Federal Government secrets may be vulnerable to Patriot Act

Today's Vancouver Sun has a lengthy article that reports officials in the federal government are concerned about the security and privacy of information that is handled by American contractors or subsidiaries of US companies. The article is interested, but does not suggest what the federal government is considering doing in reponse:

U.S. law 'threatens Canada's secrets'

OTTAWA -- Highly sensitive personal, military and national security information held by the Canadian government is accessible to U.S. authorities under the Patriot Act, according to a document obtained Friday.

A team of Canadian government lawyers studied the vulnerability of top-secret data after a controversy broke out in B.C. earlier this year over whether British Columbians' personal medical records were being put at risk due to the provincial government's plan to contract out services to a U.S.-owned firm.

The federal lawyers agreed with B.C. privacy commissioner David Loukidelis that the Patriot Act, enacted after the 2001 terrorist attacks in New York, gives the U.S. government enormous ability to probe into the databases of American companies that do business with Canadian governments.

"Their preliminary findings indicate that the Federal Bureau of Investigation could require an American corporation under the U.S. Patriot Act to disclose information under its control, including information held by its Canadian subsidiaries," wrote Mark Seely, an official with Public Works and Government Services Canada, in a July 22, 2004 e-mail to more than two dozen Public Works officials....

Outsourcing of Canadian student loans process to US results in complaint to the Privacy Commissioner

This is the first week that I've thought it would be easier to blog about who isn't complaining to the Office of the Privacy Commissioner ...

A Vancouver man is taking his complaint about foreign outsourcing of studen loans to the Privacy Commissioner, according to the Georgia Straight:

Straight.com: Student-Debt Activist Seeks Privacy Probe:

"A Vancouver man has asked the federal privacy commissioner to investigate the outsourcing of Canada student loans to a U.S.-owned company. Mark O'Meara, founder of the www.canadastudentdebt.ca/ Web site, claimed that as a result of a recent corporate takeover, Nebraska-based Nelnet has access to all federal student debtors' personal information and financial data.

On December 6, Nelnet announced that its wholly owned Canadian subsidiary had completed its purchase of a CIBC subsidiary, Edulinx Canada Corp., which administers the Canada Student Loans Program on behalf of the federal government. According to Human Resources and Skills Development Canada, more than 1.8 million students have borrowed approximately $15.6 billion through the Canada Student Loans Program since 1993.

In an e-mail to the Straight, O'Meara stated that the federal privacy commissioner should examine whether student-loan data is now subject to the USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism). Under Section 215 of the act, the FBI is permitted to obtain secret court orders to obtain "any tangible things".

On October 29, provincial Information and Privacy Commissioner David Loukidelis released a report concluding that there is a "reasonable possibility" of unauthorized disclosure of personal information under the USA PATRIOT Act. He issued numerous recommendations to mitigate this risk.

O'Meara claimed that the federal privacy commissioner's office never responded to his e-mail asking for an investigation. Federal Privacy Commissioner Jennifer Stoddart also did not respond to the Straight's request for an interview by deadline.

Nelnet's Nebraska-based spokesperson, Ben Kiser, told the Straight that nothing will change for students and borrowers as a result of the change in ownership. "Edulinx will remain a Canadian firm with operations in Canada," he said. "That means all processing, call-centre, data-storage, records-storage, and other student-loan functions will continue to take place exclusively in Canada."

Last August, however, the American Civil Liberties Union filed a submission to Loukidelis claiming that the FBI could obtain personal records stored by a subsidiary of a U.S. corporation operating in another country. In one instance, a U.S. grand jury subpoenaed a foreign-bank employee while he was on U.S. soil. In a separate submission filed by the B.C. Government and Service Employees' Union, ACLU lawyer Jameel Jaffer claimed that the USA PATRIOT Act could enable the FBI to obtain entire databases of personal records without notifying anyone."

Round two of labour-sponsored privacy campaign against BC government to begin

Labour groups are once again attacking the government of British Columbia for outsourcing public services that involve personal information. This second campaign comes after its high-profile attempt to derail the outsourcing of the province's medicare administration (See BCGEU's privacy campaign). While that campaign did not dissuade the Campbell government from its plans (BC announces medical privatization plan), it did lead to a significant inquiry by the province's Information and Privacy Commissioner. Now under attack is the province's plan to outsource bill collection:

B.C. opens private bank and credit data to U.S. scrutiny: "B.C. opens private bank and credit data to U.S. scrutiny

New privatization deal means U.S. authorities will have access to bank account and credit card numbers, property records, income and driver's licence information on B.C. residents

Vancouver - The B.C. Government and Services Employees' Union (BCGEU/NUPGE) plans to launch a new campaign this week warning residents that the Liberal government of B.C. Premier Gordon Campbell is making highly personal data vulnerable to American scrutiny through outsourcing and privatization.

The latest information to be placed in the hands of private American companies involves a wide range of information on most B.C. residents, including bank account and credit card numbers, property records, income and driver's licence information.

The province announced a $572-million ($483-million US) deal Friday with Electronic Data Systems (EDS) of Plano, Texas, to take over much of its bill collection activity. The 10-year deal comes with barely six months remaining in the Liberals' current mandate.

The province argues that privacy provisions contained in the contract will safeguard personal information but the union says the government is misleading citizens because it is already known that the contract will not withstand the overriding and intrusive powers available to American authorities under the U.S. Patriot Act.

The Patriot Act was passed by Congress and signed into law by President George Bush following the Sept. 11, 2001 terrorist attacks on New York and Washington.

The deal is even worse than a recent 10-year, $324-million contract signed with U.S.-based Maximus Inc. to privatize the processing of the medical claims of B.C. residents.

Privacy commissioner ignored

Once again, the province has ignored concerns raised by its own information and privacy commissioner, putting private sector ideological interests ahead of those of its own people, the BCGEU says.

Essentially, the latest contract means that intensely personal information on most British Columbians will be exposed to potential scrutiny by the FBI and other U.S. government agencies, the union warns.

"It’s another example of the Liberals bullying ahead without heeding the warnings of privacy commissioner David Loukidelis issues raised by the privatizing of records management, says BCGEU president George Heyman.

Loukidelis said the U.S. Patriot Act creates a real risk that personal information, once placed in the hands of private companies with U.S. links, will be open to scrutiny by the FBI and other American agencies. He recommended a series of measures to protect the privacy of British Columbians.

Heyman says Premier Campbell has failed to take the necessary range of measures recommended by the commissioner.

Patriot Act applies

"The fact is that the Patriot Act applies. EDS is an American company, and all the records in its possession are exposed," Heyman says.

"The Campbell government is clearly misleading the public and betraying the promise they made to British Columbians that real protections would be in place before any contracts were signed."

A long list of personal data at risk, Heyman warns..

"It includes everything from credit card and bank account numbers, personal property and asset details, individual and family income, and drivers license, vehicle and insurance information. It’s pretty serious stuff that British Columbians wouldn’t want to share with the Bush government," he says.

Meanwhile, the BCGEU leader said full details on his union's latest campaign to warn residents will be announced this week. The union is also continuing efforts to mount a legal challenge to the government.

The union says privacy guarantees written into the contract by EDS and the province will be overridden by the all-intrusive federal powers of the U.S. Privacy Act.

NUPGE

BC Legislature Committee recommends re-appointment of David Loukidelis as Information and Privacy Commissioner

A special committee of the BC Legislature has unanimously recommended that David Loukidelis be re-appointed as Information and Privacy Commissioner of BC. The committee's report is here: http://www.legis.gov.bc.ca/cmt/38thparl/session-1/ipc/reports/Rpt-38-1-1-IPC.pdf.

Special thanks to Cappone D'Angelo of McCarthy Tétrault LLP for the head's up.

Conference: Privacy: Are people ready to fight back?

The Centre for for Information Security and Cryptography is holding a privacy conference in Calgary on April 21. Mathew Englander and David Loukidelis, among others, are panelists.

Conference - Privacy: Are People Ready to Fight Back?
:

"Focusing on the Western Canadian experience and practical knowledge for privacy practitioners.

April 21, 2005

Location: IBM Building, 227 11th Avenue SW, Calgary, Alberta"

BC Information and Privacy Commissioner releases his report: Patriot Act contravenes BC privacy laws

The Information and Privacy Commissioner of BC has released his report into the impact of the USA PATRIOT Act on the privacy of British Columbians. His report is available here and a summary is available here.

See below for media coverage:

U.S. Patriot Act can eyeball private Canadian records, says B.C. report

Canadian Press via Yahoo! News Fri, 29 Oct 2004 11:10 AM PDT

VICTORIA (CP) - The USA Patriot Act has the power to eyeball private information about Canadians despite attempts by governments in Canada to thwart probes by American authorities, says a report released Friday by British Columbia's privacy commissioner.

Patriot Act contravenes B.C. privacy laws: report

CBC British Columbia Fri, 29 Oct 2004 11:06 AM PDT

VICTORIA - B.C Privacy Commissioner David Loukidelis says the U.S. Patriot Act violates provincial privacy laws – and he wants the province to temporarily ban the transfer of personal information to the U.S.

Canada Study Sees Risk in U.S. Anti-Terrorism Law

Reuters via Yahoo! News Fri, 29 Oct 2004 11:31 AM PDT

A key U.S. anti-terrorism law threatens the privacy of Canadians and rigorous steps are needed to protect private medical and financial information, a government study said on Friday.

Facial scans, digital fingerprints to be compiled for Canadian border security project

Canadian immigration authorities are making their first foray into using biometrics to keep track of refugees, immigrants and visitors to Canada. A pilot project is being implemented at border crossings in British Columbia and the Vancouver International Airport. The test will involve digital photos and fingerprints. At the moment it is only a pilot project, but is likely a sign of things to come. From the Canadian Press: Facial scans, digital fingerprints to be compiled for border security project - Yahoo! News.

Personal information stolen from Vancouver Island school board office

Thanks to Mathew Englander for pointing me to the following press release, from a school board in Saanich, a suburb of Victoria, British Columbia:

Media Release

As a result of a break-in at the Saanich School Board Office on Monday, September 19,
2005, a number of items were stolen including a small safe. Damage was also done to
the two buildings affected as the thieves broke into locked and secured areas.

The contents of the safe included back-up computer tapes that contained employee,
financial and student information records. All information was saved in a secure
manner which would require significant technical expertise and the use of specialized
computer equipment and software to access. While the potential for the data to be
accessed in a usable format is small, the School District is now taking steps to inform
employees and parents of the theft of these backup tapes. Releasing this information
sooner had the potential of compromising the police investigation.

Employees will be advised to take precautionary steps to address potential identity theft.
Parents will be advised that the backup tapes included student information such as
names, addresses, phone numbers, courses and grades.

Superintendent Keven Elder said, “We regret that this incident occurred, and have been
assured by the police and our insurance providers that appropriate procedures for
safeguarding this information were in place. We are working closely with the Central
Saanich Police Department to support the ongoing investigation and retrieve the stolen
goods.”

From the carefully worded release, it's apparent that the data was not encrypted. The tapes may require a "specialized" reader and specific backup/restore software, but I don't think this will be of any comfort to a sophisticated person whose information was on the tape.

All together now: "Encrypt your data."

Nova Scotia Auditor General concerned about effect of USA Patriot Act on citizen privacy

The Nova Scotia Auditor General released his report for 2005 in December. The fourth chapter is entitled Electronic Information Security and Privacy Protection.

In his report, he reviews the privacy and information security practices of a number of departments, including Justice and Community Services. He also touches upon the USA Patriot Act and its possible impact on the personal information of Nova Scotians. Data processing and information storage services for the province are provided by wholly-owned subsidiaries of American companies, which are undoubtedly subject to American laws. The province has carried out a study of the situation, but refused to provide it to the Auditor General, citing solicitor-client and cabinet privilege. In an interview by the Canadian Press, the provincial Minister of Justice hinted that Nova Scotia will be introducing a law in the spring sitting of the Legislature to mirror that passed by British Columbia to better protect personal information from being disclosed to foreign law enforcement.

Read the CP article here: N.S. auditor concerned citizens information could be leaked to U.S. agencies - Yahoo! News.

Technorati tags: privacy ::
Patriot Act ::
Nova Scotia ::
privacy law.

Privacy pitfalls of quoting fees based on salary multipliers

The British Columbia association for Consulting Engineers (CEBC) has started advising its members that they should not be using staff salaries as the basis for quoting fees for projects. Salary multipliers are a common method of quoting in the field, but doing so discloses the personal information of the individual employee (namely, their salary). This advice is restricted to British Columbia, where the Pesonal Information Protection Act applies to employee personal information. While PIPEDA does not apply to employees of consulting engineers in the "PIPEDA provices", it is a good practice to follow. See: Canadian Consulting Engineer - 1/3/2006 - British Columbia engineering firms advised not to use salaries as basis for quoting fees.