Category: Links

Categories
Links Quotations

2014.2.14

Christopher Parsons, a postdoctoral fellow at the Citizen Lab, told The Varsity that “Metadata at this point, is as or more invasive in its collection and analysis than the content of a communication. Any suggestion that because its metadata, it’s any less invasive, just isn’t true.”

“If you were to monitor the metadata coming out of my phone for a day, it would be a lot more revealing than any actual content. This would include things like where I was, when I made the phone calls, how long they were, who I made them to, and who those people talked to,” said Parsons. Using this information, Parsons said, intelligence agencies can determine movement patterns, browsing tendencies, shopping and lifestyle habits, all without figuring out specifically what was said in the conversation.

The Citizen Lab’s campaign for government surveillance oversight has been at the heart of the debate on consumer telecommunications and Internet privacy. Last week, they issued an open letter to several Canadian phone and Internet service providers (ISPs). The letter asked them to publicize the extent of customer information divulged to law enforcement and other intelligence agencies. When contacted by The Varsity for further comments on the Citizen Lab’s campaign, Jennifer Kett, Senior Manager at Rogers Media Relations said they were currently reviewing the request. She added: “We take the privacy and security of our customers’ personal information very seriously. We require a properly executed warrant to disclose customer information to law enforcement or any other body. If we believe that a request is overreaching we will take steps to challenge it.” Kett declined to provide further details when asked, saying that the review of the Citizen Lab’s request was pending. Bell Canada did not respond to multiple contact attempts.

Amitpal Singh, “U of T academics at forefront of online privacy battle”
Categories
Aside Links

CTV News Channel: ‘No invasion of privacy here’

Christopher Parsons, Citizen Lab Postdoctoral Fellow, reacts to the assessment that it is okay Wi-Fi data was collected at airports.

My appearance on CTV yesterday, talking about the CSEC Commissioner’s statement that it’s perfectly legal for the foreign signals intelligence agency to collect Canadians’ metadata.

CTV News Channel: ‘No invasion of privacy here’

Categories
Links Quotations

2014.2.13

Dr. Christopher Parsons, Postdoctoral Fellow in the Citizen Lab, Munk School of Global Affair, University of Toronto, Canada: “Our democratic governments have been caught massively spying on innocent individuals around the world. In the process, citizens’ willingness to exercise rights of speech, association, and collective action have been chilled. By reforming governments’ behaviours in a concerted, global, fashion we can push back against this surveillance, surveillance that currently threatens to suffocate our democracies.”

Katitza Rodriguez, “International Community Unites to Protest Big Brother”
Categories
Links Quotations

U of T steps into Internet privacy conversation

In the post-Snowden era of Internet privacy, Parsons and others are continuing the often difficult and unpopular work of pulling back the veil of government surveillance. Students across the country, continent, and indeed, the world, are aware of the new status quo, but may not have considered the full privacy implications of increased access to information online. It is, unfortunately, easy to ignore the droning of television anchors or the frequently updated headlines of news sources as they appear on Facebook and Twitter, especially when the medium lends itself to distraction. The irony, of course, is that as these stories appear, they are swiftly buried under an infinite stream of online information.

From the editorial board at The Varsity, U of T’s student newspaper.

Categories
Links

Media sometimes try, fail to keep NSA’s secrets

LONDON (AP) — News organizations publishing leaked National Security Agency documents have inadvertently disclosed the names of at least six intelligence officers.

…

The Canadian Broadcasting Corporation’s nightly news program, “The National,” revealed the names of three NSA employees when its cameras panned across NSA documents during voice-overs.

“They were scrolling through it and I thought, ‘Hold on, that’s an unredacted, classified document,’” said Christopher Parsons, who noticed the mistake. “It was kind of nuts. I couldn’t believe that they were so cavalierly showing it on national television.”

Parsons, a privacy expert at the University of Toronto’s Munk School of Global Affairs, was able to read the employees’ names by pausing, rewinding and replaying the video.

Source: Media sometimes try, fail to keep NSA’s secrets

Categories
Links

Alleged Wi-Fi tracking is out of Canadians’ control: privacy experts

New allegations that CSEC tracked the gadgets of travellers using Wi-Fi have some questioning their privacy – but experts say there’s little Canadians can do about it.

Last week I was interviewed by Global News about the revelations CSEC was collecting metadata emitted from wireless stations in Canada. This is the result.

Source: Alleged Wi-Fi tracking is out of Canadians’ control: privacy experts

Categories
Links

With CSEC monitoring people in airports, how much spying is done on Canadians?

We offer up volumes of private information about ourselves online and just assume we’re untouchable. But the latest revelations about

I had a chance to speak with The Current today about privacy, spying, and CSEC. It was really great to hear from the Interim Privacy Commissioner of Canada and Jacquelyn Burkell on these topics as well.

Source: With CSEC monitoring people in airports, how much spying is done on Canadians?

Categories
Links

Citizen Lab calls for government surveillance oversight

U of T post-doctoral fellow writes letter asking for detailed answers on consumer data sharing

Another article, this time in the UoT student newspaper, about the letters we sent to Canadian ISPs.

Source: Citizen Lab calls for government surveillance oversight

Categories
Links

New Snowden docs show Canadian spies tracked thousands of travelers

Christopher Parsons, a fellow at the Citizen Lab at the University of Toronto, a group that helped review the documents, added that while using corporate analytics may have been one possible attack vector, there could have been another.

“There’s a series of different kinds of identifiers—that’s not entirely clear from the documents,” he told Ars.

“It’s also theoretically possible that [CSEC] may be tapping into other identifiers. There’s going to be some global database that they’re pulling from. Whether it’s going to be cookies or another identifier. My thought would be [if not cookies] that if they’re looking for particular chat user names or e-mail that is also sent in clear or sent in clear often enough. One of [the] pieces about this [is] that it seems to indicate that it’s the act of logging on. It’s not clear that you have to make some particular action, it’s that the device[s] are likely to be sending out this kind of information upstream. It is possible that it’s your username every time you hit the mail server.”

He also noted that in Canada, the two major ISPs—Bell and Rogers—provide, by default, e-mail accounts on Microsoft and Yahoo, respectively.

So, he speculated, if CSEC was going to use such an e-mail username for instance, “that ISP is going to have a litany of personal information about a Canadian target, billing and everything else that they hold, whereas the cookie information may not provide [all that information.]”

Both Parsons and Weaver also added that the use of Tor, VPNs, and anti-tracking software (such as browser plugins like Disconnect or Ghostery) may help to somewhat thwart this type of tracking.

Source: New Snowden docs show Canadian spies tracked thousands of travelers

Categories
Links Quotations

Potholes abound on the road to car-to-car communication

The security design of the system as implemented in tests so far will require a national certificate infrastructure much like that used for preventing domain spoofing and securing the Web. It will require a database of certificates—like the X.509 certificates used in public key infrastructure (PKI)—to verify that devices are legitimate and make it possible to rescind permissions to ensure that no one can send out spoofed messages. If a certificate were to become compromised or if a manufacturer misconfigured a batch of V2V systems, the certificate authority would be able to revoke the associated certificate. This prevents spoofing much in the way that DNS SEC prevents the “poisoning” of Internet domain address tables by a rogue Domain Name Service server.

The problem is that no one has ever developed a PKI system large enough to handle every vehicle in the United States—every car, truck, bus, and motorcycle. The revocation table for expired or compromised certificates would have to be distributed constantly to cars to make sure they weren’t victimized by recorded data attacks or other systems that used hacked hardware to spoof traffic.

So far, there hasn’t been any agreement yet on how this PKI would distribute its certificates. Proposals have included having roadside systems issue certificates as vehicles drive by and having certificates sent to vehicles out-of-band over cellular connections. The latter would mean that every car in the country would have to have its own integrated cellular phone or that drivers would have to connect their phones regularly to the systems to ensure they didn’t get shut out of the network.

Oh yes, please: let’s build a mass communications network dependent on a (largely) creaky Certificate system, deploy the devices to the attackers (i.e. car owners), and just trust that no one’s gonna hack a mass, nation-wide, Vehicle-to-Vehicle communications network.

Also: taking bets on it being an escrowed certificate system. For public safety and all that good stuff.