Proposed Canadian Anti-Spam Rules Restrict Secret ISP Monitoring

New submitter Fnordulicious writes "Although Canada's anti-spam legislation is already in place, the rules to implement it have been under development for more than a year. This weekend the proposed rules from the Department of Industry were published in the Canada Gazette. Kady O'Malley reports on the CBC Inside Politics Blog that Canadian ISPs will not be allowed to secretly monitor activity except in the case that the activity is illegal and represents an 'imminent risk to the security of its network.' In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"

Comments

Yay

[Kinthelt]

Happy news, for a change!

Now, if we could only do something about the Copyright Modernization Act...

Re:Yay

[Anonymous Coward]

I dunno, they left a loophole you could drive a truck through.

is illegal and represents an 'imminent risk to the security of its network.' In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"

So, a rubber stamp judge, and a good lawyer to prove that anything that anyone does after a fishing expedition falls into those guidelines.

I mean, it's a far, far better run at this than the USA, but it seems very, very easy to exploit.

Re:This sounds good, but what is consent here?

[gl4ss]

probably not.
the problem is the "illegal and represents an 'imminent risk to the security of its network.' ".

how do you know without looking though if it's illegal. and anything can be thought of as imminent risk to security.

Some scary stuff therw

[Lieutenant_Dan]

Limited exemptions for protecting, upgrading and updating computer networks
The proposed Regulations include an exemption for telecommunications service providers (TSPs) from the requirement to have consent to install a computer program for the limited purposes of preventing illegal activities that present an imminent risk to the security of its network.

The proposed Regulations also include an exemption for TSPs from the requirement to have consent to install software on devices across an entire network for update and upgrade purposes.

Does this mean that Rogers/Bell can start pushing agents/SW on their subscribers computers which in turn allow them to control your access?

This is pretty messed up.

They should be within their rights to cut off access to the node. I suppose the TSPs need to have a higher level of assurance that the node is no longer compromised.

Re:Some scary stuff therw

[dskoll]

Does this mean that Rogers/Bell can start pushing agents/SW on their subscribers computers which in turn allow them to control your access?

It may read that way, but I don't think that's the intent. I think it's meant to allow Bell and Rogers to remotely update the firmware on their modems and routers. My mother uses Bell, but she runs Linux so Bell would have a fairly difficult time installing anything on her computer anyway. (To monitor her, they wouldn't need to... they could just install something on the router they provided.)

Boilerplate

[bmo]

This consent will just make its way into subscriber agreements as a sentence in 6 point type on page 34 of the 42 page TOS/Privacy agreement, which nobody ever reads anyway.

--
BMO

Re:This sounds good, but what is consent here?

[kelemvor4]

anything can be thought of as imminent risk to security.

That's exactly what I was thinking. If the ISP is able to make the decision on their own, this won't prevent much other than the general monitoring of all traffic. It would still be very easy for them to see a large amount of traffic to one customer and decide that it might represent an imminent risk for one reason or another.

Right, yep, sure... uhuh.

[mark-t]

In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"

And I somehow suspect there'd be absolutely nothing to stop them from terminating your service if you don't consent.

Re:Right, yep, sure... uhuh.

[davecb]

There is a duopoly of ISPs in Canada, so anything Bell Telephone or Rogers* Cable does affects a huge number of people, and an attempt to require anything that could be characterized as spyware would cause complaints to the Cabinet**.

--dave
* or any of the other local cable monopolies
** the Prime Minister and his heads of department

Re:This sounds good, but what is consent here?

[Meneth]

Even if the ISP looks, they can't determine if something is illegal or not. A court of law is required for that.

Re:This sounds good, but what is consent here?

[Beardo the Bearded]

anything can be thought of as imminent risk to security.

That's exactly what I was thinking. If the ISP is able to make the decision on their own, this won't prevent much other than the general monitoring of all traffic. It would still be very easy for them to see a large amount of traffic to one customer and decide that it might represent an imminent risk for one reason or another.

ISP decision making in Canada:

1. Will this cost more money than doing fuck all?

2. Do fuck all.

3. Profit.