Electronic Surveillance - News

The Electronic Frontier Foundation (EFF) released a timely white paper this week examining the negative implications and chilling effects that various cybercrime provisions throughout the Americas can have on coder's rights and specifically on security researchers. Entitled "Protecting Security Researcher's Rights in the Americas", the analysis explores a range of cybercrime regimes nominally intended in principle to criminalize unauthorized access to or disruption of computer systems. However, these laws have been framed so broadly as to impose a serious chilling effect on vital activity of security researchers. Drawing on the Inter-American human rights framework (of which Canada is a partial adherent), some national jurisprudence, and principles of criminal law, the paper argues for cybercrime regimes that accommodate beneficial security work. There must be latitude for non-malicious security testing, for the dissemination of critical security tools and for the responsible publication of discovered security breaches.

Sadly, current laws are framed so broadly that they have had a serious chilling effect on socially beneficial security work. Those who discover security breaches face severe legal threats and sometimes even criminal consequences for attempting to bring these to host organization's attention. The result is that security breaches are increasingly likely to remain unresolved until they are discovered by someone seeking to exploit, rather than to merely expose. The paper, to which CIPPIC provided substantive contributions, calls for clearer standards to remedy this situation.

CIPPIC joined the Electronic Frontier Foundation (EFF) and European Digital Rights (EDRi) in spearheading a submission (signed by 10 additional NGOs) which calls on the Council of Europe (CoE) to ensure privacy and other human rights safeguards are not left behind in its rush to develop new mechanisms for law enforcement to access data hosted in other jurisdictions. The submission injects our concerns into rapidly evolving negotiations between Canada, the United States, and several European and other states, for a treaty protocol that would govern cross-border data access amongst signatories.

The submission notes several concerns with the direction the negotiations have taken. Current proposals seek to bypass critical vetting mechanisms embedded in the current regime that screen foreign data access requests for blatant human rights violations. The rationale for removing this vetting mechanism is a presumption that signatory parties share an understanding of human rights protections yet, as the submission documents, no such shared basis exists. For example, Canada and some European states have faced significant liability for their roles in facilitating various United States counter-terror efforts which ultimately resulted in illegal rendition and even torture of various individuals in violation of their own human rights obligations. (p 28) Disagreements between signatories over the appropriate use of automated decision-making in a variety of circumstances has led to additional violations of states' human rights obligations while resulting in serious detrimental impact on those most vulnerable (pp 26). The treaty, as proposed, will also permit law enforcement to bypass core domestic privacy protections simply because data is stored abroad allowing Canadian police, for example, to bypass critical protections for anonymous online activity simply because data is stored abroad. This race to sacrifice human rights protections occurs despite the fact that the current regime for cross-border access (which, admittedly, is not responsive enough to law enforcement's needs) can be dramatically improved with greater training and resource investment.

Image Credit: Max Pixel, CC-0

As Bill C-59, the National Security Act, 2017, winds its way through committee (SECU), the Government has made available a lightly redacted copy of its briefing notes developed in support of the Bill. A central point of contention in Bill C-59 is the proposed CSE Act, which will provide a new and comprehensive framework for the CSE, Canada's foreign signals intelligence agency. Elements of this framework are long overdue, such as its creation of NSIRA, which will have far-reaching capabilities to review the CSE's activities, and an Intelligence Commissioner which, if properly empowered, will provide an independent check on some of the CSE's activities.  However, as we (jointly with the Citizen Lab) pointed out in a recent analysis, the CSE Act requires significant  revision if it is to provide a reasonable framework for the CSE's activities. The briefing notes provide helpful additional insights into Bill C-59 and in particular into some of the CSE's anticipated uses of its new powers embodied in the proposed  CSE Act. However, we re-joined the Citizen Lab in analyzing these briefing notes and concluded that the government's justifications for some of the more controversial elements of the CSE Act (particularly its new poers to carry out cyber operations and an exceptoin that will permit it to direct its ativities at Canadians when collecting 'publicly available information') simply fall short. Specifically, the briefing notes present only the most innocuous uses to which the CSE's new powers might be put, painting an extremely sparse picture of provisions that are far more permissive in scope. The short analysis supplements this sparse presentation, and reaffirms the need for reform of the new proposed provisions. Read the analysis, which is authored by (in alphabetical order) Lex Gill (Citizen Lab), Tamir Israel (CIPPIC) and Christopher Parsons (Citizen Lab) after the jump, or you can obtain the analysis in PDF format here.

Image Credit: Junaldrao, "Jorge Bamboa, The Tip of the Iceberg", June 2, 2017, CC-BY-ND 2.0, Flickr

The Supreme Court of Canada issued its long-awaited decisions in R v Marakah, 2017 SCC 59 and R v Jones, 2017 SCC 60 today, issuing a strong statement on the protection of privacy in digital contexts. The decision held that text messages continue to enjoy constitutional protection even after they are received by their intended recipient, meaning the state cannot bypass constitutional protections simply by directing its search to the recipient's cell phone, social media account or service provider. As CIPPIC argued in its interventions [Marakah, Jones], the decisions being appealed adopted a formalistic approach to concepts such as 'control' and 'access' which apply robustly in the physical world (who controls the data at the time of access, from what location is the data accessed) but have minimal bearing on privacy expectations in digital spaces. By contrast, the majority of the Supreme Court adopted a broad analysis of the privacy interests at stake, with outgoing Chief Justice Beverley McLachlin emphasizing the choice of a private conversation medium (i.e. text messaging) as driving the privacy analysis, concluding that "... privacy in electronic conversations is worthy of constitutional protection. That protection should not be lightly denied." Indeed, as McLachlin, CJ, explains on behalf of the majority in Marakah, the choice of a private messaging medium is, in and of itself, an exercise of effective control, underpinning privacy expectations in electronic messages that extend to their recipient. The choice to engage in a private electronic conversation creates a context where the sender can reasonably expect the messages to remain secure against the eyes of the state.

Image Credit: Matt Karp, CC-BY-NC-ND 2.0, May 7, 2010, Flickr