Entertainment industry accused of 'trying to hijack data retention directive'

Many people are willing to sacrifice some privacy to gain increased security. In this "age of terrorism", initiatives such as the European Data Retention Directive and the Canadian Lawful Access proposals seem more palatable when we are told they are essential to protecting against serious crimes such as terrorism. The European Data Protection Directive has consistenly been "sold" as being limited to protecting the continent against terrorism. Now, representatives of the entertainment industry are making the request that the retained information be available for investigations of copyright and other IP violations. Critics are saying that the entertainment industry is trying to hijack the directive. See: Entertainment industry 'trying to hijack data retention directive' - ZDNet UK News.

Also, check out the discussion on Slashdot: Slashdot | Music Industry 'trying to hijack EU data laws'.

Update (20051127) from Schneier on Security: European Terrorism Law and Music Downloaders:

"Our society definitely needs a serious conversation about the fundamental freedoms we are sacrificing in a misguided attempt to keep us safe from terrorism. It feels both surreal and sickening to have to defend out fundamental freedoms against those who want to stop people from sharing music. How is possible that we can contemplate so much damage to our society simply to protect the business model of a handful of companies."

Lawful access hits the house

The federal government's "lawful access" legislation, also known as the Modernization of Investigative Techniques Act (MITA) was introduced in the House today. The government's press release is here: Legislation to modernize investigative techniques introduced today. I guess the bill's many critics are hoping for a quick election call.

Update: Michael Geist, who has been critical of the proposal since the beginning, has some things to say about Bill C-74: Michael Geist - The Lawful Access Spin.

Lawful Access on CBC's The Current

The second hour of CBC Radio's "The Current" was devoted to a very interested discussion of latest on lawful access in Canada. You can listen in Real Audio by clicking here. A synopsis is here:

CBC Radio | The Current | Whole Show Blow-by-Blow:

The Current: Part 2

Lawful Access – Part One

We started this segment with the music of Robin Rimbaud, also known around the world as Scanner. He's a British musician and artist who began his career as a self-titled "techno data-pirate." Using a portable radio scanner, he would pluck cell-phone conversations from the ether--anything from arguments to phone-sex sessions to gossip---and then layer these voice snippets over music and sound. His work is haunting but controversial because he's often accused of invading other peoples' privacy.

Well, they're not planning to make music, but Canadian law enforcement groups are facing some similar privacy accusations when it comes to their latest plans to sample things from peoples' personal cyberspace.

This month, parliament debates a bill that will give the RCMP and CSIS access to everything WE access on the Internet---from the sites we surf, to the things we buy, to the people we instant message and e-mail. It's called the Lawful Access Initiative, and it's been in the works since October of 2000.

Those in favour say the new law will replace a terribly outmoded one, drawn up in the days before cell phones, voice mail and high speed internet. The original 1974 law HAS been updated but police say the latest technological leaps have left some of their investigations in the dust.

And so the debate over when email should just be between friends, has begun in earnest. Michael Geist is the Canada Research Chair in Internet & E-commerce Law at the University of Ottawa, and we reached him at his home.

Lawful Access – Part Two

Proponents of the new lawful access bill say that far from threatening our security and privacy, these changes go a long way towards increasing our government's ability to protect us.

Wesley Wark is one of them. He's a national security expert and professor at the University of Toronto's Munk Center for International Studies. He joined us from Guelph this morning.

Listen to The Current: Part 2

Geist: What do you want the internet to be?

Michael Geist's regular column comments upon various trends that he finds worrying, including the Lawful Access Initiative, which will require telcos to make the Canadian Internet wiretap-friendly.

What do you want the Internet to be?

".... Notwithstanding the Internet’s remarkable potential, there are dark clouds on the horizon. There are some who see a very differing Internet.
Theirs is an Internet with ubiquitous surveillance featuring real-time
capabilities to monitor online activities. It is an Internet that views
third party applications such as Vonage’s Voice-over-IP service as
parasitic. It is an Internet in which virtually all content should come at
a price, even when that content has been made freely available. It is an
Internet that would seek to cut off subscriber access based on mere allegations
of wrongdoing, without due process or oversight from a judge or jury.This
disturbing vision of the Internet is not fantasy. It is based on real
policy proposals being considered by the Canadian government today.

Leading the way is the federal government’s “lawful
access” initiative. While the term lawful access sounds innocuous, the
program, which dates back to 2002, represents law enforcement’s desire to
re-make Canada’s networks to allow for lawful interception of private
communications. If lawful access becomes reality,
Canada’s telecommunications service providers (TSPs) will be required to refit
their networks to allow for real-time interception of communications, to have
the capability of simultaneously intercepting multiple transmissions, and to
provide detailed subscriber information to law enforcement authorities without a
court order within 72 hours.

Moreover, Canada’s TSPs will be subject to
inspections and required to provide the government with reports on the technical
capabilities of their networks. All of these activities will be shrouded
in secrecy with TSPs facing fines of up to $500,000 or sentences of up to five
years in jail for failing to keep the data collection confidential.All of these
changes come at an enormous cost – both financially (hundreds of millions of
dollars in new technology) and to our personal privacy. While some changes
may be needed for security purposes, the government
has yet to make the case for why the current set of powers, which include
cybercrime and wiretapping provisions, are insufficient. Moreover, there
has been no evidence provided that this approach is the least privacy invasive
alternative...."

How to not be a law enforcement tool ...

The Electronic Frontier Foundation (EFF) has released a document entitled Best Practices for Online Service Providers. In response to Online Service Providers being continually subjected to subpoenas and warrants for log files, EFF argues that unless there is a legislated or reguatory need to archive data, OSPs should not keep any user info they don't need.

Best Practices for Online Service Providers:

"...The best way to protect against the risk of log artifacts on disk is to never create any user logs in the first place. This is the ideal and safest solution even though it is often impractical. By reconfiguring the logging preferences in server applications, one can easily change the log level to record nothing about network events. But for most OSPs, these logs are necessary for network troubleshooting and security precautions. This is also virtually impossible for large, for-profit providers that need to maintain billing and subscriber contact information. Thus, the best tactic for an OSP is to come up with a safe and sane network policy in which logs are retained for the shortest possible time..."

Under Canadian privacy laws (at least until retention requirements are imposed under lawful access guidelines), ISPs/OPSs should only be collecting for reasonable purposes and keeping it for only as long as is reasonably necessary for the purposes for which it was collected. I know of at least one ISP that keeps their log files indefinitely because they enjoy their friendly relationship with law enforcement. They still require a warrant, but the cops know that it is all kept. Some organizations want to minimise the muss and fuss of being dragged into court being asked to provide user info. If they simply don't have the info that is being sought, they say so and avoid the issue. (This issue has also come to the fore in public libraries, where privacy aware librarians have changed practices to delete the history of borrowers after books are returned undamaged.)

Thanks to the ever-informative, always useful BeSpacific for the link.

"Lawful access" back on the radar screen

Michael Geist is reporting, in privacyinfo.ca, that the Canadian lawful access initiative is creeping back onto the government's agenda:

www.PrivacyInfo.ca:

"The Toronto Star today reports what has been an open secret for a couple of months now -- the Canadian government is moving forward with its lawful access agenda. For those new to the issue, lawful access would require network providers to establish new capabilities to allow for real-time network surveillance. Failure to do so is punishable by significant fines and jail time. The big issue for the ISPs revolves around cost, as in who should pay for this. Given the enormous privacy implications, one would hope that the government would make a case demonstrating a real need for these new powers, rather than just crossing items off a wish list."

National Post editorial against Lawful Access

Today's editorial in the National Post has come out against aspects of Canada's proposed lawful access rules:

National Post

"...There will be a temptation for some to forgive this excess in light of enhanced concerns for security after 9/11. But this incorrectly assumes that the new laws would be reserved for extreme cases such as threats to national security. Think again: The Privacy Commissioner reveals that the initiative to reform Canada's lawful access laws predates the Sept. 11, 2001, attacks.

In any case, our judiciary is not insensible to the terrorist threat. And so in cases where tapping an e-mail account or cell phone truly is warranted, the police should have no problem convincing a judge that a warrant should be issued. Removing the robed gatekeeper does little to enhance safety, but merely increases the chance of a rogue officer invading someone's privacy for no valid reason.

We share the Privacy Commissioner's skepticism "about the need for these potentially intrusive and far-reaching measures." We agree that the government should be able to get just about any information it needs to protect national security. But that information should be protected from invasive fishing expeditions by the usual safeguard we have come to expect in a free society: a vigilant judge."

Internet bugging may dictate technolgies and call-routing for VoIP services

While Canadians are fretting over lawful access, our friends south of the border are dealing with the second generation, or rather an extension of the rules begun with the Communications Assistance to Law Enforcement Act. CALEA, as it is called, required telecommunications companies to build-in wiretapping capabilities. A recent set of rules published by the Federal Communications Commission extends that wiretapability requirement to VoIP providers. Any company that provides a service that connects calls to or from the traditional phone system is required to provide central bugging features for law enforcement.

Wired News is asking where that leaves VoIP companies that use a peer-to-peer model. These providers don't route calls centrally so there is no easy place to intercept the calls. And the rules apply to all calls on the system, not just those that go to or from traditional switches. According to the regs, that's no excuse.

This may be a case where law enforcement access requirements will be dictating the technology that a company can use. Read more: Wired News: Furor Grows Over Internet Bugging.

Schneier on Private Webcams and the Police

Since the Conrona (Southern California) Chamber of Commerce and the local police have begun asking local businesses to provide law enforcement with access to the feeds from local businesses' web-enabled security cameras, Bruce Schneier asks how long it will be before a law is passed requiring a backdoor for police?: Schneier on Security: Private Webcams and the Police.

"Lawful access" to the next level? "We're just keeping up with technology. In the olden days, we'd be able to post a cop in front of your store so this is no different ..."

Lawful access coming: Ottawa to give police more power to snoop on digital communications

Today's Globe &apmp; Mail is reporting that "lawful access" legislation will be introduced in the fall to give law enforcement greater access to digital communications of Canadians:

The Globe and Mail: Ottawa to give police more power to snoop:

"... The law would force Internet service providers to retain records on the Internet use of its clients in such a way that it can be easily retrieved by police, doing away with the need in many cases to seize an individual's computer as part of an investigation.

In her submission to the government earlier this year, Privacy Commissioner Jennifer Stoddart concluded that Ottawa and the police have not provided enough justification to warrant such a law.

'We remain skeptical about the need for these potentially intrusive and far-reaching measures,' she wrote. Ms. Stoddart noted the law could give police access to global-positioning-system data from cellphones combined with electronic banking data that could allow the government to track an individual's every move.

'The digits we punch into a modern telephone do not just connect us to another party, they can also reveal our financial transactions, PIN numbers and passwords, or even health information.' Michael Geist, a University of Ottawa law professor who took part in the consultations, said the proposed law goes 'well, well beyond' updating references to analog technology. 'For individual Canadians, this is an issue that should attract enormous interest because it fundamentally reshapes the Internet in Canada, creating significant new surveillance powers,' he said...."

Privacy Protection Requires Action Not Rhetoric

Michael Geist's most recent Law Bytes article says that we are facing a privacy crisis evidenced by the new "lawful access" snooping powers and the Federal Privacy Commissioner's lack of effective enforcement powers. Read it here: Michael Geist - Privacy Protection Requires Action Not Rhetoric.

Privacy International's Response to European Commission's consultation on telecommunications traffic data retention

On 30 July 2004, the European Commission's Directorate Generals on the Information Society and on Justice and Home Affairs issued a consultation document inquiring about the desirability of establishing a uniform pan-European retention regime for all internet and telecommunications traffic data for a period of 12-36 months. The deadline for submissions is 15 September 2004.

Privacy International (PI) and European Digital Rights (EDRI) have just released their submission on the topic, entitled "Invasive, Illusory, Illegal, and Illegitimate" (three guesses what their position is!). The PI/EDRI submission is an interesting summary of the kinds of data that can be collected and the privacy impact of indiscriminate retention of this data.

The Canadian Department of Justice began a consultation on "Lawful Access" in August 2002 which proposed, among other things, the capability for law enforcement to issue "Data Preservation Orders", perhaps without a warrant or other judicial authorization.

Those interested in a free-wheeling debate on the topic can check out the discussion on the European consultation at Slashdot.

Crystal ball gazing for 2006: Geist

Michael Geist recenly gazed into his crystal ball and has made some predictions for technology law in 2006. Here's what he said about privacy and security:

TheStar.com - Geist: Tech laws we need

Privacy and Security

The privacy law we need: 2005 was labelled the worst year ever for security breaches, with more than 50 million people in North America directly affected by the dozens of breaches that placed their personal information at risk. The growing awareness of security vulnerabilities stems from U.S. laws that compel companies to inform customers that their information was subject to a breach. Similar legislation is needed in Canada.

The privacy law we will get: The government introduced its so-called "lawful access" package last fall. The expression "lawful access" sounds benign; the goal isn't. It would give intrusive new powers of surveillance to law-enforcement authorities without needed judicial oversight.

Canadians can expect to see it revived whichever party forms the next government. While lawful access is better characterized as anti-privacy legislation, its re-emergence will force the privacy community to rally around appropriate oversights to guard against privacy abuse.

[Privacy] :: [Predictions] :: [Privacy Law] :: [PIPEDA] :: [Canada]