New Cyber Security Task Force in Canada?

Michael Geist reports that the Canada may be creating a Cyber Security Task Force. Although the Ministry of Public Security and Emergency Preparedness Canada has not announced it the Government Electronic Directory Service now lists a position for a Cyber Security Task Force Secretariat. Geist rasises some key issues including:

First, who will be on the task force? It is essential it include representation from privacy and civil liberties groups. Security is critical but must be imbued with full respect for the privacy and civil liberty rights of all Canadians. Revelations of widespread telephone communications surveillance in the United States — frequently with the secret participation of telecommunications firms — has provided evidence of the danger of focusing on security without counterbalancing with a privacy and civil liberties perspective.

Second, what other legislation could be introduced in such an environment? With a cyber-security task force on the way, speculation will increase that the government is also preparing to bring back so-called "lawful access" legislation. Introduced by the Liberal government, the innocuous-sounding Modernization of Investigative Techniques Act envisioned a host of new legal powers associated with near-ubiquitous surveillance technologies.

As Geist notes, the proposed legislation concerning electronic surveillance requires ISP's to "install new systems capable of capturing data and identifying specific subscriber activities" and lacks judicial oversight -- it allows various law enforcement authorities to simply request subscriber data from ISPs without a warrant.

The Most Sophisticated Internet Surveillance In the World

While China is often singled out for its Internet surveillance capabilities, new whistleblower evidence indicates that China's Internet surveillance pales in comparison to the United States' surveillance regime. The latest information reveals that AT&T implemented a sophisticated monitoring and data mining program convering both Internet and telephone communications when asked by the NSA, although the roots of the program appear to be an outgrowth of the Defense Department's Total Information Awareness (TIA) program. The USA's extensive system is able to monitor traffic on essentially the entire Internet due to AT&T's peering links with other major backbone providers:

Another Cut-In and Test Procedure document dated January 24, 2003, provides diagrams of how AT&T Core Network circuits were to be run through the "splitter" cabinet. One page lists the circuit IDs of key Peering Links which were "cut-in" in February 2003, including ConXion, Verio, XO, Genuity, Qwest, PAIX, Allegiance, AboveNet, Global Crossing, C&W, UUNET, Level 3, Sprint, Telia, PSINet and Mae West. By the way, Mae West is one of two key internet nodal points in the United States (the other, Mae East, is in Vienna, Virginia). It's not just WorldNet customers who are being spied on -- it's the entire internet.

The program covers Internet and telephone communications. The EFF has filed suit against AT&T:

The lawsuit alleges that AT&T Corp. has opened its key telecommunications facilities and databases to direct access by the NSA and/or other government agencies, thereby disclosing to the government the contents of its customers' communications as well as detailed communications records about millions of its customers, including the lawsuit's class members.

The lawsuit also alleges that AT&T has given the government unfettered access to its over 300 terabyte "Daytona" database of caller information—one of the largest databases in the world. Moreover, by opening its network and databases to wholesale surveillance by the NSA, EFF alleges that AT&T has violated the privacy of its customers and the people they call and email, as well as broken longstanding communications privacy laws.

The US Government's "Internet Police" (I wonder if there are "30,000" of them?) monitor communications in "real-time" from "secret rooms" located in AT&T buildings:

The normal work force of unionized technicians in the office are forbidden to enter the "secret room," which has a special combination lock on the main door. The telltale sign of an illicit government spy operation is the fact that only people with security clearance from the National Security Agency can enter this room.

The combination of the technical sophistication of the system and the illegal way in which it has been implemented confirms what many have suspected: the electronic surveillance regime of the US is far more extensive and sophisticated than any other country in the world.

Amnesty Campaign and Censorship Map

Amnesty International is currently working with the OpenNet Initiative (ONI) to help raise awareness of internet censorship around the world. Amnesty International is launching a campaign to show that online or offline the human voice and human rights are impossible to repress.

The aim of the ONI is to document empirically patterns of Internet content filtering and surveillance worldwide behind national firewalls over an extended period of time. Its reports have documented the scope, scale and sophistication of numerous filtering regimes worldwide, and have helped verify the use of commercial filtering technologies that are used to underpin these regimes. The ONI's flash map of global filtering shows the results of these investigations.

I can't search for shit?

Seth Finkelstein notes that Yahoo Italy is strangely redirecting searches for words like "shit". Instead of searching the "web" for shit, it redirects to a Yahoo directory search. "merda" is subject to the same redirection.But it seems that most other nasty words are fine. Another thing that's interesting is that when you search for a word like "fuck" a warning appears at the top of the results.

TapOut

No, not the fight gear or what happens when Rickson gets you in an armbar. USA Today reports:

The National Security Agency has been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth, people with direct knowledge of the arrangement told USA TODAY.

The NSA program reaches into homes and businesses across the nation by amassing information about the calls of ordinary Americans — most of whom aren't suspected of any crime. This program does not involve the NSA listening to or recording conversations. But the spy agency is using the data to analyze calling patterns in an effort to detect terrorist activity, sources said in separate interviews.

Only Qwest questioned the legality:

Unable to get comfortable with what NSA was proposing, Qwest's lawyers asked NSA to take its proposal to the FISA court. According to the sources, the agency refused.

The NSA's explanation did little to satisfy Qwest's lawyers. "They told (Qwest) they didn't want to do that because FISA might not agree with them," one person recalled. For similar reasons, this person said, NSA rejected Qwest's suggestion of getting a letter of authorization from the U.S. attorney general's office. A second person confirmed this version of events.

Sadly, 63% of Americans say they support this.

Who chooses what to filter? Part 2

Here is another recent case that illustrates the transparency and accountability issues that affect national level filtering.

The School District of Palm Beach County uses BlueCoat's WebFilter to block content that BlueCoat classifies as "Gay/Lesbian", including prominent advocacy groups, but not sites that denounce homosexuality. There are two issues here: 1) the decision to block Gay/Lesbian content and 2) the classification of web sites as Gay/Lesbian.

The Children's Internet Protection Act (CIPA) requires schools and libraries to install filtering systems in order to receive E-Rate funding. The filtering systems are to block access to "visual depictions" that are "(a) are obscene, (b) are child pornography, or (c) are harmful to minors" (from FCC Fact Sheet).

The leap from pictures to entire web sites is one that i did not notice earlier, but is a significant case of mission creep. It is even more significant in the context of the decision of what specific content categories to filter.

The decision to block Gay/Lesbian content category, supplied by BlueCoat, seems to have been made by the system adminstrator based on "common sense":

Shawn Brinkman, a systems specialist at the District, explained the decision to block gay and lesbian issues websites by citing concerns about the appropriateness of such websites for younger students.

"We have to make judgments for all our users, which include Pre-K users," Brinkman said. "We don't have the technology to disallow and allow for certain age groups."

Brinkman said that the decision was one made on "common sense."

"I think common sense says [these websites are not] appropriate for four- or five-year-olds," he said, adding that these topics featured on those websites are ones parents would probably want to discuss with their children.

Now, there isn't much "common sense" in blocking human rights sites. And it certainly extends beyond the CIPA requirements. It shows that although the system was put into place based on a narrow set of guidelines with the expressed purpose of protecting children from content such as pornography it has been extended without oversight and left to basically ad-hoc decisions based on the "common sense" of an administrator.

The second part of this concerns how BlueCoat classifies sites. Sites that are against homophobia are classified as "Gay/Lesbian" while homophobic sites are classified as "Health" and "Political/Activist Groups." BlueCoat's classification of sites into secret block lists also determine what sites the School District of Palm Beach County's students can have access to.

Circumventing Censorship

The Citizen Lab was recently featured in the Toronto Star. Just to be clear, I do go to the gym and do not wear flip flops :). Seriously though, I've received many emails and read through some of the Slashdot comments and would like to make a few points.

ONI Releases Belarus Internet Watch Report

The OpenNet Initiative has released a report that presents the findings of ONI's effort to monitor the Internet during Belarus' recent presidential elections.

The full report is available here