Tag: Media

Categories
Links

NSA trying to map Rogers, RBC communications traffic, leak shows

NSA trying to map Rogers, RBC communications traffic, leak shows :

The U.S. National Security Agency has been trying to map the communications traffic of corporations around the world, and a classified document reveals that at least two of Canada’s largest companies are included.

…

Christopher Parsons, a researcher at the University of Toronto’s Citizen Lab, who reviewed the leaked document with The Globe, said the activity described could help determine useful access points in the future: “This is preparing the battlefield so it could later be used.

“This is … watching communications come in and out of a network and saying, ‘Okay, these are the places we need to go in.’”

Categories
Links

Are internet service providers keeping tabs on your browsing? | Toronto Star

Are internet service providers keeping tabs on your browsing?:

What does your internet service providers know about your internet browsing habits?

…

Christopher Parsons, from the University of Toronto’s Citizen Lab said the range in the responses to the Star’s questions may have to do with how each company defines the word “logging.”

“I suspect that some companies may be using terms differently,“ Parsons said.

As for how long an IP address would be associated with a customer’s account, Bell said that in January they began logging IP addresses for a year in order to comply with the Copyright Act that just came into force.

Rogers said the company doesn’t “maintain a list of past IP addresses for each customer, but in some cases we can manually retrieve them for a period of time (generally not further than a year back).”

Abramson , TekSavvy’s lawyer, said via email the company keeps a log of sessions for the previous 30 days.

 

Categories
Links Quotations

What’s the big deal about Hillary using her personal email at work?

What’s the big deal about Hillary using her personal email at work?

Christopher Parsons, a Toronto-based cybersecurity expert with the think tank Citizen Lab, explained the security difference between a personal and official government email.

“The core security advantage is that the U.S. government will be attuned to the risk of her communications being deliberately targeted and, as such, would have a chance to maximize protections afforded to her communications,” Parsons said. “Moreover, data sent and received in U.S. government systems could be protected according to the sensitivity of the communications. So when sending classified or secret documents, a higher standard of care could have been provided.”

I would note that I don’t work at a think tank: I work at the University of Toronto, within the Munk School of Global Affairs.

Categories
Links

CSE monitors your emails to the government: What you need to know

CSE monitors your emails to the government: What you need to know:

CSE declined to give CBC more specific information about the amount of email and metadata collected and when it is deleted. The agency told CBC such information “could assist those who want to conduct malicious cyberactivity against government networks.”

“The key issue is understanding how CSE retains data. Is it the case that when I email my MP they store it for one to four months? Or if it passes the buffer it’s deleted in days,” Chris Parsons, a cyber security expert at Citizen Lab who viewed the document for CBC, told Global News.

Another concern Parsons raised is what happens to law abiding citizens who happen to have malware on their computers. If they email their MP – with no malicious intent – and unintentionally pass along a virus, what happens to their information?

“How is that information treated? Are you treated like someone with a random virus, or are you classified as something?” Parsons asked.

 

Categories
Links

Le Canada scrute environ 400 000 courriels des Canadiens chaque jour

Le Canada scrute environ 400 000 courriels des Canadiens chaque jour:

Chris Parsons, un expert de la sécurité sur Internet basé à Toronto affirme qu’il y a des raisons légitimes pour l’Agence de surveiller les communications des Canadiens avec leur gouvernement.

« Mais vous devriez être en mesure de communiquer avec votre gouvernement sans la crainte que ce que vous dites… pourrait revenir vous hanter de manière inattendue », dit Parsons.

« Lorsque nous recueillons des volumes énormes d’information, ce n’est pas seulement utilisé pour suivre les méchants. Cela se retrouve dans des banques de données pendant des années ou des mois à la fois et cela peut être utilisé à n’importe quel moment dans l’avenir « .

 

Categories
Links

Canadian Spies Collect Domestic Emails in Secret Security Sweep

Canadian Spies Collect Domestic Emails in Secret Security Sweep:

Chris Parsons, an internet security expert with the Toronto-based internet think tank Citizen Lab, told CBC News that “you should be able to communicate with your government without the fear that what you say … could come back to haunt you in unexpected ways.”

Parsons said that there are legitimate cybersecurity purposes for the agency to keep tabs on communications with the government, but he added: “When we collect huge volumes, it’s not just used to track bad guys. It goes into data stores for years or months at a time and then it can be used at any point in the future.”

In a top-secret CSE document on the security operation, dated from 2010, the agency says it “processes 400,000 emails per day” and admits that it is suffering from “information overload” because it is scooping up “too much data.”

First time (I think…) that I’ve been quoted in The Intercept.

Categories
Links

CSE monitors millions of Canadian emails to government

CSE monitors millions of Canadian emails to government:

The program to protect government servers from hackers, criminals and enemy states is raising questions about the breadth of the collection, the length of retention and how the information could be shared with police and spy partners in other countries.

Chris Parsons, an internet security expert who viewed the document, said there are legitimate purposes for the agency to monitor your communications with the government.

“But you should be able to communicate with your government without the fear that what you say … could come back to haunt you in unexpected ways,” says Parsons, a postdoctoral fellow at Citizen Lab, a unit at the University of Toronto’s Munk School of Global Affairs.

“When we collect huge volumes, it’s not just used to track bad guys. It goes into data stores for years or months at a time and then it can be used at any point in the future.”

Categories
Humour

‘Breakthrough’ NSA spyware shows deep grasp of makers’ hard drives

‘Breakthrough’ NSA spyware shows deep grasp of makers’ hard drives:

The espionage program appears to be fairly targeted, said Chris Parsons, an expert on state surveillance tools with the University of Toronto’s Citizen Lab.“This is what we can count,” a Kaserpsky spokesperson said. “Because of [the] self-destroying function of the malware, the number [of victims] could be much higher.”

“Realistically, that’s a comparatively small number when you look at the global population of computers that are sold,” Parsons said.

Canada was not identified as one of the nations that has been targeted by the tampered hard drives.

What is firmware?

Firmware is software that enables a computer to perform its basic functions, Parsons explained.

“It’s essentially the operating code that runs the devices in your computer,” he said. “Think of it as the base code that’s used to run the hardware. Once the firmware is running … all the pieces of your computer get activated and are able to function.”

…

Kaspersky’s analysis suggests the spyware could work on popular hard drives manufactured by Western Digital, Seagate Technology, Toshiba, IBM, Micron Technology and Samsung.

“The value of getting in before everything else loads is you can influence what loads, how it loads, when it loads, and the value is much higher than if you waited until the operating system booted up,” Parsons said.

That’s because most anti-virus programs tend to be designed to take action following the loading of firmware. This particular program, however, would be “masked” in the firmware.

Which users might be affected by this?

Parsons points out that so far all the malware collected has been designed to work with Microsoft Windows.

One of the characteristics of this malware was to modify the sensor instructions to make the changes to the firmware “almost impossible to detect,” Parsons explained.

“So by the time you go to boot into Windows, it’s already compromised, and this has been hidden for at least eight to 14 years,” he said.

…

Parsons anticipates hackers will be emboldened by the report’s findings.

“By now knowing the kinds of attacks possible, you can be certain that other actors will now try to emulate and copy what we’ve seen here,” he said. “The risk of copycats is now much more likely.”

Categories
Links

What Rogers will tell you about the police looking into your account

What Rogers will tell you about the police looking into your account:

… I emailed Rogers to ask if the police had made inquires about my account. Because of a law called the Personal Information Protection and Electronic Documents Act (PIPED) Rogers has to answer my question.

Rogers’ first response, which arrived by registered mail, was:
“A search of our records revealed that no inquiries have been made by Law Enforcement Agencies….and Rogers is not permitted to advise of this disclosure.”

Christopher Parsons from U of T’s Citizen Lab says Rogers’ response should be read, “Nobody asked for your information and if somebody has asked for your information we’re not allowed to tell you.”

…

After the Star asked for a clarification, a Rogers spokesman said in an email, “We’re also sorry that the letter you received from us dated January 19, 2015 wasn’t more clear.” They promised to update their letters to make it clear to customers “we are restricted from disclosing most information to customers.”

Last May it was revealed that in 2011 law enforcement agencies in Canada made 1,193,630 requests for subscriber information from telecoms, the majority without a warrant. In June the Supreme Court of Canada said police need a warrant to gain accesses to telecom subscriber information. The Star later reported that the police are still making warrantless requests for customer data, because of disagreement on how to interpret the court’s decisions.

Based on letters he’s seen from different telecom companies a few months ago Parsons says “Rogers’ disclosure and TekSavvy’s disclosure are about the best in the industry.” while “Most are less transparent.”

Categories
Links

How Canadian Spies Infiltrated the Internet’s Core to Watch What You Do Online

How Canadian Spies Infiltrated the Internet’s Core to Watch What You Do Online:

While the locations of EONBLUE sites are not disclosed in the documents, one slide makes reference to the internet’s “core” and describes EONBLUE’s ability to “scale to backbone internet speeds”—implying possible access to telecom operators, data centers, undersea cables and other infrastructure providers worldwide.

Such access would mean that much, if not all of the data, travelling through a location tapped by CSE could be subject to surveillance. Though the agency maintains it cannot legally track Canadians at home or abroad it is hard to fathom how such data could be exempt.

As of November 2010, when the document was dated, EONBLUE had already been under development for ove> r eight years. However, it isn’t clear from the slides for how long EONBLUE has been used, or whether it is still in use today.

“We haven’t seen very much to date that hasn’t been suspected or known about, but it’s the scale and breadth of this activity that is so staggering on a daily basis,” said Christopher Parsons, a postdoctoral fellow at the ​Citizen Lab, an interdisciplinary research group that studies global surveillance issues at the University of Toronto’s Munk School of Global Affairs.

“It’s designed for mass tracking, mass surveillance, on a global level,” Parsons said. ​