Category: Writing

Categories
Quotations

2014.2.11

Each Five Eyes partner collects information over a specific area of the globe in accordance with their national priorities, but their collection and analysis activities are orchestrated to the point that they essentially act as one. Precise assignments are not publicly known, but research indicates that Australia monitors South and East Asia emissions. New Zealand covers the South Pacific and Southeast Asia. The UK devotes attention to Europe and Western Russia, while the US monitors the Caribbean, China, Russia, the Middle East and Africa.

As it did during the Cold War, Canada’s arctic territory provides considerable sigint advantage. Canadian Forces Station Alert, on the northern tip of Ellesmere Island, Nunavut, was originally an arctic weather station, but began sigint duty by eavesdropping on northern regions of the Soviet Union in 1958. Alert remains active today, collecting information from the interior of Russia and China.20 Other Canadian sigint assets reach into Latin America and out into the North Atlantic and North Pacific Oceans.

James Cox, “Canada and the Five Eyes Intelligence Community(.pdf)”
Categories
Links

Media sometimes try, fail to keep NSA’s secrets

LONDON (AP) — News organizations publishing leaked National Security Agency documents have inadvertently disclosed the names of at least six intelligence officers.

…

The Canadian Broadcasting Corporation’s nightly news program, “The National,” revealed the names of three NSA employees when its cameras panned across NSA documents during voice-overs.

“They were scrolling through it and I thought, ‘Hold on, that’s an unredacted, classified document,’” said Christopher Parsons, who noticed the mistake. “It was kind of nuts. I couldn’t believe that they were so cavalierly showing it on national television.”

Parsons, a privacy expert at the University of Toronto’s Munk School of Global Affairs, was able to read the employees’ names by pausing, rewinding and replaying the video.

Source: Media sometimes try, fail to keep NSA’s secrets

Categories
Links

Alleged Wi-Fi tracking is out of Canadians’ control: privacy experts

New allegations that CSEC tracked the gadgets of travellers using Wi-Fi have some questioning their privacy – but experts say there’s little Canadians can do about it.

Last week I was interviewed by Global News about the revelations CSEC was collecting metadata emitted from wireless stations in Canada. This is the result.

Source: Alleged Wi-Fi tracking is out of Canadians’ control: privacy experts

Categories
Links

With CSEC monitoring people in airports, how much spying is done on Canadians?

We offer up volumes of private information about ourselves online and just assume we’re untouchable. But the latest revelations about

I had a chance to speak with The Current today about privacy, spying, and CSEC. It was really great to hear from the Interim Privacy Commissioner of Canada and Jacquelyn Burkell on these topics as well.

Source: With CSEC monitoring people in airports, how much spying is done on Canadians?

Categories
Links

Citizen Lab calls for government surveillance oversight

U of T post-doctoral fellow writes letter asking for detailed answers on consumer data sharing

Another article, this time in the UoT student newspaper, about the letters we sent to Canadian ISPs.

Source: Citizen Lab calls for government surveillance oversight

Categories
Links

New Snowden docs show Canadian spies tracked thousands of travelers

Christopher Parsons, a fellow at the Citizen Lab at the University of Toronto, a group that helped review the documents, added that while using corporate analytics may have been one possible attack vector, there could have been another.

“There’s a series of different kinds of identifiers—that’s not entirely clear from the documents,” he told Ars.

“It’s also theoretically possible that [CSEC] may be tapping into other identifiers. There’s going to be some global database that they’re pulling from. Whether it’s going to be cookies or another identifier. My thought would be [if not cookies] that if they’re looking for particular chat user names or e-mail that is also sent in clear or sent in clear often enough. One of [the] pieces about this [is] that it seems to indicate that it’s the act of logging on. It’s not clear that you have to make some particular action, it’s that the device[s] are likely to be sending out this kind of information upstream. It is possible that it’s your username every time you hit the mail server.”

He also noted that in Canada, the two major ISPs—Bell and Rogers—provide, by default, e-mail accounts on Microsoft and Yahoo, respectively.

So, he speculated, if CSEC was going to use such an e-mail username for instance, “that ISP is going to have a litany of personal information about a Canadian target, billing and everything else that they hold, whereas the cookie information may not provide [all that information.]”

Both Parsons and Weaver also added that the use of Tor, VPNs, and anti-tracking software (such as browser plugins like Disconnect or Ghostery) may help to somewhat thwart this type of tracking.

Source: New Snowden docs show Canadian spies tracked thousands of travelers

Categories
Links Quotations

Potholes abound on the road to car-to-car communication

The security design of the system as implemented in tests so far will require a national certificate infrastructure much like that used for preventing domain spoofing and securing the Web. It will require a database of certificates—like the X.509 certificates used in public key infrastructure (PKI)—to verify that devices are legitimate and make it possible to rescind permissions to ensure that no one can send out spoofed messages. If a certificate were to become compromised or if a manufacturer misconfigured a batch of V2V systems, the certificate authority would be able to revoke the associated certificate. This prevents spoofing much in the way that DNS SEC prevents the “poisoning” of Internet domain address tables by a rogue Domain Name Service server.

The problem is that no one has ever developed a PKI system large enough to handle every vehicle in the United States—every car, truck, bus, and motorcycle. The revocation table for expired or compromised certificates would have to be distributed constantly to cars to make sure they weren’t victimized by recorded data attacks or other systems that used hacked hardware to spoof traffic.

So far, there hasn’t been any agreement yet on how this PKI would distribute its certificates. Proposals have included having roadside systems issue certificates as vehicles drive by and having certificates sent to vehicles out-of-band over cellular connections. The latter would mean that every car in the country would have to have its own integrated cellular phone or that drivers would have to connect their phones regularly to the systems to ensure they didn’t get shut out of the network.

Oh yes, please: let’s build a mass communications network dependent on a (largely) creaky Certificate system, deploy the devices to the attackers (i.e. car owners), and just trust that no one’s gonna hack a mass, nation-wide, Vehicle-to-Vehicle communications network.

Also: taking bets on it being an escrowed certificate system. For public safety and all that good stuff.

Categories
Links

Experts weigh in on the state of Canada’s spying rules

On Tuesday, Interim Privacy Commissioner Chantal Bernier called for more surveillance disclosure and a rewrite of Canada™’s privacy laws

Christopher Parsons, a postdoctoral fellow at the Munk School of Global Affairs’ Citizen Lab, who studies state access to telecommunications data.Some of the recommendations in the report are similar to those made before – including a call for broader powers and more robust laws to allow watchdogs to do their job.

“Many of these suggestions the privacy commissioner has put forward are indicative of that office not being able to play its role. It doesn’t have the required powers to understand what’s going on in order to a) make things right or b) blow the whistle,” he said, later adding: “Should Canadians be concerned? Yeah. What the Commissioner’s office is saying is we do a good job, we do the best we can within our mandate, but our mandate is to narrow.”

Hopefully the Commissioner’s recommendations are implemented by the federal government given how pressing national security and signals intelligence issues have become.

Source: Experts weigh in on the state of Canada’s spying rules

Categories
Links

Privacy: You need to know who is listening

As it happens, last week, a group of academics and civil-liberties organizations, led by Christopher Parsons, a postdoctoral fellow at the University of Toronto, sent out a long questionnaire to 16 Canadian telecommunications carriers. For example, it asks the carriers how the types of the authorities’ requests break down, as among matters of child exploitation, terrorism, national security and foreign intelligence.

Nice to have been mentioned in the Globe’s Editorial!

Source: Privacy: You need to know who is listening

Categories
Quotations

2014.1.29

But no politician should ever apologize for stealing a good policy idea. And it is a good idea. It is a brave idea, courageous even, which is usually enough to start political antennae tingling in veterans whose modus operandi is to never do anything for the first time.

John Ivison, “With Senate caucus expulsion, Trudeau is testing the depth of the water with both feet ”