The Canadian Response to the USA Patriot Act

I was recently invited to contribute an article to the IEEE Security & Privacy magazine on the Canadian response to the USA Patriot Act. Here's the abstract:

The Canadian Response to the USA Patriot Act

Since the attacks of September 11, 2001, US authorities have spent untold millions of dollars guarding their frontiers to regulate what gets into the country. On the other side of the border, many Canadian jurisdictions have turned their thoughts to regulating what information flows southward into the US. This isn't out of concern about terrorism but rather about the US response to it.

Citation: David Fraser, "The Canadian Response to the USA Patriot Act," IEEE Security and Privacy, vol. 5, no. 5, pp. 66-68, Sept/Oct, 2007

I think I reserved the right to publish the article on the blog after the publication by IEEE, but I'll have to track down that release .... stay tuned.

Update: Definitely Not the Opera

I found out that tomorrow's Definitely Not the Opera is "all privacy, all the time".

Here's the synopsis from the website:

Definitely Not the Opera

Broadcast time: Saturdays at 1:00 p.m. (1:30 NT) on CBC Radio One

On the street, on stage or behind the scenes, DNTO takes listeners on a fast paced trip through the cultural landscape of Canada and around the world. Definitely Not the Opera is the ideal audio guide to the fast-changing world of popular culture. It's your tip sheet to what's hot, what to watch, who to listen to and what's going on.

This Week on DNTO!

Every breath you take… every move you make… DNTO will be watching you. ‘Cause this week, we’re looking at privacy, and asking the question – how far will you go to protect it?

From 1-2

To begin, Sook-Yin hits the streets to see what kind of bribe it take to get strangers to give up their deeply personal information.

Nick Purdon struggles to rid himself of that ancient violation of his mailbox’s privacy… junk mail.

So maybe the question isn’t so much how far you’ll go to protect your privacy… but why you should bother. Halifax-based lawyer and privacy expert David Fraser will come by to explain how your privacy is at risk in everyday situations… like turning on your computer at work.

Then it’s over to paranoid contributor Clare Lawlor, who has formed a special bond with her shredder.

Musicians put their private lives on the stage… so how do they maintain their privacy? Sook-Yin will chat with Neverending White Lights, and they’ll play us a tune live in studio.

And we’ll head south of the border to hear from funnyman John Wing with his take on privacy.

Plus tunes from the New Pornographers, Chris Walla, Crowded House and Hawksley Workman.

From 2-3

Sook-Yin pays a visit to Canadian science-fiction icon Robert J. Sawyer, who maintains that our notion of “privacy” might be a bit overrated… but to get to know Robert a little better, she’ll start by paying a visit to his garbage.

We’ll ask Robert to stick around for this week’s edition of Parlour Games.

Sook-Yin takes her mic back to the streets to find out how you’ve invaded the privacy of others. We willingly surrender a lot of our privacy online these days… but is it worth it? DNTO’s Wab Kinew looks into it.

Comedian Fraser Young loves the GPS chip. Privacy… not so much. He’ll explain why.

And Sook-Yin will talk with artist Hasan Elahi, who’s taken a unique approach to privacy… by making his every move public.

All that, and music from Immaculate Machine, Metric, the Russian Futurists, George Michael,and Prince.

DNTO airs Saturday afternoons across Canada at 1:00 p.m. (1:30 in Newfoundland) on CBC Radio One.

You can also catch the show on Sirius Satellite Radio channel 137 - Saturdays at 11:00 a.m. and 9:00 p.m.

And if you're in Chicago or Seattle, you can catch us on public radio... we're on WBEZ in Chicago Sunday at midnight, and on KXOT in Seattle Saturday at 9:00 a.m.

Plus, if you can't catch us on the air, download our weekly podcast of highlights from DNTO!

DNTO's theme music is "Bentley's Gonna Sort You Out" by Bentley Rhythm Ace.

UPDATE: My interview wasn't on the post-show podcast, but if you're interested, here's an MP3 of the interview (2931Kb).

Alberta commissioner: "It' just nuts that we're not looking after this stuff better"

After an investigation into a stolen laptop from Alberta Capital Health, Frank Work has expressed some exasperation about how personal information is being protected:

Safeguard cyber-privacy

The Edmonton Journal

Thursday, November 15, 2007

Crafting sophisticated privacy legislation has never been more important, as lawmakers struggle to keep up with technological advances. And yet all the statutes in the world are no excuse for common sense.

"It's just nuts that we're not looking after this stuff better," exclaimed an exasperated Frank Work on Tuesday. Work, Alberta's information and privacy commissioner, had just released a report investigating the May theft of four laptop computers at a Capital Health office.

The study concluded that Capital Health had contravened the Health Information Act by not taking adequate security precautions. This was in spite of two previous warnings about the need for encryption programs. Capital Health has promised that it will have encryption for laptops installed by January and will soon provide the commissioner with a detailed implementation plan for other changes. Let's hope so.

Not that Capital Heath is alone. Work also announced another investigation into the theft of a memory stick storing personal details of 560 students attending Edmonton Catholic Schools. An employee of the board's school bus company kept the stick in her purse. The school board now insists bus carriers' memory sticks must be encrypted.

The hope is that other organizations are paying attention. Breaches in consumer information security have made all of us think twice when ordering online or even at the local cash register.

To be fair, a lot of bright people are working on this and lessons have been learned. Still, coming to terms with the storehouse of private information most of us carry around daily in various devices is everyone's business. As technology moves forward, we must remember that privacy is too precious to be taken lightly. That begins at home, at work and at school.

Tune into Definitely Not the Opera's privacy segment

On Saturday, tune into CBC Radio One's Definitely Not the Opera, where they are doing a segment on privacy. I'm meeting the host, Sook-Yin Lee, on Friday for an interview to be broadcast Saturday afternoon.

US Intel Official wants to change the definition of privacy

In a speech to a conference on GEOINT, Donald Kerr (principal deputy director of national intelligence) called for a redefinition of what is privacy. And his definition excludes the concept of anonymity.

The speech is worth a read as it contains such nuggets:

And that leads you directly into the concern for privacy. Too often, privacy has been equated with anonymity; and it’s an idea that is deeply rooted in American culture. The Long Ranger wore a mask but Tonto didn’t seem to need one even though he did the dirty work for free. You’d think he would probably need one even more. But in our interconnected and wireless world, anonymity – or the appearance of anonymity – is quickly becoming a thing of the past.

Anonymity results from a lack of identifying features. Nowadays, when so much correlated data is collected and available – and I’m just talking about profiles on MySpace, Facebook, YouTube here – the set of identifiable features has grown beyond where most of us can comprehend. We need to move beyond the construct that equates anonymity with privacy and focus more on how we can protect essential privacy in this interconnected environment. Protecting anonymity isn’t a fight that can be won. Anyone that’s typed in their name on Google understands that. Instead, privacy, I would offer, is a system of laws, rules, and customs with an infrastructure of Inspectors General, oversight committees, and privacy boards on which our intelligence community commitment is based and measured. And it is that framework that we need to grow and nourish and adjust as our cultures change.

I think people here, at least people close to my age, recognize that those two generations younger than we are have a very different idea of what is essential privacy, what they would wish to protect about their lives and affairs. And so, it’s not for us to inflict one size fits all. It’s a need to have it be adjustable to the needs of local societies as they evolve in our country. Eventually, we can only hope that people’s perceptions – in Hollywood and elsewhere – will catch up.

Our job now is to engage in a productive debate, which focuses on privacy as a component of appropriate levels of security and public safety. This is work that the Office of the DNI has started to do, and must continue and make a high priority. This careful balance we need to strike, however, is nothing new. With the advent of telephones, we entered a new frontier that required careful balancing between safety and privacy. We faced this challenge again at the end of the ’70s in the aftermath of the Church-Pike Hearings. And now, in the era of new technologies, we have to work to continue to keep that balance, to earn that trust, and re-earn it every day through our actions. But we also have to be willing to reopen the laws and regulations that were based on technologies that existed 1978 and adjust them to the realities of 2007 and 2008.

For some reaction to the speech, see: The Associated Press: Definition Changing for People's Privacy and US intelligence honcho channels Orwell, redefines privacy - Boing Boing.

The Shocking Truth! Comcast manual suggests it takes privacy seriously

I thought this was interesting and a sign of the times in the US ...

It is now newsworthy that a confidential manual from Comcast written to assist law enforcement in properly requesting customer information suggests they take privacy seriously! I'll repeat: they appear to take customer privacy seriously. Declan McCullagh has more: Secret manual shows Comcast (gasp!) protects customers' privacy The Iconoclast - politics, law, and technology - CNET News.com.

Salesforce.com leak leads to targeting phishing attacks

An employee of Salesforce.com has been taken in by a phishing scam and had his credentials compromised. The fraudsters have since used data from the vast ASP an in attempt to defraud a handful of users. See Schneier on Security: Targeted Phishing from Salesforce.com Leak and Salesforce.com Acknowledges Data Loss - Security Fix.

What do you want a friend of a friend of a friend to know about you?

The Office of the Privacy Commissioner of Canada has put together a snazzy flash presentation that looks at social networking sites and suggests you think about how much you want people -- including your mother and your boss -- to know about you. See: Office of the Privacy Commissioner » Blog Archive » A friend of a friend of a friend knows you’re on vacation.

Commissioner questions no-fly list in inquiry testimony

In testimony before Justice Major's Air India Inquiry, Privacy Commissioner Jennifer Stoddart questioned whether the "opaque" no fly list is effective. Justice Major's comments suggest he agrees. The Inquiry's mandate is to review, among other things, air travel security in Canada. See: Privacy watchdog questions 'opaque' federal no-fly list.

PIPEDA consultation marches onward

In case you haven't been consulted enough ...

The Government of Canada issued its response to the PIPEDA review report from the Standing Commitee on Access to Information, Privacy and Ethics, agreeing in parts and disagreeing in others with the committee's recommendations. So the government is now seeking public input on the topics that were relatively well canvassed before the parliaentary commitee.

If you have additional thoughts, you have until January 15 to make them known to Industry Canada.

Canada Gazette

DEPARTMENT OF INDUSTRY

IMPLEMENTATION OF THE GOVERNMENT RESPONSE TO THE FOURTH REPORT OF THE STANDING COMMITTEE ON ACCESS TO INFORMATION, PRIVACY AND ETHICS ON THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT

Deadline for submission of views: January 15, 2008

On October 17, 2007, the Government of Canada tabled in Parliament its response to the Fourth Report of the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on the statutory review of the Personal Information Protection and Electronic Documents Act (PIPEDA). In support of the Minister of Industry's responsibility for PIPEDA, Industry Canada is seeking the views of Canadians on a number of issues related to the response, including proposals for legislative amendments to PIPEDA.

PIPEDA, which came into force on January 1, 2001, sets rules for the collection, use and disclosure of personal information in the course of commercial activity in Canada. In a modern, information-based economy, an effective and efficient model for the protection of personal information is vitally important to ensure that the privacy of Canadian consumers remains protected. The ETHI Report contains 25 recommendations for how PIPEDA could be fine-tuned to ensure that the Act continues to achieve this objective. The government response expresses agreement with a majority of the Committee's recommendations and reflects the view held by a number of stakeholders that PIPEDA is working well and is not in need of dramatic change at this time. However, a small number of specific amendments may be warranted, and this consultation process provides Canadians with the opportunity to present further information, advice and views regarding the implementation of key proposals for legislative change.

In particular, Industry Canada is seeking views on the implementation of a data breach notification provision in PIPEDA (ETHI recommendations 23, 24 and 25). Such a provision is an important component of a comprehensive strategy to address the growing problem of identity theft. The Government proposes that the Privacy Commissioner be notified of any major breach of personal information, and that affected individuals and organizations be notified when there is a high risk of significant harm resulting from the breach. Ultimately, a requirement for data breach notification should encourage organizations to implement more effective security measures for the protection of personal information, while enabling consumers to better protect themselves from identity theft when a breach does occur. Industry Canada is seeking input in developing the parameters of a data breach notification provision, including, but not limited to, questions of timing, manner of notification, penalties for failure to notify, the need for a "without consent" power to notify credit bureaus, and appropriate "thresholds" for when organizations should be required to notify.

Industry Canada is also seeking further views on the issue of "work product" information (ETHI recommendation 2). The question of whether information created by individuals in their employment or professional capacity should be explicitly excluded from the definition of personal information has been a matter of significant debate. Industry Canada would therefore appreciate a wider range of views on whether an amendment to PIPEDA is needed, and, if so, how this should be implemented.

Furthermore, in order to ensure that PIPEDA is consistent with the needs of Canadian law enforcement agencies, the Government intends to clarify the meaning of lawful authority in PIPEDA as recommended by the Committee (ETHI recommendation 12). Industry Canada is seeking views and specific advice on how the concept of lawful authority could be better defined.

The Committee also recommended a number of issues for further consideration and/or consultation, including witness statements (ETHI recommendation 10), consent by minors (ETHI recommendation 15), and an assessment of the extent to which elements contained in the PIPEDA Awareness Raising Tools (PARTS) document may be set out in legislative form (ETHI recommendation 17). Industry Canada welcomes submissions on these matters.

Finally, Industry Canada is considering alternatives to the current process for the designation of investigative bodies (ETHI recommendation 6) and would appreciate any further views on this issue.

Submissions on the above, or on any other issues related to the government response that you may wish to raise, can be sent by email to PIPEDAconsultation@ic.gc.ca, by fax to 613-941-1164, or by mail to Richard Simpson, Director General, Industry Canada, Electronic Commerce Branch, 300 Slater Street, Ottawa, Ontario K1A 0C8.

The Government's response to the Fourth Report of the Standing Committee on Access to Information, Privacy and Ethics is available electronically on the World Wide Web at the following address: http://ic.gc.ca/specialreports.

For printed copies, please contact Publishing and Depository Services, Public Works and Government Services Canada, Ottawa, Ontario K1A 0S5; 1-800-635-7943 (Canada and U.S. toll-free telephone), 613-941-5995 (telephone), 1-800-465-7735 (TTY), 1-800-565-7757 (Canada and U.S. toll-free fax), 613-954-5779 (fax), publications@pwgsc.gc.ca (email), www. publications.gc.ca.