Mobile and location privacy presentation

This past week, I co-chaired the Canadian Institute's Privacy Law and Compliance conference in Toronto. I also gave a presentation on Mobile and geolocation privacy issues.

In case you're interested, here it is:

Ontario Information Privacy Commissioner blesses cross-border outsourcing of province's hunting and fishing license system

This decision from the Information and Privacy Commissioner of Ontario snuck under my radar this summer while I was on vacation.

This investigation is the result of a complaint brought by a Member of the Provincial Parliament about the Ontario Government's decision to outsource the processing and management of fishing and hunting licenses to a US-based business. The Commissioner did a thorough investigation and I am told they were pleasantly surprised by what they found. With regard to the USA Patriot Act, the Commissioner wrote:

The PATRIOT Act

The complainant has expressed concerns that the personal information of Ontarians will be subject to and accessible under American laws, including the PATRIOT Act. It is important to remember that, in Ontario, there is no legislative prohibition against the storing of personal information outside of the province or Canada. In other words, Ontario law, including the Act, does not speak to this issue. However, the Act and its regulations do require provincial institutions to ensure that reasonable measures are in place to protect the privacy and security of their records containing personal information. This applies regardless of where the records are located. Further, Ontario provincial institutions remain accountable for the actions of their agents or service providers, whether located in Ontario or in other jurisdictions.

I understand the complainant’s concern that the PATRIOT Act may be used by U.S. law enforcement agencies to access Ontarians’ personal information. However, the risk that law enforcement agencies may access personal information is not restricted to information held in the U.S. In fact, Canadian law enforcement agencies have similarly robust legal powers to obtain personal information held in Canada, and similar powers exist throughout most countries in the world. Further, law enforcement agencies in Canada, the U.S. and other countries have the ability to reach across borders to access personal information under various laws and agreements.

In this regard, the federal Privacy Commissioner of Canada has found that the privacy risks posed by the PATRIOT Act are similar to those found in Canada and, therefore, the privacy protection afforded by a U.S. service provider is comparable to that of a Canadian-based provider. In particular, the federal Privacy Commissioner has stated:

The risk of personal information being disclosed to government authorities is not a risk unique to U.S. organizations. In the national security and anti-terrorism context, Canadian organizations are subject to similar types of orders to disclose personal information held in Canada to Canadian authorities.

The federal Privacy Commissioner has also found that prior to the passing of the PATRIOT Act, U.S. authorities were able to access records held by U.S.-based firms relating to foreign intelligence gathering in a number of ways, including through formal bilateral agreements.3

Canadian legal scholars and practitioners have also carefully examined and commented on the privacy implications of the PATRIOT Act. Professor Michael Geist, Canada Research Chair in Internet and E-commerce Law, has written:

Claims that the enactment of the USA Patriot Act has dramatically altered the legal landscape are simply false. The U.S. law enforcement toolkit, which allows for the compelled, secret disclosure of personal information, pre-dates the USA Patriot Act by decades. Suggestions that the problem can be solved by keeping personal information from flowing outside the country are not realistic from a real-world, commercial perspective, where data is transferred and stored instantly on computer servers in other jurisdictions without regard for location.

David T.S. Fraser, a prominent Canadian privacy lawyer, has also been very clear in writing:

Most people are surprised to learn that some of the most “problematic” provisions of the USA Patriot Act are replicated in Canadian law in the Anti-Terrorism Act. We just don’t hear about it as much. People are also surprised to learn of huge amount of information sharing that takes place between agencies in Canada and their counterparts in the US.

The Act does not prohibit provincial institutions from outsourcing services on the basis that foreign law, including the PATRIOT Act, may apply. Similarly, there is no prohibition on the storage of personal information by government institutions outside the province. In fact, as noted by Professor Geist, outsourcing of technology services is a reality, whether by government agencies or private sector companies. Personal information may be subject to disclosure to law enforcement authorities, whether stored in the province or elsewhere. The critical question for institutions which have outsourced their operations across provincial or international borders is whether they have taken reasonable steps to protect the privacy and security of the records in their custody and control. I have always taken the position that you can outsource services, but you cannot outsource accountability. With this in mind, I now turn to consider what measures the Ministry has put into place in the circumstances of this complaint.

The decision is worth reading in its entirety: IPC - Office of the Information and Privacy Commissioner/Ontario | Reviewing the Licensing Automation System of the Ministry of Natural Resources: A Special Investigation Report [PC12-39].

Guest post: A police officer's take on informational privacy and the police in the digital age

Warren Bulmer is a detective constable with the Toronto Police and an instructor on Computer and Technology Facilitated Crime for the Toronto Police College. Recently, Warren has written comments on some of the posts about lawful access on this blog that show a perspective on the issue that differs from what I usually write. I invited Warren to write a guest post as it would be helpful for readers of this blog and those interested in the lawful access debate to hear things from his perspective.

---

Informational Privacy and the Police in the Digital Age

Background

In the past 12 months there has been much attention paid to the issue of “lawful access” and what information police can obtain about your digital trail.  Unfortunately, many of those who write online posts, blogs and communications seem to misunderstand or in some cases grossly mischaracterize such issues.  

Let’s leave aside for a moment, the issues of Internet users who post public information to social networks without any privacy settings.  The reason; the police and any other citizen can access that information and use it for any purpose thereby making any subsequent claim to an expectation of privacy, absurd.  Having said that, one must understand that if the police intend on using that information in a criminal prosecution, they must account for how it was obtained and for their authority to obtain it.

The police have many authorities that govern how they obtain information, which can be with or without a search warrant.  The most common authorities come from Statutes both Federal, like the Criminal Code and Provincial, like the Highway Traffic Act.  Police are also governed by common law, which is derived from the decisions made at various levels of Canadian courts.

The Charter of Rights and Freedoms Section 8 protects citizens against “unreasonable search and seizure” and the key term is “unreasonable”.  In a Supreme Court of Canada decision Hunter v. Southam, [1984] 2 S.C.R. 145 the court outlined that a search (by the State) without prior judicial authorization (i.e. a warrant) is presumed to be unreasonable.  The State has to justify or explain why a search is reasonable if they didn’t have a warrant.  There are also six exceptions written into law where the police are exempt from having to obtain a warrant.  They are consent, abandonment, incident to arrest, investigative detention, exigent circumstances and plain view.  

Informational Privacy

We are all given a name at birth.  Our name identifies us and distinguishes us from each other.  We provide our name to others to connect and address one another.  We have all given our name in various contexts hundreds if not thousands of times and it is safe to say that it is the purpose for our name.  Many of us wear our names on ID cards as we walk around in the public domain yet somehow it is expected that when we use the Internet our name becomes this secret entity hidden behind screens and wires.  

The Internet encourages people to believe that they are completely anonymous online however; when carefully deconstructed one can see that technology has made us more vulnerable than ever.  Every device we use creates a digital record, every time we go to the mall we are captured on dozens of high definition security cameras, and when we use an ATM the entire transaction is captured.  When you use the Internet there can be a digital trail that when followed could lead back to you.

As an Internet user you require an Internet Service Provider or Telecommunications company to facilitate that access.  ISPs are private companies like Bell Canada, or Rogers Communications and their business model requires the ability to maintain customer databases for their Internet subscribers for the purposes of billing.  These databases contain information such as your name, address, phone number, email address and credit card or banking information.  The ISPs are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) which legislates the collection, use and disclosure of your personal information by private companies. The Police have no authority to search under PIPEDA.

The ISP provides the mechanism to connect to the Internet by assigning a user an Internet Protocol (IP) address.  This unique number is assigned to the customer (subscriber) and is logged with a date and time reference as to when it was used and by whom.  This is the central issue in the whole “lawful access” debate.  

Your name, which is generally not entitled to Charter protection, is now attached to an IP address which proponents argue means that it should attract Section 8 protection. Their argument is basically derived from the belief that if the police have your name associated to an IP address, they therefore can construct a complete picture of your “electronic trails” on the Internet.  This concept is not technically possible despite the so-called “wishes” of the police.  One of many parameters is that IP addresses are dynamic and constantly change between customers.  A computer must be physically examined to learn of those electronic trails or traces.

PIPEDA supports the notion that an ISP may voluntarily provide police with customer name and address information when asked without the knowledge or consent of the customer.  These provisions are provided for in 7(3) of the Act.  If the ISP does not decide to disclose the information which by the way is only a name, address and email address then the police would have to seek judicial authorization to obtain it.  For example, in child exploitation cases many ISPs will voluntary disclose the names and addresses of customers who may be involved in offences involving child pornography or child luring.  In fraud cases for example, ISPs have refused to voluntarily provide this information and directed police to obtain a court order for it.  In this circumstance, the information remains the same and all that is accomplished is the police, the victim and the justice system as a whole, suffer unnecessary delay.

PIPEDA does not grant the police any powers or authority and neither does the newly proposed lawful access Bill C-30 (Preventing Criminal Electronic Communications Act).  Equally however; PIPEDA also does not grant citizens an extraordinary Section 8 Charter protection. The crux of this debate is the misrepresentation of “personal information”.  Section 2 of PIPEDA defines personal information as “information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization”.  Section 3 of PIPEDA is the stated purpose of the Act: “The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.”

Herein lays the fundamental flaw in the argument that customer names subscribed to an Internet Service attract Section 8 protection. The definition provided in PIPEDA of “personal information” is completely different than the constitutional definition provided for in Section 8 of the Charter.   In 1993, the Supreme Court of Canada determined what information is subject to Section 8 protection in a case called Plant (R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 SCR 281) stating the following: “In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of the Charter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. This would include information which tends to reveal intimate details of the lifestyle and personal choices of the individual.”  

It becomes clear then that PIPEDA cannot be used to solely determine if there was a valid breach under Section 8 of the Charter.  It requires an analysis in the totality of the circumstances.  This approach was confirmed by the Nova Scotia Court of Appeal in Chehil (R. v. Chehil, 2009 NSCA 111).  The Supreme Court provided the same criteria back in 1996 in Edwards (R. v. Edwards, [1996] 1 SCR 128) using a list of factors to potentially be considered in evaluating but not limiting the totality approach.  They can be found at paragraph 45 of the judgement.

The police don’t seek customer names or IP address subscribers under PIPEDA.  Their authority to ask for the information voluntarily comes from Section 487.014(1) of the Criminal Code which makes it clear that production orders (prior judicial authorization) are not necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament from asking a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.

 In 2004, the Supreme Court of Canada stated in Tessling (R. v. Tessling, [2004] 3 S.C.R. 432) at paragraph 26, “Nevertheless, Plant clearly establishes that not all information an individual may wish to keep confidential necessarily enjoys s. 8 protection”.  

Section 8 of the Charter does cover Informational Privacy and when assessing the facts on each case the Courts have evaluated a number of factors.  Included in these decisions is the relationship between the ISP and the customer usually disclosed in the form of a contract.  Most ISP have conditions or terms of use that a customer must agree to in order to use the Service.  These terms are typically phrased similarly to: “The client is warned that they must not use the service in a manner contrary to an applicable law” or “the client “agrees” that the named ISP has the right to monitor or investigate the use by the client of the network and to disclose any information necessary to satisfy any laws … or other governmental request … as necessary”.  These contractual terms fall under the analysis of the totality of circumstances when evaluating an objective or subjective expectation of privacy enjoyed by the customer.  

The argument over whether or not a name and address associated to an IP address deserves Section 8 protection is not a new one.  In fact, to the contrary, it has been litigated in numerous cases across Canada.  Here are just some of those case citations where no expectation of privacy was found in a name and address of an individual:

R. v. Wilson, [2009] O.J. No. 1067 (S.C.)

R. v. Ward, [2008] O.J. No. 3116 (C.J.)

R. v. Friers, [2009] O.J. No. 5646 (C.J.)

R. v. Trapp, [2009] S.J. No. 32 (Prov. Ct.)

R. v. Vasic, [2009] O.J. No. 685 (S.C.)

R. v. Spencer, [2009] SKQB No. 31

R. v. Ewanshyn, [2009] unreported AltaCA

R. v. Brown, [2000] O.J. No. 1177 (S.C.)

R. v. Lillico (1994), 92 C.C.C. (3d) 90 (Ont. C.A.)

R. v. McNeice, [2010] B.C.J. No. 2131 (B.C.S.C.)

R v. McGarvie, 2009 CarswellOnt 500 (Ct. Jus.)

To be fair, many of these cases relied heavily on the contractual terms and agreements between the customer and their ISP but some did find no expectation of privacy regardless of those terms.   There are a few decisions in the lower level courts that did rule in favour of a Section 8 protection of CNA such as Kwok (R. v. Kwok, [2008] O.J. No. 2414 (C.J.) but there was no information about the contractual relationship entered into evidence.  So it is not that we keep score but it is fair to say that there is a significant amount of cases that after careful judicial analysis, declare there is no constitutional protection afforded to a person’s name.  To argue differently implies there has been a large number of trial Judges who got it wrong.  

To put things into context on informational privacy, the police do not need a warrant to type the licence plate of a car into their computer system to learn the name and address of the registered owner.  The police do not need a warrant to get the registered name and address of a cellular or residential phone number.  Many of these items of personal description do not meet the threshold of a subjective expectation of privacy due to the lack of an objective reasonableness in that belief.  We are talking about one of the least intrusive searches the police can engage in.  There is no physical search by police through the Bell Canada servers and despite what you have heard no spying of a person’s Internet browsing.  

Reality Check

According to 2011 Internet Statistics, there were over 3.1 billion email accounts globally.  Does anyone realistically think the police have the time or resources to sneak a peek or read the trillions of messages exchanged?  There are over 17 million Canadians on Facebook each with an average friend’s list of 150 friends.  In 2010, there were 25 billion tweets sent out on Twitter.  In February 2012, police announced the take down of 60 individuals involved in child pornography offences and revealed that the overall investigation involved 9000 IP addresses and several hundred suspects who will go unprosecuted.

In all of these electronic “cybernetic peregrinations” to quote the Supreme Court of Canada in Morelli (R. v. Morelli, 2010 SCC 8) the police have to obtain IP logs and customers associated to this data if commencing a criminal investigation in relation to them.  When police require this information and it is not voluntarily supplied by the ISP for whatever reason they have to seek a court order called a Production Order.   Section 487.012 of the Criminal Code is the authority police have to do this.  Most companies require a minimum of 30 days to comply with this order.  If it is an emergency, that being imminent losses of life or grievous bodily harm, most ISPs have an emergency form that the police can use.  The determination of what constitutes an emergency is not necessary made by the police but the ISP ultimately.  It still reverts back to what was written earlier, the police can ask and the ISP can say “yes or no”.  

A great example of this impasse is the recent situation in New York.  The NYPD had information a person was going to attend a Mike Tyson show at a particular theatre and commit mass murder.  He posted it on Twitter and when the NYPD served Twitter with an emergency request to identify this person, Twitter refused and stated it wasn’t a bonafide emergency.   Twitter forced the NYPD to obtain a court order which took valuable time and resources.  Read more about this case here.  What’s troubling is Twitter’s position in light of the fact it occurred shortly after the 2 mass shooting sprees in Colorado and Wisconsin.  Had the suspect actually shown up at the theatre and shot people before police could have arrested him, who would have taken the brunt of the blame? The police?  I am curious to know what the people attending the theatre show that night thought.  I mean the police took the threat seriously what more could they have done?  Where is the public bashing for Twitter?  

Lawful Access

The proposed Bill C-30 by the Federal Government announced in February this year is an attempt to alleviate some of these concerns.  In the above scenario, if in Canada, Twitter would have no choice but to provide the name.  The proposed Bill would change the voluntary discretion of an ISP to provide a name and address to the Police, by making it mandatory.  (Section 16(1) of the Investigating and Preventing Criminal Electronic Communications Act).

The Bill is certainly not without its flaws, but no piece of legislation is perfect.  What’s important is that public safety and the pursuit of criminals is paramount and the legislation or something like it is necessary to achieve these basic police functions.  The justice system cannot continue to stall for 30, 60 or 90 days because a private company determines how the police are to conduct a criminal investigation.  The criteria the police require to ask for the information remains the same as it is now.  It remains a lawful request, which the police are accountable for and will be scrutinized if they abuse this authority.  Their authority also remains unchanged in that the request has to be based on their existing mandates and authorities.  The Bill does not guarantee against an abuse of process or investigative errors but neither does the system we have now.

On a positive note the Bill mandates tracking, recording and other administrative oversights of the police use of lawful requests.  This is not currently done or even mandated under PIPEDA.  The police and the public have no idea of knowing how many times we have asked for someone’s information because we aren’t keeping track.  This is unacceptable the police should be accountable for such requests and the public should be able to demand through the freedom of information process how often the police make these types of requests.  The public may not be able to learn the details for each one because of confidentiality, ongoing investigations or a court ordered prohibition but at the very least the public should know how often these requests are made.

Wrap up

I share the same concerns as many people about how the Internet, particularly social networks, is creating a database of epic proportions.  But in fairness, as a user, are you not responsible for the content you choose to share?  I would be more worried about what the Facebook’s, the Google’s and the Apple’s of the world are collecting about me than the police.  If you are a law-abiding citizen and don’t use the Internet to facilitate, perpetrate or associate with criminal activity than you don’t really exist for the police.  

There are times when victims are caught up in these situations where their Internet activity becomes a relevant issue but overall “Joe-q-public” has nothing to fear.  If you are a criminal and you choose to involve the Internet in your life, be warned.  The police are there; they are getting better at finding you in the anonymous World Wide Web with or without a warrant and you should be concerned.  The courts generally see the Internet for what it is; a public domain and if you choose to incriminate yourself while using technology, you have nobody to blame but yourself.

Warren Bulmer

Detective Constable (1406)

Toronto Police Service

Instructor – Computer and Technology Facilitated Crime

Toronto Police College - Criminal Investigation Section

416-808-4882 (direct)

warren.bulmer@torontopolice.on.ca 

Author’s Bio

Detective Constable Warren Bulmer has been a member of the Toronto Police Service since 1990.  Detective Constable Bulmer’s policing career has been predominantly spent within the field of criminal investigation including a total of 11 years assigned to Major Crime and the Child Exploitation Section of the Sex Crimes Unit.  Detective Constable Bulmer continues to be an International instructor in the area of computer-facilitated crime having lectured over 2500 Police and Prosecutors in 11 different countries to date.  Detective Constable Bulmer has taught at the Canadian Police College and the Ontario Police College where he still teaches on a part time basis. From 2005 to 2009 he was a qualified Computer Forensic Examiner and has testified in court as an expert in various capacities relating to digital evidence.  For the past 3 years, Detective Constable Bulmer has specialized in the area in Social Networks and is called upon by Police all over Canada to teach how law enforcement can balance the right to investigate with the protections afforded to citizens under the Charter. As a member of the Toronto Police College for the past 3 years, Detective Constable Bulmer continues to instruct on conducting computer and Internet investigations, the lawful search and seizure of electronic devices as well as the identification, categorization and management of digital evidence.

Warren is a published writer of many articles and a contributing author to a book entitled “Evidence and Investigation: From the Crime Scene to the Courtroom” by Emond Montgomery Publications.        http://www.emp.ca/evidence-and-investigation-from-the-crime-scene-to-the-courtroom.html 

 

Article References

1. Case law citations as provided
2. http://royal.pingdom.com/2012/01/17/internet-2011-in-numbers/ 
3. R v. David WARD Ontario Court of Appeal, 2012, Court file #C50206, Respondent’s (MINISTRY OF THE ATTORNEY GENERAL) Factum
4. Criminal Code of Canada http://laws-lois.justice.gc.ca/eng/acts/C-46/ 
5. PIPEDA (Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) http://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html 
6. Bill C-30 (Investigating and Preventing Criminal Electronic Communications Act)

http://www.parl.gc.ca/HousePublications/Publication.aspx?Docid=5380965&file=4 

Photographing and filming police officers in Canada

The Ottawa Citizen has a very good editorial on the practice of police intimidation of citizens who use their cellphone cameras and other devices to record the police.

Here's a summary of what Canadians should know about this:

• There is no law in Canada that prevents a member of the public from taking photographs or video in a public place (other than some limitations related to sensitive defense installations);
  
• There is no law in Canada that prevents a member of the public from taking photographs or video of a police officer executing his or her duties in public or in a location lawfully controlled by the photographer (in fact, police officers have no privacy rights in public when executing their duties);
  
• Preventing a person from taking photos or video is a prima facie infringement of a person's Charter rights;
  
• You cannot interfere with a police officer's lawful execution of his or her duties, but taking photos or videos does not, in and of itself, constitute interference;
  
• A police officer cannot take your phone or camera simply for recording him or her, as long as you were not obstructing;
  
• These privileges are not reserved to media -- everyone has these rights;
  
• A police officer cannot make you unlock your phone to show him or her your images; and
  
• A police officer cannot make you delete any photos.

Here's the Citizen's editorial:

Watching the watchmen

Every Ontarian should read the Police Services Act’s Code of Conduct, especially the part in Section 30 that says an officer engages in discreditable conduct when he or she “uses profane, abusive or insulting language or is otherwise uncivil to a member of the public.”

This reminder is necessary given what appears to be a predilection on the part of some police to order citizens to cease using cellphones or video cameras to record officers in the public performance of their duties.

The fact is, police have no sweeping authority under Canadian law to order people to stop taking pictures or videos of them in public or confiscate their devices without a court order. Certainly, police can arrest anyone who wilfully obstructs them while taking pictures, but even then they have no automatic right to seize the device, much less delete its contents.

Unfortunately, say observers, too many police think otherwise. And even if they know better, they too often use the excuse of obstruction and the threat of arrest to cover their illegal demands.

“Increasingly, people are being arrested, charged or even assaulted by police officers, merely for attempting to take photos or videos of officers at work,” says lawyer Karen Selick, who wrote on the topic last week in the National Post. “Often, police simply command people to stop photographing. Scared into thinking they must be breaking some law, citizens comply.”

“Police are being caught on camera and they don’t like it,” says Carleton University criminologist Darryl Davies. “But contrary to what the police may feel about the use of this technology to record their activities, there is no restriction on people taking pictures.”

“There is nothing in the Criminal Code that would directly prohibit someone taking pictures of officers in the performance of their duties in public,” says Abby Deshman, Director of the Public Safety Program at the Canadian Civil Liberties Association. “They can tell you to move away but they don’t have the right to stop you taking pictures.”

Deshman says the association has been contacted by several people complaining of “feeling intimidated or threatened with charges by police for taking pictures of them in public.”

The most infamous case in Canada in this cops versus cameras confrontation is undoubtedly that of Robert Dziekanski, the Polish visitor, who died after he was tasered at the Vancouver airport in 2007. A bystander captured the tragedy on video. The RCMP seized the camera and the owner had to threaten court proceedings to get it back.

In Selick’s account, a client whose property was being searched by police asked friends to videotape the event. The police, however, forbade them taking pictures. They also confiscated the cellphones of three others they thought connected to Selick’s client when they searched their homes. The photos taken on one phone were even deleted. According to Selick, when the phone’s owner complained, police responded: “We can do whatever we want.”

No they can’t. So, what should you do when a police officer (or, for that matter, a self-important security guard, pompous park warden, officious bylaw officer or any other badge-carrying public servant) tells you to stop taking pictures?

Davies offers this advice: Politely and respectfully inform them that they have no authority to issue such an order, that there is no law in Canada that forbids you taking pictures in a public space, and if they act aggressively toward you or threaten to seize your advice, calmly inform them they will face an official complaint and, possibly, criminal charges of illegal search-and-seizure.

As a society, we give large-scale powers to police. However, cellphones and video cameras readily expose how those powers can be abused. And as Davies remarks, “that is why the presence of this technology is being resisted by some police. They don’t want to be caught on camera doing what they have always done.”

Policing is a tough and risky job. Officers confront the worst of human nature. It is also true that subduing someone can appear excessively violent to an outside observer when, in fact, the controlled use of violence may be the safest thing for both the suspect and the officer. Police officers may think those who question their authority — or take pictures of them — raise the risk threshold. Thus, they react aggressively.

But unwarranted aggressiveness is a symptom of inadequacy and, indeed, compensation for the insecurity born of that inadequacy. In this regard, more psychological testing of police officers over the course of their career might be warranted. Police cadets take a psychological examination when they join the force, but considering the nature of the job and the effects of police culture — that thin blue line mentality that regards anyone not wearing the badge with skepticism — periodic testing every, say, five years might prove worthwhile.

Citizens should always be respectful of police, but the greater onus is on the police to respect the citizen — even when they are taking pictures that might embarrass officers — because they have sworn an oath to uphold the law.

Possessing a badge and a gun is not an excuse for petty tyranny. The police exist to ensure the safety of the public, not control the public.

Update (2013-11-09): If you are interested in this topic, you'll also want to read this: Canadian Privacy Law Blog: Yes, you can photograph or video police in public in Canada.

BC Commissioner: Privacy is a partner, not a foe, in medical research

The Information and Privacy Commissioner of British Columbia, Elizabeth Denham, has a very good and thoughtful opinion piece in yesterday's Vancouver Sun:

Privacy is a partner, not a foe, in medical research

Medical research is vital to all British Columbians. It saves lives and decreases morbidity. It improves our health outcomes and creates efficiencies in health care. And attracting research dollars is good for B.C.’s economy.

In recent weeks, there has been a lively debate about the barriers researchers encounter in accessing health data for medical research. Many participants in this debate allege that privacy law and policies are the culprits. I disagree.

As B.C.’s information and privacy commissioner, I am confident that it is possible to facilitate research and protect privacy at the same time. I have no doubt that medical research is in the public interest. In my view, privacy and research are partners, not adversaries, in the pursuit of better health outcomes. Protecting privacy and promoting research are both laudable public policy goals and both are important to British Columbians.

Opinion polling consistently demonstrates that citizens generally support giving academic and clinical researchers access to their health data, in de-identified form, or when the research requires it, in identifiable form. But their support depends on robust protection of the personal health information collected in the course of that research.

Protection of privacy matters in medical research, because the data is never “just data”: It is sensitive health information provided by individuals in good faith, in the context of receiving care. If that personal information is lost, compromised or improperly accessed, it can have a significant effect on a person’s sense of autonomy, dignity and trust in the health care organizations, research institutions and the health care system as a whole. Moreover, if people cannot be assured their privacy will be respected, they may be less willing to participate in future research. So, protecting privacy is essential if we want to maintain public support for medical research.

Fortunately, B.C.’s current legal framework facilitates privacy-positive health research; our legal commitment to privacy protection is not an obstacle. Our laws and policies are in line with international ethical and legal standards, and strike an appropriate balance between the needs of researchers to access data and the right to privacy.

One of the statutes that I oversee, the Freedom of Information and Protection of Privacy Act, allows public bodies such as the Ministry of Health and health authorities to disclose information for a research purpose.

Nevertheless, privacy concerns have been raised about the effect of this legislation. So, in an effort to address this issue head-on, I brought together a small but representative group of thoughtful individuals including data stewards, elected officials, government representatives and members of the health research community to have a lively and frank discussion about the state of medical research and data access in B.C.

There was unanimous agreement around the table that there is a problem. The problem is real and it is systemic. Researchers in British Columbia are simply not getting access to the health data they need to conduct medical research. This is unacceptable.

Barriers identified at the meeting included a troubling lack of information about what data types are available to researchers, persistent data silos that make accessing data across and within health agencies an exercise in frustration, data stewards with no efficient processes to approve data access requests and inefficient administration, including duplicate paperwork and lengthy approval timelines, which result in significant delays.

While I am pleased that the roundtable participants confirmed that B.C.’s robust privacy laws are not getting in the way, I will remain vigilant in ensuring these laws do not become impediments to vital medical research.

The Ministry of Health has committed to improve its record, ensuring that researchers obtain more timely access to necessary data. Participants at the roundtable were keen to talk about administrative solutions to remove impediments, streamline the request process, and reduce the paperwork required for researchers seeking approval, while ensuring accountability for the release and security of the data. They identified the need to explore greater use of de-identified data and broader support for data sources such as Population Data B.C., a multi-university data resource facility.

What is needed now is for members of the legislature to enunciate the importance of health research, for the ministry of health to articulate their vision and make it a priority, and for stakeholders to continue the dialogue begun at the roundtable.

Now more than ever, it is important to keep the channels of communication open and to collaborate on lasting solutions to address the systemic problems that have been identified.

Elizabeth Denham is information and privacy commissioner for British Columbia. A public report of the commissioner’s roundtable on health research is available at: www.oipc.bc.ca

British Columbia first responder protection law clashes with privacy rights, Commissioner says

I rarely disagree with Liz Denham, the very bright Information and Privacy Commissioner of British Columbia, but I do in this case. The BC government has passed a law that allows police officers, firefighters and paramedics to seek a court order to access someone else’s medical records if the first responder has come into contact with bodily fluids. (I'll admit a possible source of bias in this case: I am related to two first responders who live in BC: a police officer and a paramedic.) The Commissioner has stated in a letter to the minister responsible which says that the bill will not be useful, as there are “very few instances where emergency responders contract communicable diseases.” (I have only seen reports about the letter, not the letter itself.)

But even if there are very few instances of first responders contracting communicable diseases, the possible outcome of those few cases can be very harmful to the first responder. And we're talking about those situations where the individual stubbornly (and selfishly, in my view) refuses to disclose whether he or she has put a first responder at risk.

Most of the risk of many forms of infection can be proactively mitigated if not eliminated immediately following contact. If there's a flaw with the bill, it's the time that it likely takes to get into court to get the requisite court order. The information disclosure can be very carefully handled to protect the privacy of the individual as much as possible in the circumstances ("nothing to worry about" or "you need prophylaxis for HIV"), but the possible outcome of untreated contact can be disastrous for the cops, paramedics and firefighters who put themselves at risk.

We are often called to balance privacy rights against other societal values. That balancing should be done by a judge within a framework of accountability and transparency. I think the legislation gets the balance right.

For more coverage, see: Victoria News - First responder protection law clashes with privacy rights.

Skype makes chats and user data more available to police

The Washington Post has entered the discussion on Skype and cooperation with law enforcement with an interesting and more through canvass of the debate and the facts. It includes information obtained from unnamed insiders who the Post says are familiar with the situation.

But it does seem to affirm that Microsoft, consistent with its past track record of cooperation with law enforcement, can and does make customer information and chat records available to law enforcement. (Customer information would require a subpoena, which chat records would require a court order. What their thresholds are for non-US legal process or whether they will abide by non-American court orders is unclear.)

With respect to the actual contents of Skype audio or video calls, the article notes:

Surveillance of the audio and video feeds remains impractical — even when courts issue warrants, say industry officials with direct knowledge of the matter.

That could change if the FBI gets its wish to have VoIP services added to the Communications Assistance to Law Enforcement Act. Currently, such services are not required to be wiretap-ready.

Here's the Washington Post article:

Skype makes chats and user data more available to police - The Washington Post

Skype makes chats and user data more available to police

By Craig Timberg and Ellen Nakashima, Published: July 25

Skype, the online phone service long favored by political dissidents, criminals and others eager to communicate beyond the reach of governments, has expanded its cooperation with law enforcement authorities to make online chats and other user information available to police, said industry and government officials familiar with the changes.

Surveillance of the audio and video feeds remains impractical — even when courts issue warrants, say industry officials with direct knowledge of the matter. But that barrier could eventually vanish as Skype becomes one of the world’s most popular forms of telecommunication.

The changes to online chats, which are written messages conveyed almost instantaneously between users, result in part from technical upgrades to Skype that were instituted to address outages and other stability issues since Microsoft bought the company last year. Officials of the United States and other countries have long pushed to expand their access to newer forms of communications to resolve an issue that the FBI calls the “going dark” problem.

Microsoft has approached the issue with “tremendous sensitivity and a canny awareness of what the issues would be,” said an industry official familiar with Microsoft’s plans, who like several people interviewed for this story spoke on the condition of anonymity because they weren’t authorized to discuss the issue publicly. The company has “a long track record of working successfully with law enforcement here and internationally,” he added.

The changes, which give the authorities access to addresses and credit card numbers, have drawn quiet applause in law enforcement circles but hostility from many activists and analysts.

Authorities had for years complained that Skype’s encryption and other features made tracking drug lords, pedophiles and terrorists more difficult. Jihadis recommended the service on online forums. Police listening to traditional wiretaps occasionally would hear wary suspects say to one another, “Hey, let’s talk on Skype.”

Hacker groups and privacy experts have been speculating for months that Skype had changed its architecture to make it easier for governments to monitor, and many blamed Microsoft, which has an elaborate operation for complying with legal government requests in countries around the world.

“The issue is, to what extent are our communications being purpose-built to make surveillance easy?” said Lauren Weinstein, co-founder of People for Internet Responsibility, a digital privacy group. “When you make it easy to do, law enforcement is going to want to use it more and more. If you build it, they will come.’’

Skype was slow to clarify the situation, issuing a statement recently that said, “As was true before the Microsoft acquisition, Skype cooperates with law enforcement agencies as is legally required and technically feasible.”

But changes allowing police surveillance of online chats had been made since late last year, a knowledgeable industry official said Wednesday.

In the United States, such requests require a court order, though in other nations rules vary. Skype has more than 600 million users, with some in nearly every nation in the world. Political dissidents relied on it extensively during the Arab Spring to communicate with journalists, human rights workers and each other, in part because of its reputation for security.

Skype’s resistance to government monitoring, part of the company ethos when European engineers founded it in 2003, resulted from both uncommonly strong encryption and a key technical feature: Skype calls connected computers directly rather than routing data through central servers, as many other Internet-based communication systems do. That makes it more difficult for law enforcement to intercept the call. The authorities long have been able to wiretap Skype calls to traditional phones.

The company created a law-enforcement compliance team not long after eBay bought the company in 2005, putting it squarely under the auspices of U.S. law. The company was later sold to private investors before Microsoft bought it in May 2011 for $8.5 billion.

The new ownership had at least an indirect role in the security changes. Skype has endured periodic outages, including a disastrous one in December 2010. Company officials concluded that a more robust system was needed if the company was going to reach its potential.

Industry officials said the resulting push for the creation of so-called “supernodes,” which routed some data through centralized servers, made greater cooperation with law enforcement authorities possible.

The access to personal information and online chats, which are kept in Skype’s systems for 30 days, remains short of what some law enforcement officials have requested.

The FBI, whose officials have complained to Congress about the “going dark” problem, issued a statement Wednesday night saying it couldn’t comment on a particular company or service but that surveillance of conversations “requires review and approval by a court. It is used only in national security matters and to combat the most serious crimes.”

Hackers in recent years have demonstrated that it was possible to penetrate Skype, but it’s not clear how often this happened. Microsoft won a patent in June 2011 for “legal intercept” of Skype and similar Internet-based voice and video systems. It is also possible, experts say, to monitor Skype chats as well as voice and video by hacking into a user’s computer, doing an end run around encryptions.

“If someone wants to compromise a Skype communication, all they have to do is hack the endpoint — the person’s computer or tablet or mobile phone, which is very easy to do,” said Tom Kellermann, vice president of cybersecurity for Trend Micro, a cloud security company.

Some industry officials, however, say Skype loses some competitive edge in the increasingly crowded world of Internet-based communications systems if users no longer see it as more private than rival services.

“This is just making Skype like every other communication service, no better, no worse,” said one industry official, speaking on the condition of anonymity. “Skype used to be very special because it really was locked up. Now it’s like Superman without his powers.”

InfoWorld critical of Microsoft-Skype snooping accusations, calls for greater transparency

InfoWorld has posted a response to the Salon blog post that I blogged about yesterday (Skype cooperation with law enforcement and privacy policy weasel words), arguing that the post was inflamatory and designed to "push all the paranoia buttons". (See: Microsoft-Skype snooping accusations push all the paranoia buttons | Cringely - InfoWorld.)

The conclusion of the InfoWorld post echoes that of the Slate post and my own post:

What Microsoft should do is issue a transparency report similar to the ones released recently by Google and Twitter, detailing the many requests it receives for user data from various and sundry government authorities. It should also officially publish the guidelines authorities must follow in order to request information, as well as what types of data are available and how long they are retained. That document [PDF] was made available via a leak to Cryptome.org and is now four years old; I'd like a fresh copy, please.

That would be one way to dispel the notion that Microsoft is the evil bogeyman -- at least, more evil than all the other bogeymen. But it won't make for a very sexy headline.

It is about transparency. As I said yesterday, "Transparency/clarity = good. Weasel words = bad".

If Microsoft and Skype aren't clear about their abilities and their practices, people will make assumptions and they'll assume the worst. If calls for transparency are evaded, it's even worse.

Skype cooperation with law enforcement and privacy policy weasel words

Ryan Gallagher at Slate's Future Tense blog asks whether Skype can intercept VOIP conversations and whether they provide such content to law enforcement. What's more troubling is how evasive Microsoft/Skype appears to be when asked a direct question:

But when I repeatedly questioned the company on Wednesday whether it could currently facilitate wiretap requests, a clear answer was not forthcoming. Citing “company policy,” Skype PR man Chaim Haas wouldn’t confirm or deny, telling me only that the chat service “co-operates with law enforcement agencies as much as is legally and technically possible.”

The post refers to the Skype privacy policy, which appears clear but is really sketchy:

Under Section 3 of the privacy policy, it is stated that Skype or its partners “may provide personal data, communications content and/or traffic data to an appropriate judicial, law enforcement or government authority lawfully requesting such information.” It also notes that instant messages sent over Skype will be stored for a maximum 30 days “unless otherwise permitted or required by law.”

Note the use of "lawfully requesting such information". There's a very real difference between a lawful request and a lawful demand. We have in our Canadian Criminal Code the following section:

Power of peace officer

487.014 (1) For greater certainty, no production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.

In Canada, the police are permitted to ask, lawfully, in circumstances where they have no court order or production order, and therefore can't legally compel the information. (As an aside, I have seen on many, many occasions in my practice "request letters" from law enforcement that use this section as their "lawful authority" to demand information from service providers. Most service providers read this as a legally-enforceable demand that can't be declined.)

Skype isn't alone in this .... many other privacy policies use this sort of language which reserves to the operator the discretion of whether they'll require legal process that compels the production of information.

Transparency/clarity = good. Weasel words = bad.

See: Skype won't comment on whether it can now eavesdrop on conversations.

Infographic: What social networks know about you

Mashable has a nice, big infographic about "What Social Networks Know About You". I haven't had a chance to really dig into it, but what's probably most remarkable is that only one (Pandora) shares any of your information with marketers or outside organizations (other than when required by law, presumably).

Many people, when they see an ad on a social network assume, wrongly, that their info has been shared with the company whose products are being advertised. That's generally not the case at all.

Check it out: See: Here's What Social Networks Know About You.