Severe privacy challenges

RICHARD S. ROSENBERG

As Internet usage has grown over the years, most people have made the trade-off between ease of use and privacy protection subconsciously. In recent weeks though, we have been reminded repeatedly – with the reports from the United States of unauthorized government access to information held by such companies as Facebook, Google and Yahoo – that government agencies have access to vast amounts of personal data.

These recent revelations have been particularly disturbing because it seems that the private sector has been willing to supply personal information to the government when requested without judicial approval. The underlying motivation is, of course, to prevent a repetition of the tragic events of 9/11, as well as other such acts. It appears that most people are willing to make some personal information available to the FBI and the National Security Agency (NSA), for example, without the requirement of a court order. However, the reports of both the breadth and extent of surveillance by these agencies has caused considerable concern in the general public around the world.

In the past few weeks, the word PRISM has become the popular term to refer to the system involved in the collection of personal information by U.S. government agencies. PRISM, similar to a program put into place in the last months of the George W. Bush presidency, collects data, enormous amounts, controlled by companies with significant resources, such as Microsoft, Google, Yahoo, Facebook, PalTalk, YouTube, Skype, AOL and Apple. The types of information collected by PRISM include the following: e-mail, chat, videos, photos, stored data, file transfers, notification of target activity – logons, etc. – and special requests. Such information is stored both in the United States and elsewhere. As such, the surveillance activities of the FBI and NSA are worldwide and would appear to violate the privacy laws of many countries.

The recent story was broken by Edward Snowden, a contract employee at the NSA and a current employee of defence contractor Booz Allen Hamilton, until recently. As Snowdon described his work, “But I, sitting at my desk, had the authority to wiretap anyone, from you or your accountant to a federal judge to even the president if I had personal e-mail,” it is clear that the Internet provides many opportunities to examine international electronic traffic. Snowden’s revelations have stimulated a host of denials and explanations; suspicions about the fragility of Internet security seem to have been verified.

Anti-terrorist activities generally receive public support but the scope and depth of the ones described above raise such serious privacy issues that they must be addressed and limitations proposed, if necessary. It should be remembered that specific laws were passed just after 9/11 and renewed via the U.S. Patriot Act. The FBI was given the power to determine information about e-mails, including source, destination and subject matter, but not necessarily content. It was felt that this power would give investigatory agencies the ability to identify terrorist threats and to prevent or reduce their impact. But revelations such as the existence of PRISM have increased the level of public concern – concern that seems warranted – and even unsophisticated users are being educated about the possibilities that exist now and will exist in the future for privacy violations. For example, the following advice was given by Gillian Shaw in the June 12 Vancouver Sun: update software, use anti-virus and security software, beware of bogus e-mails and websites that may not be what they seem, and don’t assume that anything you post on social networks will only be seen by those you intend to have to see it.

Prior to the recent revelations, the Internet was seen as important communications tool, to connect with friends, companies, relevant government agencies and other interesting parties. Expectations of privacy have always had to be tempered – now, the expectations of experienced and technically sophisticated Internet users must become public working knowledge. In the long tradition of government access to private sector information, the Internet is an exemplar of a wonderful tool for use by an active population and an even more active tool for government agencies.

How much information is requested by the U.S. government of social networks? The New York Times of June 14 reported that Facebook had disclosed the following information: “In the last six months of 2012, it had 9,000 to 10,000 requests for information about its users from local, state and federal agencies. Those requests covered 18,000 to 19,000 user accounts.” Verizon was reported to have received national security orders of the type that required it to provide business records about U.S. customers. Many other reports on U.S. government requests for information from social networks have been reported, and most of these were honored, so obviously there exists a close relationship between spy agencies and social networks in the United States and elsewhere. It is clearly important that citizens of a democracy be alert to the intelligence activities of its government.

In Canada, privacy concerns are compounded because the Canadian government has access to information about Canadian users and the U.S. government also has information on the activities of many Canadians because much data about Canadians – for example, credit card data – is stored in the United States and, hence, readily available to the FBI and NSA. Canadians also should remember attempts by our government to introduce legislation to give police the power to obtain information about e-mails without court order, so-called “informed consent.” This legislation was withdrawn after considerable effort invested by opponents aroused widespread public opposition. The revelations about the PRISM system should arouse sufficient opposition such that, even in difficult times, privacy will once again be valued as a hallmark of a democratic society, and the Internet will no longer be fertile ground for exploitation by so-called spy agencies.

The basic question remains, however. Have privacy rights been so compromised that we can no longer refer to privacy as a fundamental right? Recall that seemingly archaic maxim attributed to Thomas Jefferson: “The price of liberty is eternal vigilance.” In a recent interview on this topic, I was quoted as follows: “We are almost out of control [of the collection of information]. The problem is, we expect government to be responsible. What we need to do is, we need to know what type of information is being collected. What that information is being used for should be apparent and that it’s secure. The government claims the right to do what they want [with our information]. How did they get this right? Did they ask? The government would say: ‘No, this is just what we’ve always been doing. We just do it better now. We do it faster. We get more information. We can answer questions more quickly and we can be more efficient.’ They say they’re doing all this for our protection. We should say: ‘At what cost?’”

Richard S. Rosenberg, professor emeritus, department of computer science at the University of British Columbia, is president of the B.C. Freedom Information and Privacy Association and a member of the executive of the B.C. Civil Liberties Association.

^TOP