The Information Policy Blog

The (unofficial) blog of the BCLA Information Policy Committee

Tag Archives: edward snowden

Elizabeth Denham and Terms & Conditions May Apply – #MDD2013

Media Democracy Days 2013 was this past weekend in Vancouver and I was glad to be able to attend. In the IPC we’d talked a couple of months ago about trying to get together a screening of the film Terms & Conditions May Apply, and were happily pre-empted from that by the Media Democracy Project showing the movie at the Cinematheque on Friday night. Thanks

Before showing the movie though, Elizabeth Denham talked to the audience about her role as Information and Privacy Commissioner for the province of BC. It was a good talk, which highlighted some of the important reasons citizens should be concerned about their lack of privacy and how their rights are being protected.

Her main themes were transparency and accountability and how those principles are necessary for a democratic government to function. “Sunlight is the best disinfectant” was one of the phrases she used. This led into a discussion of how every scandal one can think of in government has an Access to Information angle to it. It’s the perception of secrecy by those people in power that messes everything up, because an informed citizenry knows you shouldn’t just rely on the goodwill of the folks making up whatever government is in power at any given time.

One of the things she discussed was how new democracies are so much better at enshrining laws about transparency and privacy regulation than older, more established democracies. When a country makes a constitution now, privacy rights are clearly seen as fundamental and get strong wording to protect them (in theory – she didn’t provide any specific examples).

The biggest concern Denham had for the future was the complacency of our citizens on privacy and transparency issues. keep these issues of privacy in the front of people’s minds. Even though no Canadian Snowden has dropped a bunch of CSEC powerpoint presentations in our laps there should still be a deep concern about the systematic collection of our personal data. Denham encouraged the audience to advocate and politicize this issue, and really, that’s something that librarians have every opportunity to do.

There is a real divide out there between people who have the technical knowledge to deal with privacy invasions and the people without that knowledge. We are out there working with people and their information habits every day. We need to be using the goodwill we create to try to correct the imbalance between what corporations and governments know about us and what we know about them. Denham talked about how important it was to pull back the curtain enshrouding these secret decisions.

The movie

Terms & Conditions May Apply is a movie about the things we agree to when we click through End User Licensing Agreements and how much information we are giving away to be used against us later. There were interviews with people from the EFF and the ACLU as well as with people held on pre-crime charges and the British guy who was banned from entering the US because he tweeted about how he was ready to go destroy America.

The movie was completed before Snowden and his big revelations about the NSA, but there was an added-on postscript mentioning it and how much that plays into the rest of the film.

It was a good documentary. If you’ve been immersing yourself in these types of issues there wasn’t a lot of really new stuff, but there was an ambush interview of Mark Zuckerberg, which was done well and used effectively. The weirdest part was that they had Orson Scott Card talking for a few sentences. Thankfully, it wasn’t about his thoughts on homosexuality, but it was a little weird.

Breaking Cryptography Matters

This week we learned that Glenn Greenwald was not exaggerating when he said that there was more in Edward Snowden’s leaked info than we had seen thus far. It turns out the NSA (and the GCHQ, its UK equivalent) has been using many methods to attack ubiquitous encryption on the internet:

Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with “brute force”, and – the most closely guarded secret of all – collaboration with technology companies and internet service providers themselves.

Through these covert partnerships, the agencies have inserted secret vulnerabilities – known as backdoors or trapdoors – into commercial encryption software.

This is different from saying that the NSA had cracked everyone’s encryption, but it appears that they’ve been undermining everyone’s privacy and security with the complicity of major technology companies.

This is a big fucking deal.

Part of the reason is because putting in secret vulnerabilities means that dedicated non-governmental agents can find those vulnerabilities and exploit them.

There are ways to protect your security online, but seriously, if the NSA really wanted something about you (and I’m assuming here that most of this blog’s readers are Canadians, thus foreigners to the NSA and fair game for spying on their information conveniently passing through US data-centres) they can get it. From Bruce Schneier:

This kind of thing is done by its TAO – Tailored Access Operations – group. TAO has a menu of exploits it can serve up against your computer – whether you’re running Windows, Mac OS, Linux, iOS, or something else – and a variety of tricks to get them on to your computer. Your anti-virus software won’t detect them, and you’d have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget. What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it’s in. Period.

In Wired Kim Zetter lays out a bit of the history of this program, called Bullrun:

The ten-year Bullrun program began after the U.S. government failed in its pla to place a backdoor, the so-called Clipper chip, into encryption that would have allowed it to eavesdrop on communications at will. Without the Clipper chip, the government launched a systematic plan using trickery and other methods to circumvent encryption and achieved an unspecified breakthrough in 2010. In the wake of this, according to one document, “vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.”

Some of the methods involved the deployment of custom-built, supercomputers to break codes in addition to collaborating with technology companies at home and abroad to include backdoors in their products. The Snowden documents don’t identify the companies that participated.

Schneier again:

Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it’s explained away as a mistake.

We don’t have a secure internet. Major corporations have joined up with security agencies to make it that way.

One thing we can and probably should be doing as information professionals is calling for our libraries and other institutions to be using more Free and Open Source Software. These independent, community-based technologies allow us to see inside the code and make it much more difficult for nefarious shadowy agents (governmental or non-) to add in holes specifically to spy on us and our members we’re providing services to.

I work in a public library in a community that isn’t on the cutting edge of technology. For many of our members I’m the public tech support person, and people ask me about using things like online banking and whether it’s safe to do. It’s important for anyone in this kind of position to know about the tradeoffs being made by technology titans, and how we’re selling our members to companies that, even though the language of the internet is cute (“like” “friend” even “google”), those companies don’t have our members’ best interests at heart.

Schneier suggests techniques like using Tor, and encrypting communications with public-domain encryption that’s cross compatible (this makes it less likely to have been NSA compromised). These won’t keep everything you do secret from a determined, well-funded attacker, but it does make you more expensive to target.

Most members of my library probably don’t need to be paranoid about encryption. They’re looking up recipes and sending messages to their kids and reading romance novels or whatever. But our individual uses of the internet shouldn’t really matter. As Byron Holland says in his post NSA Internet surveillance where’s the outrage?:

It’s not that governments should not have the power to monitor citizens under certain circumstances and with the appropriate oversight – it’s an unfortunate necessity to maintain law and order. But we’re not talking about surveillance with appropriate oversight. We’re talking about an opaque and deliberate system to gather and monitor the activities and communications of potentially everyone who is online.

Why should a government feel it is above judicial oversight to monitor its citizens’ activities, just because they’re online?

Because apparently, we’re fine with it. At the very least, we’re complacent with it.

As information professionals we need to be aware of, and ensure our communities have the chance to be learn about the consequences of these surveillance and broken security technologies. That is our way to help fight complacency.

Open Media on Privacy and the Cloud

Catherine Hart wrote an excellent piece on privacy and storing data in the Canadian infosphere on OpenMedia:

As more and more of our personal information circulates online, is stored in ‘the cloud’, or is moved about on USBs and other portable devices, it’s essential that we make sure those data flows are secure. And as we’ve been seeing, due to a lack of safeguards they’re not secure at all when it comes to the government. Cloud services are likely more secure for both citizens and the government than carrying around USB keys or hard drives full of sensitive data (see “data breaches” below), but that increased security goes out the window when government bureaucrats recklessly use them for spying without our consent.

I tweeted it already but just wanted to stress how good a resource that post is. It’s filled with links so if you’re inclined to get lost in rabbit holes that’s an excellent place to start.

This kind of article is important because it’s not focused on the personalities involved, but the policies. Don’t get me wrong, I think we should be supporting Snowden and Manning and Swartz as people, but the issues these people brought to light are bigger even than them.

Organizational Transparency and Closed Doors

We haven’t been talking about the Library Archives Canada/Canadiana digitization project here on the IPC blog these past few weeks for a couple of reasons. The first is mostly because a lot of the discussion has been taking place on mailing lists I’m not actually on, so whenever I sit down to write I feel a bit like I’m missing some crucial context. But the bigger reason is that other people have been writing very clearly on the matter and I haven’t had anything to add.

I’d suggest that the very best piece of commentary I’ve read has been Mita Williams’ The Heritage Heritage Minute and The Digital Library of Canada We Lost. She goes through the chronology of the situation and provides a very even-handed analysis of why people have concerns about the project. Her essay is peppered with links, including to Kevin Read’s We Ask for Transparency, Heather Morrison’s explanation of why the misuse of Open Access in the leaked documents was problematic, and of course Bibliocracy (I’ll just link to Myron’s most recent post which came after Williams’ was published.

In the face of all that there’s not a lot that I would be adding. But I want to make a comment tying this together with the other big information news of the last month. The American Library Association just had one of their annual conferences and at it they passed a resolution about the NSA spying scandal saying:

that the American Library Association recognize Edward Snowden as a whistleblower who, in releasing information that documents government attacks on privacy, free speech, and freedom of association, has performed a valuable service in launching a national dialogue about transparency, domestic surveillance, and overclassification.

Interestingly, the next day that resolution was “replaced” by this resolution in which Snowden’s name was removed and the language was changed to reflect a more general support for “privacy, open government, government transparency and accountability.” In a letter to the Social Responsibilities Round Table Al Kagan said:

As progressive councilors have discussed for the past two years, it is all fine and good to support the results of whistleblowing, but this does not happen without the brave action of individuals. Whistleblowers put their jobs, their careers,their freedom, and sometimes their lives in danger by taking bold measures to bring abuse of the public trust to the media. Nothing happens without the individuals, and they need all the support that they can get.

He also called for librarians to be braver and lead discussion, rather than simply accepting backroom deals.

Libraries in general could benefit from a more open discussion of how our organizations work, especially when some members have issues with the results. Being quiet and unquestioning doesn’t help anyone improve.

access, surveillance & edward snowden

As it stands right now, there are three biggish stories going on in the information policy world right now. As is usual with the IPC, access to information is our unifying thread.

First the World Intellectual Property Organization’s treaty that wants to ensure print-disabled citizens can’t have access to materials for them. That’s going on right now. In Canada library organizations are urging Canada’s negotiating team to argue for certain positions:

  • That authorized agencies have the right to bypass a technological protection measure to make alternate format available to another authorized agency or qualified individual worldwide.
  • That the treaty not include a “commercially available” restriction on the cross border supply of alternate formats. This would have the effect of placing cumbersome, if not unworkable, requirements authorized entities and severely impede the availability of content to all, especially in underdeveloped and developing countries.
  • That cumbersome and unnecessary treaty language referencing other legislative (US fair use) or treaty (Berne’s 3 step test) regimes is unnecessary.

CULC’s full letter is available here. One of the issues with these treaties and negotiations has to do with our old friend Digital Rights Management (or TPM in Canada) and how the language of these agreements (and Canadian laws) are set up to benefit well-resourced lobbying groups even while there’s some reasonable lip-service paid. So this is an issue.

There’s also rumbling about Library and Archives Canada putting up paywalls on digitized materials. This one doesn’t have anything official out there yet, so we’ll just link to some preparatory ire.

And then thirdly there’s the big American news about the NSA keeping databases of phone calls and the program PRISM that gives the NSA access to internet companies’ information and just today Edward Snowden came forward as the leaker of that NSA information.

There’s a lot out there on these things to read. David Simon (of The Wire fame) wrote about how this PRISM thing isn’t a scandal because this is how the law works. Warrants are still necessary, and do you really want to take these tools out of law enforcement’s hands?

Frankly, I’m a bit amazed that the NSA and FBI have their shit together enough to be consistently doing what they should be doing with the vast big-data stream of electronic communication. For us, now — years into this war-footing and this legal dynamic — to loudly proclaim our indignation at the maintenance of an essential and comprehensive investigative database while at the same time insisting on a proactive response to the inevitable attempts at terrorism is as childish as it is obtuse. We want cake, we want to eat it, and we want to stay skinny and never puke up a thing. Of course we do.

Others are talking about what shoddy journalism these leaked stories are since all the tech companies are denying that they’re participating. And there’s some indication that all these companies are doing is just making the NSA’s job easier within the bounds of the law.

I have some sympathy with David Simon (and John Scalzi, for that matter) when they say that this whole thing is just how the world works and pretending to be surprised now is bullshit. Money and Power and all that. These are the laws we made to create a legal surveillance state. But that doesn’t make it right. (It’s also impossible to feel any sympathy for (and infuriating to see) a government who is trying to make itself out as the gut-wrenched victim though.)

There’ll be more coming. But one of the things to be aware of here is that even though it’s possible the only person who did anything illegal in regards to this whole NSA program is Edward Snowden for leaking it (and it is very interesting that Hong Kong is where he’s hoping to avoid being extradited; the Chinese probably have more clout on that than they were portrayed as in The Dark Knight) that’s a huge problem. We wouldn’t be able to talk about what these surveillance laws hath wrought if someone hadn’t snuck them out. This just highlights the importance of challenging and changing laws to fit the needs of citizens instead of law-enforcement and spy agencies.

Of course, it is possible to talk about these policies even without a scandal of illegality. Michael Geist has a great post (filled with links and analysis) talking about how the issues raised by PRISM apply in Canada:

Does this mean Canadian authorities are engaged in similar forms of surveillance? That phone companies such as Bell and Telus are subject to warrants similar to those faced by Verizon? That Internet companies co-operate with Canadian authorities? That Canadian and U.S. authorities share information obtained through programs such as the Verizon meta-data program or PRISM? That Canadians are targeted by the U.S. programs?

The law would suggest that all of these things are entirely possible. Given the integrated communications networks and the increased information sharing, it seems very likely. Yet since virtually everything remain shrouded in secrecy, Canadians don’t know for sure.

That “shrouded in secrecy” is the problem in all three of these issues we’re talking about today. As information professionals we need to push for more transparency in our laws. We also need to be working with organizations pushing for more privacy for individuals and more openness for governments (and other powerful organizations). This is one of those times we need to be supporting OpenMedia and the Electronic Frontier Foundation.

Last word for today comes from Edward Snowden:

The primary lesson from this experience was that “you can’t wait around for someone else to act. I had been looking for leaders, but I realised that leadership is about being the first to act.”

What do you think we should do?