Privacy Commissioner of Canada releases annual report on public sector privacy law

Jennifer Stoddart has just tabled her annual report to Parliament on the Privacy Act, Canada's federal public sector privacy law: Annual Report to Parliament 2010-2011 - Report on the Privacy Act.

From her media release on the topic:

Audit of airport security measures flags concerns about over-collection and safeguarding of travellers’ personal information

2010-2011 Annual Report to Parliament on the Privacy Act examines the stewardship of personal information by Canada’s airport security authority, the RCMP and other federal departments and agencies

OTTAWA, November 17, 2011 – The Government of Canada is collecting too much information about some air travellers and is not always safeguarding it properly, Privacy Commissioner Jennifer Stoddart found in an audit published with her annual report today.

The audit of the privacy policies and practices of the Canadian Air Transport Security Authority (CATSA) concluded that the agency was reaching beyond its mandate by completing security reports on incidents which were not related to aviation security.

This was the case even with incidents involving an activity that was legal. For example, CATSA collected information about air passengers who were found to be carrying large sums of cash on domestic flights. CATSA also contacted police in such cases. Since it should not be collecting personal information about legal activities not related to aviation security, the Office of the Privacy Commissioner of Canada recommended that CATSA immediately cease that practice. CATSA agreed.

Moreover, the audit found that such incident reports, and other types of personal information collected by the agency, were not always properly secured.

“Documents containing sensitive personal information were left on open shelves and in plain view in a room where passengers may be taken for security checks,” Commissioner Stoddart reported.

The audit also identified other concerns about procedures not being followed during the screening process. When auditors visited the rooms where CATSA officials screen full-body scans, they discovered a cell phone and a closed-circuit TV camera even though these types of devices are strictly prohibited according to CATSA’s operating procedures.

“Fortunately, these irregularities were uncommon and we were pleased that CATSA moved quickly to correct them by issuing a reminder to staff and conducting inspections to ensure proper procedures were followed,” said Commissioner Stoddart.

Even so, she added, “the Government of Canada is entrusted with highly sensitive personal information, and is obliged to handle it with an uncompromising level of care—not some of the time, or even most of the time, but all of the time.”

The audit was summarized in the 2010-2011 annual report on the Privacy Act, which was tabled in Parliament today.

The annual report also contains a summary of another audit conducted by the Office of the Privacy Commissioner of Canada (OPC). It examined the Royal Canadian Mounted Police’s (RCMP) management of operational databases that are widely shared with other police forces, government institutions and other organizations.

The audit determined that, while the RCMP has policies and procedures to safeguard the sensitive information contained in the databases, there were also some disturbing gaps.

For instance, the Privacy Act, which governs the information-handling practices of federal government departments and agencies, requires that organizations retain personal information no longer than absolutely necessary. And yet, information about offences for which a pardon had been granted, or that resulted in a wrongful conviction, continues to be accessible in a database called the Police Reporting and Occurrence System.

“People who were convicted of an offence they did not commit, or who have been granted a pardon, have a right to go about their lives without information—and especially misinformation—about their past coming to light,” Commissioner Stoddart noted. “Such information must be more tightly controlled.”

The annual report highlights the work of the OPC in 2010-2011 in strengthening the privacy rights of Canadians. It summarizes key investigations into privacy complaints and data breaches that the Office conducted under the Privacy Act. The report also describes several Privacy Impact Assessments that federal institutions submitted to the Office for review during the past fiscal year.

Aimed at assessing the government’s stewardship of personal information, the report has separate chapters devoted to the collection, use and disclosure of data. Given the sensitive nature of the personal information that the state needs to govern, the report warns of grave consequences for its over-collection, misuse or inappropriate disclosure.

Aside from the two audit summaries, here are other highlights of today’s reports:

• Biometric identifiers: Citizenship and Immigration Canada submitted Privacy Impact Assessments for two initiatives involving the use of fingerprints and other biometric identifiers for immigration control. The OPC recommended ways to strengthen privacy safeguards for vulnerable populations such as refugee claimants.
  
• Passenger behaviour observation: A Privacy Impact Assessment for a new pilot project to observe airport travellers for suspicious activity raised several concerns, including the potential for inappropriate risk profiling based on characteristics such as race, age or gender.
  
• Personal data breaches: The OPC received a record number of reports of breaches of personal information in 2010-2011. One involved a malfunction of the new My Service Canada Account website, a day after its launch, which allowed an estimated 75 users to see financial and other personal data of previous visitors to the site.
  
• Follow-up to past audits: During follow-ups on three audits originally conducted in 2008 and 2009, the entities that we audited indicated that 32 of 34 of the OPC’s recommendations had been fully or substantially implemented. For example, the RCMP reported that it had removed tens of thousands of surplus files from its exempt databanks, in compliance with the Privacy Commissioner’s recommendations.

The full annual report and audit reports on CATSA’s aviation security measures and the RCMP operational databanks are available at www.priv.gc.ca.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada.

DHS reportedly seeking covert naked scanners

Computerworld is reporting that the Electronic Privacy Information Center has obtained documents under the Freedom of Information Act that suggest the Department of Homeland Security is on the hunt for portable body scanners. This is not surprising, but what is most chilling is the suggestion that they're seeking devices that can be deployed to covertly see through clothing of unsuspecting people.

See:

DHS seeks systems for covert body scans, documents show - Computerworld

Computerworld - Documents obtained Tuesday by the Electronic Privacy Information Center suggest that the U.S. Department of Homeland Security has signed contracts for the development of mobile and static systems that can be used scan pedestrians and people at rail and bus stations and special event venues -- apparently at times without their knowledge.

The documents indicate that DHS moved to develop the technology as part of an effort to bolster the ability of law enforcement personnel to quickly detect concealed bombs and other explosives on individuals.

EPIC obtained the documents from the DHS under a Freedom of Information Act request for data on mobile and static scanning systems it filed last year....

Opt out, while you still can: Airport security reaches new levels of absurdity

"Ask the Pilot", over at Salon.com, has a great/sad illustration of the absurdity of idiotic policies and slavish adherence to these policies at airport screening: Airport security reaches new levels of absurdity - Ask the Pilot - Salon.com.

Over the past year, I've been "randomly" selected for the virtual stip-search about a half dozen times. Each time, I've opted out and have gone for the pat-down. I don't really have a problem with modesty and would probably streak through the terminal for a reasonable fee, but I do so just to make a point. The machines are pointless security theatre.

On my last trip to Ottawa, the CATSA screener guy directed me to the naked machine after I went through the metal detector. He didn't tell me it was optional. I said "I decline." And he was visibly surprised. When I opted out, he tried to sell me on the benefits of going into naked machine: "It only takes two seconds."

"No thanks. I opt out."

He was also the guy who got to give me the rub-down, and I'm sure I got extra-special treatment because I defied him.

A few weeks before, when I opted out to a woman CATSA person, she said I'd have to wait for a male guy. I said I didn't care if it was her, but I still had to wait. But she had to hold onto my boarding pass to make sure I didn't make a break for it (though I'd been through the metal detector). A few minutes passed and there was no male CATSA guy available. Obviously upset she was having to loiter with me, she quickly ran the explosive decting swab on my hands, gave me the all-clear and sent me on my way.

Does this make you any safer?

Body scanning, which started as random, is becoming de rigeur in the United States and I will not be surprised to see it make a similar change in Canada. It's the classic bait and switch: don't worry ... it's optional and we randomly choose people for secondary screening through the scanner. Now that we have them installed in all the airports, it's the scanner or the glove. Then it'll be the scanner or the train.

Recently, an American blogger wrote about his surreal experience in trying to opt-out at San Diego airport and it has garnered over 4000 comments so far.

Not surprisingly, this has led to a backlash. A number of groups in the US are calling for national opt-out day in airports on the busiest travel day of the year. I expect that it will have an impact on Thanksgiving travelers and will get some notice.

Canada may introduce "naked naked" machines for airport security

Yesterday was the Canadian Bar Association's first full-day continuing education event in Ottawa. The first panel of the morning was particularly interesting, composed of the information and privacy commissioners from British Columbia, Saskatchewan, Quebec and the two federal offices. Each commissioner was asked what keeps them up at night and Jennifer Stoddart foreshadowed the possible introduction of "naked naked" machines in Canadian airports. Sarah Schmidt from CanWest was in the audience and reported on it:

'Naked' screening may land at Canadian airports, says privacy czar

OTTAWA — Canada's privacy watchdog has warned that even more intrusive "naked" screening machines at airports could be in the works with the federal government's emphasis on national security.

Speaking to members of the Canadian Bar Association, Jennifer Stoddart on Monday highlighted national security as one of the pressing issues that keeps her "up at night" and mused openly about second generation full-body scanners coming to Canada in the future, calling them "naked, naked" scanners.

"National security pressures — they're real, they're constant," Stoddart, Canada's privacy commissioner since 2003, told participants of the special symposium about privacy in the age of technology.

"Are we going to get naked, naked machines? Apparently, not for the moment." ...

TSA employee arrested for assault after being teased about what body scanner revealed

With all the fuss over full body scanners in airports, I did not expect this.

According to The Smoking Gun, an airport security officer has been arrested after assaulting a co-worker. The spat arose because the accused was imaged in the scanner during a training exercise, exposing all his bits and pieces to his colleagues. As a result, the accused was allegedly teased mercilessly about what the image revealed.

Pretty grim.

See a summary and a copy of the arrest report here: For Airport Security, Size Matters - May 6, 2010.

Heathrow worker given police warning for body scanning co-worker

The Guardian is reporting about an incident that seems at odds with the official pronouncements that body scanners at airports protect privacy:

Airport worker given police warning for 'misusing' body scanner UK news guardian.co.uk

... A Scotland Yard spokesman said: "Police received an allegation regarding an incident that happened at Heathrow Terminal 5 on March 10. A first-instance harassment warning has been issued to a 25-year-old male."

The BAA employee took a photo of his co-worker, Jo Margetson, when she inadvertently went through a scanner.

"I can't bear to think about the body scanner thing," she told the Sun. "I'm totally traumatised. I've spoken to the police about it. I'm in too much of a state to go to work."...

EPIC reports that body scanners can store, send images

According to documents obtained by EPIC and made available to CNN, body scanners procured by the TSA are designed to be able to record and transmit images, whcih appears to contradict assurances given by the agency:

Body scanners can store, send images, group says - CNN.com

Washington (CNN) -- A privacy group says the Transportation Security Administration is misleading the public with claims that full-body scanners at airports cannot store or send their graphic images.

The TSA specified in 2008 documents that the machines must have image storage and sending abilities, the Washington-based Electronic Privacy Information Center (EPIC) said.

In the documents, obtained by the privacy group and provided to CNN, the TSA specifies that the body scanners it purchases must have the ability to store and send images when in "test mode."

That requirement leaves open the possibility the machines -- which can see beneath people's clothing -- can be abused by TSA insiders and hacked by outsiders, said EPIC Executive Director Marc Rotenberg.

EPIC, a public-interest group focused on privacy and civil rights, obtained the technical specifications and vendor contracts through a Freedom of Information Act lawsuit.

The written requirements also appear to contradict numerous assurances the TSA has given the public about the machines' privacy protections....

I wasn't able to find the documents themselves on the EPIC website.

Alberta Privacy Commissioner has some choice words about airport body scanning

The incomparable Frank Work, Information and Privacy Commissioner of Alberta, appears to have an opinion on body scanning technologies.

Privacy boss pans scans

New naked body security measures at airports don't fly, he says

By MICHAEL PLATT

The thin edge of the wedge -it's not the happiest of analogies when the subject is naked body scans and orifice-probing technology.

But that's the uncomfortable warning from Alberta Privacy Commissioner Frank Work, following a federal decision to install full-body security scanners at major Canadian airports, including Calgary and Edmonton.

Blasting the move as a serious blow to personal privacy and dignity, Work says he expects the obvious flaws in body-scanning security will result in more high-tech "toys" to fill the gaps.

"What will they do next, after the next incident? We're running out of toys and technological silver bullets," said Work, one day after the federal government announced the new airport security measures.

Work guards the privacy of Albertans, be it information or images.

If this was an Alberta rule or an airport decision, Work would surely step in and prevent the visual strip-search.

But being federal legislation, Work fears there is nothing he can do to block the airport scanners, which expose naked images of passengers to the eyes of prying security staff.

"The bottom line is it's a dignity issue, and either out of fear or because we don't want to stand in line too long, we've forsaken any notion of dignity -- it's like, all right, we'll assume the position," said Work.

He's awaiting a call from federal Transport Minister John Baird, but Work believes his hands are tied.

Work said that because human-monitored body scanners aren't perfect, showing only a surface view of the nude passenger, he believes it's a matter of time and/or tragedy before the next step is taken.

"The system is still prone to failure, so let's say the next guy packs his ass with however many grams of (plastic explosive) he can shove up there, and either successfully or unsuccessfully detonates it. What do they do next?" said Work.

"How do they trump full body scans? There actually is a device called the BOSS -- the Body Orifice Security Scanner -- where you sit in a plastic armchair and it can detect plastic or metal in body orifices. Is this next?"

The privacy boss knows his technology, and the chair he references is used in U.S. prisons, in lieu of the old rubber glove approach. That it could easily be installed in airport security areas is a squirmy thought.

Work believes it's just a matter of time.

"At what point do we say, 'Holy crap man, you're patting me down, you've got pictures of me naked, you've got me squatting on a chair, and you've taken my water bottle away'. I mean at what point is enough, enough?"

The federal government is installing 44 of the $250,000 body-scanners across Canada, as well as implementing a new system of visual observation, where security staff will monitor passenger behaviour.

The changes come in response to a Christmas Day attempt to blow up a jetliner over Michigan, when a Nigerian man failed to ignite explosives sewn into his underwear.

While the new body-scanners reportedly wouldn't have caught the underwear bomber -- the explosives were spread too thin -- U.S. demands for extra security have forced countries like Canada to follow suit.

Work says Canada obviously has little choice, if citizens want to travel internationally.

While the U.S. is forcing Canadian travellers to surrender their dignity, Work said the real danger is people starting to believe in safety, purchased through an invasion of privacy.

"The thing that troubles me most as the privacy commissioner, is we're getting more and more used to this stuff.

"Maybe we have to throw in the towel on the body scanners, but the next time the police or authorities come along wanting to blanket the city in cameras for safety reasons, we'll be that much more compliant."

Scary and funny: Undressing the naked truth about the future of airline travel

This is too funny, scary and prescient:

Undressing the naked truth about the future of airline travel

Cavity searches, complementary catheters, cryogenic suspension will be the norms

By Paula Simons, Edmonton Journal

January 7, 2010 2:07 AM

The Edmonton Journal

January 7, 2011

The federal government says Canadian air travellers will soon be asked to undergo full-body cavity searches.

The move comes after full-body scanners, of the same type installed in Canadian airports last year, failed to detect bomb-making materials that a group of alleged would-be bombers had secreted within their personal body cavities.

Transport Canada says passenger privacy will be fully protected, because all individuals being stripped-searched will wear paper bags over their heads, preventing security officers from seeing their faces.

"We feel this strikes the necessary balance between protecting passenger safety and avoiding unnecessary traveller embarrassment," said Transport Canada spokesman Winston Smith.

Health Canada will compensate travellers by including complementary prostate exams and PAP smears as part of the inspection process.

"We won't just be striking a blow in the war on terror," said Reductio Ad-Absurdum, a spokesman with the Prime Minister's office. "We'll also reduce the burden on our public health-care system by screening early for cervical and prostate cancer. We think Canadians will be open to the value-added benefits."

While a few civil libertarian academic-types raised concerns about the invasion of privacy, most of those commenting on The Journal's web-site were enthusiastic.

"Flying is a privilege, not a right," said one.

"If you don't have anything to hide, why would you object?"

"The world is a scary place," said another. "I don't mind having my government stick its nose into every nook and cranny."

The Edmonton Airport Authority is asking all local passengers to arrive at the airport at least five hours before flight time to allow enough time for the new inspections.

---

The Edmonton Journal

January 7, 2015

In a new policy initiative designed to flush out terrorist plots, Transport Canada has announced that airline passengers will no longer be allowed to use on-board washrooms while the plane is in flight.

"Letting people move freely through the cabin, allowing them access to a private space where they couldn't be monitored, well, it's just too big a risk," said Transport Canada spokesman Winston Smith.

Passengers will be required to stay in their seats, with their belts securely fastened, for the duration of the flight. For short-haul flights, passengers will be provided complementary adult diapers. Long-haul flyers will be issued personal catheters.

"We feel this strikes the necessary balance between protecting passenger safety and avoiding unnecessary traveller embarrassment," Smith said.

While civil libertarians and others soft on terrorism suggested the new policy was an affront to human dignity, public response was muted.

"This is public safety we're talking about here," said Edmonton passenger Saaphtee Pherst, 52.

"If you have a problem with it, then don't fly."

The Edmonton Airport Authority is asking long-haul passengers to arrive six hours ahead of their departure time to be fitted for catheters.

---

The EdJour.com

January 7, 2020

In a move designed to restore public confidence in air travel, Transport Canada has announced it is moving to align with a new American policy that requires that all airline passengers be placed in pre-flight cryogenic suspension.

"We believe that flash-freezing will maximize both passenger safety and passenger comfort," said federal spokesman Winston Smith. "Ever since we banned people from taking books, magazines, computers and food aboard planes, and made it illegal for them to get out of their seats, air travel has become unduly tedious. This way, we eliminate any terrorism and boredom, and allow passengers to arrive safe and well-rested, without jet lag. And since we'll be able rip out the seats and stack passengers like cordwood, we'll be able to make more efficient use of space and fuel."

Federal spokesman Reductio Ad-Absurdum said cryogenics was a proven technology with minimal health risks.

The Edmonton Airport Authority is asking all passengers to report to the airport 24 hours before their flight for freezing.

The EdJour.com

January 2, 2021

---

Air UnitedCanNorthWestDeltaKLMVirginJALEl-AlJet, the world's sole surviving airline, filed for creditor protection this week in the wake of a disastrous Christmas travel season. A climate of fear, combined with fears about climate change, meant no one flew anywhere.

"Flying was no longer exciting or convenient," said business analyst Noitall Pundit. "The Age of the Airplane is over."

Travel Alberta is now asking people to travel by low-carbon donkey instead, and to stay strictly within a 100-mile radius of home.

"Foreign travel is dangerous and overrated. So are foreigners," said spokeswoman Pollyanna Xenophobe. "Alberta is the promised land. Really, no one should ever want leave it again."

We need a debate on the privacy impact of body scanners

I was interviewed by the Halifax Chronicle Herald on the need for a thorough debate about the privacy impact of body scanners and to make sure that we are actually dealing with the problem. And if we're going to use the technology, we need to ensure that all steps are taken to mitigate the privacy impact.

Safety vs. privacy: - Nova Scotia News - TheChronicleHerald.ca

Safety vs. privacy: Legal expert warns tradeoff of agreeing to virtual strip search might not be worth it

By KELLY SHIERS Staff Reporter Thu. Jan 7 - 4:47 AM

A Halifax privacy expert says airline passengers willing to undergo virtual strip searches are trading privacy for security in an equation that may not result in increased safety in the air.

"Because this is almost unprecedented in its intrusiveness, that means we really need to have a debate about it," David Fraser said Wednesday.

"If you throw out people’s privacy, it doesn’t necessarily mean you’re going to end up with the best security.

"I think we need to have all the facts in front of us about how effective these things are, what sort of impact they’re having on privacy, and how (we can) increase the effectiveness of security while trying to mitigate the impact it can have on privacy."

RELATED» Privacy czar probes Ottawa’s plan for airport surveillance » Slovaks plant explosive in traveller’s luggage in failed security test» Airport security: Last line of defence

Mr. Fraser, a privacy lawyer with McInnes Cooper, said most of the people he has spoken with have reacted positively to the news that airports across the country, including in Halifax, will soon use scanners that see through clothes.

The machines show a three-dimensional outline of a naked body that allow screening officers to see whether someone is carrying dangerous items.

"When they balance their safety versus their privacy, they’re happy to give up their privacy in exchange for their safety," he said.

The scanners have been used at some airports outside Canada and were expected to be introduced in this country at some point.

But on Tuesday, the federal government announced it will buy 44 machines as part of an international response to a man’s attempt to blow up a jet approaching Detroit on Christmas Day. The man was wearing explosives sewn into his underwear.

The devices are only supposed to be used on passengers who have been singled out for secondary screening. Those passengers can choose to go through the machines or be frisked.

Mr. Fraser said he would prefer to be scanned rather than have the kind of intrusive pat-down that would be required in order to detect explosives sewn into underwear.

But he said he believes technology is only part of the answer to combating terrorism in the air.

"It’s convenient to throw technology at the problem and I think there may be an assumption this is going to make everybody safe, but I’m not sure this is necessarily the case," he said.

The devices have shortcomings, even if they are better than what is now in place, he said.

And technology, he said, may not be as effective as "strategic investments in humans" who are collecting, analyzing and using the massive amounts of data about possible threats and possible terrorists.

He said the public should ask questions about the use of the images and the safeguards that will be in place to protect them.

Under a plan approved by Canada’s privacy commissioner, an officer would view the image in a separate room and never see the passenger. The images are supposed to be erased automatically and no copies kept.

Other possible safeguards could include scanning screeners to ensure they’re not carrying cameras or cellphones capable of taking pictures of the images, Mr. Fraser said. And just as pat-downs are only done by members of the same sex, perhaps that rule should apply to viewing the naked images, he said.

Pantsbomber revives debate over body scanners as implementation is expanded

The thwarted Christmas Day bombing plot has certainly raised security levels in airports over the holidays. Individual passengers are being frisked before boarding, presumably to make sure they don't have any hidden compartments in their unmentionables (but inspectables). Carryons are being dramatically restricted to reduce screening times, as all such items have been hand inspected. Not at all surprisingly, this has brought body scanning technology to the fore.

In October of this year, the Federal Privacy Commissioner gave her conditional approval to the use of the technology. The conditions are that the images are not retained and the scanners are used only as a secondary screening tool. (See: A necessary image - The Globe and Mail.) However, all passengers to the US are now subject to secondary screening. The Globe article says that technology exists to blur faces and genitals, but I would think that genital blurring may might have obscured a cleverly hidden crotch bomb.

Also according to the Globe (Nigeria, Netherlands to introduce full-body imaging; Canada undecided - The Globe and Mail), both countries that were connected to the pantsbomber, Nigeria and the Netherlands, are introducing body scanning for all flights to the United States. So are UK airports (BAA to introduce full-body scanners at UK's Heathrow).

I travel a lot. Personally, I'd rather be virtually stripped in five seconds than physical patted down by a stranger over two or three minutes. But I'm not so shy. I would also think that the same technology that is currently used to detect explosives residue should be rolled out on a wider scale as well.

For a good overview of the technology and the debate, check out: Full-Body Scanners at Airports: The Good, the Bad, and the Ugly Technomix Fast Company.

Also, CBS (via YouTube) does a pretty good job of covering the debate:

Commissioner tables annual Privacy Act Report for 2008-2009

The Privacy Commissioner of Canada has tabled her annual report on the public sector privacy law, the Privacy Act: Annual Report to Parliament 2008-2009 - Report on the Privacy Act.

At the same time, she has also tabled additional privacy audits, related to FINTRAC and the Canadian no-fly list:

• Audit of the Financial Transactions and Reports Analysis Centre of Canada
• Audit of the Passenger Protect Program of Transport Canada

Here's the media release that accompanied the tabling of the reports:

Audits of major national security programs raise concerns for privacy Excessive reporting of personal information to FINTRAC and potential information technology risks with Canada’s “no-fly list” are among concerns identified in audits highlighted in the Privacy Commissioner’s annual report on public sector issues.

OTTAWA, November 17, 2009 — The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has more personal information in its database than it needs, uses or has the legislative authority to receive.

This was one of the key findings of the Privacy Commissioner of Canada’s in-depth audit of the independent agency mandated to analyze financial transactions and identify suspected money laundering and terrorist financing in Canada.

A separate audit, also published today, examined the Passenger Protect Program – better-known to Canadians as the no-fly list. It identified several concerns, such as the fact that the Deputy Minister ultimately in charge of who is on the list was not provided with complete information to allow for informed decision-making.

“Since the terrorist attacks of 9/11, we’ve seen a proliferation of new national security programs. We fully appreciate the underlying aim of many security programs – protecting Canadians. However, it is critical – a point reinforced by our new audits – for government officials to integrate privacy protections into all of these programs at the outset,” says Privacy Commissioner Jennifer Stoddart.

The findings of the two audits are highlighted in the Commissioner’s 2008-2009 report to Parliament on Canada’s federal public-sector privacy legislation, the Privacy Act.

FINTRAC Audit

Legislative changes passed in 2006 expanded the types of transactions that must be reported to FINTRAC, as well as the number of professionals and organizations that are required to collect information about clients and to report it to FINTRAC. Examples of entities required to report to FINTRAC include financial institutions, life insurance companies, accountants and casinos.

The audit found that FINTRAC needs to do more to ensure that the amount of personal information it acquires is kept to an absolute minimum. A random sample of files examined in the audit turned up several reports that did not clearly demonstrate reasonable grounds to suspect money laundering or terrorist financing. For example:

A reporting entity filed several reports stating it was “taking a conservative approach in reporting this … because there are no grounds for suspecting that this transaction is related to the commission of a money laundering offence, but there is a lack of evidence to prove that the transaction is legitimate.”

An individual deposited a government cheque for an amount less than $300 and then withdrew the entire amount. The financial institution filed a suspicious-transaction report, but did not indicate why the transaction was deemed suspicious.

A financial institution filed a report about an individual who had deposited a cheque from a law firm. The institution was satisfied that the individual had provided legitimate reasons for the source of funds, but decided to notify FINTRAC anyway because of the individual’s ethnic origin and the fact that this person had visited a particular country.

“It is clear that such reports, containing not a shred of evidence of money laundering and terrorist financing, should not be making their way into the FINTRAC database,” says Commissioner Stoddart.

“It is a bedrock privacy principle that you collect only the personal information you need for a specific purpose,” she says. “The federal government needs to have a justifiable need to collect someone’s personal information. Clearly, FINTRAC needs to do more work with organizations to ensure it does not acquire personal information that it has no legislative authority to receive – and that it does not need or use.”

The audit recommended enhanced front-end screening of reports; stronger ongoing monitoring and review to ensure that information holdings are relevant and not excessive, and the permanent deletion of information that FINTRAC did not have the statutory authority to receive.

Under amendments passed in 2006, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act requires the Privacy Commissioner to review FINTRAC every two years and report the results to Parliament.

Passenger Protect Program Audit

The “no-fly list” is a passenger screening tool introduced in 2007 to prevent people named on a “specified persons list” from boarding domestic and international flights from or to Canadian airports.

The program has sparked privacy concerns, in part because it is secretive in that it uses personal information without the knowledge of the individuals concerned. Moreover, the repercussions for a person named on the list being denied boarding on an aircraft can be profound in terms of privacy and other human rights, such as freedom of association and expression and the right to mobility.

The focus of the audit, however, was to determine whether the program has adequate controls and safeguards in place to protect personal information.

“We were concerned to learn that officials did not always provide the Deputy Minister – who is ultimately responsible for adding to or removing people’s names from the ‘specified persons’ list – all the information needed to make these sorts of decisions,” says Assistant Privacy Commissioner Chantal Bernier.

Other concerns identified during the audit included:

Transport Canada has not verified that airlines are complying with federal regulations related to the handling and safeguarding of the “specified persons list.” The risk of this information being inappropriately disclosed is particularly high for the small number of air carriers that rely on paper copies of the list.

There were no requirements that air carriers report to Transport Canada security breaches involving personal information related to the no-fly list.

Transport Canada did not demonstrate that the application used to transmit information to air carriers met government security standards.

The Passenger Protect Program and the FINTRAC audits, as well as the latest Privacy Act annual report, are available at http://www.priv.gc.ca/.

The annual report also includes details of privacy-related complaints against federal departments and agencies investigated during the 2008-2009 fiscal year. The Office received 748 formal complaints in 2008-2009, down slightly from the previous year. The most common complaints related to access to personal information and to the length of time government departments and agencies were taking to respond to access requests.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

To view the reports:

• Annual Report to Parliament 2008-2009 – Report on the Privacy Act
• Audit of the Financial Transactions and Reports Analysis Centre of Canada
• Audit of the Passenger Protect Program of Transport Canada
• Audit of Federal Annual Privacy Reports

Privacy Commissioner OKs airport body scanners

Apparently the Privacy Commissioner has given the thumbs up body scanners for aviations security:

The Canadian Press: Privacy watchdog OKs see-through scanners

Privacy watchdog OKs see-through scanners

By Jim Bronskill (CP) – 46 minutes ago

OTTAWA — Airport scanners that see through the clothes of travellers have received the blessing of Canada's privacy czar.

Chantal Bernier, the assistant federal privacy commissioner, said Friday the national air security agency has successfully answered her office's questions about the project. The system, tested in British Columbia at the Kelowna airport, allows a screening officer to see whether someone is carrying plastic explosives or other dangerous items.

The proposal has stirred controversy because the scanner produces a three-dimensional outline of a person's naked body.

"It is a very touchy issue, and we have addressed it with exactly that level of care," Bernier told a gathering of security officials and academics.

Under the plan approved by the privacy chief, the officer would view the image in a separate room and never see the actual traveller.

Only people singled out for extra screening would be scanned, and they would have the option of getting a physical pat-down instead.

Bernier said the holographic image generated by the scanner makes it difficult to identify the traveller's face.

"You would not know who it is, even if you knew the person was in line," she said at the annual meeting of the Canadian Association for Security and Intelligence Studies. "We've actually tested it.

"In addition, the image would be deleted the moment the person leaves the screening portal.

"In our view, these privacy safeguards meet the test for the proper reconciliation of public safety and privacy," Bernier said.

The Canadian Air Transport Security Authority has done thorough threat assessments that reveal a need to search passengers for weapons that might elude a conventional metal detector, she said.

Giving a traveller who undergoes secondary screening the choice of either a full-body scan or a pat-down reduces the "sense of invasion" posed by the new tool, Bernier added.

In a preliminary assessment early last year, the air-security authority said the scanner project amounted to a "low privacy risk" due to the built-in safeguards.

The scanners are already in use at airports in cities including Amsterdam, Moscow and Phoenix. They are also found in the high-security "green zone" of Baghdad and at some U.S. courthouses and prisons.

The air-security authority says the low-level radio frequency wave emitted by the body scanner meets Canadian health-and-safety standards.

Data from the Kelowna pilot project will help the security authority determine which Canadian airports would most benefit from scanners.

Transport Canada would then decide whether to approve use of the devices across the country.

Laptop searches at airports infrequent, DHS privacy report says

Computerworld is reporting on the first report of the Department of Homeland Security Privacy Office since the changeover to the Obama administration. The report itself is interesting, but perhaps most interesting are the statistics related to the number of searches of laptops at border crossings. This has been a controversial practice since reports on it came to light some time ago. I was surprised to read that fewer than two thousand took place in the year under review, in light of the millions of people (and laptops) that have crossed the border during that time.

Here's Computerworld's coverage: Laptop searches at airports infrequent, DHS privacy report says.

CATSA orders invasive body scanners for Canadian airports

According to the Edmonton Sun, the Canadian Air Transport Security Authority is ordering seven whole body scanners for use in airports. The scanners are controversial because they result in a "virtual strip search" so that the operator is able to make out the details of the passenger's body and supposedly anything that the person may be hiding under his or her clothes. The passenger's bits and pieces are clearly visible, and the manufacturer has special software that can be installed to blur the passenger's genital region (on the screen, not in real life). But CATSA has declined to order or install the blurring software, saying that if the nether region are blurred, it would be possible for bad guys to hide stuff in that area. See: Green light for scanners Canada News Edmonton Sun.

"Clear" may put customer information up for sale

Clear, the for profit company that did pre-screening of travelers so they could breeze through security, recently went out of business. Now there's a suggestion that the personal information they've compiled may be put up for sale. According to the release (below), it would be to a company that would provide a similar business and would be approved by the Transportation Security Administration.

Out of business, Clear may sell customer data ITworld

by Robert McMillan

June 26, 2009, 08:18 AM — IDG News Service — Three days after ceasing operations, owners of the Clear airport security screening service acknowledged that their database of sensitive customer information may end up in someone else's hands, but only if it goes to a similar provider, authorized by the U.S. Transportation Security Administration.

Until this week, the Clear service had given customers a way to skip long security lines in certain airports. For a $199 annual fee, air travelers could be pre-screened for flight and then use Clear's security checkpoints instead of the TSA's. Clear was run by New York's Verified Identity Pass, which also shut down on Monday.

Customers had to provide personal information, including credit card numbers, fingerprints and iris scans in order to participate in the program. After Clear abruptly shut its doors -- it has not yet declared bankruptcy -- some worried that this data could fall into the wrong hands.

"They had your social security information, credit information, where you lived, employment history, fingerprint information," said Clear customer David Maynor, who is chief technical officer with Errata Security in Atlanta. "They should be the only ones who have access to that information."

Maynor wants Clear to delete his information, but that isn't happening, the company said in a note posted to its Web site Thursday.

Clear's IT partner, Lockheed Martin, is working with the company "to ensure an orderly shutdown as the program closes," Clear said. But in a section of the note entitled, "Will personally identifiable information be sold?" Clear acknowledged that it could be used by someone else, presumably if Clear's assets were sold. "If the information is not used for a Registered Traveler program, it will be deleted," Clear said.

Boasting more than 260,000 customers, Clear was the largest private company authorized to provide airport security services, under a TSA program called Registered Traveler. Other providers, who may now be interested in purchasing Clear's assets, include Flo and Preferred Traveler.

Until Clear's demise, Registered Traveler companies operated in about 20 airports nationwide. Once a traveller has registered with any one of these companies, he is given a travel card that can be used for security screening by any company in the Registered Traveler program.

Last year the TSA temporarily yanked Clear's Registered Traveler status after the company lost an unencrypted laptop containing data on 33,000 customers at San Francisco International Airport. A few days later, Clear was allowed back into the program after the laptop mysteriously reappeared and the TSA determined that Clear was properly encrypting data.

Although it appears to be retaining information on its central databases, Clear said it has erased PC hard drives at its airport screening kiosks, and it is wiping employee computers as well, using what it calls a "triple wipe process." This technique, used by the U.S. Department of Defense, is considered to be a reliable way of erasing data.

"Clear is communicating with TSA, airport and airline sponsors, and subcontractors, to ensure that the security of the information and systems is maintained throughout the closure process," the company said.

Customers will be notified via e-mail when their information is deleted.

That wasn't good enough for Maynor. "How about the opposite? Where if they sell my information, they send me an e-mail," he said.

If you want to fly, show us your body or we'll feel you up

An interesting review of the increasing intrusiveness of airport security: The expanding invasion of the naked body scanners. - By William Saletan - Slate Magazine.

Ontario commissioner calls for "privacy filters" on whole-body scanners

The Information and Privacy Commissioner of Ontario is calling for implementing privacy filters to mitigate part of the damage to privacy caused by whole body scanners that are appearing soon in an airport near you.

IPC - Office of the Information and Privacy Commissioner/Ontario Whats New Summary

Whole Body Imaging (WBI) technologies – which have been described in the media as “naked scanners” – raise significant privacy concerns that must to be addressed, says Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian. “These technologies, which are being deployed as a voluntary passenger-scanning security measure in a growing number of airports around the world, pose a serious threat to privacy since they produce high-quality images of an essentially naked body beneath a passenger’s clothes.” But the risk to privacy can easily be mitigated through the use of a strong “privacy filter.”

The Commissioner released a white paper entitled, Whole Body Imaging in Airport Scanners: Activate Privacy Filters to Achieve Security and Privacy, which outlines how the activation of privacy (or modesty) filters can reduce the amount of unnecessary personal details captured by WBI technologies.

• Executive Summary: Increase airport security without compromising privacy: Commissioner Cavoukian makes the case for the use of “Privacy Filters”
• Paper: Whole Body Imaging in Airport Scanners: Activate Privacy Filters to Achieve Security and Privacy

The importance of audits

Bruce Schenier has a great piece on his blog, which previously appeared in the Wall Street Journal, on the importance of audits. It's a must-read:

Schneier on Security: Audit

... When we think about security, we commonly think about preventive measures: locks to keep burglars out of our homes, bank safes to keep thieves from our money, and airport screeners to keep guns and bombs off airplanes. We might also think of detection and response measures: alarms that go off when burglars pick our locks or dynamite open bank safes, sky marshals on airplanes who respond when a hijacker manages to sneak a gun through airport security. But audit, figuring out who did what after the fact, is often far more important than any of those other three.

Most security against crime comes from audit. Of course we use locks and alarms, but we don't wear bulletproof vests. The police provide for our safety by investigating crimes after the fact and prosecuting the guilty: that's audit....

Privacy right extends to drugs in luggage

A Judge of the Supreme Court of Newfoundland has made an interesting evidentiary ruling when considering the constitutionality of a search that resulted in finding drugs and cash in the luggage of an airline passenger.

Acting on a tip, a sniffer dog alerted police, the bag was searched and the accused was arrested. He has argued that he had a reasonable expectation of privacy in his luggage and wanted the evidence excluded. The prosecutors argued that you have no expectation of privacy when traveling because luggage is routinely screened.

The Judge had this to say, according to the National Post:

"Obviously, searching or screening the accused's bags for the presence of drugs does not fit into the category of purposes for which screening was authorized," wrote Mr. Hall.

"I conclude that Brian Crisby had a reasonable expectation of privacy with respect to the contents of his luggage, save and except for searches by [airport] personnel for items that could be used to jeopardize the security of an aerodrome or aircraft. The drugs and money found in his baggage, which are the subject of this proceeding, are not such items and thus Brian Crisby had a reasonable expectation of privacy."

Mr. Rogers described the win as clearing the first hurdle toward having the charges dropped.

Interesting.

See: Privacy right extends to drugs in luggage: judge.