Sunday, April 10, 2011

Harper's aggressive internet surveillance push

That blog title is fair comment given the 100 day time frame (p. 50) Harper wants to put on passage of the "lawful access" internet legislation that would form part of his omnibus crime bill campaign promise. Due to Harper's prorogation of 2009 and the Conservatives' having done little to move this effort through committee, there's been little to no study on these proposals. Yet the privacy concerns and potential for abuse are immense.

Michael Geist writes:
There are several concerns with the Conservatives lawful access plans. First, it bears noting that these bills have never received extensive debate on the floor of the House of Commons and never been the subject of committee hearings. Police officers may support the legislation, but there has never been an opportunity to question them on the need for such legislation or on their ability to use lawful access powers if the bills become law. Federal and provincial privacy commissioners have expressed deep concerns about these bills, yet they have never had the opportunity to air those concerns before committee. Internet service providers, who face millions in additional costs - presumably passed along to consumers - have never appeared before committee. By making a commitment to passing lawful access within 100 days, the Conservatives are undertaking to pass legislation with enormous implications for the Internet that has never received parliamentary scrutiny and will receive limited attention.

Second, more important than process is the substance of the proposals that have the potential to fundamentally reshape the Internet in Canada. The bills contain a three-pronged approach focused on information disclosure, mandated surveillance technologies, and new police powers.

The first prong mandates the disclosure of Internet provider customer information without court oversight. Under current privacy laws, providers may voluntarily disclose customer information but are not required to do so. The new system would require the disclosure of customer name, address, phone number, email address, Internet protocol address, and a series of device identification numbers.

While some of that information may seem relatively harmless, the ability to link it with other data will often open the door to a detailed profile about an identifiable person. Given its potential sensitivity, the decision to require disclosure without any oversight should raise concerns within the Canadian privacy community.

The second prong requires Internet providers to dramatically re-work their networks to allow for real-time surveillance. The bill sets out detailed capability requirements that will eventually apply to all Canadian Internet providers. These include the power to intercept communications, to isolate the communications to a particular individual, and to engage in multiple simultaneous interceptions.
...
Having obtained customer information without court oversight and mandated Internet surveillance capabilities, the third prong creates a several new police powers designed to obtain access to the surveillance data. These include new transmission data warrants that would grant real-time access to all the information generated during the creation, transmission or reception of a communication including the type, direction, time, duration, origin, destination or termination of the communication.
...
Few would argue that it is important to ensure that law enforcement has the necessary tools to address online crime issues. But these proposals come at an enormous financial and privacy cost, with as yet limited evidence that the current legal framework has impeded important police work. In fact, when then Public Safety Minister Peter Van Loan tried to justify his lawful access package, he pointed to an emergency situation that I later revealed (via access to information) had nothing to do with the Internet. (emphasis added)
Here's what the Privacy Commissioner previously said when this lawful access proposal from the Conservatives came up, from February 2009:
"The [obtaining] of a warrant for looking into people's private papers, private affairs, now e-mail conversations is a basic tenet of our democratic and constitutional rights in Canada. To erode this is a very serious step toward mass surveillance so I would like to get a copy of any draft legislation and look at how this could be possibly justified. I've said in the past I've seen no compelling argument put forward for its justification."
There are ways to legislate in this country that study and take into account legitimate concerns. That's not present here and the results could be ground shifting. The 100 day jam fest on this one, needless to say, seems to be totally inappropriate.

(h/t)