on law­ful ac­cess by pro­ceed­ing with the bor­der mea­sures in a dif­fer­ent bill.

Lawful ac­cess never dies, how­ever. Bill C-22 cover the two main as­pects of law­ful ac­cess: law en­force­ment ac­cess to per­sonal in­for­ma­tion held by com­mu­ni­ca­tion ser­vice providers such as ISPs and wire­less providers and the de­vel­op­ment of sur­veil­lance and mon­i­tor­ing ca­pa­bil­i­ties within Canadian net­works. In fact, the bill is sep­a­rated into two with the first half deal­ing with “timely ac­cess to data and in­for­ma­tion” and the sec­ond es­tab­lish­ing the Supporting Authorized Access to Information Act (SAAIA).

I an­tic­i­pate pro­vid­ing ex­ten­sive cov­er­age of the bill on both this blog and my pod­cast. My ini­tial take is that the ac­cess to data and in­for­ma­tion piece of the bill is much im­proved. The ear­lier Bill C-2 it­er­a­tion of a new in­for­ma­tion de­mand power was as­ton­ish­ing in its breadth (covering far more than just com­mu­ni­ca­tions providers by tar­get­ing any­one who pro­vides a ser­vice in Canada in­clud­ing physi­cians and lawyers) and de­mands for war­rant­less dis­clo­sure of per­sonal in­for­ma­tion in di­rect con­tra­dic­tion to re­cent Supreme Court of Canada ju­rispru­dence.

The gov­ern­ment has scrapped that ap­proach by shift­ing to a new “confirmation of ser­vice” de­mand power. This would al­low law en­force­ment to de­mand that tele­com providers (not any ser­vice provider) con­firm whether they pro­vide ser­vice to a par­tic­u­lar per­son. The other sub­scriber in­for­ma­tion would be sub­ject to a new pro­duc­tion or­der re­viewed and ap­proved by a judge. This would ad­dress the long­stand­ing po­lice com­plaint that they may do con­sid­er­able work seek­ing in­for­ma­tion about a sub­scriber at a provider only to learn that the per­son is­n’t a cus­tomer and they start over with some­one else.

These new rules con­tain other or­ders and rules on vol­un­tary dis­clo­sure, chal­leng­ing the re­quests, ex­i­gent cir­cum­stances, and for­eign or­ders for the same in­for­ma­tion. I plan to un­pack these rules in the com­ing weeks. For ex­am­ple, there are con­cerns about the thresh­olds that the pro­duc­tion or­ders en­vi­sion, namely the low “reasonable grounds to sus­pect” stan­dard. However, the main take­away here is that the gov­ern­ment has sig­nif­i­cantly lim­ited the scope of war­rant­less in­for­ma­tion de­mand pow­ers, now fo­cus­ing solely on telecom­mu­ni­ca­tions providers and whether they pro­vide ser­vice to a par­tic­u­lar in­di­vid­ual. Access to more per­sonal in­for­ma­tion will re­quire over­sight. That’s a ma­jor con­ces­sion and high­lights how Bill C-2 was too broad, dan­ger­ous from a pri­vacy per­spec­tive, and un­likely to pass con­sti­tu­tional muster.

If that is the good news, the bad news is very bad. The SAAIA, which es­tab­lishes new re­quire­ments for com­mu­ni­ca­tions providers to ac­tively work with law en­force­ment on their sur­veil­lance and mon­i­tor­ing ca­pa­bil­i­ties are largely un­changed from Bill C-2. In fact, there are el­e­ments in­volv­ing data re­ten­tion that are even worse. The gov­ern­ment will point to in­creased over­sight — min­is­te­r­ial or­ders must now be ap­proved by the Intelligence Commissioner — but the con­cerns re­gard­ing sur­veil­lance ca­pa­bil­i­ties, se­cu­rity vul­ner­a­bil­i­ties, se­crecy, and cross-bor­der data shar­ing re­main.

The SAAIA has huge im­pli­ca­tions for net­work providers as they en­vi­sion pro­vid­ing law en­force­ment with di­rect ac­cess to provider net­works to test ca­pa­bil­i­ties for data ac­cess and in­ter­cep­tion. The bill in­tro­duces a new term — “electronic ser­vice provider” — that is pre­sum­ably de­signed to ex­tend be­yond tele­com and Internet providers by scop­ing in Internet plat­forms (Google, Meta, etc.). Those in­ter­na­tional ser­vices are now key play­ers in elec­tronic com­mu­ni­ca­tions (think Gmail or WhatsApp), though some may be be­yond this form of reg­u­la­tion (eg. Signal if you don’t in­ad­ver­tently add peo­ple to chat groups).

The de­f­i­n­i­tion of an ESP is:

a per­son that, in­di­vid­u­ally or as part of a group, pro­vides an elec­tronic ser­vice, in­clud­ing for the pur­pose of en­abling com­mu­ni­ca­tions, and that
(a) pro­vides the ser­vice to per­sons in Canada; or

(b) car­ries on all or part of its busi­ness ac­tiv­i­ties in Canada.‍

“a ser­vice, or a fea­ture of a ser­vice, that in­volves the cre­ation, record­ing, stor­age, pro­cess­ing, trans­mis­sion, re­cep­tion, emis­sion or mak­ing avail­able of in­for­ma­tion in elec­tronic, dig­i­tal or any other in­tan­gi­ble form by an elec­tronic, dig­i­tal, mag­netic, op­ti­cal, bio­met­ric, acoustic or other tech­no­log­i­cal means, or a com­bi­na­tion of any such means.”

All elec­tronic ser­vice providers are sub­ject to oblig­a­tions to “provide all rea­son­able as­sis­tance, in any pre­scribed time and man­ner, to per­mit the as­sess­ment or test­ing of any de­vice, equip­ment or other thing that may en­able an au­tho­rized per­son to ac­cess in­for­ma­tion.” Moreover, all are re­quired to keep such re­quests se­cret.

But be­yond the ba­sic oblig­a­tions, the gov­ern­ment will iden­tify “core providers” who will be sub­ject to ad­di­tional reg­u­la­tions. These may in­clude:

(a) the de­vel­op­ment, im­ple­men­ta­tion, as­sess­ment, test­ing and main­te­nance of op­er­a­tional and tech­ni­cal ca­pa­bil­i­ties, in­clud­ing ca­pa­bil­i­ties re­lated to ex­tract­ing and or­ga­niz­ing in­for­ma­tion that is au­tho­rized to be ac­cessed and to pro­vid­ing ac­cess to such in­for­ma­tion to au­tho­rized per­sons;

(b) the in­stal­la­tion, use, op­er­a­tion, man­age­ment, as­sess­ment, test­ing and main­te­nance of any de­vice, equip­ment or other thing that may en­able an au­tho­rized per­son to ac­cess in­for­ma­tion;

(c) notices to be given to the Minister or other per­sons, in­clud­ing with re­spect to any ca­pa­bil­ity re­ferred to in para­graph (a) and any de­vice, equip­ment or other thing re­ferred to in para­graph (b); and

(d) the re­ten­tion of cat­e­gories of meta­data — in­clud­ing trans­mis­sion data, as de­fined in sec­tion 487.‍011 of the Crim­i­nal Code — for rea­son­able pe­ri­ods of time not ex­ceed­ing one year.

Note that the re­ten­tion of meta­data found in (d) is new. It was not in Bill C-2, so this bill ac­tu­ally ex­pands the scope of oblig­a­tions. The new bill con­tains some lim­its on data re­ten­tion:

4) Paragraph (2)‍(d) does not au­tho­rize the mak­ing of reg­u­la­tions that re­quire core providers to re­tain in­for­ma­tion that would re­veal

(a) the con­tent — that is to say the sub­stance, mean­ing or pur­pose — of in­for­ma­tion trans­mit­ted in the course of an elec­tronic ser­vice;

(b) a per­son’s web brows­ing his­tory; or

(c) a per­son’s so­cial me­dia ac­tiv­i­ties.

The bill also re­tains an ex­cep­tion for sys­temic vul­ner­a­bil­i­ties, which states:

A core provider is not re­quired to com­ply with a pro­vi­sion of a reg­u­la­tion made un­der sub­sec­tion (2), with re­spect to an elec­tronic ser­vice, if com­pli­ance with that pro­vi­sion would re­quire the provider to in­tro­duce a sys­temic vul­ner­a­bil­ity re­lated to that ser­vice or pre­vent the provider from rec­ti­fy­ing such a vul­ner­a­bil­ity.

There re­main con­cerns that is in­suf­fi­cient and that there are real risks that net­works may be made less se­cure by virtue of these rules with the changes kept se­cret from the pub­lic. Moreover, as Kate Robertson of the Citizen Lab has dis­cussed (including on the Law Bytes pod­cast), many of these rules ap­pear geared to­ward global in­for­ma­tion shar­ing, in­clud­ing com­pli­ance with the Second Additional Protocol to the Budapest Convention (2AP) and the CLOUD Act.

There is much to un­pack with this sec­tion in­clud­ing the abil­ity to chal­lenge or­ders, the se­crecy as­so­ci­ated with the sys­tem, over­sight, and costs. I plan to cover these as well but for the mo­ment it is suf­fi­cient to con­clude that Bill C-22’s SAAIA en­vi­sions a sig­nif­i­cant change to how gov­ern­ment agen­cies in­ter­act with Canadian com­mu­ni­ca­tions net­works and net­work providers rais­ing enor­mous pri­vacy and civil lib­er­ties con­cerns. The gov­ern­ment may have taken war­rant­less ac­cess to sub­scriber in­for­ma­tion off the table, but there re­mains se­ri­ous pri­vacy con­cerns as­so­ci­ated with its law­ful ac­cess plans.

There is a cer­tain kind of com­puter re­view that is re­ally a per­mis­sion slip. It tells you what you’re al­lowed to want. It lo­cates you in a tax­on­omy — stu­dent, cre­ative, pro­fes­sional, power user — and as­signs you a prod­uct. It is help­ful. It is re­spon­si­ble. It has very lit­tle in­ter­est in what you might be­come.

The MacBook Neo has at­tracted a lot of these re­views.

The con­sen­sus is rea­son­able: $599, A18 Pro, 8GB RAM, stripped-down I/O. A Chromebook killer, a first lap­top, a sen­si­ble ma­chine for sen­si­ble tasks. “If you are think­ing about Xcode or Final Cut, this is not the com­puter for you.” The peo­ple say­ing this are not wrong. It is also not the point.

Nobody starts in the right place. You don’t be­gin with the cor­rect tool and work sen­si­bly within its con­straints un­til you or­gan­i­cally grad­u­ate to a more ca­pa­ble one. That is not how ob­ses­sion works. Obsession works by tak­ing what­ever is avail­able and press­ing on it un­til it ei­ther breaks or re­veals some­thing. The ma­chine’s lim­its be­come a map of the ter­ri­tory. You learn what com­put­ing ac­tu­ally costs by pay­ing too much of it on hard­ware that can barely af­ford it.

I know this be­cause I was run­ning Final Cut Pro X on a 2006 Core 2 Duo iMac with 3GB RAM and 120GB of spin­ning rust. I was nine. I had no busi­ness do­ing this. I did it every day af­ter school un­til my par­ents made me go to bed.

The ma­chine came as a hand-me-down from my nana. She’d wiped it, set it up in her kitchen in Massachusetts. It was one soft­ware up­date away from get­ting the axe from Apple. I tor­rented Adobe CS5 the same week. Downloaded Xcode and dragged but­tons and con­trols around in Interface Builder with no un­der­stand­ing of what I was look­ing at. I edited SystemVersion.plist to make the “About this Mac” win­dow say it was run­ning Mac OS 69, which is the s*x num­ber, which is very funny. I faked be­ing sick to watch WWDC 2011 — Steve Jobs’ last keynote — and clapped alone in my room when the au­di­ence clapped, and re­built his slides in Keynote af­ter­ward be­cause I wanted to un­der­stand how he’d made them feel that way.

I knew the ma­chine was wrong for what I wanted to do with it. I did­n’t care. Every lim­i­ta­tion was just the edge of some­thing I had­n’t fig­ured out yet. It was green fields and blue skies.

I thought about all of this when I opened the Neo for the first time.

What Apple put in­side the Neo is the com­plete be­hav­ioral con­tract of the Mac. Not a Mac Lite. Not a browser in a lap­top cos­tume. The same ma­cOS, the same APIs, the same Neural Engine, the same weird byzan­tine AppKit con­trols that haven’t mean­ing­fully changed since the NeXT era. The abil­ity to dis­able SIP and in­stall some fuck-ass sys­tem mod­i­fi­ca­tion you saw in a YouTube tu­to­r­ial. All of it, at $599.

They cut the things that are, ap­par­ently, not the Mac. MagSafe. ProMotion. M-series sil­i­con. Port band­width. Configurable mem­ory. What re­mains is the Retina dis­play, the alu­minum, the key­board, and the full soft­ware plat­form. I held it and thought, “yep, still a Mac.”

Yes, you will hit the lim­its of this ma­chine. 8GB of RAM and a phone chip will see to that. But the lim­its you hit on the Neo are re­source lim­its — mem­ory is fi­nite, sil­i­con has a clock speed, processes cost some­thing. You are learn­ing physics. A Chromebook does­n’t teach you that. A Chromebook’s ceil­ing is made of web browser, and the things you run into are not the edges of com­put­ing but the edges of a prod­uct cat­e­gory de­signed to save you from your­self. The kid who tries to run Blender on a Chromebook does­n’t learn that his ma­chine can’t han­dle it. He learns that Google de­cided he’s not al­lowed to. Those are com­pletely dif­fer­ent lessons.

Somewhere a kid is sav­ing up for this. He has read every re­view. Watched the in­tro­duc­tion video four or five times. Looked up every spec, every bench­mark, every foot­note. He has prob­a­bly walked into an Apple Store and in­ter­ro­gated an em­ployee about it ad nau­seam. He knows the con­sen­sus. He knows it’s prob­a­bly not the right tool for every­thing he wants to do.

He has de­cided he’ll be fine.

This com­puter is not for the peo­ple writ­ing those re­views — peo­ple who al­ready have the MacBook Pro, who have the pro­fes­sional con­text, who are op­ti­miz­ing at the mar­gin. This com­puter is for the kid who does­n’t have a mar­gin to op­ti­mize. Who can’t wait for the right tool to ma­te­ri­al­ize. Who is go­ing to take what’s avail­able and push it un­til it breaks and learn some­thing per­ma­nent from the break­ing.

He is go­ing to go through System Settings, panel by panel, and ad­just every­thing he can ad­just just to see how he likes it. He is go­ing to make a folder called “Projects” with noth­ing in it. He is go­ing to down­load Blender be­cause some­one on Reddit said it was free, and then stare at the in­ter­face for forty-five min­utes. He is go­ing to open GarageBand and make some­thing that is not a song. He is go­ing to take screen­shots of fonts he likes and put them in a folder called “cool fonts” and not know why. Then he is go­ing to have Blender and GarageBand and Safari and Xcode all open at once, not be­cause he’s work­ing in all of them but be­cause he does­n’t know you’re not sup­posed to do that, and the ma­chine is go­ing to get hot and slow and he is go­ing to learn what the spin­ning beach­ball cur­sor means. None of this will look, from the out­side, like the be­gin­ning of any­thing. But one of those things is go­ing to stick longer than the oth­ers. He won’t know which one un­til later. He’ll just know he keeps open­ing it.

That is not a bug in how he’s us­ing the com­puter. That is the en­tire mech­a­nism by which a kid be­comes a de­vel­oper. Or a de­signer. Or a film­maker. Or what­ever it is that comes af­ter spend­ing thou­sands of hours alone in a room with a ma­chine that was never quite right for what you were ask­ing of it.

He knows it’s prob­a­bly not the right tool. It does­n’t mat­ter. It never did.

The re­views can tell you what a com­puter is for. They have very lit­tle in­ter­est in what you might be­come be­cause of one.