ghosts in the machine: Canada

Showing posts with label Canada. Show all posts

Monday, February 18, 2008

Canada's Privacy Commissioner on Social Networking

This video, from the Office of the Privacy Commissioner of Canada, Jennifer Stoddart, wants users of social networks to pause and ask themselves the following questions before posting personal information online:

What judgments or conclusions might others form with my information?
Are there some details about my life I would like to keep personal?
Who might view or purchase this information about me?
Will this information reflect well on me a year from now? Five years?
Would I want my best friend to know this?
Would I want my boss to know this?
Would I want my mom to know this?

For more information, visit the website of the Office of the Privacy Commissioner of Canada.

Wednesday, January 9, 2008

Fair Copyright for Canada

Michael Geist is spearheading a movement on Facebook to raise awareness about the Canadian government's plans to introduce new copyright legislation that is expected to cave in to U.S. government and lobbyist demands:

The new Canadian legislation will likely mirror the U.S. Digital Millennium Copyright Act with strong anti-circumvention legislation that goes far beyond what is needed to comply with the World Intellectual Property Organization's Internet treaties. Moreover, it will not address the issues that concern millions of Canadians. For example, the Conservatives' promise to eliminate the private copying levy will likely be abandoned. There will be no flexible fair dealing. No parody exception. No time shifting exception. No device shifting exception. No expanded backup provision. Nothing that focuses on the issues of the ordinary Canadian.

Instead, the government will choose locks over learning, property over privacy, enforcement over education, (law)suits over security, lobbyists over librarians, and U.S. policy over a "Canadian-made" solution.

The Facebook group has grown to nearly 40,000 members and is garnering lots of media attention in Canada.

Geist, Canada Research Chair of Internet and E-commerce Law at the University of Ottawa, talks more about what's at stake with this proposed legislation in this CBC interview:

Monday, August 27, 2007

This is Privacy Awareness Week

Privacy Awareness Week is a promotional campaign first initiated by Privacy Victoria (Australia) in 2001. This year, for the first time, Privacy Awareness Week has gone international.

The week is an opportunity for organizations and agencies covered by privacy legislation to promote privacy awareness to their staff, customers, and to the wider community. The theme for Privacy Awareness Week 2007 is ‘Privacy is your business'.

Do you know your rights and obligations with respect to privacy? Organizations, governments, and government agencies in many countries are bound by a variety of privacy laws. As consumers, each of us is responsible to understand what our rights and responsibilities are under those laws.

Learn more about your rights!

International: Privacy International and Electronic Frontier Foundation

In the U.S.: Office of Information and Privacy, U.S. Department of Justice and American Civil Liberties Union

In Canada: Office of the Privacy Commissioner of Canada and CAPAPA

In the U.K.: Information Commissioner's Office

In Australia: Privacy Victoria

Tuesday, July 3, 2007

Privacy Rights and Terror Investigations

Two recent developments on the international cooperation front provide some redress to concerns about privacy and information-sharing between governments. The introduction of no-fly lists in the U.S., Canada and the E.U., as well as the increasingly globalised nature of personal information in data banks has raised questions about how this information will be shared with and used by foreign governments.

A tragic example of the failure to provide protection to citizens in these areas is the story of Maher Arar, a story familiar to most Canadians:

Maher Arar, a Syrian-born Canadian citizen was detained during a layover at John F. Kennedy International Airport in September 2002 on his way home to his family in Canada. He was held in solitary confinement in the U.S. for nearly two weeks, interrogated, and denied meaningful access to a lawyer. The Bush administration labeled him a member of Al Qaeda and rendered him, not to Canada, his home and country of citizenship, but to Syrian intelligence authorities, known by the U.S. government to practice torture.While in Syria, he was regularly tortured for almost a year before being released to Canada. Both the Canadian and Syrian governments have publicly cleared Arar of any links to terrorism. The United States government, however, refuses to clear Arar’s name and continues to have both him and his family on a watchlist.

Mr. Arar’s incarceration was the result, in part, of misleading information provided by the RCMP, which eventually led to the resignation of the RCMP commissioner. Following Mr. Arar’s return to Canada, there were several intentional disclosures to the public from his file, which appeared to be made in order to justify the actions of the security agencies involved. These disclosures were in violation of Mr. Arar’s privacy rights.

In our increasingly globalised economy, the volume of personal data crossing borders represents a growing threat to personal privacy. In an effort to counter the threat, the Organization for Economic Cooperation and Development (OECD) has issued a report proposing amendments to data privacy legislation as well as enhancements to international cooperation in the field of privacy protection:

When personal information moves across borders it may put at increased risk the
ability of individuals to exercise privacy rights to protect themselves from the
unlawful use or disclosure of that information. At the same time, the authorities charged with enforcing privacy laws may find that they are unable to pursue complaints or conduct investigations relating to the activities of organisations outside their borders. Their efforts to work together in the cross-border context may also be hampered by insufficient preventative or remedial powers, inconsistent legal regimes, and practical obstacles like resource constraints. In this context, a consensus has emerged on the need to promote closer co-operation among privacy law enforcement authorities to help them exchange information and carry out investigations with their foreign counterparts.

While most OECD member countries have enacted privacy legislation, Canada's Privacy Commissioner Jennifer Stoddard has pointed out that different rules in different countries were not only causing unease among citizens and companies, but were also leading to more red tape and higher costs.

Meanwhile, The European Union and the U.S. have reached a provisional deal on exchanging information about transatlantic air passengers. According to a TechWorld News story, the U.S. will be required to adhere to "strict data retention obligations," including retaining both used and unused data for no more than five years.

The United States and European Union share views on combating terrorism but
"these activities should be done in full respect for fundamental rights," said
Franco Frattini, the EU's justice and home affairs commissioner.

While privacy protections need to go even further than these two initiatives, it is encouraging to see some developments that attempt to preserve individual privacy rights and hopefully prevent a recurrence of the nightmare that Maher Arar experienced.

Sunday, June 17, 2007

Canada's No-Fly list could be linked to biometrics

Canada new “no-fly” list, to be known as “Passenger Protect”, takes effect on June 18th and according to an Ottawa Citizen report, the federal transport minister isn’t ruling out linking the names to biometric data in the long term. The Canadian no-fly list will have hundreds of names, rather than the tens of thousands on the U.S. list. Names will be added to the list based on information supplied by CSIS and the RCMP.

In an earlier post, I wrote about the risks associated with biometrics and DNA-enabled travel documents, data security and the potential impact on individual privacy. The first steps toward collecting biometric data are already underway in both the U.S. and Canada:

The United States already scans the fingerprints of foreign visitors entering the country and stores the information in a database. Visitors from Canada and some countries are excluded from the program.
Meanwhile, Transport Canada has bulked up security at airports by issuing biometric ID cards to staff who work in "restricted areas."

Canada’s Privacy Commissioner, Jennifer Stoddart has spoken out against the no-fly list, along with other privacy advocates such as Pippa Lawson, director of CIPPIC. Citizens could be the subject of mistaken identity and personal information collected by governments could make citizens vulnerable when traveling abroad or if their information is stolen or abused. The potential for abuse was highlighted at the Air India inquiry, where a Transport Minister acknowledged that the no-fly list could be shared with foreign governments.

While airlines could be fined up to $25,000 if they disclose personal information about individuals on the list, there appear to be little safeguards provided to prevent foreign governments from using or abusing this information. Passengers who feel they have been mistakenly placed on the no-fly list can appeal to the Office of Reconsideration, but are not allowed to know why their name was originally placed on the list.

Canadians are entitled to strong and rigorous guarantees from their federal government about the uses and limits of the collection and dissemination of personal information. The implications of misuse and abuse are far too serious for anything less.

Tuesday, June 5, 2007

Biometrics and DNA-enabled passports

About 10 years ago, a large brown envelope arrived in my mailbox from my old alma mater. It contained a request for me to participate in a long-term research study that the university was undertaking on the effects of drinking water from Lake Ontario, which I had been drinking for most of my life. The large brown envelope also contained a much tinier brown envelope into which I was to deposit the clippings of all ten of my toenails. Once I got past the "ew…gross" factor, I began to ponder the implications of sending away little pieces of my DNA that were to go on file for a decades-long study. Despite the assurances from this well-respected university that my toenail clippings would be kept secure and not used for any other purpose, I opted not to participate, as I just did not feel comfortable with the prospect.

Fast-forward a decade and it appears that our governments will eventually be forcing us to provide DNA samples, if we ever want to travel outside the country, that is. According to a CanWest News report:

Canadians will inevitably have to carry travel documents with their DNA,
biometrics or other biological identifiers in order to ensure secure border
travel to the United States, according to a new white paper to be revealed to
government officials in Ottawa Monday.

Although some technology, such as DNA-enabled passports or driver's
licences, may be a long way off, terror threats and other looming risks mean
governments must begin to seriously consider how they will introduce those
measures in the future, [said Michael Hawes, executive director of the
Foundation for Educational Exchange between Canada and the United States of
America.]

The white paper will outline the implications of the U.S.’s Western Hemisphere Travel Initiative, which earlier this year required Canadians flying into the U.S. to carry a passport and which will require all Canadians driving or walking across the border to have a passport by 2008.

A few toenail clippings in a university researcher’s file cabinet are a minor concern compared to a DNA profile being available in electronic format to my own government, let alone a foreign government. While the purpose is to guarantee that I am who I say I am when traveling in and out of my country, what would happen if the electronic representation of my DNA were stolen? Just ask someone who shares a similar name to someone on the U.S. "no-fly" list how easy it is to prove who they are: how much more difficult and dangerous will it be if your DNA profile is stolen or altered?

It raises the question of ownership of the data and informed consent to citizens about how it will be used. Citizens should have assurances that their DNA profile will not be collected or saved by foreign governments and that the information will not be made available to other government agencies or third parties. Genetic information from DNA and other biometric information can be dangerous not only if it is used to assume someone’s identity, but also if it reveals health or social information that could be used in a negative way against the owner.

The use of biometrics and DNA seems inevitable in an increasingly security-obsessed world. As citizens we need to pay very close attention to these initiatives and the laws in place to protect our identity.

Thursday, May 24, 2007

Unmanned drones secure U.S. borders

It seems the more I read about the U.S. Secure Border Initiative, the less I want to know.

In addition to the networks of towers with radar, video cameras and GPS tracking, Homeland Security will be patrolling sections of the Canadian border with unmanned drones. The Unmanned Aircraft Systems (UAS), known as the MQ-9 Predator "B" or the "Reaper," is a significantly improved version of a variation of the MQ-1 Predator used by the U.S. Air Force in Afghanistan and Iraq. The first will be deployed along the border between North Dakota and Manitoba before the end of 2007.

While fewer than 10,000 people were detained for entering the U.S. illegally via Canada in 2004, U.S. officials are concerned about drug smuggling, terrorist risks and the smuggling of Asian migrants via the northern border.

"What we are looking to build is a virtual fence, a 21st-century virtual fence,"
U.S. Homeland Security Secretary Michael Chertoff said.

In 1987, U.S. President Ronald Reagan stood at the Brandenburg Gate in Berlin and admonished Soviet leader Mikhail Gorbachev to “tear down this wall”. Thirty years later, a virtual wall of surveillance is being constructed along the 49th parallel.

Sunday, May 20, 2007

Local Reaction to the Arivaca Tower and SBInet

Imagine the government is planning to build a 98 foot (30 metre) tower on the edge of your small town, where guards monitoring the adjacent national border will use radar and live video streaming to transmit the images and GPS locations of people crossing the border illegally to the laptops of guards waiting on the ground. At any time in this rural area, a 130 decibel "hailer-horn" could sound, disrupting the peace of your day, startling horses and their riders and scattering local birds and wildlife. Twenty-four hours a day, seven days a week.

This is the reality facing the residents of Arivaca, Arizona, the town which will serve as the pilot project for U.S. Homeland Security’s Secure Border Initiative or SBInet. The tower is scheduled to be erected this week. I wrote a few days ago about the privacy concerns this may raise for Canadian and Mexican citizens living near the U.S. borders and the proposed network of 10,000 kilometres (6,213 miles) of towers. J. Otto Pohl, a resident of Arivaca who has been writing about the tower in his blog Otto’s Random Thoughts pointed me to several local articles about the tower and the reaction of local residents. This is an enormous intrusion in their lives and they have been given very little notice and no real consultation by Homeland Security or Boeing.

What is more discouraging is the tremendous cost and apparent failure of this kind of technology in securing the borders. One year ago, The Washington Post wrote about SBI net and the checkered record of similar kinds of multi-billion dollar surveillance technologies:

If the military could seal a 6,000-mile border for $2 billion, Iraq's borders would have been sealed two years ago," said Andrew F. Krepinevich Jr., executive director of the Center for Strategic and Budgetary Assessments, a defense think tank.

The small town of Arivaca will serve as the proving ground for SBInet and local residents appear to have an uphill battle in ensuring their concerns are heard. Hopefully the amount of international attention given this story will not disappear once the tower goes up.

--------------

Meanwhile, under the Western Hemisphere Travel Initiative (WHTI), Canadians are facing huge line-ups at Passport Offices, as under the new American law every Canadian is now expected to produce a passport when flying across the border and a year from now, in order to cross the border by land. Until recently, a driver’s licence was adequate, particularly for a daytrip of cross-border shopping or visiting family and friends. The United States is implementing the WHTI to increase border security. The initiative stems from the Intelligence Reform and Terrorism Prevention Act of 2004, which is based on the 9/11 Commission Report.

Politicians in Canada and the U.S. have often boasted about sharing the longest, undefended border; those days are about to become a distant memory as a vast network of towers and surveillance equipment is erected along the border over the next few years.

Thursday, May 17, 2007

U.S. Border Surveillance Goes High Tech

A high-tech network of nine surveillance towers in Arizona is the first of many more like it to be erected as part of the U.S.’s Secure Border Initiative, the National Post reported today. Residents of the small town with the dubious distinction of serving as a pilot for this initiative are up in arms about the government’s ability to observe and record every public activity in their ordinary lives.

"It's like Big Brother. It will place the whole town under surveillance," said C Hues, a community activist, as residents gathered for a meeting late Tuesday with customs and border patrol representatives.

"The government will be able to watch and record every movement we make, 24 hours a day. It will be like living in a prison yard," she added.

In 2006, over 1 million people were arrested for illegally attempting to cross the Mexican border into the United States. One of the towers to be constructed just south of the town will be 30-metres (98 feet) high and topped with cameras and radar. Images and video captured at the tower will be streamed live to troupers on the ground, along with GPS coordinates.

The ability to monitor the activities of the residents of one town of 1500 may not be a big concern to many people. But the Secure Border Initiative isn’t limited to the little town of Arivaca, Arizona. Over the next few years, similar networks of towers, with cameras and radar will be constructed along over 10,000 kilometres (6,213 miles) of the Mexican and Canadian borders. Conceivably, hundreds of thousands of residents along the borders of all three countries may come under the scrutiny of these cameras.

It isn’t a stretch to be concerned about how this recorded information could be used, given the recent experience of Andrew Feldmar who was barred from entering the U.S. after a border guard googled his name and didn’t like what he read. The residents of Arivaca, Arizona are fighting the construction of the massive surveillance network in their town and I hope that other Americans will be just as alarmed about this attack on privacy.

In the meantime, how will the Mexican and Canadian governments respond to cross-border surveillance of their citizens? Will our right to privacy be traded away in the name of U.S. national security?

Tuesday, May 1, 2007

Facebook: Student lessons on libel

Some students in Toronto are getting a primer on libel and ethics this week, as they were banned from a class trip as punishment for making false accusations about a teacher on Facebook. In the most recent incident, a group of Grade 8 students jokingly accused a teacher of masturbating in class. There have been two similar incidents in Ontario in recent months, according to this Canadian Press story:

"The principal implemented our progressive discipline policy, and so no, there are no new developments," Robert Dunn, superintendent of the York Region District School Board, said when asked if the punishment was being re-thought. The action follows two other recent high-profile incidents in the province.

Five teenagers were suspended last month from Toronto's Birchmount Park Collegiate for writing inappropriate remarks about staff. In February, 19 students who blamed their principal for school policies on cellphone use, and took their gripe online, were suspended from Robert F. Hall Catholic Secondary School in Caledon East, northwest of Toronto.

Part of the problem may lie in the expectations students have of the Internet. "Kids don't think of those places as public places," said Annie Kidder of the group People for Education. In a recent Ipsos-Reid poll conducted for Microsoft Canada, 70 per cent of respondents aged 10 to 14 said they believe the information they put online is private.

It is clear that the line between private and public is blurring as people increasingly use social networking technologies to share their most intimate thoughts and ideas. In the most recent case, a teacher’s reputation and career could have been put on the line as his name was associated with inappropriate conduct on the job, whether done jokingly or not. According to Canadian Defamation Law, these kinds of false accusations certainly seem to fit the interpretation of libel. From Duhaime Law (emphasis in italics are mine):

Defamation was well described in a 1970 British Columbia Court of Appeal decision called Murphy v. LaMarsh: (Defamation is where) a shameful action is attributed to a man (he stole my purse), a shameful character (he is dishonest), a shameful course of action (he lives on the avails of prostitution), (or) a shameful condition (he has smallpox). Such words are considered defamatory because they tend to bring the man named into hatred, contempt or ridicule. The more modern definition (of defamation) is words tending to lower the plaintiff in the estimation of right-thinking members of society generally.

The major points of defamation law in Canada are as follows:
- Defamation is a "strict liability" tort. In other words, it does not matter if the defamation was intentional or the result of negligence. Defamatory material is presumed to be false and malicious. "Whatever a man publishes", according to one case, "he publishes at his peril."
- Defamation must be a direct attack on an actual reputation, not an alleged reputation that a "victim" believes they deserve. A judge will assess the statement against the evidence of the victim's reputation in their community.
- The remarks must be harmful (i.e. "defamatory") and this will be assessed on a case-by-case basis. Some statements are clearly defamatory. Other statements would only be defamatory to the person targeted by the remarks. What may be a nonsensical or mildly offensive remark to one person may constitute serious defamation to another. The judge will consider the situation of the person defamed in assessing the claim of defamation.
- The defamatory remark must be clearly aimed at the plaintiff. General, inflammatory remarks aimed at a large audience would not qualify as the remarks must be clearly pointed at a specific person.
- The defamatory remarks must be somehow conveyed to a third party. Private defamation just between two parties causes no reputation damage to reputation because there are no other persons to be impacted by the remarks. With libel, the damage is presumed as it is published.

Posting these kinds of accusations on Facebook or in a blog is no different from publishing them in a book or a newspaper. So, I think that teaching administrators are taking the right approach by suspending the privileges of students who make these kinds of false accusations, in order to help them and other students understand the seriousness of their actions and the potential consequences to individuals who are the target.

In Canada, teacher-librarian associations have been advocating for over a decade for an Information Literacy curriculum to provide students with the knowledge and skills to understand the opportunities and risks of web-based information. Students need to understand their rights to free speech, as well as their legal obligations, and based on these incidents, they need it early.