Privacy regulators must tackle surveillance

U.S. can tap our phones and Internet

As the near-weekly revelations of pervasive surveillance activities generate both debate and mounting opposition in the United States and Europe, the Canadian reaction has remained somewhat muted. After an initial flurry of coverage over the surveillance activities of Canadian intelligence agencies, the issue has largely disappeared despite evidence Canadian data is regularly collected by foreign intelligence agencies, notably the U.S. National Security Agency.

Interestingly, the battle over the potential entry of Verizon into Canada might have opened the door to greater public scrutiny of the privacy practices of all telecom carriers. The debate unexpectedly features a privacy and surveillance dimension, with the incumbents and their unions raising fears about the link between Verizon and U.S. surveillance.

Verizon might raise privacy concerns, but it is worth asking whether the Canadian carriers can provide assurances that Canadian phone and Internet activity is any less prone to surveillance. The major Canadian carriers have been very secretive about many of these issues. A recent University of Toronto report found none issues transparency reports informs users about data requests, states where data is routed and stored or avoids U.S. routing.

The extensive U.S. surveillance programs appear to capture just about all communications: everything that enters or exits the U.S., anything involving a non-U.S. participant, and anything that travels through undersea cables.

This would seem to leave Canadian cellphone and Internet users at a similar risk of surveillance regardless of the nationality of the carrier and suggests that Canadian companies might be facilitating surveillance of their customers by failing to adopt safeguards that render it more difficult for foreign agencies to access data.

For example, both Bell and Rogers link their email systems for residential customers to U.S. giants, with Bell linked to Microsoft and Rogers linked to Yahoo. In both cases, the inclusion of a U.S. email service provider might allow for U.S. surveillance of Canadian email activity. While the Canadian privacy commissioner previously dismissed concerns associated with using U.S. email providers on the grounds that Canada had similar security laws, the new surveillance revelations suggest that a re-examination of that conclusion may be warranted.

The issue of avoiding U.S. routing is particularly important since even Canadian domestic communications that travel from one Canadian location to another might still transit through the U.S. and thus be captured by U.S. surveillance. Despite these risks, Bell requires other Canadian Internet providers to exchange Internet traffic outside the country at U.S. exchange points, ensuring that the data is potentially subject to U.S. surveillance.

Add in the regular surveillance demands for the email traffic that passes through BlackBerry’s Waterloo-based servers and the likely interception of communications traffic through several undersea cables that enter Canada, and there is little doubt that Canadian Internet and phone use is subject to significant U.S. surveillance activity.

Given these privacy risks, it is surprising that Canadian privacy regulators (which for telecom issues includes both the Office of the Privacy Commissioner of Canada and the Canadian Radio-television and Telecommunications Commission) have remained largely on the sidelines as the surveillance revelations mount. Responsibility for oversight of Communications Security Establishment Canada (the Canadian equivalent of the U.S. NSA) might fall to the CSEC commissioner. However, the role of the private sector in facilitating surveillance activities sits squarely within the mandate of the privacy commissioner, while the CRTC has a clear role on telecom privacy concerns.

All companies have an obligation under Canadian privacy law to adopt minimally invasive practices, yet the use of foreign service providers or network routing that increases the likelihood of surveillance might run afoul of that obligation.

With audit powers and the right to launch investigations, it is time for privacy regulators to proactively address whether Canada’s telecom companies should be doing more to protect their customers from foreign surveillance.