Category: Links

Categories
Links

Telco-abetted spying is perverse on many levels

Telco-abetted spying is perverse on many levels:

The financial side of this whole issue aside, the Citizen Lab believes it’s time for people themselves to seek answers from the telecom companies, who have so far been obfuscating with experts, government bodies and the press on exactly what sorts of information they’re sharing. Canadians have the right to demand such information under Principle 4.9 of Schedule 1 and section 8 of federal privacy legislation, the Personal Information Protection and Electronic Documents Act, Parsons says. To that end, he has created a template letter and supplied the addresses of various companies’ privacy officers that they can be sent to.

Refusing to reveal to a customer what information is being shared about them would be a violation of federal privacy law, Parsons says. The answers to all of this will come out one way or another.

If you’ve been wondering what information your telecommunications company has about you, and whether it’s disclosed to other parties, then you can fill out the Citizen Lab’s template letter in under 5 minutes and then send it off to the relevant corporate privacy officers.

Categories
Links

Rob Deibert on Privacy Concerns

Ron Deibert, Director of the Citizen Lab, speaks with Amanda Lang about why government access to our digital data is a threat to liberal democracy.

Categories
Links

Feds tap telecoms for customer data at ‘staggering’ rate

One Canadian company told officials it has installed “what is essentially a mirror” on its network, so that it can send some raw data traffic directly to “federal authorities.”

“Mirroring is when you take a one-to-one copy of a traffic stream,” explained Chris Parsons, an expert state surveillance tools at the Citizen Lab at the University of Toronto. He said that such technology can be used as a tool of mass surveillance, but that in this case it appears to have been used selectively, so as to route lawfully requested information to authorities.

“The more concerning use, which I don’t believe we saw in those documents, would be if they were digging through my [Internet] packets,” he said.

Source: Feds tap telecoms for customer data at ‘staggering’ rate

Categories
Links

Responding the the Crisis in Canadian Telecommunications

This post argues that Canadians are not powerless. They can use existing laws to try and learn whether their communications companies are disclosing their personal information to state agencies. I begin by explaining why Canadians have a legal right to compel companies to disclose the information that they generate and collect about Canadians. I then provide a template letter that Canadians can fill in and issue to the telecommunications companies providing them with service, as well as some of the contact information for major Canadian telecommunications companies. Finally, I’ll provide a few tips on what to do if companies refuse to respond to your requests and conclude by explaining why it’s so important that Canadians send these demands to companies providing them with phone, wireless, and internet service.

It’s not hard to file a request to a telecommunications company and, now, I’ve made it as simple as filling out and mailing a form letter.

Source: Responding the the Crisis in Canadian Telecommunications

Categories
Links

Telecoms’ tight lips on customer data use leaves privacy watchdog in the dark

Canada’s privacy commissioner says she has no idea how often telecom companies share consumers’ personal information, despite repeated requests for such information from Canada’s telecom giants. After an appearance before the Senate committee on transportation and communications Tuesday, Interim Privacy Commissioner Chantal Bernier said cell phone and internet companies are refusing to release details on the practice.

It is beyond disappointing that Canada’s telecoms have decided to treat Canadians’ personal information without even basic regards for Canadian privacy law (which includes being transparent, accountable, and open about how personal information is collected, retained, managed, and disclosed). What’s worse is that most Canadians seem bemused when officers of parliament, academics, reporters, and similarly interested groups try to learn this information, with many Canadians seemingly believing that the telecoms are (effectively) beyond the law and that it’s a fool’s errand to try and bring them into compliance.

Source: Telecoms’ tight lips on customer data use leaves privacy watchdog in the dark

Categories
Links

Canadians’ rightful access to public information being blocked, experts say

Information watchdogs, researchers, media and others say government, institutions keeping citizens in the dark even as opportunities for transparency increase.

A good long form piece about the existing deficits in Canada’s access to information policies and laws. These laws are designed to let Canadians understand their governments and hold them to account. Unfortunately, our laws have become so atrophied that they are often more helpful for getting documents of some (routinely minor) historical import instead of getting documents that can meaningfully enable citizens to be active in their democracies.

Source: Canadians’ rightful access to public information being blocked, experts say

Categories
Aside Links

Ethical hackers say government regulations put information at risk

Ethical hackers say government regulations put information at risk:

Why “white hat” hackers – who cyber security experts argue are vital to security research – are sometimes leery of reporting vulnerabilities.

…according to Parsons, reporting those findings to vendors risks bringing on defamation or SLAPP (Strategic Litigation Against Public Participation) suits – a long and costly legal endeavour.

“Let’s say you discovered that there was vulnerability in something the CRA was running separate to Heartbleed – the CRA purchased that from a vendor, so the vendor would have an interest in that not becoming public because it could damage them,” he said.

“They will say if you disclose this we will sue you – and it might be a SLAPP case, but unless you are well-off financially the cost of defending yourself against a SLAPP suit could cost hundreds of thousands of dollars.”

Global News contacted Shared Services Canada, the agency responsible for IT infrastructures for all government departments, for comment regarding whether outside researchers would be allowed to report vulnerabilities found within government websites without risking legal action.

Shared Services Canada did not immediately respond to a request for comment.

The chilling effect of vulnerability disclosure stems from potential legal liability for reporting vulnerabilities to software vendors. While it’s often (though not always) the case that technical staff understand the problems and may work to mitigate them, things can go to hell pretty quickly once non-technical staff such as legal or public relations get involved.

In effect, the incentive model for White Hats to come forward to help the commons of software users breaks down incredibly quickly in the face of harsh penalties for individuals ‘breaking digital locks’ or found to violate terms of service, penalties that corporate vendors can (and do) leverage in order to maintain their public reputations.

Categories
Links Writing

Low-level federal judges balking at law enforcement requests for electronic evidence

Low-level federal judges balking at law enforcement requests for electronic evidence:

Among the most aggressive opinions have come from D.C. Magistrate Judge John M. Facciola, a bow-tied court veteran who in recent months has blocked wide-ranging access to the Facebook page of Navy Yard shooter Aaron Alexis and the iPhone of the Georgetown University student accused of making ricin in his dorm room. In another case, he deemed a law enforcement request for the entire contents of an e-mail account “repugnant” to the U.S. Constitution.

For these and other cases, Facciola has demanded more focused searches and insisted that authorities delete collected data that prove unrelated to a current investigation rather than keep them on file for unspecified future use. He also has taken the unusual step, for a magistrate judge, of issuing a series of formal, written opinions that detail his concerns, even about previously secret government investigations.

“For the sixth time,” Facciola wrote testily, using italics in a ruling this month, “this Court must be clear: if the government seizes data it knows is outside the scope of the warrant, it must either destroy the data or return it. It cannot simply keep it.”

Broad based access to telecommunications information can be extremely revealing: law enforcement know this, civil advocates (and defence attorneys) know this, and (increasingly) justices know this. And as justices in particular become more cognizant of just what law enforcement agencies are accessing, and of authorities’ decisions to not target their searches but instead collect (and retain) the entirety of people’s personal information, we’ll see more and more pushback against authorities’ overreaches.

Politics and justice tend to move slowly, often to the point where they ‘lag’ a decade or more behind technology and social norms. However, even these conservative systems tend to eventually correct themselves. As federal American judges ‘balk’ at over collection we’ll see these issues of evidence collection rise through the courts until, hopefully, a good ruling is issued by the Supreme Court of the United States. And then we’ll move onto the next overreach that authorities identify and begin exploiting…

Categories
Links Writing

CMHC again moves to tighten mortgage insurance rules as housing market cools

The government continues to engage in (somewhat) quiet actions to reduce its exposure to a mortgage or more general financial crisis. At this point we’ve seen shifts in EI, routine concern about Canadian debt levels and risk of increased interest rates, and now tightening of the mortgage insurance rules. CMHC’s decision parallel’s former Minister Flaherty’s earlier comments, summarized as:

Former finance minister Jim Flaherty had also expressed concern that CMHC had become too large a player in the market, needlessly exposing Canadian taxpayers to risk should there be a housing crash. The agency currently has about $560 billion in outstanding mortgage insurance on its books.

When/if there is a mortgage crisis in Canada that leads to substantial job loss, I don’t think Canadians are going to be thrilled by how their social infrastructures have been quietly reshaped around them. Or the relative lack of monetary policies that are the result of long-term low interest rates. Let’s hope nothing happens to make Canadians practically realize the implications of the past 3-4 years EI, monetary, and now CMHC changes.

Categories
Aside Links

Canada Bought $50 Million Worth of ‘Secure’ Phone Systems from the NSA

Canada Bought $50 Million Worth of ‘Secure’ Phone Systems from the NSA:

Technically, the Canadian Prime Minister shouldn’t have to worry about being snooped on. Declassified information on the so-called Five Eyes partnership—an intelligence-sharing agreement between America, Canada, the United Kingdom, Australia, and New Zealand—supposedly forbids the five friendly governments from snooping on each other. But we don’t know what caveats exist in that agreement, because it’s kept top secret. We do know, however, that the NSA was operating in Toronto during the G8 and G20—and that CSE knew about it. That sort of cooperation, Parsons says, is to be expected by the Five Eyes partners.

“There is of course a concern that in the Five Eyes agreement there is an proviso that members of the Five Eyes network can engage in surveillance on other partners if it’s in their sovereign interest,” Parsons said.

It’s certainly interesting (and newsworthy) that Canada is buying cryptographically-secure systems from the NSA, though not necessarily surprising: the NSA is recognized as a leader in this technical space and has economies of scale that could reduce the cost of the equipment. These isn’t, however, any indication whether CSEC examines or tests the devices for backdoors. Presuming that the math hasn’t been compromised, and the phones and faxes aren’t being compromised by our close ally, then there are presumably (relatively) few worries with the Canadian procurement strategy and lots of benefits.