Sunday, March 06, 2011

DHS reportedly seeking covert naked scanners

Computerworld is reporting that the Electronic Privacy Information Center has obtained documents under the Freedom of Information Act that suggest the Department of Homeland Security is on the hunt for portable body scanners. This is not surprising, but what is most chilling is the suggestion that they're seeking devices that can be deployed to covertly see through clothing of unsuspecting people.

See:

DHS seeks systems for covert body scans, documents show - Computerworld

Computerworld - Documents obtained Tuesday by the Electronic Privacy Information Center suggest that the U.S. Department of Homeland Security has signed contracts for the development of mobile and static systems that can be used scan pedestrians and people at rail and bus stations and special event venues -- apparently at times without their knowledge.

The documents indicate that DHS moved to develop the technology as part of an effort to bolster the ability of law enforcement personnel to quickly detect concealed bombs and other explosives on individuals.

EPIC obtained the documents from the DHS under a Freedom of Information Act request for data on mobile and static scanning systems it filed last year....

Time to check your permissions

Yesterday, a posting by twitter user @warrenehart prompted me to go into my Twitter settings to double-check my sharing settings. Here's what reminded me:

http://twitter.com/#!/WarrenEHart/status/44166823645687808

With all the recent scams & malware, worth checking Ur Twitter 3rd Party access: http://twitter.com/account/connections

I did just that and revoked permissions for a number of apps I no longer use. It also prompted me to check out Facebook, Flickr and Google.

Thanks @warrenehart and please, for both of us, take a few minutes to check your settings:

Take control over your accounts.

Saturday, March 05, 2011

BC NDP demanding social media login credentials

In the last week, there have been reports that the British Columbia New Democratic Party has been demanding the social media login credentials from candidates for the leadership of the party (see: B.C. NDP candidate in social-media standoff with party bosses - The Globe and Mail). All of the candidates have provided this info, except for one who -- quite rightly -- challenges this an an invasion of privacy.

We've heard in the past about employers asking for this sort of information and then backing off when facing a fire-storm of criticism. I can appreciate that the party is hoping to avoid any surprises, but this, in my view, seriously crosses the line. People use their Facebook accounts not only as a trove of embarrassing photos and journals of indiscretions, but also as a primary means of communicating with friends and family. I have close friends who I exclusively communicate with via Facebook. Would it be reasonable for an employer or a political party to ask for my GMail login? Phone records? All my photo albums? My journals? Crappy poetry written in high school (for the record: that was hypothetical; I wrote no poetry in high school)? The notes my mother left me in my lunchbox?

Come on, people. Just because it's easy and just because some people relent and hand it over, does not make it reasonable. It is not reasonable to ask and it is not reasonable to provide it.

It should also be noted that handing over your Facebook login credentials is a violation of the site's terms of use, which could not be more clear:

4.8 You will not share your password, (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account.

The Information and Privacy Commissioner of BC is on the case and it will be interesting to see what she concludes.

My personal conclusion: any political party that demands this sort of information doesn't care at all about privacy and doesn't deserve to govern. Any candidate who acquiesces to this doesn't deserve to be elected.

Nova Scotia Court of Appeal favours open courts over youth privacy in Facebook defamation case

Yesterday, the Nova Scotia Court of Appeal issued a decision (AB v Bragg Communications Inc, 2011 NSCA 26) denying a child-plaintiff's application to proceed in a defamation action under a pseudonym and to impose a publication ban on the defamatory materials. The case involves a fake Facebook profile created by an unknown person and the dissemination of defamatory messages via that profile. The plaintiff sought the court's assistance in tracking town the intended defendant based on the IP address. At the original hearing, the judge denied the application to proceed under a pseudonym, which was upheld by the Court of Appeal. In short, the open courts principle trumps her concerns.

Since I was one of the lawyers working for the young girl who sought the application, you should read Dan Michaluk's summary for an unbiased view: Nova Scotia CA Favours Open Courts Over Youth Privacy in Facebook Defamation Case « All About Information.

Wednesday, March 02, 2011

Is university faculty e-mail subject to access and privacy laws?

Dan Michaluk has just blogged about an interesting case out of Alberta (University of Alberta v. Alberta (Information and Privacy Commissioner), 2011 ABQB 100) that may have a significant impact on freedom of information law, particularly in universities. It will also have an impact on cloud computing decisions by universities. The Canadian Association of University Teachers takes the position that faculty e-mail are not under the "custody and control" of the educational institution. If this is found to be the case, faculty e-mail is not within the ambit of access to information laws at all and the privacy protection provisions of those laws. And, if that's the case, such e-mails are not covered by laws that are meant to regulate the export of personal information (out of fear of the USA Patriot Act). Stay tuned ....

See Dan's post: Alberta Court set to Hear Faculty E-mail Case « All About Information

Tuesday, March 01, 2011

US Supreme Court: Corporations do not have personal privacy rights under US Freedom of Information law

The United States Supreme Court has just ruled today that the personal privacy exemptions in the US Freedom of Information Act do not protect information about corporations. In short, corporations do not have a personal privacy right.

This is consistent with the Canadian approach.

FCC v. AT&T Inc. :: Volume 562 :: Docket Number 09-1279 :: 2011 :: Syllabus :: US Supreme Court Cases from Justia & Oyez

SYLLABUS

OCTOBER TERM, 2010

FCC V. AT&T INC.

SUPREME COURT OF THE UNITED STATES

FEDERAL COMMUNICATIONS COMMISSION et al. v. AT&T INC. et al. certiorari to the united states court of appeals for the third circuit No. 09–1279. 

Argued January 19, 2011—Decided March 1, 2011

The Freedom of Information Act requires federal agencies to make records and documents publicly available upon request, subject to several statutory exemptions. One of those exemptions, Exemption 7(C), covers law enforcement records the disclosure of which “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U. S. C. §552(b)(7)(C). CompTel, a trade association, submitted a FOIA request for documents AT&T had provided to the Federal Communications Commission Enforcement Bureau during an investigation of that company. The Bureau found that Exemption 7(C) applied to individuals identified in AT&T’s submissions but not to the company itself, concluding that corporations do not have “personal privacy” interests as required by the exemption. The FCC agreed with the Bureau, but the Court of Appeals for the Third Circuit did not. It held that Exemption 7(C) extends to the “personal privacy” of corporations, reasoning that “personal” is the adjective form of the term “person,” which Congress has defined, as applicable here, to include corporations, §551(2).

Held: Corporations do not have “personal privacy” for the purposes of Exemption 7(C). Pp. 3–12.

(a) AT&T argues that the word “personal” in Exemption 7(C) incorporates the statutory definition of “person,” which includes corporations, §551(2). But adjectives do not always reflect the meaning of corresponding nouns. “Person” is a defined term in the statute; “personal” is not. When a statute does not define a term, the Court typically “give[s] the phrase its ordinary meaning.” Johnson v. United States, 559 U. S. ___, ___. “Personal” ordinarily refers to individuals. People do not generally use terms such as personal characteristics or personal correspondence to describe the characteristics or correspondence of corporations. In fact, “personal” is often used to mean precisely the opposite of business-related: We speak of personal expenses and business expenses, personal life and work life, personal opinion and a company’s view. Dictionary definitions also suggest that “personal” does not ordinarily relate to artificial “persons” like corporations.

AT&T contends that its reading of “personal” is supported by the common legal usage of the word “person.” Yet while “person,” in a legal setting, often refers to artificial entities, AT&T’s effort to ascribe a corresponding legal meaning to “personal” again elides the difference between “person” and “personal.” AT&T provides scant support for the proposition that “personal” denotes corporations, even in a legal context.

Regardless of whether “personal” can carry a legal meaning apart from its ordinary one, statutory language should be construed “in light of the terms surrounding it.” Leocal v. Ashcroft, 543 U. S. 1, 9. Exemption 7(C) refers not just to the word “personal,” but to the term “personal privacy.” “Personal” in that phrase conveys more than just “of a person”; it suggests a type of privacy evocative of human concerns—not the sort usually associated with an entity like AT&T. AT&T does not cite any other instance in which a court has expressly referred to a corporation’s “personal privacy.” Nor does it identify any other statute that does so. While AT&T argues that this Court has recognized “privacy” interests of corporations in the Fourth Amendment and double jeopardy contexts, this case does not call for the Court to pass on the scope of a corporation’s “privacy” interests as a matter of constitutional or common law. AT&T contends that the FCC has not demonstrated that the phrase “personal privacy” necessarily excludes corporations’ privacy. But construing statutory language is not merely an exercise in ascertaining “the outer limits of [a word’s] definitional possibilities,” Dolan v. Postal Service, 546 U. S. 481, 486, and AT&T has provided no sound reason in the statutory text or context to disregard the ordinary meaning of the phrase. Pp. 3–9.

(b) The meaning of “personal privacy” in Exemption 7(C) is further clarified by two pre-existing FOIA exemptions. Exemption 6, which Congress enacted eight years before Exemption 7(C), covers “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” §552(b)(6). This Court has regularly referred to Exemption 6 as involving an “individual’s right of privacy,” Department of State v. Ray, 502 U. S. 164, 175, and Congress used in Exemption 7(C) the same phrase—“personal privacy”—used in Exemption 6. In contrast, FOIA Exemption 4, which protects “trade secrets and commercial or financial information obtained from a person and privileged or confidential,” §552(b)(4), clearly applies to corporations. Congress did not use any language similar to that in Exemption 4 in Exemption 7(C). Pp. 9–11. 582 F. 3d 490, reversed.

Roberts, C. J., delivered the opinion of the Court, in which all other Members joined, except Kagan, J., who took no part in the consideration or decision of the case.

Monday, February 28, 2011

Tracking Internet miscreants

A growing portion of my practice is working with the litigators in my firm on cases of online torts, including defamation and harassment. This mainly involves working to track down people who do harmful things under a veil of supposed internet anonymity. This includes people who hide behind pseudonyms on chat boards and other internet fora while saying defamatory things in addition to the (apparently) growing problem of creating fake Facebook profiles in order to harass and bully others. We've dealt with similar situations involving online dating sites, where people have set up fake profiles in the names of the victims in order to harass them.

I'm not sure about the psychology behind this, but it certainly appears as though many people feel free to say things about others on the internet that they would never say in "public" or to the person's face. Others, bullies in particular, see the internet as a great place to extend their activities, often with very harmful results.

Some of the cases I've worked on have become well-publicized in this region, and I was asked by the Canadian Bar Association - New Brunswick Branch to present on the topic at their annual Mid-Winter Meeting. In case you're interested, below is a presentation on what sorts of tracks people leave online and how they can be assembled and used to try to identify otherwise unnamed defendants. In almost all cases, they involve applying to the court for Norwich orders, which is a form of order from the court to require a mostly uninvolved third-party to provide information that will lead to the identification of the actual defendant. The court, acting as the gatekeeper, needs to balance the interests of the plaintiff who is looking for a remedy against the interests of both the third party service provider and the unnamed defendant. In short, the court should not allow a fishing expedition, nor should it allow the disclosure if the claim is not reasonably well established. Only if the plaintiff is able to satisfy the following test will the court order disclosure:

(1) the applicant must establish a bona fide claim against the unknown alleged wrongdoer;

(2) the third party against whom discovery is sought must be in some way connected to or involved in the misconduct;

(3) the third party must be the only practical source of the information available to the applicant;

(4) the third party must be reasonably compensated for expenses and legal costs arising out of compliance with the discovery order; and

(5) the public interest in favour of disclosure must outweigh the legitimate privacy interests.

Here is the presentation I gave to the Canadian Bar Association New Brunswick's Mid-Winter Meeting:

https://docs.google.com/present/view?id=ddpx56cg_379fgxwmgd4&interval=60

Here are a couple of notable reported cases where we have been successful in obtaining information from third party service providers to identify defendants:

Thursday, February 24, 2011

Ryerson University looks to the cloud

Today, I had the great pleasure of being one of the speakers at Ryerson University's broad consultation on the possibility of adopting cloud computing at the university. It was an incredibly high-quality event with a packed auditorium (in the middle of reading week, no less) and a very engaged audience.

The agenda is here: E-mail and Collaboration Tools Consultation | Email & Collaboration Tools Consultation.

My presentation is here:

If you can't see the embedded presentation, try this link: https://docs.google.com/present/view?id=ddpx56cg_415c4c8k5g5&interval=60

The full symposium was webcast live and will be available here:

If you want to see the many, many tweets which were sent out, search Twitter for #ryeprivacy.

UPDATE: Over at Slaw.ca, Dan Michaluk, who was at the symposium, has posted a few of his observations on the day: Commissioner Cavoukian says the Patriot Act is nothing.

Tuesday, February 22, 2011

Social Media and the Courts

In September of last year, I was honoured to be invited to give a presentation to the Canadian Centre for Court Technology as part of a panel on The Ethical Implications of Technology. My co-panelists were the Assistant Privacy Commissioner Chantal Bernier and Professor Pierre Trudel.

I've just been advised that the video of the presentation is now online here. It's worth checking as it's chock full o' privacy stuff.

If you want to see the presentation, it's here:

Monday, February 21, 2011

Court Grants Ex Parte Order to Preserve Facebook

Last month, one of my partners made an application before the New Brunswick Court of Queens bench for an unusual ex parte order for the preservation and production of the contents of plaintiff's Facebook account. The order and reasons are here: Sparks v. Dubé, 2011 NBQB 40 (CanLII).

It's an unusual situation, which is well summarized by Dan Michaluk: Court Grants Ex Parte Order to Preserve Facebook « All About Information.