Canadian ISPs Could Take On Big Brother Role

QGambit writes: "C|Net is reporting that the Canadian Government is considering a proposal that would force ISPs to keep logs of web browsing for up to 6 months, allow police to get search warrants allowing them to find 'hidden electronic and digital devices' and ban the possession of computer viruses. Canada and the U.S. have both endorsed this proposal, contained in a cybercrime treaty of the Council of Europe. Both countries are non-voting members of the Council. George Radwanski, Canada's privacy commissioner has not yet commented on the proposal."

Comments

Ban possession of computer viruses?

[AMuse]

I'm pretty sure the majority of people who are "in possession" of computer virii would rather not be, if only windows would stop executing them.

In all seriousness, though, how can you ban the possession of something that can be pretty much invisibly placed in your property?

This is probably illegal

[Retief65]

Such an initiative would likely be subject to a challenge under the Charter of Rights and Freedoms, so much so that it would likely not be introduced in the first place. Endorsing a foreign initiative is not the same as legislating a domestic one, and I think Canadians believe that sufficient personal freedom has been traded for security. Besides, like this would stop evildoers who know how to surf untraceably.

This doesn't seem right

[Zakabog]

Arguing that more and more communications take place in electronic form, Canadian officials say such laws are necessary to fight terrorism and combat even run-of-the-mill crimes.

Isn't it great how taking away basic rights can be justified by "We're doing it to stop terrorism." I don't see how taking away the rights of millions of people (and pissing alot of them off) will STOP terrorism. I do see how it could lead to more terrorism, by people from within the country.

If the discussion draft were to become law, it would outlaw the possession of computer viruses, authorize police to order Internet providers to retain logs of all Web browsing for up to six months, and permit police to obtain a search warrant allowing them to find "hidden electronic and digital devices" that a suspect might be concealing.

How do you even enforce that? How will they know if I poses a virus or not? How do you tell the difference between posessing a virus and being infected by one? If they have logs of all web browsing for up to six months what does that include? I'm pretty sure that the police need to ask the ISP for the logging to start on a particular user (they can't keep 6 months logs for everyone's web usage), but what would count as web usage? Will they be able to log my FTP usage and see all the unencrypted passwords?

User tracking is more than an annoyance for ISPs

[Tajarix]

As an admin (like so many of you) for a small to medium sized regional ISP, I'd like to throw out some numbers here to give some people the idea of why ISPs monitoring users for very long is generally massively irritating to try to manage. For e-mail tracking (as merely my humble example), let's look in our example at an SMTP (not even counting POP, here) server which processes about 60k messages per day. We don't use unusually verbose logging, and we generally keep 24 hours of logs on rotation. Each 24 hours varies from about 120-200 MB. Okay, the math is easy enough to do. Let's monitor all e-mail transactions for 6 months (using the more conservative 120 MB figure): 120 x 7 x 4 x 6 = about 20.2 GB. That's not too bad in terms of our MP3 and DivX collections, but text logs? Yuck! I don't want to keep 20 gigs of logs on my server! If anyone comes to me (from an authority of some sort) and asks for logs that old, I have no problems givng them the explanation, "Sorry, we rotated them out. Buy me a new SCSI hard disk and pay us for the time to install it on our box, then we'll talk about old logs."

Just Won't Happen

[Inexile2002]

This seems to happen around once or twice a year in Canada. Some beaurocrat or treaty negotiator gets excited, puts something up for review and once the government figures out that it would violate the Charter of Rights and Freedoms (this clearly would) or just generally piss people off, it gets dropped.

Look at the knee jerk terrorism laws that were suggested after 9/11. Once the MPs looked at them seriously, cooler heads prevailed nothing happened. Same shit all over again.

As for the Charter of Rights,this law would easily be shot down in court on a number of counts including:

1. The Canadian Charter of Rights and Freedoms guarantees the rights and freedoms set out in it subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.

2. Everyone has the following fundamental freedoms:
a) freedom of conscience and religion;
b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;
c) freedom of peaceful assembly; and
d) freedom of association.

7. Everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice.

8. Everyone has the right to be secure against unreasonable search or seizure.

24. (1) Anyone whose rights or freedoms, as guaranteed by this Charter, have been infringed or denied may apply to a court of competent jurisdiction to obtain such remedy as the court considers appropriate and just in the circumstances.
(2) Where, in proceedings under subsection (1), a court concludes that evidence was obtained in a manner that infringed or denied any rights or freedoms guaranteed by this Charter, the evidence shall be excluded if it is established that, having regard to all the circumstances, the admission of it in the proceedings would bring the administration of justice into disrepute.

Any law that infringes on this even a little will get thrown out by the courts the first time the police come hunting for a search warrant. The fact that the ISPs are not stupid means they will not be willing to shell out the cash for an infrastructute of a law that would collapse on the first court challenge.

Just won't happen.

Re:why?!

[lommer]

I must state outright that I agree with the poster to whom you are replying. As I am a Canadian, when I first read this, I almost immediately fired off an email to la-al@justice.gc.ca (the privacy commissioner's office) stating that I was against the act. However, before I did this, I took the time to find the full text and I am very glad that I did.

First of all, this is a proposal. Just that. Nothing more. It is a suggestion that the Canadian Government look into the issue of passing and Act or Statute which will enable the lawful interception of computer data, in conjunction with the EU convention.

Furthermore, as I read the proposal, I realized that most of it made sense and that I agreed with it. It clearly mentioned in the preamble the Charter of Rights and Freedoms and its intent to uphold it. I was actually surprised to find that the documents authors' held true to their word: after every major section or point that they make in the document, there is a section entitled "Issues to be Considered" in which they outline every single one of the privacy concerns that had come to my mind while reading the above section.

As well, all the way through the document, considerable effort was made to insure that due process (namely search warrants) would have to be undertaken before any of these searches could be undertaken.

In all I was quite pleased at how the document was presented, but one item piqued my interest. When reading the subject regarding "Interception of Email" (which btw, dealt as much with criminal's interception of email as it did with law enforcement's) I was initially disturbed to find that previous, already passed legislation had determined that only oral conversations can be considered "extremely private". All letters, bothe written and electronic, are considered to be "private". This means that one only needs a standard search warrant to lawfully intercept these communications whereas to intercept oral communications, a police officer must present extra evidence to obtain a warrant. However, on reflection I think this seems reasonable.

I would now finally like to reply to your direct question by asking you another one: could you not think of ways in which internet logs could possibly be useful in a criminal investigation? Keep in mind this may also include times once a person has already been arrested and the crown is building evidence against them.

Re:Write!

[Bishop]

Before you write, read. Read the whole discuss paper. The paper covers many different areas not covered in the news article. Some parts, such as the intercept proposals, aren't acceptable. Other parts of the paper make a lot of sense.

For example read the section on Interception of Email. The gist of this section is that email interception can and has fallen under two conflicting sections of the Criminal Code. In some cases a judge ruled that the email was a private communication and subject to those laws. In another case a judge ruled that email was subject to the less onerous search and seizure laws. The criminal code is not clear on the matter. So the discussion paper simply asks 3 questions:

* should there be a specific provision in the Criminal Code in relation to how an e-mail should be acquired?

* if such a provision should be included, what kind of procedural safeguards should be imposed?

* should the type of order to be obtained in order to acquire an e-mail vary depending on the stage of the communication or delivery process?

These are three important questions! How do you want your email protected under the Criminal Code and the Charter of Rights and Freedoms? The Dept of Justice is asking for your inpupt on these and other important questions regarding your privacy.

Read the whole paper and send send in your opinions. You do not need to comment on all sections. Specify which section your comments reference. Be clear. Check your spelling (unlike me). Check your grammar. Reread what your wrote. Wait a day after writeing before sending (from some sober second thought).