Canada's Internet snooping bill is dead —

Canada's terrible proposed spying law, Bill C-30, is dead. The Harper Tories, who nailed the colours to the mast on the passage of the law, which would have given nearly unlimited access to private electronic communications to law enforcement, government, and random appointed persons, has issued a statement saying they won't reintroduce the bill. It's a humiliating climbdown and it couldn't have happened to a crummier government. — Cory •

Michael Geist sez,

A coalition of Canadian industry groups, including the Canadian Chamber of Commerce, the Canadian Marketing Association, the Canadian Wireless Telecommunications Association and the Entertainment Software Association of Canada, are demanding legalized spyware for private enforcement purposes. The demand comes as part of a review of anti-spam and spyware legislation in Canada.

The potential scope of coverage is breathtaking: a software program secretly installed by an entertainment software company designed to detect or investigate alleged copyright infringement would be covered by this exception. This exception could potentially cover programs designed to block access to certain websites (preventing the contravention of a law as would have been the case with SOPA), attempts to access wireless networks without authorization, or even keylogger programs tracking unsuspecting users (detection and investigation).

Sony Rootkit Redux: Canadian Business Groups Lobby For Right To Install Spyware on Your Computer

The Ontario Teachers Pension Plan (OTPP) has joined a private equity consortium that acquired the notorious Internet surveillance company BlueCoat, yoking teachers' retirement security to the fortunes of a company that has systematically assisted some of the world's most brutal dictatorships to censor and surveil their citizenry. Blue Coat has blood on its hands, people rounded up and tortured and even killed thanks to it and products like it, and it's a disgrace for teachers -- whose professional ethics embrace freedom, intellectual inquiry, and fairness -- to be part of the financial exit strategy for the people who founded and ran that company.

Ron Deibert and Sarah McKune from the University of Toronto's CitizenLab and Munk School of Global Affairs have written an op-ed in the Toronto Star, detailing some of BlueCoat's ethical unsuitablity, and the fact that the OTPP went into the transaction having been thoroughly briefed on what they were getting into.

If you'd like to read more about BlueCoat, check out CitizenLab's excellent report: "Mapping Global Censorship and Surveillance Tools."

Now, a year later, Citizen Lab has released a new report, Planet Blue Coat: Mapping Global Censorship and Surveillance Tools. Using a combination of technical interrogation methods, our researchers scanned the Internet to look for signature evidence of Blue Coat products. While our investigation was not exhaustive and provided only a limited window of visibility into the deployment of such tools, what we were able to find raises serious concerns.

We uncovered 61 Blue Coat ProxySG and 316 Blue Coat PacketShaper devices, which are designed to filter online content and inspect and control network traffic. While legitimate for some purposes, these capabilities can also be used for mass censorship and surveillance of a country’s Internet users. It is noteworthy in this respect that 61 of these Blue Coat appliances are on public or government networks in countries with a history of concerns over human rights, surveillance and censorship (see the work of the OpenNet Initiative documenting such concerns).

Specifically, we found the ProxySG product, designed to filter access to information online, in Egypt, Kuwait, Qatar, Saudi Arabia and the United Arab Emirates. We found the PacketShaper appliance, capable of deep packet inspection and mass surveillance, in Afghanistan, Bahrain, China, India, Indonesia, Iraq, Kenya, Kuwait, Lebanon, Malaysia, Nigeria, Qatar, Russia, Saudi Arabia, South Korea, Singapore, Thailand, Turkey and Venezuela.

Teachers’ pension plan invests in Internet surveillance firm. (Thanks, Mom!)

Sean sez, "Thought you guys would dig this pictorial guide to electronic bugging that I posted today. The article ran in the September 7, 1968 issue of the legendary Bay Area radical slick Ramparts. Quaint by comparison to the spy tech of today. Also of interest, I posted Yvonne D'Angers (shot by Baron Wolman) modeling some of the equipment on the cover a few days back. These and all scans on my site are from my personal collection...."

A Paranoid's Guide to Bugging - Ramparts, 1968 (Thanks, Sean!)

A fascinating article in The Verge looks at the history of casino cheating and talks to Ted Whiting, director of surveillance at the Aria casino in Vegas, who specced out a huge, showy CCTV room with feeds from more than 1,100 cameras. They use a lot of machine intelligence to raise potential cheating to the attention of the operators.

Despite that, Whiting says facial recognition software hasn’t been of much use to him. It’s simply too unreliable when it comes to spotting people on the move, in crowds, and under variable lighting. Instead, he and his team rely on pictures shared from other casinos, as well as through the Biometrica and Griffin databases. (The Griffin database, which contains pictures and descriptions of various undesirables, used to go to subscribers as massive paper volumes.) But quite often, they’re not looking for specific people, but rather patterns of behavior. "Believe it or not, when you've done this long enough," he says, "you can tell when somebody's up to no good. It just doesn't feel right."

They keep a close eye on the tables, since that’s where cheating’s most likely to occur. With 1080p high-definition cameras, surveillance operators can read cards and count chips — a significant improvement over earlier cameras. And though facial recognition doesn’t yet work reliably enough to replace human operators, Whiting’s excited at the prospects of OCR. It’s already proven useful for identifying license plates. The next step, he says, is reading cards and automatically assessing a player’s strategy and skill level. In the future, maybe, the cameras will spot card counters and other advantage players without any operator intervention. (Whiting, a former advantage player himself, can often spot such players. Rather than kick them out, as some casinos did in the past, Aria simply limits their bets, making it economically disadvantageous to keep playing.)

With over a thousand cameras operating 24/7, the monitoring room creates tremendous amounts of data every day, most of which goes unseen. Six technicians watch about 40 monitors, but all the feeds are saved for later analysis. One day, as with OCR scanning, it might be possible to search all that data for suspicious activity. Say, a baccarat player who leaves his seat, disappears for a few minutes, and is replaced with another player who hits an impressive winning streak. An alert human might spot the collusion, but even better, video analytics might flag the scene for further review. The valuable trend in surveillance, Whiting says, is toward this data-driven analysis (even when much of the job still involves old-fashioned gumshoe work). "It's the data," he says, "And cameras now are data. So it's all data. It's just learning to understand that data is important."

One thing I wanted to see in this piece was some reflection on how casino level of surveillance, and the casino theory of justice (we spy on everyone to catch the guilty people) has become the new normal across the world.

Not in my house: how Vegas casinos wage a war on cheating [Jesse Hicks/The Verge]

(via Kottke)

Activists in Berlin have created a game called Camover where they move through public spaces in disguise, smashing CCTV cameras, recording the act and uploading it to YouTube for points.

The rules of Camover are simple: mobilise a crew and think of a name that starts with "command", "brigade" or "cell", followed by the moniker of a historical figure (Van der Lubbe, a Dutch bricklayer convicted of setting fire to the Reichstag in 1933, is one name being used). Then destroy as many CCTV cameras as you can. Concealing your identity, while not essential, is recommended. Finally, video your trail of destruction and post it on the game's website – although even keeping track of the homepage can be a challenge in itself, as it is continually being shut down.

East Germany withered under the punishing, spying gaze of the Stasi, whose surveillance was always couched in the language of "public protection" and "crime solving." Today, the CCTVs used by commercial firms are an extension of government surveillance, because their footage can be seized, often in secret, in the name of "fighting terror" and similar rubrics.

Game to destroy CCTV cameras: vandalism or valid protest?

The American Civil Liberties Union filed a Freedom of Information Act request with the FBI seeking details of its surveillance policy -- who it spies upon, and how, and under what circumstances. The FBI sent back two 50+ page memos in reply, each of them totally blacked out except for some information on the title page.

In a 12-minute video posted online, Weissmann spoke about two memos: one focused on the use of GPS tracking on forms of transportation beyond cars, the other regarding how Jones applies to tracking methods outside of GPS (presumably like cellphone ping data).

“Is it going to apply to boats, is it going to apply to airplanes?” Weissmann asks in the video. “Is it going to apply at the border? What’s it mean for the consent that’s given by an owner? What does it mean if consent is given by a possessor? And this is all about GPS, by the way, without getting into other types of techniques.”

And those questions remain wholly unanswered.

“The Justice Department’s unfortunate decision leaves Americans with no clear understanding of when we will be subjected to tracking—possibly for months at a time—or whether the government will first get a warrant,” Catherine Crump, an ACLU staff attorney, wrote on Wednesday.

FBI to ACLU: Nope, we won't tell you how, when, or why we track you [Cyrus Farivar/Ars Technica]

Buzzing around the internet this week: Polish security researcher and professor Wojciech Mazurczyk (left) claims to be developing a way to hide secret, un-eavesdroppable messages in "silent" packets transmitted within Skype conversations. He and his team plan to present SkypeHide at a steganography conference in Montpellier, France, this coming June. VentureBeat has a writeup here. The ease with which Skype can be snooped by law enforcement is well-known. I'll be interested to hear what other security researchers make of Mazurczyk's project, when and if it is eventually released.

City buses across America increasingly have hidden microphones that track and record the conversations that take place on them. It's easy to see the reasoning behind this: once it's acceptable to video-record everything and everyone on a bus because some crime, somewhere was thus thwarted, then why not add audio? If all you need to justify an intrusion into privacy is to show that some bad thing, somewhere, can be so prevented, then why not? After all, "If you've got nothing to hide..."

According to the product pamphlet for the RoadRecorder 7000 system made by SafetyVision (.pdf), “Remote connectivity to the RoadRecorder 7000 NVR can be established via the Gigabit Ethernet port or the built-in 3G modem. A robust software ecosystem including LiveTrax vehicle tracking and video streaming service combined with SafetyNet central management system allows authorized users to check health status, create custom alerts, track vehicles, automate event downloads and much more.”

The systems use cables or WiFi to pair audio conversations with camera images in order to produce synchronous recordings. Audio and video can be monitored in real-time, but are also stored onboard in blackbox-like devices, generally for 30 days, for later retrieval. Four to six cameras with mics are generally installed throughout a bus, including one near the driver and one on the exterior of the bus.

Cities that have installed the systems or have taken steps to procure them include San Francisco, California; Eugene, Oregon; Traverse City, Michigan; Columbus, Ohio; Baltimore Maryland; Hartford, Connecticut; and Athens, Georgia.

There are lots more exciting possibilities opened up here. For example, our phones and laptops could continuously stream all the audio from our immediate surroundings when we're in public, even when we're not actively using them. No one would listen to them in real-time (or, at least, no one would be authorized to do this), unless they were a cop or someone in government. But when a crime was committed, imagine how useful it would be if all the phones in the vicinity could be tapped for a record of the event!

Why not? If you've got nothing to hide?

This is the NSA's argument, by the way. They're recording all of the Internet and voice traffic in the USA, but they only plan on examining it after the fact, to find criminals who do bad, bad things. Once you accept that logic, there's no reason that they shouldn't put prisoner-tracking ankle-cuffs on all of us (mobile phones are only slightly less invasive than these, anyway, in the current legislative regime), start using lawful interception backdoors to watch us through the webcams in our consoles and computers, and so on.

It's also UK Home Secretary Theresa May's argument in favour of her "Snooper's Charter" -- the communications act she's pushing, which will give law enforcement the power to order service providers to retain any data, and give government and law enforcement access to it.

Public Buses Across Country Quietly Adding Microphones to Record Passenger Conversations [Kim Zetter/Wired] (via Wil Wheaton)

Yesterday morning, I wrote about the closed-door International Telecommunications Union meeting where they were working on standardizing "deep packet inspection" -- a technology crucial to mass Internet surveillance. Other standards bodies have refused to touch DPI because of the risk to Internet users that arises from making it easier to spy on them. But not the ITU.

The ITU standardization effort has been conducted in secret, without public scrutiny. Now, Asher Wolf writes,

I publicly asked (via Twitter) if anyone could give me access to documents relating to the ITU's DPI recommendations, now endorsed by the U.N. The ITU's senior communications officer, Toby Johnson, emailed me a copy of their unpublished policy recommendations.

OOOPS!

5 hours later, they emailed, asking me not to publish it, in part or in whole, and that it was for my eyes only.

Please publish it (credit me for sending it to you.)

Also note:

1. The recommendations *NEVER* discuss the impact of DPI.

2. A FEW EXAMPLES OF POTENTIAL DPI USE CITED BY THE ITU:

"I.9.2 DPI engine use case: Simple fixed string matching for BitTorrent"
"II.3.4 Example “Forwarding copy right protected audio content”"
"II.3.6 Example “Detection of a specific transferred file from a particular user”"
"II.4.2 Example “Security check – Block SIP messages (across entire SIP traffic) with specific content types”"
"II.4.5 Example “Identify particular host by evaluating all RTCP SDES packets”"
"II.4.6 Example “Measure Spanish Jabber traffic”"
"II.4.7 Example “Blocking of dedicated games”"
"II.4.11 Example “Identify uploading BitTorrent users”"
"II.4.13 Example “Blocking Peer-to-Peer VoIP telephony
with proprietary end-to-end application control protocols”"
"II.5.1 Example “Detecting a specific Peer-to-Peer VoIP telephony with proprietary end-to-end application control protocols”"

Read the rest

The International Telecommunications Union, a UN agency dominated by veterans of incumbent telcoms who mistrust the Internet, and representatives of repressive governments who want to control it, have quietly begun the standardization process for a kind of invasive network spying called "deep packet inspection" (DPI). Other standards bodies have shied away from standardizing surveillance technology, but the ITU just dived in with both feet, and proposed a standard that includes not only garden-variety spying, but also spying "in case of a local availability of the used encryption key(s)" -- a situation that includes the kind of spying Iran's government is suspected of engaging in, when an Iranian hacker stole signing keys from the Dutch certificate authority DigiNotar, allowing for silent interception of Facebook and Gmail traffic by Iranian dissidents.

The ITU-T DPI standard holds very little in reserve when it comes to privacy invasion. For example, the document optionally requires DPI systems to support inspection of encrypted traffic “in case of a local availability of the used encryption key(s).” It’s not entirely clear under what circumstances ISPs might have access to such keys, but in any event the very notion of decrypting the users’ traffic (quite possibly against their will) is antithetical to most norms, policies, and laws concerning privacy of communications. In discussing IPSec, an end-to-end encryption technology that obscures all traffic content, the document notes that “aspects related to application identification are for further study” – as if some future work may be dedicated to somehow breaking or circumventing IPSec.

Several global standards bodies, including the IETF and W3C, have launched initiatives to incorporate privacy considerations into their work. In fact, the IETF has long had a policy of not considering technical requirements for wiretapping in its work, taking the seemingly opposite approach to the ITU-T DPI document, as Germany pointed out in voicing its opposition to the ITU-T standard earlier this year. The ITU-T standard barely acknowledges that DPI has privacy implications, let alone does it provide a thorough analysis of how the potential privacy threats associated with the technology might be mitigated.

These aspects of the ITU-T Recommendation are troubling in light of calls from Russia and a number of Middle Eastern countries to make ITU-T Recommendations mandatory for Internet technology companies and network operators to build into their products. Mandatory standards are a bad idea even when they are well designed. Forcing the world’s technology companies to adopt standards developed in a body that fails to conduct rigorous privacy analysis could have dire global consequences for online trust and users’ rights.

Adoption of Traffic Sniffing Standard Fans WCIT Flames [CDT]