OPC finds LSAT fingerprinting violates PIPEDA

In a preliminary letter to the complainant, the Office of the Privacy Commissioner of Canada has concluded that the Law School Admissions Council violates PIPEDA by requiring candidates to submit to fingerprinting at the time the LSAT test is taken:

CIPPIC News « CIPPIC

In a decision released earlier this month, the Privacy Commissioner of Canada found that the requirement for Canadian students to provide a finger/thumb print in order to take the Law School Admission Test (LSAT) is an unnecessary infringement of privacy.

Copy of letter decision sent to Complainant

One of the most interesting aspects of the letter is the conclusion that the non-profit LSAC is engaged in commercial activities sufficient to have PIPEDA apply in the first place.

Also, the Assistant Commissioner's conclusion turned on the four point test applied in the past to video surveillance:

• Is the measure demonstrably necessary to meet a specific need?
  
• Is it likely to be effective in meeting that need?
  
• Is the loss of privacy proportional to the benefit gained?
  
• Is there a less privacy-invasive way of achieving the same end?

Cleanse or secure your electronics before crossing the border

Over the past weeks, I've done a lot of travelling. First to Geneva and then to the US. On both occasions, I had to be very mindful of what information I have on my laptop and my USB drives, since I am subject to the Personal Information International Disclosure Protection Act.

This new law prohibits the export of personal information by Nova Scotia public bodies and their service providers. As a lawyer to a number of public bodies and an instructor at Dalhousie Law School, my laptop an blackberry are subject to those laws. Since I didn't want to go to the bother of asking the chief executive of each public body I work for wheter I had one-off permission to take their data with me (and since I wouldn't need their data on the road), I had to delete all traces of such personal information from my portable electronics.

While this is a concern for public bodies in Nova Scotia and their service providers, it's also a concern for anyone who is crossing the border into the United States as increasingly customs officers are scrutinizing laptops at the border.

Bruce Schneier, who always has interesting things to say, has an article in the Guardian on how to secure your laptops if you're taking them into the US. It's a good read and probably something to bookmark to read next time you're crossing the frontier: Read me first: Taking your laptop into the US? Be sure to hide all your data first Technology The Guardian.

First stats on National Security Letters

According to EPIC, the first public reporting on National Security Letters has been released, showing over twelve thousand NSLs were issued in 2006.

FISA Orders Up, Government Reporting on National Security Letters Begins. According to the 2007 FISA report (broken link), the Foreign Intelligence Surveillance Court approved 2,370 application to conduct electronic surveillance and physical searches in the United States in 2007, up from 2,176 applications approved in 2006. For the first time, the report includes information regarding the total number of requests made by the Department of Justice with National Security Letter authority for information concerning U.S. persons. in 2006, the government made approximately 12,583 NSL requests for information concerning 4,790 U.S. persons. The 2007 NSL statistics are expected later this year. (May 1)

Does the SWIFT incident expose PIPEDA's loopholes?

IT Business is running an article entitled SWIFT scandal exposes PIPEDA holes, in which the Privacy Commissioner of Canada and Phillipa Lawson of the Canadian Internet Policy and Public Interest Clinic lament that PIPEDA allows the disclosure of personal information without consent in response to a foreign subpoena.

(For some background, see my previous posts on SWIFT.)

Is this a loophole or something that should be remedied? Certainly the European Union thinks that disclosing European info in this way is not OK.

I'm not sure there is really anything that can be done about this, other than to keep data out of jurisdictions with laws that you consider offensive. Certainly, we have seen that the EU and some Canadian provinces think that the USA Patriot Act is overbroad and a threat to privacy. Unlike some public sector laws in Canada, PIPEDA is completely silent with respect to the export of personal information. But if data is in a jurisdiction with a lawful power to compel the production of that information, the practical impact of a foreign law is virtually nil. Particularly if the foreign law is as toothless as PIPEDA.

Practically speaking, the solution is really to keep those data warehouses out of those jurisdictions. While SWIFT is a European outfit, they had a data centre in the US that was within the lawful jurisdiction of the US authorities armed with subpoenas. As an international clearing system, it would obviously have to transmit some data back and forth between HQ and the US. But there doesn't seem to be any compelling argument to suggest that all that data should have been kept there.

Canada, with it's European-accepted privacy laws, would have been an ideal place to locate the SWIFT data centre. Miliseconds from New York and Brussels, but a world away from the US as far as privacy laws go. Any international company doing business with personal information in the United States really should think about this. What SWIFT did may have been completely lawful in the US, but it certainly has caused more than its fair share of headaches and has opened it up to potential liability in the EU.

US border agents given unfettered access to travelers' laptops

A US Federal Appeals Court has overruled a lower court ruling that had previously restricted laptop searches at the border. The 9th Circuit Court of Appeals, in a unanimous three judge ruling, held that border agents do not need any probable cause to rummage through portable electronics.

Border Agents Can Search Laptops Without Cause, Appeals Court Rules Threat Level from Wired.com

... Federal agents at the border do not need any reason to search through travelers' laptops, cell phones or digital cameras for evidence of crimes, a federal appeals court ruled Monday, extending the government's power to look through belongings like suitcases at the border to electronics.

The unanimous three-judge decision reverses a lower court finding that digital devices were "an extension of our own memory" and thus too personal to allow the government to search them without cause. Instead, the earlier ruling said, Customs agents would need some reasonable and articulable suspicion a crime had occurred in order to search a traveler's laptop.

On appeal, the government argued that was too high a standard, infringing upon its right to keep the country safe and enforce laws. Civil rights groups, joined by business traveler groups, weighed in, defending the lower court ruling.

The 9th U.S. Circuit Court of Appeals sided with the government, finding that the so-called border exception to the Fourth Amendment's prohibition on unreasonable searches applied not just to suitcases and papers, but also to electronics.

Via Boing Boing.

Previously: Canadian Privacy Law Blog: Crossing the border? Consider the possibility of laptop searches, Canadian Privacy Law Blog: Your papers and laptops, please?, Canadian Privacy Law Blog: US Customs confiscating laptops.

Google introduces Google Web History

I don't envy Google these days. (Other than for the fact that they net a billion dollars in the first quarter of '07.) Many of their incredibly popular services depend upon knowing their users and in many cases being knowing them on a one-on-one basis. Because their slice of the web is growing, there are concerns out there that the aggregated databases of user information may be misused.

One of the newest services will probably be the most controversial: Google Web History tracks all your surfing and all your searches. You can easily go back to that website you visited two weeks ago but forgot the address, and you can analyze the trends in your browsing. That's a convenience. At the same time, every website you've visited and each search you've done will be very strongly linked to you and will be hosted in the United States. This means that it will be available to be handed over to law enforcement under the USA Patriot Act and other statutes. It may also be available to your spouse's divorce lawyer armed with a subpoena. Or is just there to be hacked into.

This may be very convenient and appealing for a lot of users, but people need to think carefully about the risks of having someone else host this highly personal data ....

Official Google Blog: Your slice of the web

Your slice of the web

Thursday, April 19, 2007 at 4:23:00 PM

Posted by Payam Shodjai, Product Manager for Personalization

I'll probably visit more than 100 web pages today, and so will hundreds of millions of people. Printed and bound together, the web pages you'll visit in just one day are probably bigger than the book sitting on your night table. Over the next month alone, that's an entire bookcase full! The idea of having access to this virtual library of information has always fascinated me. Imagine being able to search over the full text of pages you've visited online and finding that one particular quote you remember reading somewhere months ago. Imagine always knowing exactly where you saw something online, like that priceless YouTube video of your friend attempting to perform dance moves from a bygone age. Better yet, imagine having this wealth of information work for you to make searching for new information easier and faster.

Today, we're pleased to announce the launch of Web History, a new feature for Google Account users that makes it easy to view and search across the pages you've visited. If you remember seeing something online, you'll be able to find it faster and from any computer with Web History. Web History lets you look back in time, revisit the sites you've browsed, and search over the full text of pages you've seen. It's your slice of the web, at your fingertips.

How does Web History work? All you need is a Google Account and the Google Toolbar with PageRank enabled. The Toolbar, as part of your browser, helps us associate the pages you visit with your Google Account. If you're currently a Search History user, you'll notice that we've renamed Search History to Web History to reflect this new functionality. To sign up for Web History, visit http://www.google.com/history.

US Patriot Act deters Canadians from Google service

I was interviewed last week by Out-Law.com, a service of UK firm Pinsent Masons, for an article on the recent stories out of Canadian universities about hesitation to use Google's services due to USA Patriot Act concerns. See: US Patriot Act deters Canadians from Google service OUT-LAW.COM.

Out-law also has a weekly podcast that featured this story, which includes portions of my interview. See: High quality recording (10MB, 12 minutes) or Low quality recording for 27/03/2008 (2MB, 12 minutes).

The Canadian Response to the USA Patriot Act

I was recently invited to contribute an article to the IEEE Security & Privacy magazine on the Canadian response to the USA Patriot Act. Here's the abstract:

The Canadian Response to the USA Patriot Act

Since the attacks of September 11, 2001, US authorities have spent untold millions of dollars guarding their frontiers to regulate what gets into the country. On the other side of the border, many Canadian jurisdictions have turned their thoughts to regulating what information flows southward into the US. This isn't out of concern about terrorism but rather about the US response to it.

Citation: David Fraser, "The Canadian Response to the USA Patriot Act," IEEE Security and Privacy, vol. 5, no. 5, pp. 66-68, Sept/Oct, 2007

I think I reserved the right to publish the article on the blog after the publication by IEEE, but I'll have to track down that release .... stay tuned.

Librarians to talk about Patriot Act challenge in Vermont

Seven Days, the Vermont alternative web weekly is running a preview of a presentation to be given by Peter Chase and George Christian later this month. Both are librarians who were on the receiving end of national security letters under the USA Patriot Act and fought them with the assistance of the ACLU.

If I get my hands on the presentation materials, I'll post them here.

Seven Days: Librarians, No Longer Gagged, Detail Patriot Act Abuses

WINDSOR, CT — In September 2003, then-U.S. Attorney General John Ashcroft ridiculed the American Library Association for its “breathless reports and baseless hysteria” about a USA PATRIOT Act provision that allows FBI agents to search library records without a warrant. Until he left office in early 2005, Ashcroft repeatedly denied that the feds were snooping into Americans’ reading habits and computer activities.

In July 2005, Peter Chase and George Christian discovered firsthand that Ashcroft was lying. They couldn’t tell anyone, though — not friends, co-workers or family members — even as Congress debated the Patriot Act’s reauthorization.

Christian is executive director of the Library Connection, a nonprofit consortium in Windsor, Connecticut. Chase is president of the group’s executive committee and director of one of its 27 member libraries. An eight-month gag order prevented them from disclosing that they’d received a “national security letter” from the FBI seeking confidential library computer records.

“We were shocked,” Chase recalls. “None of us had ever heard of a national security letter before.”

....

Chase and Christian, along with fellow committee members Barbara Bailey and Janet Nocek, decided to fight the warrantless search. Though the librarians were never told why the FBI wanted their files, a federal prosecutor later disclosed that it was a matter of “domestic surveillance.”

The Connecticut librarians have since been released from their gag order. On March 20, they’ll speak at the University of Vermont about how they fought the Patriot Act — and won. Civil libertarians say their case is a chilling example of the threats to privacy rights in the post-9/11 era.

“My initial twinge in opposing [the FBI] was that I was aiding and abetting a catastrophe,” recalls Christian. “But right away, I could glean that they weren’t worried that someone was going to cause a catastrophic event tomorrow.” The letter, he notes, was dated two months earlier, and the records the FBI wanted were six months old. In Connecticut, as in 47 other states, library records are protected by law.

Vermont’s own protections for library records aren’t as strong as those in other states, notes Trina Magi, who chairs Vermont’s Intellectual Freedom Committee. Though library records are exempt from the open-records law, she says, nothing explicitly prevents librarians from disclosing them. Moreover, last year’s Patriot Act reauthorization did nothing to alleviate librarians’ concerns.

“What people read at libraries is confidential,” Chase argues. “People should feel free to come to the library and look up whatever information they need, without thinking that Big Brother is looking over their shoulder.”

In August 2005, the Connecticut librarians sued the federal government, with help from the ACLU. Initially, they were collectively known as “John Doe.” However, because of sloppy redacting of court records by government attorneys, Christian’s and Chase’s identities were made public, and reporters soon came calling.

...

Even after the librarians’ names were known, the gag order still barred them from discussing their case. Those restrictions reached absurd proportions. When the government asserted that the librarians’ presence in federal court in Bridgeport raised a “national security issue,” they had to watch the proceedings on closed-circuit TV from a locked courtroom in Hartford. When an appeal was heard in federal court in Manhattan, the librarians were allowed to attend but were prohibited from entering the courtroom together, sitting together, speaking to each other, or making eye contact with their attorneys.

Tellingly, the librarians were released from the document request and gag order shortly after the Patriot Act was reauthorized in March 2006. Once the government dropped its appeal, the librarians lost their legal standing to challenge the statute’s constitutionality.

Today, Christian is troubled by how many Americans have apparently complied with NSL requests. “I’m trying to figure out in my mind how 30,000 NSLs can be issued each year,” he says, “and in five years only two people have said, ‘I don’t think so.’”

Peter Chase and George Christian give a lecture titled "Gagged by the Government: Two Librarians Tell How They Resisted the USA PATRIOT Act." Tuesday, March 20, 3:30-5 p.m. Bailey Howe Library, University of Vermont. Free. Info, 656-5723.

US DOJ audit discloses abuses of National Security Letter powers

This probably isn't a big surprise to a lot of people, but I'm surprised to see it publicly disclosed:

Mueller Admits Fault in FBI Intrusions

Mar 9, 8:33 PM EST

By LARA JAKES JORDAN

Associated Press Writer

WASHINGTON (AP) -- The nation's top two law enforcement officials acknowledged Friday the FBI broke the law to secretly pry out personal information about Americans. They apologized and vowed to prevent further illegal intrusions.

Attorney General Alberto Gonzales left open the possibility of pursuing criminal charges against FBI agents or lawyers who improperly used the USA Patriot Act in pursuit of suspected terrorists and spies.

The FBI's transgressions were spelled out in a damning 126-page audit by Justice Department Inspector General Glenn A. Fine. He found that agents sometimes demanded personal data on people without official authorization, and in other cases improperly obtained telephone records in non-emergency circumstances.

The audit also concluded that the FBI for three years underreported to Congress how often it used national security letters to ask businesses to turn over customer data. The letters are administrative subpoenas that do not require a judge's approval.

"People have to believe in what we say," Gonzales said. "And so I think this was very upsetting to me. And it's frustrating."

"We have some work to do to reassure members of Congress and the American people that we are serious about being responsible in the exercise of these authorities," he said.

Under the Patriot Act, the national security letters give the FBI authority to demand that telephone companies, Internet service providers, banks, credit bureaus and other businesses produce personal records about their customers or subscribers. About three-fourths of the letters issued between 2003 and 2005 involved counterterror cases, with the rest for espionage investigations, the audit reported.

...

FBI Director Robert S. Mueller said many of the problems were being fixed, including by building a better internal data collection system and training employees on the limits of their authority. The FBI has also scrapped the use of "exigent letters," which were used to gather information without the signed permission of an authorized official.

...

The American Civil Liberties Union said the audit proves Congress must amend the Patriot Act to require judicial approval anytime the FBI wants access to sensitive personal information.

...

Both Gonzales and Mueller called the national security letters vital tools in pursuing terrorists and spies in the United States. "They are the bread and butter of our investigations," Mueller said.

...

In 2000, for example, the FBI issued an estimated 8,500 requests. That number peaked in 2004 with 56,000. Overall, the FBI reported issuing 143,074 requests in national security letters between 2003 and 2005.

But that did not include an additional 8,850 requests that were never recorded in the FBI's database, the audit found. A sample review of 77 case files at four FBI field offices showed that agents had underreported the number of national security letter requests by about 22 percent.

Additionally, the audit found, the FBI identified 26 possible violations in its use of the letters, including failing to get proper authorization, making improper requests under the law and unauthorized collection of telephone or Internet e-mail records.

The FBI also used exigent letters to quickly get information - sometimes in non-emergency situations - without going through proper channels. In at least 700 cases, these letters were sent to three telephone companies to get billing records and subscriber information, the audit found.

---

On the Net:

The report is at: http://www.usdoj.gov/oig/reports/FBI/index.htm

Justice Department: http://www.usdoj.gov

FBI: http://www.fbi.gov

Crossing the border? Consider the possibility of laptop searches

As March Break is almost in full swing, it's timely to read Compterworld's recent 5 things you need to know about laptop searches at U.S. borders. State sovereignty usually means that a country has total control over who and what gets in and traditional searches are being extended to laptop searches. This makes sense on one level but seems futile as any traveller can upload ilicit digital content before crossing into the US and then download it on the other side of the border.

But searches are happening, so make sure you delete from your computer all content that you wouldn't want disclosed as part of such a search. Lawyers should particularly remove any privileged content they don't need to be taking with them. And if you're a public servant from BC, Alberta or Nova Scotia, you can't take it with you thanks to the USA Patriot Act blocking legislation in your province.

Recruiting software company sets up data centre in Canada to address Patriot Act concerns

This is the first public announcement of the establishment of a data centre in Canada in response to privacy concerns about data being hosted in the United States:

Cytiva Responds to Canadian Privacy Concerns With New Canadian Data Centre: Financial News - Yahoo! Finance

Wednesday February 7, 9:00 am ET

New Data Centre Helps Canadian Employers Comply With Privacy Laws and Addresses Concerns About the United States Patriot Act

VANCOUVER, BC--(MARKET WIRE)--Feb 7, 2007 -- Cytiva Software Inc. (CDNX:CRX.V - News), a leading provider of on-demand recruiting software solutions, announced today the establishment of a new data centre located in Burnaby, BC.
This new data centre provides Canadian clients of Cytiva's SonicRecruit recruiting software with assurance that their candidate and employee data will remain in Canada. This is important news for Canadian companies trying to comply with privacy laws. A growing number are concerned about their employee data being subject to a United States Patriot Act that lessens requirements for government seizure of personal data in U.S. territories.

Because of the Personal Information Protection and Electronic Documents Act (PIPEDA), and other provincial privacy laws, Canadian companies that use software from U.S. companies to manage their recruiting and other human resource processes face a complicated landscape in trying to protect employee data. When employee data is transferred outside of Canada to U.S. servers that run on-demand human resources software, the issue becomes even more complicated. This data may become subject to the United States Patriot Act, which supersedes PIPEDA inside the U.S.

Canadian privacy laws are some of the most stringent in the world and have been evolving rapidly over the last ten years. All this has compelled many Canadian companies to require that their customer and employee data stay in Canada.

"Some vendors walk away from Canadian business, while others try and deal with the issue through contractual language regarding privacy," said Jason Moreau, president and CEO of Cytiva Software. "But Cytiva recognizes how important an issue this is to Canadian companies, so we have taken the extra step of establishing a data centre on Canadian soil."

The Burnaby BC data centre provides state-of-the-art security, network access, climate control and power backup.

Cytiva announces the establishment of the Canadian data centre a few months after implementing a host-based Intrusion Protection System (IPS) which goes beyond mere firewalls or detection systems and provides the highest level of data protection available.

"With the Intrusion Protection System and the option of local hosting for our Canadian clients, Cytiva sets the standard for privacy and data protection for on-demand recruiting software," says Moreau. "We believe that all companies should expect this level of protection."

About Cytiva Software Inc.

Cytiva Software Inc. (CDNX:CRX.V - News) provides innovative recruiting software and services to mid-sized and Fortune 500 companies. More than an application, its flagship talent acquisition product, SonicRecruit, allows corporations to screen applicants, automate their recruiting departments, customize their corporate career sites and hire great people. This premier applicant tracking system improves recruiting effectiveness, speeding up the hiring process and reducing cost per hire. For more information, visit http://www.sonicrecruit.com

The TSX has not reviewed and does not accept responsibility for the accuracy or adequacy of this news release, which has been prepared by management.

Distributed by Filing Services Canada and retransmitted by Market Wire

EU parliament debates personal data rules in wake of SWIFT scandal

In the wake of the SWIFT privacy scandal, the European parliament will be debating the scandal, European data protection laws and broader issues of access to personal data. Should be interesting to watch:

theparliament.com - EU parliament debates personal data rules

EU parliament debates personal data rules

MEPs are this week expected to intensify pressure on the European commission to act over the controversial Swift case.

In November, an independent panel found that the Belgian-based money transfer company Swift had breached EU privacy laws by secretly giving personal financial data to the US authorities.

Swift denied breaking the law, saying it was subpoenaed to give limited data for use in the fight against terrorism.

On 31 January, in the first Brussels parliamentary plenary of the year, deputies will debate the issue of current personal data legislation and table a series of questions to the commission on the Swift case.

Included in the list of questions is a demand to know whether the commission is aware of any other requests to private companies to make their data available to the US.

MEPs also want to know what action the commission intends to take given that access to data handled by Swift makes it possible to get information on the economic activities of individuals and businesses.

The ongoing row involving Swift, which handles 11 million transactions a day, could further exacerbate tensions between the EU and the US over the use of personal flight data in the fight against terrorism.

The EU and US recently resolved a long-running dispute over the issue and is confident of reaching an agreement on passenger name records (PNR).

US negotiator Michael Chertoff and his EU counterpart Wolfgang Schauble said at the weekend that despite continued differences of opinion on the use of the personal data they were confident of reaching a deal by July.

Some MEPs, however, are currently raising concerns which they would like the commission to take on board when the executive alone negotiates a new agreement with the US.

The plenary, though, will be urged by British Conservative MEP Timothy Kirkhope to back the deal brokered by the EU and US.

"Some of these concerns are warranted but the most important thing to adopt are appropriate air safety and anti-terrorism measures and provide certainty for the airlines, while also ensuring that data protection norms are respected,” Kirkhope said.

Tracked in America

The American Civil Liberties Union, along with a coalition of civil liberties groups, has put up an interesting web site with stories of state surveillance in America, from pre-WWI to post 9/11. Check it out: Tracked in America.

Publicity for Nova Scotia's Patriot Act blocker

Nova Scotia's Personal Information International Disclosure Protection Act has kept a pretty low profile as of late, but the Halifax Chronicle Herald has devoted a quarter page in its technology supplement to the legislation. It includes a fair amount of content provided by yours truly, but may have the effect of making Nova Scotians more aware of this important development.

Click on the image to download the article in PDF format.

Bush administration to seek warrants for terrorism investigation wiretapping

In what appeas to be a significant retreat from its previous position, the Bush administration is reportedly going to turn to the Foreign Intelligence Surveillance Court to remove the word "warrantless" from the controversial warrantless wiretapping program. AP, via ABC News: Secret Court to Govern Wiretapping Plan.

Law enforcement access to e-mail in the US

Today's Washington Post is running an interesting article on the unique legal regime in the US related to law enforcement / intelligence access to e-mail stored by third parties. A bit ...

The Legal Tangles Of Data Collection - washingtonpost.com

... E-mail is a slightly different matter. The law makes a distinction between intercepting e-mail in transit and obtaining stored e-mail from a service provider's servers. The distinction made sense in the 1980s and early 1990s when downloaded e-mail often sat only on the user's computer. If the government wanted the records, it had to go to the e-mail recipient.

These days, most e-mail is held and stored by third parties. So the government claims the authority to read someone's most intimate communications, including stored chat sessions, by serving a subpoena -- no probable cause required. A person may never even know that this has been done, as there is no legal requirement for an Internet service provider to provide notice. In most cases where the government subpoenas the e-mail, it demands that the third party keep that fact confidential, at least for a while.

The same holds true for virtually any information held by a third party: phone company records that indicate who called you, when they called and how long the call lasted; Internet service provider records on what Web sites you visited, when and for how long; tollbooth records; security camera footage; records of emergency calls made from a car; supermarket purchase records. All that and more can be requested by the government with a search warrant, or sometimes with an administrative subpoena or other demand, frequently without judicial review....

New video on National Security Letters and the US Constitution

The US Bill of Rights Defence Committee has produced a two-part video on National Security Letters under the USA Patriot Act. There are additional materials on their website: FBI Unbound: How National Security Letters Violate Our Privacy

Military and CIA seeking access to financial info of US residents

The New York Times, always on the leading edge of reporting in this area, is reporting that US military intelligence is expanding its role in domestic intelligence gathering. It, and the CIA, have been using non-compulsory letters to get access to financial information on residents of the United States. Perhaps more troubling from a privacy point of view is that most recipients of these letters volunteer the info. Check it out: Military Is Expanding Its Intelligence Role in U.S. - New York Times.

In related news, changes to an American army manual have raised concerns that the Army also takes the position that warrants are not required for domestic wiretapping. See: Deletions in Army Manual Raise Wiretapping Concerns - New York Times.

Update (20070114): On Fox News Sunday, VP Dick Cheney says the practice isn't illegal:

Cheney: Credit checks aren't illegal - Yahoo! News

"The Defense Department gets involved because we've got hundreds of bases inside the United States that are potential terrorist targets," Cheney said.

"The Department of Defense has legitimate authority in this area. This is an authority that goes back three or four decades. It was reaffirmed in the Patriot Act," he said. "It's perfectly legitimate activity. There's nothing wrong with it or illegal. It doesn't violate people's civil rights."

The Pentagon and the CIA, to a lesser extent, have used this little-known power, officials said. The
FBI, the lead agency on domestic counterterrorism and espionage, has issued thousands of such letters since the attacks of Sept. 11, 2001.

Government moving to access personal info, sparking privacy fears

The CBC has a lengthy piece on the quiet consultation I referred to the other day (Canadian Privacy Law Blog: Public Safety Canada Quietly Launches Lawful Access Consultation):

Government moving to access personal info, sparking privacy fears

Government agencies are moving to gain access to telephone and internet customers' personal information without first getting a court order, according to a document obtained by CBCNews.ca that is raising privacy issues.

Public Safety Canada and Industry Canada have begun a consultation on how law enforcement and national security agencies can gain lawful access to customers' information. The information would include names, addresses, land and cellphone numbers, as well as additional mobile phone identification, such as a device serial number and a subscriber identity module (SIM) card number.

The consultation also seeks input on access to e-mail addresses and IP addresses. An IP address is a number that can be used to identify a computer's location.

The document says the objective of the consultation is to provide law enforcement and national security agencies with the ability to obtain the information while protecting the privacy of Canadians.

The document says that under current processes, enforcement agencies have been experiencing difficulties in gaining the information from telecommunications service providers, some of which have been demanding a court-issued warrant before turning over the data.

"If the custodian of the information is not co-operative when a request for such information is made, law enforcement agencies may have no means to compel the production of information pertaining to the customer," the document says. "This poses a problem in some contexts."

It says enforcement agencies may need the information for matters other than probes, such as informing next-of-kin of emergency situations, or because they are at the early stages of an investigation.

"The availability of such building-block information is often the difference between the start and finish of an investigation," according to the document.

Privacy advocates, however, expressed displeasure over both the content and the process of the consultation.

Criticizes short consultation time

Michael Geist, chair of internet and e-commerce law at the University of Ottawa, said the process is not being conducted publicly as two previous consultations have been, in 2002 and in 2005.

The consultation has not been published in the Canada Gazette, where such documents are normally publicized, or on the agencies' websites.

Interested parties have been given until Sept. 27 to submit their comments, which is a short consultation time, Geist said. Several organizations and individuals contacted by CBCNews.ca only received their documents this week.

More pointedly, a number of parties that took part in the previous consultations, including privacy and civil liberty advocates — and even some telecommunication service providers — have not been made aware of the discussion, he said.

"It's really disturbing particularly in light of the fact that they've had two prior consultations on lawful access in the past, so it's not as if they don't know the parties that are engaged on this issue," Geist said.

Officials with the Canadian Civil Liberties Association were not aware of the consultation.

All about appearances?

Jacqueline Michelis, an Ottawa-based spokeswoman at Bell Canada Inc., the country's largest telecommunications provider, said the company was aware of the consultation but would not comment further. Rogers Communications Inc. and Telus Corp., the country's next biggest providers, did not have immediate comment.

Geist said the other problem with the consultation is that it appears as if the government agencies have already made up their minds on how to proceed and are simply conducting it for appearances' sake.

"The fear is that law enforcement knows what it would like to do — it would like to be able to obtain this information without court oversight — and so it has pulled together this consultation in the hope that they can use that to say they have consulted, and here are the safeguards that the consultation thought was appropriate."

Denies document secrecy

Mélisa Leclerc, a spokeswoman for Public Safety Minister Stockwell Day, said the government was not trying to keep the consultation secret and would post the document on the internet on Thursday. The deadline for submissions would also be extended, although no decision on a date has been made yet.

Colin McKay, a spokesman for the privacy commissioner of Canada, said the government agencies have not yet proven that accessing information without a court order is necessary. The commissioner will be making a submission to the consultation on that matter.

"We'd like to see some proof that this is a necessary step because at the moment there is provision in privacy law if necessary and if presented with a legal authority to do it, in most cases that's a court order," McKay said. "That gives Canadians some level of protection."

The Information Technology Association of Canada, which will also be making a submission, agreed and said it would like to see details on instances where telecommunication providers have refused to co-operate with authorities.

"This is about transposing to new technology the same kind of law enforcement we used to have on wire-line phone networks," said Bernard Courtois, president and chief executive officer of ITAC. "Conversely, just because you're going to do law enforcement on new technology people should not lose any of their privacy protection or rights in terms of the nature of investigation."

Canada's move is in contrast to one by the United States, where last week a federal judge overturned a part of the Patriot Act that allowed the Federal Bureau of Investigation to secretly obtain personal records about customers from internet providers, phone companies, banks, libraries and other businesses without a court's permission.

Speaking on the phone from Paris, Peter Fleischer, global privacy counsel for internet search giant Google Inc., told CBCNews.ca that even in the security-conscious United States, courts have moved to curtail excessive attempts by the government at extracting personal information.

A year and a half ago, the Department of Justice obtained a warrant demanding Google turn over users' personal information as part of an investigation into the effectiveness of anti-pornography software that was being tested. Google refused and a judge ending up siding with the company.

"The order we had from the U.S. Department of Justice was a valid legal order under the U.S. legal system, but even then it was excessive and infringed privacy, and was curtailed by a U.S. court when we challenged it," Fleischer said.

Companies operating in Canada, and their customers, should have the same rights here, he said.

"There should be judicial authorization and a valid legal process before a government should be able to compel companies to hand over information about their users."

Ironically, Google on Wednesday came under fire from Privacy Commissioner Jennifer Stoddart for its Street View web photo application. The commissioner said many of the images used by the application could break Canada's privacy laws.

Fleischer would not comment on the matter, but said he would address it when he visits Canada later this month.