Sony Rootkit Redux: Canadian Business Groups Lobby For Right To Install Spyware

An anonymous reader writes "Michael Geist reports that a coalition of Canadian industry groups, including the Canadian Chamber of Commerce, the Canadian Marketing Association, the Canadian Wireless Telecommunications Association and the Entertainment Software Association of Canada, are demanding legalized spyware for private enforcement purposes. The potential scope of coverage is breathtaking: a software program secretly installed by an entertainment software company designed to detect or investigate alleged copyright infringement would be covered by this exception. This exception could potentially cover programs designed to block access to certain websites (preventing the contravention of a law as would have been the case with SOPA), attempts to access wireless networks without authorization, or even keylogger programs tracking unsuspecting users (detection and investigation)."

Comments

Only over my dead body

[Kardos]

will you be installing your spyware on my computer.

Re:Only over my dead body

[Capt.DrumkenBum]

You and me both.
If I find that someone (Person or corporate entity.) has installed software on MY computer without my explicit permission, they will be explaining to law enforcement why they think they have the right.

Re:Only over my dead body

[Kardos]

And therein lies the problem. "Oh, but the law permits them to".

Stallman saw this shit coming decades ago, sadly he's right :x

Re:Only over my dead body

[jxander]

Unless they're backed by law enforcement, at which point they'll be explaining nothing.

That's the point.

These agencies are trying to legalize computer-rape, so that when they bend you over, you've no recourse but to take it and pray for a reach around

Re:Only over my dead body

[Anonymous Coward]

Please, let's not start the pile of corpses on the wrong side. The original solution for spies is still the best. It needs practiced more to change their propensity to even consider such a solution.

Corporations and governments should be the ones spied upon by real people, not the other way around. Tracking is something done by hunters and those seeking to control, perhaps part of a herd. So, are those here sheep? or cats? or ?

Re:Only over my dead body

[tonywong]

I'd agree to this if only the corporations allow the people to install spyware on their board's and employee's computers to check on whether there is any malfeasance in their accounting and to watch for deviant pornography.

Just for their own good, of course.

Re:Only over my dead body

[iksbob]

In which case, the only option is to not buy the spyware-infested product. Since the spyware is secret, there's no way to tell which disks are infected and which are not. The only safe alternative is to avoid buying any official content what so ever. The industry will drive any previously paying customers that give two s**** about their privacy to turn to the "piracy" avenue of acquiring content.
The contortions the industry goes through to reach out and nail their own coffin shut are quite impressive.

Re:Only over my dead body

[Lemos]

This is ridicoulous, unfortunately its already done.

Re:Only over my dead body

[Anonymous Coward]

"Your proposal is acceptable".

-- Giant space cochroach, CEO of the MAFIAA

Re:Only over my dead body

[TheGratefulNet]

blueray runs 'mobile code' when it starts the disc.

for that reason (a big one) I refuse to buy BD discs or even support the business model with recorders/players.

I can't know what they run and it could be harmful. I refuse to play that game.

Re:Only over my dead body

[icebike]

In which case, the only option is to not buy the spyware-infested product. Since the spyware is secret, there's no way to tell which disks are infected and which are not. The only safe alternative is to avoid buying any official content what so ever.

I suspect Antivirus/anti-spyware companies (smaller ones, foreign ones) will provide methods of de-installing the spyware. With fewer and fewer software packages being delivered on disk, you just about have to install downloaded software in a clean room to to inspect it.

Re:Only over my dead body

[Em Adespoton]

This will spawn an entirely new term:

Pirivacy. Those who practice it will be Silicon Pirites :D

I can see CMA and ESAC being behind this, but the Canadian Wireless Telecommunications Association is food for thought... if they're behind it, that means we're talking about legal spyware on smartphones. Bundled by the carriers. Sound familiar? Unless you don't use a smartphone, these groups just did an end-run around your privacy with this proposal.

Basically, the groups advocating this, if they were allowed to implement it, would have you coming and going; there'd be almost no way to use electronics in Canada without the worry that spyware was either bundled in, or a conduit was in place to load it without your knowledge.

Re:Only over my dead body

[Anonymous Coward]

That gets you part of the way there but the Internet Service Providers up here (at least the sh*thole known as Telus) reserve the right to install software on your devices. Can't get out of that without pulling the plug.

Re:Only over my dead body

[mwvdlee]

Who says they have to distribute the spyware with paid products? They might simply pay computer manufacturers to include it, similar with drivers (closed source GFX card drivers for Linux?) or any other products. They wouldn't need to ask you or even tell you. They might even be able to have such software installed on the BIOS level with every motherboard sold if they pay the manufacturers enough money. I can't see of any way to avoid it if they're legally allowed to.

Re:Only over my dead body

[interkin3tic]

I think you're calling it while it's still in the air though. These groups are lobbying for it. Of course they are: it's in their interests. Lobbying groups always ask for things that are in their interests, often at the expense of everyone else's. As always, the rest of us must oppose it. I saw nothing in the article suggesting it was likely to pass. Don't get discouraged yet, in other words, gear up for a fight.

Re:Only over my dead body

[Capt.DrumkenBum]

Unless they're backed by law enforcement, at which point they'll be explaining nothing.

Then they can try to explain it to me. That will not be a pleasant conversation.

Re:Only over my dead body

[interkin3tic]

I suspect that if we limit ourselves to boycotting, we're going to lose. Most people don't remember the sony rootkit thing. In fact, I'm betting most of them didn't know it while it was a story. The word "spyware" is probably not something most consumers know about.

I also don't see a real potential for them to hurt themselves with this. Doesn't any EULA already grant them the "consent" they'd need to install spyware?

Re:Only over my dead body

[jxander]

If these laws (or any like them) are allowed to pass, the explanation will be "we installed it because the law permits it, any further harassment by you will result in fines and jail time."

That's why it's important to spread the knowledge now, well in advance. That's why it was so important for sites like Wikipedia to stage the blackout in defiance of SOPA/PIPA last year. Raise awareness BEFORE the laws are passed. Because once they are, digging the hooks out will be an extremely painful process.

Re:Only over my dead body

[Anonymous Coward]

"Imagine a [MAFIAA CEO] with unlimited [money], a massive inferiority complex, and a real short temper, is tear-assing around [Canada] in a brand-new Edgar suit."

Sounds bad enough.

Re:Only over my dead body

[lgw]

The Department of Justice certainly remembers the Sony Rootkit. Remember, this rootkit found its way ont a great many government computers, which had to be cleaned by government IT staff, and was recent enough that there was already laws about that. Sony was fined enough for investors to notice, and punish the leadership, but the DoJ also said: do this again and Sony will no longer be a going concern in the US.

Any new spyware/rootkit product, even if intended only for the Canadian market, could also easily make its way onto US federal government computers, and the DoJ made it clear at the time that it wasn't just Sony they were warning - any company pulling this stunt again would cease to exist within the US. Apparantly the govenment's love for corporation does not reach quite so far as overlooking putting spyware on government networks (especially the DoJs own network) - so we've got that going for us.

Re:Only over my dead body

[the eric conspiracy]

It seems to me this law allows that.

After all corps are people too. And we certainly have reason to believe they are breaking laws.

Re:Only over my dead body

[Anonymous Coward]

Funny how the industry keeps digging their own grave, even when they're dead to us. Maybe this is what the zombie apocalypse turned out to be.

Re:Only over my dead body

[dryeo]

The Canadian government wouldn't put up with spyware being on their devices either though they would love it on the oppositions devices. This may be the carrot that gets it passed, this government is the most undemocratic government in memory, don't even call themselves the Government of Canada anymore, just Harpers government.
There will probably be a disable switch only known to the government and shared with friendly governments which hopefully will leak out.

Re:Only over my dead body

[PhxBlue]

I suspect Antivirus/anti-spyware companies (smaller ones, foreign ones) will provide methods of de-installing the spyware.

Cracking groups like Razor1911 et al might get into the game as well. And as always, the folks who buy the legit software will end up worse off than the people who don't pay for it.

Re:Only over my dead body

[Anonymous Coward]

buy Chinese direct

I 3 the chinese ability to ignore american laws

Re:Only over my dead body

[dwywit]

It won't be long before interested parties find out what hosts the spyware reports to, then that information will become public. Anti-malware suppliers can either provide an option to remove said spyware, or at the very least, block it at the nearest firewall. Hell, anyone with half a brain can just add a 127.0.0.1 entry to the HOSTS file.

Re:Only over my dead body

[Anonymous Coward]

Your offer is acceptable!

Re:Only over my dead body

[flyonthewall]

Fine, better take your last rites then.

Re:Only over my dead body

[Frank T. Lofaro Jr.]

Then they'll pass a law where providing tools to remove spyware will get you a 5 year prison sentence.

Re:Only over my dead body

[Yaa 101]

I disagree, the right sentense is:
"Over YOUR dead body, will you be installing spyware on my computer"

Re:Only over my dead body

[icebike]

Then they'll pass a law where providing tools to remove spyware will get you a 5 year prison sentence.

But preventing the installation of spyware is a totally different thing. Beside, you are talking about Canada here, not Australia.

Re:Only over my dead body

[Gr8Apes]

Funny enough, I'm pretty sure my BD ripper program doesn't phone anybody, especially as it's not on the net.

Re:Only over my dead body

[DarwinSurvivor]

Now he's wearing a Harper suit! Come to think of it, he's been wearing that suit for while. It must be starting to smell by now...

Re:Only over my dead body

[Gr8Apes]

I guess you don't know how this works. Governments really really really do not want foreign spyware on their systems. I mean REALLY don't. To the extent that they'll track you down and throw you into Guantanamo don't, at least in the US case.

Re:Only over my dead body

[idontgno]

Sure. Use the US model. Call the spyware "anti-circumvention technology" protecting "copyright access control mechanisms" and Bob's your draconian millienial copyright uncle, and the world is your rich copyright violation lawsuit plaintiff.

Re:Only over my dead body

[Anonymous Coward]

I suspect that the recording industry will get in bed with the anti-malware people to piggy back the spy software into their products. /tinfoilhat

Re:Only over my dead body

[VortexCortex]

Protip: If you're not running your Windows in a VM from a know good snapshot each "boot", then you're doing it wrong.

Anti-virus / anti-malware can not trust an infected OS not to lie about itself.

Run your malware scans from a known good source: Linux live CD, or bootable flash drive, if you're not using a VM. Even then, scanners might not have signatures for new malware, and malware could be a mutation that installs other malware so the "removal" process can't be trusted to work all the time. Keep a separate partition for data. Restore to a known good snapshot of the OS each boot. To add new programs: Install new software in the known good snapshot and re-image it, then run from that new snapshot. Get a virus or program with bad features? Restore to a point before it touched the OS.

Re:Only over my dead body

[grantspassalan]

And therein lies the problem. "Oh, but the law permits them to".

Stallman saw this shit coming decades ago, sadly he's right :x

Why not go a step further and mandate that all computer makers preinstall government approved spyware? Any user who removes such government mandated malware shall be guilty of a felony with a mandatory five-year prison sentence. /sarcasm

Re:Only over my dead body

[Anonymous Coward]

Then they'll pass a law where providing tools to remove spyware will get you a 5 year prison sentence.

They can only go so far before people simply up and ignore the law.

Once people start setting government buildings aflame and putting bullets into heads, one way or another the government intrusion will stop. Either willingly so by the government, or because every last citizen is dead and there is no one left to govern.

Re:Only over my dead body

[dryeo]

They don't seem overly worried about all the fake Chinese chips showing up in our respective air forces.
Too many links so here's a google search, https://www.google.com/search?hl=en&safe=off&client=seamonkey-a&tbo=d&rls=org.mozilla:en-US:unofficial&spell=1&q=counterfeit+chips+canadian+air+force

Re:Only over my dead body

[Cajun Hell]

Hopefully not buying the spyware is enough. It might not. If they pass a law that you have to just sit there and take it, when they come to your house, point a gun at you, go to your computer, type "sudo apt-get install spyware", and then say "type your password or else I will kill you" then you will have an important decision to make.

The decision: whether or not to tell them they're typing in the VM sandbox that you set up for just that sort of eventuality.

I say you shouldn't. But talk is cheap when I don't have a gun to my head.

Re:Only over my dead body

[Anonymous Coward]

In which case, the only option is to not buy the spyware-infested product. Since the spyware is secret, there's no way to tell which disks are infected and which are not. The only safe alternative is to avoid buying any official content what so ever.

No it's not. If private organisation are trying to make it legal to install spyware on random computers, they're trying to make it legal to spy on not just ordinary citizens but people who may be involved in top security and highly secret projects. By spying on these people, the private organisations can obtain information that can be used to blackmail these people into giving away highly sensitive information.

In short, the individuals who have made this demand, together with anygovernment official who is aiding them in implementing this law, are attempting to subvert national security. This, I believe, is a severe crime and all individuals involved should be arrested and put on trial.

Re:Only over my dead body

[farble1670]

That gets you part of the way there but the Internet Service Providers up here (at least the sh*thole known as Telus) reserve the right to install software on your devices. Can't get out of that without pulling the plug.

how are they installing software on your device if you are buying unlocked devices from non-carrier sources?

Re:Only over my dead body

[PlusFiveTroll]

If it's from the manufacture the drivers can bypass the hosts file and communicate directly with the network card if they wanted/needed to. You'd have to have an external firewall monitoring and blocking said traffic. Chances are the software would turn in Diablo 3 like, where you had to have an internet connection for it to work at all in the first place.

Re:Only over my dead body

[Anonymous Coward]

will you be installing your spyware on my computer.

If you set up a dummy network with no real Internet access sending the traffic straight to a Router you will find most of your programs will take a lot longer to load because they are trying to find the Internet to call home to send data home. For example: all of magix.com products. Voice recognition software from Dragon for a Windows system actually sends out samples of people's speech every time the product is loaded.

Windows 7 and Windows 8 notify Microsoft every time you switch on your computer to check to see that you are using a activated window system.
Most of the software products that declare you can switch the sending data home option off are simply not telling the truth. Some computer programs to get around the data protection act will program in a auto check for updates options which actually never receives any updates only sends out data.

Re:Only over my dead body

[dwywit]

Pardon my ignorance, but wouldn't the malware need an IP address to get packets out through the NIC? If that IP address isn't going to come from the usual sources (DNS, HOSTS file, etc) to avoid being dead-ended, then it would need to be hard-coded within the malware itself, updatable only by updating the malware or driver. Anyway, it's trivial to block access to a host whether you use its IP address or host name. And, the validation server for a game is not likely to be the same server that the spyware reports to, but I suppose you can tell the game to not start without a connection to the spyware and validation server/s.

Re:Only over my dead body

[mcgrew]

If I find that someone (Person or corporate entity.) has installed software on MY computer without my explicit permission, they will be explaining to law enforcement why they think they have the right.

LOL, who went to prison for Sony's XCP? I was bitten by Sony's malware almost ten years ago but idiots keep buying Sony's shit. It cost them NOTHING, I'll never EVER buy another Sony product but I'm one in seven billion.

Someone should have gone to prison for deliberately infecting thousands of their paying customers' PCs, but no... rich people only go to prison when they fuck over someone with more wealth and power.

Is there a silver lining in this cloud? FOSS will benefit... a tiny bit. There are too many people stupid enough to buy Sony products after XCP, OtherOS, and all the other fuckings over they served their paying customers.

If you have mod points and buy Sony, mod me flamebait because I'm calling you a fucking moron. God damned dumbasses. Yes, I'm still pissed and I still want someone in prison over this, but governments are and have always been owned by the rich. Expect malware in your proprietary shitware.

I want Sony to fucking DIE. Unfortunately, they won't be bothered one tiny bit. They can do any damned thing they want to you. Bend over and take it, serfs.

Re:Only over my dead body

[__aaltlg1547]

No problem. They'll upload their spyware-laden files to the services from which you download what you think are safe copies.

Re:Only over my dead body

[Gr8Apes]

I don't know - last time I actually had any insight into this, it was a very worrisome topic for the brass, at least for the US. So much so they banned working USB ports on all computers, among other things.

Re:Only over my dead body

[Anonymous Coward]

I hope you are right. If someone gets infested over this spyware - it opens gates for flood for court action against spyware, from which those bustards can't escape.
Captcha: felony

Re:Only over my dead body

[KiloByte]

"will"? Sorry, but future tense you used is inappropriate.

Take a look at new games, for example, and note how many of them come without some form of SecuROM, Steam or another kind of phone-home spyware.

Re:Only over my dead body

[KiloByte]

No, the original is sadly correct. If you try to step up to your rights, then get overwhelmed by force (legal, illegal or bought legal), they can do with your gear whatever they want.

Re:Only over my dead body

[Anonymous Coward]

Dude, they're way ahead of you, and have been for some time.

http://thepiratebay.se/torrent/7522392/NEW_2012_Sony_Rootkit_Exploit

And the fucking EULA says they can.

Re:Only over my dead body

[Nyder]

In which case, the only option is to not buy the spyware-infested product. Since the spyware is secret, there's no way to tell which disks are infected and which are not. The only safe alternative is to avoid buying any official content what so ever. The industry will drive any previously paying customers that give two s**** about their privacy to turn to the "piracy" avenue of acquiring content.
The contortions the industry goes through to reach out and nail their own coffin shut are quite impressive.

So you saying the pirates will be safe and the customers will be the ones affected?

Nice business model!

Re:Only over my dead body

[Anonymous Coward]

A fanciful understanding of law enforcement.

You and me both.

If I find that someone (Person or corporate entity.) has installed software on MY computer without my explicit permission, they will be explaining to law enforcement why they think they have the right.

Re:Only over my dead body

[Anonymous Coward]

But wait until the next video you buy requires a firmware update, then the next, then the next, sooner or later you'll plug it into the net to do those updates for you.... (Althought truthfully, you are probably smart enough not to do that, and will maybe use a USB Key, or even hack the device), but for the 90%, if it is easier to just plug it in they will :( And truthfully, companies don't care about the 10-20% of us who do care, they only care about the 80% (and that is NOT us).

Re:Only over my dead body

[TheHappyHippo]

But if you're not doing anything illegal you got nothing to hide. So if you don't want our fancy spyware you must be a pirate...

Re:Only over my dead body

[Anonymous Coward]

Which will spawn the next level of spyware which intercepts accessing the hosts file, making sure that such entries are not found there (and reporting anyone who has them as suspected pirate).

Re:Only over my dead body

[Gr8Apes]

You are entirely incorrect - it's a ripper, this isn't firmware, there is no content producer that supports this software.

BD+ has been broken for years. All versions. The entire approach was flawed from day one. The best thing the content folks could do is actually provide us with working product, instead of all this hackery that drives more and more folks to exercise their fair use rights and right of first sale. DMCA can actually be argued is in violation of the constitution, as it oversteps the boundaries allotted for Copyright. Copyright explicitly relates to the right to distribute copies, not the actual copying itself - something the **AA's routinely ignore in their paid for legislation.

Re:Only over my dead body

[david_thornley]

I suspect Antivirus/anti-spyware companies (smaller ones, foreign ones) will provide methods of de-installing the spyware.

That's what I would have thought before the Sony rootkit. AFAIK, nobody's anti-malware software caught it, and that was deliberate on the part of the AV people. (In other words, they screwed the cash customers.) Currently, I'm not nearly so sure.

Re:Only over my dead body

[JeanCroix]

Holy crap, really? I almost don't even want to own a computer any more.

Re:Only over my dead body

[Anonymous Coward]

Then smaller vendors can guarantee spyware-free products and eat the big companies' lunch. That and open source can solve these problems. The big boys continue to shoot themselves in the foot.

Re:Only over my dead body

[Anonymous Coward]

The Canadian government wouldn't put up with spyware being on their devices either though they would love it on the oppositions devices. This may be the carrot that gets it passed, this government is the most undemocratic government in memory, don't even call themselves the Government of Canada anymore, just Harpers government.
There will probably be a disable switch only known to the government and shared with friendly governments which hopefully will leak out.

yet another person whom can not comprehend how the liberals lost the last election, and why the NDP(Q) is only the opposition.

Re:Only over my dead body

[Anonymous Coward]

Huawei being another example: http://forums.cnet.com/7726-6132_102-5361088.html

Re:Only over my dead body

[CCarrot]

I'll never EVER buy another Sony product but I'm one in seven billion.

Make that two in seven billion...

I avoid Sony products like they carry malaria, now. I'm proud to say that the last Sony product I ever purchased was a PS2 (that sits in the basement, collecting dust). If I want to buy a CD, I make damn sure it's not a Sony Music CD: a movie, it can't be Sony Pictures, sorry. I'm sure they don't even notice, but I feel better...

I suppose the fallout if this gets passed will be a longer list of 'no-go' software/music/movie producers for me. *sigh*, oh well, time to start weaning myself away from closed source software anyway...

Re:Only over my dead body

[rhalstead]

I do that if it comes from Sony. I have not purchased a Sony product since the infamous root kiit. The only devices I have that will play a CD or DVD are my computers. I used to purchase around a 100 CDs and/or DVDs per year. That has gone to zero. Come to think of it, I've not watched the mainstream media or networks for close to 4 years either because of their biased reporting..and no, I'm not a conservative.

Re:Only over my dead body

[pnutjam]

Perfect, can I interest you in this iDevice that is guaranteed not to run any software the manufacturer doesn't approve.

//copyright enforcement software pre-installed and we retain the ability to yank back any content we disagree with.

Re:Only over my dead body

[Anonymous Coward]

So that would help these Canadians how?

Re:Only over my dead body

[Samizdata]

In which case, the only option is to not buy the spyware-infested product. Since the spyware is secret, there's no way to tell which disks are infected and which are not. The only safe alternative is to avoid buying any official content what so ever. The industry will drive any previously paying customers that give two s**** about their privacy to turn to the "piracy" avenue of acquiring content. The contortions the industry goes through to reach out and nail their own coffin shut are quite impressive.

So you saying the pirates will be safe and the customers will be the ones affected?

Nice business model!

Isn't this pretty much the way it works for PC owners now?

Re:Only over my dead body

[Anonymous Coward]

Amazingly, vast numbers of gamers seem to accept spyware/remote-controlware being installed on their computer and couldn't care less.

    http://en.wikipedia.org/wiki/PunkBuster#Games_using_PunkBuster

Of course, who reads EULAs? But perhaps if they realized that Even Balance was watching all their pr0n and cataloguing all the torrents they download, they might be a bit less complacent.

Re:Only over my dead body

[DarthVain]

I thought they already did. Digital-Locks. Circumventing them now has been made illegal I believe. It will be interesting if one ever goes to court.

Legit uses for legalized spyware

[Synerg1y]

Law enforcement computers, politician's computers, government computers, homeland security computers. My bet is within a week 50% of those folks wouldn't have jobs, and 75% in a month.

Re:Legit uses for legalized spyware

[Deadstick]

Those agencies install their own.

Re:Legit uses for legalized spyware

[Solandri]

Read TFA. This would allow you to do exactly that.

a program that is installed by or on behalf of a person to prevent, detect, investigate, or terminate activities that the person reasonably believes (i) present a risk or threatens the security, privacy, or unauthorized or fraudulent use, of a computer system, telecommunications facility, or network, or (ii) involves the contravention of any law of Canada, of a province or municipality of Canada or of a foreign state;

So if you think a police officer, politician, or someone working at the government is breaking any law - Canadian, provincial, or foreign, you can break into their network and computers and install your rootkit and keylogger. Hackers and groups like Anonymous would simply have to claim "we broken into the system because we suspected the owner was violating Moldavian law" or something like that, and they'd be in the clear.

Re:Legit uses for legalized spyware

[dryeo]

Probably everyone is breaking a foreign states laws, just think of Saudi Arabia and its insane laws.

Re:Legit uses for legalized spyware

[Drishmung]

So, they do understand that means the Chinese government can install rootkits on their servers, because they bought kit with chips made in China, and packets passing through them need to be investigated to ensure there are no dissidents using them, in violation of Chinese law (that would be the contravention of the laws of a foreign state mentioned)?

Re:Legit uses for legalized spyware

[Khashishi]

Probably everyone is breaking US laws. Who the hell knows all of them?

Re:Legit uses for legalized spyware

[Anonymous Coward]

HAH! Silly, you think that the same laws apply to them as they do to us. They put text like that in there to make you think that it actually might be used for "the good of society" or whatever. It won't. Ever. Like... EVER.

It's cute how naive you are.

Here's what you want to do in the future. Any time you read ANYTHING regarding privacy, or people's rights, or anything whatsoever that will affect the population at large, tell yourself the following: Absolutely everything that they say about how it will benifit society, or be good for you, are ALL complete lies. It will never be used as such. You have to think to yourself "Now, if I were horrendously corrupt and evil, how could I best use this to fuck over as many people as humanly possible, and get some coin in my pocket either immediately or in the long run?"

The answer to THAT question is what they actually plan to use it for. If you're lucky. Odds are they've had far, far longer to practice being corrupt, so they're going to think of dozens of ways to use it against you that you can't even fathom.

Re:Legit uses for legalized spyware

[Anonymous Coward]

The Guinness world book of record called, they said they want their tinfoil hat back.

Dear CCC et al

[gignac.adam]

Screw off. Sincerely, Canadians.

Re:Dear CCC et al

[jxander]

... without an immediate apology? Are you sure that you're Canadian?

Re:Dear CCC et al

[overmoderated]

Honey, so soon?

Re:Dear CCC et al

[gstoddart]

OK, how's this ... Dear CCC et all, we're sorry to hear you're a bunch of ignorant douchebags who feel it should be your right to install crap onto our computers. Screw off. Sincerely, Canadians. Have a nice day.

Re:Dear CCC et al

[Em Adespoton]

Canadians might be polite when it comes to battling ignorance -- they get pretty rabid if you go after their privacy though.

You see, the 52 nuances of "sorry" have very specific meanings. The "Oh, sorry for not letting you in front of me in line" sorry translates to American as "you ignorant prick". However, it has the advantage that the recipient can't really take offense in a violent manner without looking like a real scumbag.

Re:Dear CCC et al

[Anonymous Coward]

The best way of dealing with this is to shine a light on it. Make sure the CBC gets hold of this story, particularly their investigative units like Marketplace. It will wind up in the House of Commons during Question Period.

Frame the whole thing in terms of invasion of privacy, spyware, hidden software (just like a virus!), point out that the rights of children to are being trampled (not just the parents).

Next inform the Office of the Privacy Commissioner.

Finally sit back and watch the cockroaches scuttle for the dark corners.

Re:Dear CCC et al

[mark-t]

What are the other 51 nuances?

Re:Dear CCC et al

[CCarrot]

... without an immediate apology? Are you sure that you're Canadian?

That's why he said "Screw off" instead of "Fuck off, you miserable, goat sucking, syphilitic, halitosis-ridden sons of diseased moose shit." Sincerely.

You know you were thinking it...

I reserve the right to install and recommend Linux

[overmoderated]

On every machine I find.

Open Source

[DaMattster]

This makes a good argument for using open source. Removing a secret rootkit is a lot easier when the underlying layers of the operating system aren't obscured. I'll be this goes nowhere. Either that or proprietary OS vendors suffer sales losses as people flock to Linux and *BSD

Re:Open Source

[overmoderated]

Only if you can read code. What about people who can't and who rely on the integrity of companies to provide them with proper software. Oh, that's right. Companies and integrity don't mix.

Re:Open Source

[overmoderated]

Futhermore, you cannot expect all users to be familiar with netstat, iptables, tcpdump and other similar tools.

Re:Open Source

[fredprado]

Only if you or anyone whom you trust can read code. That is not so hard to find. Open source is open for all, and chances are that anything fishy inserted in open source software will be detected by someone and the whistle will be blown.

Re:Open Source

[overmoderated]

I'm not doubting the integrity of the open source community. I'm saying that the majority uses closed source software and are unaware of the potential risks.

Re:Open Source

[SolitaryMan]

Well, it only takes one user to find it and tell everybody about it. I would argue that Open Source systems are at better position here.

Re:Open Source

[overmoderated]

I'm not doubting the integrity of the open source community. I'm saying that the majority uses closed source software and are unaware of the potential risks.

is aware :)

Re:Open Source

[lightBearer]

One can also choose a distro to trust and not install software that falls outside of their core repositories without running it past that friend of yours who can read code.

Re:Open Source

[mark-t]

Oh... if only.

I'm just waiting for them to come to the conclusion that running such OS's is "circumventing" the so-called "digital protections" (aka rootkits, spyware, etc) they have put in place, and thus illegal under the anti-circumvention provisions of Bill-C32.

Re:Open Source

[icebike]

True, but that is just one more argument for going to Linux or something.

Even if the users inserted on of these companies disks, the spyware on those disks is heavily dependent on Windows.
Its doubtful they even have a linux version. If they do, the community will discover it in short order even if they try to install
via binary blobs. Word will spread.

Re:Open Source

[Anonymous Coward]

Only if you or anyone whom you trust can read code. That is not so hard to find. Open source is open for all, and chances are that anything fishy inserted in open source software will be detected by someone and the whistle will be blown.

or the open source community can change how the OS is installed - the core and supporting binaries installed on a separate partition that is periodically compared - signature changes and or services added would send an alert - there are several good ways to detect changes to an OS. I use a similar version to this except I compare the kernel level and binaries to backup that was made when the OS was first installed and prior to it being connected to the internet. any file that changes size outside of directories like /home are flagged and put in a file....I just haven't fully figured out how to handle yum updates...

Re:Open Source

[Anonymous Coward]

That's much better than what we get from closed source vendors. I really don't understand why we keep hearing arguments against this, it's pretty evident which group has the benefit here.

Re:Open Source

[Frank T. Lofaro Jr.]

Exactly.

Making it (spyware, malware which stops your PC from doing unapproved things, etc) legal isn't enough, if people can fight it by disabling it, removing it, etc.

If the law won't stop it, but people can, the companies pushing for this gain nothing.

So they have to make it illegal for people to fight against. Claim a property right in the software or an anti-circumvention prohibition and say people fighting it are interfering with property and/or circumventing protections.

Re:Open Source

[DarwinSurvivor]

They can try that, I'll just tell them I circumvented nothing, their shit software failed to function properly.

Re:Open Source

[Anonymous Coward]

Only if you can read machine code. The source only gets you so far if the compiler's compromised - see Reflections on Trusting Trust.

Are we in China or some place like it?

[Maow]

It's getting pretty hard to differentiate between living in North America under corporate controlled government and China under government controlled corporatism.

If only there were a similarity that I could put my finger on, it seems there is but it escapes me.

I guess we'll see how similar if this passes. I doubt it will, but it indicates we have more in common that I'm comfortable with. Hell, just the fact that this has been proposed is a lot more egregious than I'd have ever imagined possible just a few years ago.

Re:Are we in China or some place like it?

[overmoderated]

It's getting pretty hard to differentiate between living in North America under corporate controlled government and China under government controlled corporatism.

Different control mechanisms, same goal.

Re:Are we in China or some place like it?

[Anonymous Coward]

Shit like this goes down all the time. This isn't the first time and it certainly won't be the last. If you feel that strongly about it, write to your MP and to the Industry Minister and have your voice heard. Sulking about it won't fix anything.

Re:Are we in China or some place like it?

[hedwards]

Indeed, I spent the last year living in China. And it was really disturbing how quickly I got used to having no say at all in anything. It's no wonder that most Americans are so complacent. I only hope that the Canadians are smart enough to avoid that. I wouldn't mind moving to BC and taking my trade craft with me.

Re:Are we in China or some place like it?

[Anonymous Coward]

It's getting pretty hard to differentiate between living in North America under corporate controlled government and China under government controlled corporatism.

It's not so hard. Go outside and take a look around you. Then, come back and take a look at Beijing. Your corporate controlled government likely still manages some useful "socialist" regulations.

Re:Are we in China or some place like it?

[Anonymous Coward]

Different control mechanisms [citation needed], same goal.

Hang them. Problem solved.

[Anonymous Coward]

Hang them. Problem solved.

Re:Hang them. Problem solved.

[overmoderated]

Brutal, but effective.

Re:Hang them. Problem solved.

[Anonymous Coward]

Hang them. Problem solved.

Hire a hitman. Works better although it's more costly.
But hey, whoever said that disinfectation was free ?

Re:Hang them. Problem solved.

[VitaminB52]

I dislike your solution for the problem.

However, I hate the problem more than I dislike the solution.

Re:Hang them. Problem solved.

[hedwards]

I dunno, I hear that sunshine is the best disinfectant and they haven't gotten around to charging for that yet.

Re:Hang them. Problem solved.

[leonardluen]

But it doesn't work on vampires.

Re:Hang them. Problem solved.

[jamiesan]

Hangin's too good for 'em. Burnin's too good for 'em...

Re:Hang them. Problem solved.

[Anonymous Coward]

They need to be torn into little bitty pieces and buried ALIVE.

Sorry, it's such a classic I had to finish it.

Re:Hang them. Problem solved.

[canadiannomad]

The french had a good solution for politicians that got out of hand.......
Old solution to a modern problem :)

Re:Hang them. Problem solved.

[DarwinSurvivor]

Personally, I'm partial to drawn and quartered.

Re:Hang them. Problem solved.

[canadiannomad]

But how would a drawing being cut into 4 pieces do any good? o_O

:P

Re:Hang them. Problem solved.

[WillAffleckUW]

But it doesn't work on vampires.

There is always guillotines. Those work.

Re:Hang them. Problem solved.

[mrbcs]

STERN ! ;-)

How about killing obsolete business?

[betterunixthanunix]

Instead of legalizing a practice that would otherwise be illegal to protect obsolete businesses, why not legalize a practice that is otherwise illegal to rid ourselves of those obsolete businesses?

Re:How about killing obsolete business?

[jxander]

Money, my dear boy. (best spoken aloud with a posh British accent)

Why should the powers that be do anything logical, if logic dictates that they make less money? They'll gladly spend millions to ensure their archaic practices are retained as long as it takes to recoup the millions they spent ... with interest.

Re:How about killing obsolete business?

[TheGratefulNet]

I don't, for a minute, believe this is there for the business guys.

more and more, government does an end-run around laws by having a company do its dirty work and then contracting to the company. we see this a lot in lots of areas, where it would be 'bad' if the gov directly did X, but if they were clean-hands and did not do X directly, they can escape the laws.

this is what I worry the most about. not sony or some stupid company but the fact that this lets governments who are out of control (ie, all modern ones) skirt the laws that are supposed to ensure a just and lawful society, where we could trust our leaders to look out for our interests.

don't look one step ahead, look two steps and you'll agree that this is not just possible but a standard MO.

Re:How about killing obsolete business?

[king neckbeard]

The companies aren't doing these favors out of the goodness of their hearts of their patriotic duties. They are getting something out of it, whether they are literally being paid to do so, getting legislation in exchange, good favor from the government, etc. Also, it's worth noting that a lot of government action is at the behest of corporations, typically in actions that the corporations couldn't legally do themselves, but occasionally actions that would be legal, but expensive.

Re:How about killing obsolete business?

[VortexCortex]

why not legalize a practice that is otherwise illegal to rid ourselves of those obsolete businesses?

The needs of the money outweigh the needs of the you.

Re:How about killing obsolete business?

[Inda]

My good man, all posts on /. sound like that in my head.

Maybe I've missed your point?

Happened already here.

[Anonymous Coward]

My own computer running Windows 7 was hacked in a drive-by when I visited a website (didn't download anything), and the drive began spinning wildly. The router logs showed connections to the Dutch anti-piracy group, BREIN. If it's not currently legal, it isn't stopping them.

Re:Happened already here.

[Anonymous Coward]

What site was that?

Re:Happened already here.

[Anonymous Coward]

I believe some countries have laws where striking back at the systems of those who break in to your system is legal. Set up a DDoS of that anti-piracy group.

Re:Happened already here.

[mug funky]

you quite possibly caught Anonymous' latest ddos weapon...

Re:Happened already here.

[Anonymous Coward]

You were most likely infected by a trojan from some Anonymous script kiddies trying to DDOS anti-piracy websites with a botnet.

I get the message

[Anonymous Coward]

They are saying

"Look. Piracy exists, and with piracy, you get none of this spyware. With piracy, things are free, often easier and faster to get, and many times they work better. We know you need your money, so we want to make sure once and for all time, that you never, ever waste it giving it to us."

Loud and clear.

Also: How far down the road is piratebay.org in comparison to sneakyfucktards.com? Discuss.

Let's not blame ALL Canadians, shall we?

[eksith]

This is just a case of bureaucrats being bureaucrats as usual and common sense taking a back seat.

There are plenty of level-headed folks with a tenacity for doing what's right up there in moose country that will fight this tooth and nail (Theo comes to mind). At most, this will cause a whole lot of noise a la SOPA and eventually get dumped.

Besides, the anti-spam legislation, I hear, is quite popular. More than this rubbish is popular with law enforcement.

Re:Let's not blame ALL Canadians, shall we?

[Dins]

I don't think anyone's blaming Canadians in general. It's just one stupid company who needs to be smacked down, doesn't matter where they are.

Re:Let's not blame ALL Canadians, shall we?

[Anonymous Coward]

However, if this happened in the US, Europeans and Canadians would be blaming the entire US populace for being lazy, stupid, and complacent for letting this happen (despite it not actually happening yet). Remember, the US government, corporations, and populace are all one super hive-mind! If one person wants it they all do!

Looks like we're going down the copyright tubes

[drussell]

I was dismayed to see this article in the paper today:

http://www.calgaryherald.com/technology/Smartphone+storage+memory+cards+exempt+from+copying+fees/7920963/story.html

I didn't think we'd (Canada) be stupid enough to actually go through with this new copyright bill, but it seems that it has.

An IP address doesn't identify a person

[Anonymous Coward]

Spyware like this can prove that someone did indeed commit acts of copyright infringement as alleged. Do in a sense, it's the next logical step from a law enforcement perspective.

But we're getting to the point where the cure is clearly more harmful than the disease. Have the *AA's not learned anything from the Sony rootkit debacle?

Re:An IP address doesn't identify a person

[overmoderated]

You hit the nail right on the head. IP addresses can be spoofed. Long live Tor nodes and secure browser profiles.

Re:An IP address doesn't identify a person

[VitaminB52]

Spyware like this can prove that someone did indeed commit acts of copyright infringement as alleged.

No, it can't. Since the TFA talks about "a group of 13 industry associations", we would get every one of these industry associations to install it's own spyware package on your machine.
So if copyrights were to be infringed from your machine, who can prove that YOU were to one to do it, and not one of the spyware packages? All one can prove is that it happened from your machine, not WHO or WHAT did it. A compromised system is by definition out of your control.

Re:An IP address doesn't identify a person

[overmoderated]

What if the spyware is designed to provide such proof? Using a webcam to transmit pictures of the user for instance.

Re:An IP address doesn't identify a person

[LoRdTAW]

I imagine if the computer had a webcam, they would snap a picture along with the infringement evidence.

CAD **AA Lawyer: Your honor, ladies and gentlemen of the jury, if we examine exhibit A you will see that at on November 12th 2014, at 11:24 PM Sally Smith visited a known website which engages in piracy or illegal downloading if you will. She downloaded what is called a torrent file which enabled the defendant to download an illegal copy of Star Trek: Into the Darkness. From that illegal copy our "copyright law enforcement software" logged that seventeen copies were uploaded to other users. We are seeking damages equal to the cost of making the film, squared.

Judge: what proof do you have that it was in fact Sally Smith who was actively engaging in the heinous crime of illegally downloading a precious piece of Hollywood?

CAD **AA Lawyer: Your honor, our "copyright law enforcement software" detected the presence of a web camera which allowed us to record the user as she committed the crime. Article 5 paragraph 34 of the Canadian copyright enforcement act explicitly allows us the right to enable remote viewing of criminal behaviour once it is detected.

Judge: proceed.

Re:An IP address doesn't identify a person

[leonardluen]

Spyware could theoretically also use Tor nodes to report your real IP to authorities, or the *AA.

i fail to see how TOR will save us if the spyware/keylogger is installed on your computer.

Re:An IP address doesn't identify a person

[VitaminB52]

A picture of the user sitting at the keyboard is no evidence if other software/spyware capable of downloading copyrighted has been installed (without user knowledge or consent) at the same computer.

All the picture proofs is that said user was using the computer at a certain point in time. It doesn't proof the user was doing the download of the copyrighted material. If there was other spyware running at the computer, then that other piece of spyware could be performing the download. All recorded keystrokes, mouse clicks and other logged event are suspect if spyware packages are running at the a machine.
If such a picture were to be accepted as 'evidence' in court, then hackers could easily frame anybody they dislike. Just install the hackers spyware package, spoof some 'evidence' towards the corporate spyware and another sucker gets owned.

Re:An IP address doesn't identify a person

[Beardo the Bearded]

Max damages in Canada are $5000 for all your piracy ever.

That means they can only sue you in small claims court.

If you go to small claims by yourself and the other guy sends a dozen lawyers, the judge will almost always find in favour of the guy by himself. A really good judge will take 50+ hours to do so in order to mess up the team of lawyers.

Also I have electrical tape over my laptop's camera.

Re:An IP address doesn't identify a person

[VitaminB52]

If there is spyware on a machine, doing it's dirty thing without the users knowledge or consent, then any piece of event logging, keystroke logging or pictures taken is suspect. It could be produced by the user, by other spyware, or by a hacker with access to the machine.

The very fact that the 'evidence' is collected by spyware is full evidence that spyware is performing activities the user is unaware about. It implicitely proofs the machine is not under full user control. It therefore proofs not all actions performed at the machine are endorsed by the user.

Since one piece of spyware/malware managed to get installed on the computer means users anti virus and anti malware software is not up to its task. If that is the case, then the installation of other spyware/malware packages is very likely. Meaning there is reasonable doubt about who or what did a download.
And you can not convict a suspect if there is reasonable doubt - not yet anyway.

Re:An IP address doesn't identify a person

[jxander]

Spyware like this can prove that someone did indeed commit acts of copyright infringement as alleged.

Having police officers break into someone's house at night, unannounced and without warrant, can prove that someone did indeed commit whatever crimes they're accused of. While they're in there, might just find a few more crimes to accuse them of.

We wouldn't for a second tolerate this level of intrusion in meat-space... why is it permissible on computers?

Re:An IP address doesn't identify a person

[um... Lucas]

Last I read, tor is useless for bit torrent. Not only is. It horrendously slow, but bit torrent clients go ahead and publish their users real ips in the process.

Re:An IP address doesn't identify a person

[WillAffleckUW]

Also I have electrical tape over my laptop's camera.

You should use duct tape. It keeps your tear ducts from welling up and splashing on the laptop camera lens.

Re:An IP address doesn't identify a person

[mark-t]

How do you spoof your IP outside of your own LAN?

If you try to use an IP that your ISP owns, but isn't the one actually allocated to you, the company's hardware that connects your network to theirs may simply reject your packets out of hand. Even if it doesn't, the risk of IP collisions will get pretty high, and will alert your ISP to your activities.

If you try to use an IP that your ISP doesn't own, even assuming that you can get past the company's hardware that connects your network to theirs, they would still be able to spot it in an instant, again, alerting the ISP to what you were doing.

There are legitimate reasons to spoof an IP, but I can't think of any that are applicable to when you are utilizing a network that you do not either own or have any rights to administrate (ie, your ISP).

Re:An IP address doesn't identify a person

[overmoderated]

It's called a proxy chain.

Re:An IP address doesn't identify a person

[mark-t]

That's not IP spoofing... that's using a proxy. IP address spoofing tends to mean something else entirely, and, as I said... can't generally be practiced outside of a LAN.

Re:An IP address doesn't identify a person

[overmoderated]

Potato, potatoe. It is pretending to be somebody else. Same basic principle, just a different network layer.

spoof (spf)

1. Nonsense; tomfoolery. 2. A hoax. 3. A gentle satirical imitation; a light parody.

tr.v. spoofed, spoofing, spoofs

1. To deceive. 2. To do a spoof of; satirize gently.

Re:An IP address doesn't identify a person

[mark-t]

No. Not the same at all... With a web proxy you are only "anonymous" to the end-point site you are communicating with. You are not necessarily anonymous to the proxy, since you are providing your real IP to them, and the proxy's IP address is not remotely anonymous to the site you are connecting to through it. Theoretically, any proxy server you connect to could very much be capable of providing the IP address that you connected to it from to a requesting party, and from there, you might get the ISP, which can then trace to your own personal connection. Multiple proxies in between merely add more layers of indirection, the actual level of anonymity is still roughly the same. In fact, with the only anonymity you get with a proxy is the minimum of either the amount of anonymity the hosts of the proxy network are actually willing to provide you with, and the amount of anonymity you might get by making it inconvenient enough to find out who you are that somebody who might otherwise be interested could not practically justify the effort or expense of finding you.

IP spoofing, on the other hand, is something that you administrate entirely yourself, and involves forging the sender's address that is embedded in any IP packets that originate on your computer. NAT is a well-known form of IP spoofing.

Technical terms have technical meanings. One would think people who've been reading slashdot for any period of time would know that.

How ridiculous?

[lorinc]

How far all thess jokes will go until we decide collectively for a stop, and just throw all those IP crap out the window?

Sure - no problem

[Eristone]

I say absolutely. As long as part of the law is continuous video surveillance of all executives of the companies that install the spyware. (Bedroom, bathroom, mistress' place, hotel room, etc.) And their families. And it has to be accessible by any Canadian citizen to do with as they please at any time.

Re:Sure - no problem

[Anonymous Coward]

And why not? They don't have anything to hide, do they?

I'm not going to apt-get it.

[scorp1us]

Not even if it is open source.

Re:I'm not going to apt-get it.

[overmoderated]

Use make instead.

Re:I'm not going to apt-get it.

[PolygamousRanchKid]

In Soviet Kanada, Corporate Spyware apt-gets you!

They'll just send someone by to install it:

Ding-Dong! "Hi, I'm from your local utilities, I'm here to read your power meter, check your gas meter, and install our Corporate Spyware for you."

Easy in Canada . . . nobody bothers to lock their front doors.

Re:I'm not going to apt-get it.

[scorp1us]

Sure after I comment out everything between { and } in int main(int arc, car*argv[])

Re:I'm not going to apt-get it.

[DarwinSurvivor]

Believe it or not, that would probably make you guilty under bill C-32.

Legal definition of 'behalf'

[Jmc23]

in Canada seems to be where the problems would stem from. Would it be considered in 'my' best interests to install software to incriminate myself?

Re:Legal definition of 'behalf'

[Anonymous Coward]

and the canadian government wonders why things in canada are more expensive than the U.S. It doesn't always take a government report to know why things are more expensive there.

nobody ever won a war with their customers

[Presto Vivace]

It is amazing that corporations do not recognize this simple truth.

Re:nobody ever won a war with their customers

[Anonymous Coward]

But in special circumstances, some did win some fights ("any color as long as it's black" rings a bell?)

Re:nobody ever won a war with their customers

[Common Joe]

I dunno. Does AT&T qualify?

Re:nobody ever won a war with their customers

[Presto Vivace]

very droll

Great

[Anonymous Coward]

The spyware should also be able to $SYS$steal retrieve banking and credit card information from the users. This way they could automatically charge them for any usage of their 'content'.

Re:Great

[Em Adespoton]

This raises a very valid point: once this spyware is on a system, it'll be trivial for malware authors to co-opt the malware to steal data for their own use. Not to mention, the temptation for PRIVATE GROUPS to misuse information lifted from private citizens in secret is huge.

Luckily, this goes against Canadian Privacy law in so many ways, I don't see how even the Conservative government could succeed in ramming this through.

Re:Great

[dryeo]

Once the Conservative government considers the usefulness of this software on the oppositions computers and the usefulness of it on voters computers so they know how to target those voters they'll ram it through.

With the Current Canadian Administration...

[IonOtter]

...these so-called "business groups" will get everything they're asking for. With extra tongue.

The U.S. administration has probably given this up long ago, we just haven't heard about it yet.

Can install our spyware on their computers too?

[WarrenLong]

I guess I am okay with this, as long as we can install stuff on their machines as well. I am pretty sure that they have a lot more to hide than I do...

Look at the Bright Side

[sycodon]

When they do install it on your computer, you will know who to hunt down and kill.

Only One Appropriate Response

[Scarletdown]

The only appropriate response to such a request is, "Go fuck yourself."

I'm breathlessly waiting...

[Anonymous Coward]

...for the Linux version. Ooo ooo ooo & Linus' comments on how badly implemented it is...:-)

Re:I reserve the right to install and recommend Li

[denmarkw00t]

That doesn't solve the problem, though - more and more people are using Linux on a regular basis, and while they are shielded from a good majority of threats seen on Windows, it doesn't meant that 1) there isn't spyware that can affect them and 2) that they would know how to lock down their systems just because they have an OS more capable of being finely-tuned and locked down. Don't mistake a great tool for a great carpenter.

Spyware that spies on the spyware

[overmoderated]

See? Problem solved. Second line.

5 years too late

[TheSkepticalOptimist]

I don't use a PC for copyright infringement anymore.

Damages

[boristdog]

And when the software inevitably bricks a few thousand (or hundred thousand, or million) devices and people lose untold billions worth of data...Will these companies be required to provide just compensation since no EULA was even clicked?

How much are those lost photos of a couple's new baby worth to them, anyway?

Then here's what you can do to understand code

[Anonymous Coward]

Go find a cliff or a bridge somewhere then take your entire fucktarded family. Have all of them jump off to their deaths and after that jump to yours as you are too fucking stupid to even exist let alone use a computer.

These exceptions would legalize hacking in Canada

[Eightbitgnosis]

http://tinyurl.com/9wpxjg6 Page 11-12

These exceptions they are asking for are so very broad. Take a look this exception they're seeking,

(a) a program that is installed by or on behalf of a person to prevent, detect, investigate, or terminate activities that the person reasonably believes (i) present a risk or threatens the security, privacy, or unauthorized or fraudulent use, of a computer system, telecommunications facility, or network,

Do you believe the RIAA poses a reasonable threat to your privacy from their new rootkits? Well then it seems, under this law, you could install a trojan horse on their computer, read their files, and then crash programs that might end up help the RIAA from violating your privacy...Like Windows

Cross platform availibility?

[LoRdTAW]

I hope they provide the source to their security software or at least port it so it can run on on Linux/BSD. I want to continue to legally be able to watch DVD's and BluRay movies/TV shows on my Linux HTPC.

Re:Cross platform availibility?

[Beardo the Bearded]

Well, they could just push an update to a BR player to be a packet sniffer.

The Gun Rights Argument

[emorning]

I'm not a big supporter of gun rights here in the US but it just occurred to me that now I understand the argument that 'only people that have guns will be the criminals'.

In this case, the only people with rootkits installed on their machines will be the law abiding citizens.

PS: I assume they'll also make it illegal to remove a rootkit, so people that just care about their privacy instantly become criminals too.

Re:The Gun Rights Argument

[Anonymous Coward]

Since you're commenting from the States, you do know that even a normal concern for privacy is considered an indication that you're a terrorist. Look up the current flyer form the FBI. Paying for purchases with cash, not letting people look over your shoulder and see what's on your notebook, stockpiling supplies of food and water and trying to affirm your rights under the Constitution are all indications that you might be a terrorist.

Anyway, so they get you coming or going. If you don't protect your identity and personal information the criminals can get it. If you do protect yourself, the government comes after you saying that if you're hiding it then it must mean you're doing something illegal. Wonderful system.

Re:The Gun Rights Argument

[DarwinSurvivor]

I'm not a big supporter of gun rights here in the US but it just occurred to me that now I understand the argument that 'only people that have guns will be the criminals'.

In this case, the only people with rootkits installed on their machines will be the law abiding citizens.

PS: I assume they'll also make it illegal to remove a rootkit, so people that just care about their privacy instantly become criminals too.

They already did.

Legalized Vigilantes

[Anonymous Coward]

Yes this sounds like an excellent idea.
Corporations are already tax havens, now they're turning into law havens.

Microsoft - stop these dick fucks jacking the kernel please. Windows is turning into an STD infested cheap hooker of an OS.

Everyone is missing the obvious.

[Anonymous Coward]

This is Canada were talking about here, no politician has the balls to go through with this. Even one of our provinces doesn't have the balls to separate after they continuously threaten to do it.

Re:Everyone is missing the obvious.

[Anonymous Coward]

My suggestion regarding that province is to have a referendum in the rest of Canada to decide if we're going to put up with this special child any longer. Time for it to come into the fold or get the heck out and if it won't leave and won't become part of the country proper then we should withdraw our support of it.

Re:I reserve the right to install and recommend Li

[UltraZelda64]

Watch out for those Windows 8/RT ARM-based machines. Not possible without money going to Microsoft for a key.

Re:I reserve the right to install and recommend Li

[Anonymous Coward]

Exactly. The average naive user will enter their password, or the root password, in a box when prompted to do so.

I lobby...

[Anonymous Coward]

I lobby for the right to kick these fuckers squarely in the nuts.

-- green led

Naw...

[PopeRatzo]

They wanna do WHAT now?

I'm starting to think it's going to take some heads on pikes before they get the message. And every day it seems more likely I'll see such in my lifetime.

I don't know about you all, but I'm putting some money in guillotine futures.

Re:Naw...

[Frank T. Lofaro Jr.]

I don't know about you all, but I'm putting some money in guillotine futures.

So you'll make money even if the gov't wins and executes all the people it doesn't like.

Win-win. (in a way)

Re:Naw...

[PopeRatzo]

So you'll make money even if the gov't wins and executes all the people it doesn't like.

Why should I be any different from the rest of the financial elite?

Did you know the top 1%'s income rose by 60% since the financial downturn?

Like they say, when poor people get lemons, force them to make me a nice lemonade and give me a backrub.

Re:I reserve the right to install and recommend Li

[the eric conspiracy]

I have a drill press in my garage for dealing with such defective equipment.

Buy huawei

[Anonymous Coward]

I'd rather by spied on by the chinese than corporations in the united states

Re:Buy huawei

[Anonymous Coward]

I'd rather by spied on by the chinese than corporations in the united states

You're not interesting enough to spy on.

signed, American Corporate CEOs.

Re:Buy huawei

[WillAffleckUW]

I'd rather by spied on by the chinese than corporations in the united states

I see you missed CBC last night. Where the Chinese Ambassador said something about this. At least on 22 Minutes they gave the translation.

hello, anonymous? got targets

[swschrad]

spend some time up in .ca land, leave a message.

thank you.

EULA

[Anonymous Coward]

why dont they just put it in their EULA, like how adobe scans for registration keys and whatnot for their own products if you install flash player. oh they dont want to look like evil maple syrup mainlining weirdo's i get it... blame canada.

Time for niceness has ended

[phorm]

You joke, but look where being nice and/or polite has gotten us so far.

These guys don't play nice...

Same as it's ever been

[Anonymous Coward]

So it's basically what we already have now.

Pirivacy?

[Anonymous Coward]

This will spawn an entirely new term:

Pirivacy. Those who practice it will be Silicon Pirites :D

Although I condone raising chemistry and geology geekdom, what's wrong with reusing good old term "Privateering" and "Privateers" in this new context?

Re:Pirivacy?

[Nostromo21]

I thought he was going for pyrrhivacy, as in pyrrhic privacy :)

Re:Pirivacy?

[Nefarious Wheel]

Or Pyrites. It is indeed worthy of sulferous language, but he did specifically say Silicon, ironically enough.

Re:Pirivacy?

[Em Adespoton]

Eww... I saw what you did there xP

BYOD Devices behind Government Firewall

[Anonymous Coward]

Rootkits written by Foreign Governments. Undisclosed Zero Day Microsoft Exploits. Badly written Laws. Secretly Installed Software. LOL! What could go wrong?

Somebody has been snorting the magic security fairy dust again.

Of course they realize the IT budget line is going to need a Fat Increase this year to deal with this additional vector of security compromise. Training. Scanners. Awareness. Detection. Monitoring. Logging. Removal. Forensics to figure out what got stolen, and who has it now.

Better bump up the budget for the Lawyers too to take the case to court. That would be a court in a foreign country. Travel Expense. Hotel Expense. Translators. Can Canadian Lawyers practice law in Red China ?

The accountants will need a bigger budget to add paragraphs on the financial statements disclosing the new risks. After an audit. A new type of audit that will take money to decide what that new type of audit is supposed to do.

The Insurance Guy is going to want more. More Risk == More money.

No Warrant Request to use root kit access

[Anonymous Coward]

Or just exploiting a bug in the root kit.

Re:I reserve the right to install and recommend Li

[denmarkw00t]

And Linux, just as OSX and Windows, often assigns the root password to the first user's password - OEMs used to add their own passwords (at least on some Windows boxes I've used), but it seems they stopped after there was a bunch of "WTF is an Administrator Password? Try Kitties123" I'm thankful for it when I work on someone else's computer, while simultaneously cringing that an entire machine is at the mercy of "stormclouds1"

Still, security ultimately falls on the user - to make an OS stronger we inevitably must make the user smarter, but let's keep throwing firewalls, anit-virus, and ad-block at them until at least they have a computer, even if they don't know what it does or why they haven't seen strange pop ups in months (how many frickin times can you advise someone to at least use a different browser, or less malware-laden porn site?)

Keystone XL Pipeline Project. TransCanada

[Anonymous Coward]

Has asked the Head of IT security of TransCanada about how he is going to protect his company's sensitive against this threat?

How about the plant operators at Syncrude and Suncor? What measures are they taking to secure against this new attack vector?

Just make sure they let the consumer know

[aklinux]

If they disclose this on clearly the package, similarly to what is done w/ cigarettes, I have no issues with it. The labeling certainly hasn't done much to stop the sale of tobacco.

As far as I'm concerned, they can put key-loggers, root-kits, or whatever the hell else they want as long as they make the consumer aware.

For an icon, they could use a 'human looking' figure. Bent forward, pants down, maybe holding a jar of Vaseline?

I, of course, won't be buying it. But I wasn't buying it anyway.

Vote with your wallets

[Tool Man]

Simply stop buying their crap, there are alternatives. I think the choices will start to become more apparent to the masses over time, and the losers will be those depending on unsupportable business models.

Consider: You can buy DRM-free music, today, where they make no attempt to lock it to specific devices. Emusic is one, and Magnatune is another. In the latter case, you are even encouraged to share your purchase in limited amounts, and there's also free streaming if you are OK with the per-song nag message. Non-lossy formats are supported too, and they go for quality content instead of large amounts of crap. (Yeah, preaching here, but I just bought a lifetime membership.)

In TV/movie terms, Netflix has just released a season of a series, "House of Cards", that *they* produced. Screw Sony and their ilk, this is produced and distributed without their help. I'm hoping this gives big media companies a shocking wheeze, where it's apparent even to them that they're becoming irrelevant.

Re:Vote with your wallets

[Anonymous Coward]

I think you are underestimating the apathy and stupidity of the Canadian (also American and European) public.

They think if they ignore it, then it will "magically" go away. They'll say the most asinine and horribly stupid things to excuse it like "if you aren't doing anything wrong, then you don't have anything to worry about" and "nothing will stop me from listening to the greatest music ever from Lady Gaga and Justine Bieber!"

What you don't understand is these companies have studied (in great depth) the psychology of how pathetic and purposefully retarded the general public actually is. If it doesn't have sex, beer, sports (only the vicarious kind living through the lives of sports entertainers who do drugs, go to jail, act like jerks, and curse that same fan base), soap operas, reality TV, or egotistically competing with the Jones' to prove how much better they are since they have a slightly newer shinier car... then they don't want anything to do with it. Read that last run on sentence again.

I hate to be the pessimist here... but the vast majority of people are brainwashed and fill their lives with "entertainment" to cover up what losers they actually are (which is why the depression rates and prescription drug use are sky-rocketing). See... it's about priorities. If they didn't care more about entertainment (where "artists" get paid in the millions and are worshiped) than they did about curing cancer (where the funding is so low, it's a miracle they get by on government funding) or solving the major problems in this world, then your "answer" would have a chance.

Never underestimate how dumb, lazy, apathetic, and blind most people in this day and age choose to be. Sucks, but it's 100% the truth.

Re:Vote with your wallets

[Tool Man]

Nope, I know how sheep-like people can be. My point is that there are choices available, and it's becoming more obvious to everyone. Sure, there will always be the stampede to the spoon-fed pap, but those who are interested can make different, educated choices (and technical decisions).

Re:These exceptions would legalize hacking in Cana

[Khashishi]

I doubt the courts will accept that argument even if it plainly written in the law. Only sufficiently rich corporations are allowed to install rootkits.

Re:I reserve the right to install and recommend Li

[DarwinSurvivor]

And Linux, just as OSX and Windows, often assigns the root password to the first user's password

I have NEVER seen a distro do this and I've worked with Ubuntu, Fedora, Arch, Debian, Mint, FreeBSD* and more. Unless you meant "sudo", but that is NOT root's password.

* Not technically Linux, but uses almost identical security design.

Doesn't work.

[Anonymous Coward]

Anything like you're suggesting would quickly be picked up on; installing what amounts to a trojan on someone else's PC is likely to remain a crime in Europe, even if not the US and Canada. This means that vendors would have to supply different software and firmware packages to different geographical locations, even though the hardware is identical. Anyone even remotely sav would just grab the European versions, via proxy or p2p networks if need be.

That said, some vendors would outright refuse to install third party malware regardless of what they were paid; malware tends to hurt performance and incur additional support costs when it fails. On top of that, vendors based in Europe (eg, anyone using Ireland as their tax haven) would put themselves in danger of legal challenges even if the affected 'ware never made it into Europe.

How about this tradeoff:

[TsuruchiBrian]

You can (try to) install spyware on anyone's computer without legal penalty, but people can (try to) pirate anything from your company without legal penalty. Deal?

You know...

[um... Lucas]

I really like my Mac, worlds better than windows. But I just installed a linux computer at home that I've been using more and more, and news like this makes me want to use it more. I'm not a programmer, but I feel reasonably safe that the many eyes of you programmers will catch this code should it ever be inserted into a distribution. Only question is, with rhel essentially being closed off to all of you - if they were to adopt software like this. Would it be caught and removed in centos (the distro I settled on?) or will they faithfully include that "feature" as well? Otherwise, I'll have to go to openbsd, which would suck, because as much as I admire the is and theo, I'm very excited about the possibilities afforded by virtualization, which he doesn't seem inclined to support thus far.

Re:You know...

[cpghost]

If you're patient, consider using FreeBSD, and wait for them to support Xen/Dom0 for full virtualization capabilities. They're not there yet, but there's work being done right now.

Lets start with him, Anon?

[citizenr]

Lets start with his computer. How long till Anonymous uploads dumps form his hard drive?

I've installed Vista 5 times on my PC over the yrs

[Anonymous Coward]

every time it complains that the key is already in use - But then I call the phone activation bot and get a whopping great number that will only work to activate Windows 1 time (so I have to repeat this process every time I get issues).

It doesn't cost me anything but I do wonder why this number will only work once... what an annoying feature!

PS why are the captures always the same?

WTF?

[benjfowler]

These corporate carpet bagger cunts deserve to be sued into a smoking hole in the ground. I hope the community opens the gates of Hell on them.

Re:I reserve the right to install and recommend Li

[mark-t]

Slackware

This action violates my Constitutional Rights

[WillAffleckUW]

As a former Army Sergeant in the Canadian Army, I just want to point out that trying to do this violates my Constitutional rights as a Citizen of Canada.

This is very un-Canadian.

Re:I reserve the right to install and recommend Li

[denmarkw00t]

but that is NOT root's password.

Touché - I had hastily assigned the ability to sudo to the ability to login as root. And, just tested, it does not set the same as root in OSX. So...Windows, at least XP and Vista. Where's my hat? *begins eating*

I hear that double tap suicides are up

[Anonymous Coward]

speeding up the appointment with the gun control civil war showdown

Time for action Canada ...

[drrilll]

Time to write letters that border on being impolite!

Re:These exceptions would legalize hacking in Cana

[SampleFish]

Not only that but the act itself is indeed fraudulent use of a computer system. They would become guilty themselves by exercising this software. What if their software captured copyrighted data? Ouroboros would eat his own tail!

So if they can, I can too?

[Anonymous Coward]

If they can by law install spyware on my computer, then by reciprocity, I can install spyware on their computer too, right? I can install botnets, viruses and spyware because the law allows them, and everyone is equal under the law, then I can install spyware, botnets, trojans and virii on their computers too, right?

Just like media control

[Tyr07]

Not so much like China really.

Before they manipulated the media. Then the internet came, word spread faster than ever, people became more much informed about events that were going on.
Government lost some control.

Now they're trying to regain it and stifle the internet. It might look like it's all about money and anti-piracy, but how long before suddenly that spyware is used for monitoring people under future laws, like 'Causing unrest in the general populace' Post something the government doesn't like, even if it's true, and if it upsets people against the government, suddenly the unrest law comes into affect and you get arrested, thankfully to the spyware on your pc identifying you on the net.

Like how youtube wants to use your real name.

Sure we might be a long way off before it gets that bad, but that's only because they're doing it slowly and trying to make it about something that doesn't really matter. Most of us won't cry that much if you have to purchase all your content, for some it will suck but life will go on.
Some companies will die because we won't buy their shit.
Keep everyone focused on that, later it becomes a tool to root out anyone who protests the government. Surprise.

Re:These exceptions would legalize hacking in Cana

[Yakasha]

http://tinyurl.com/9wpxjg6 Page 11-12 (a) a program that is installed by or on behalf of a person to prevent, detect, investigate, or terminate activities that the person reasonably believes (i) present a risk or threatens the security, privacy, or unauthorized or fraudulent use, of a computer system, telecommunications facility, or network, Do you believe the RIAA poses a reasonable threat to your privacy from their new rootkits? Well then it seems, under this law, you could install a trojan horse on their computer, read their files, and then crash programs that might end up help the RIAA from violating your privacy...Like Windows

I think I like section (b):
(b) a program that is installed, by or on behalf of a person who provides services related to the operation of the Internet or another digital network or who operates a network including a telecommunications service provider for the purposes of network management;

legalizing botnets... awesome.

That's what you think ...

[golodh]

Sorry to disappoint you, but I really have to set you straight. You won't be much of an obstacle against the installation of spyware, should someone decide that your box needs it installed.

First off, you won't be told when they install spyware on your computer. And I'm fairly positive that you lack the time, inclination, and competence to either use sourcecode distributions of FOSS exclusively (_and_ read the entire source before you install), or to disassemble and thoroughly study all and any proprietary software you may be installing. And neither will you thoroughly secure all the ports and networking software on your box, again because it takes too much time, hassle, and expertise.

Should you be using MS Windows or X-os, there's no need to talk further as you've already lost.

Secondly, "they" won't be installing any spyware on your box. You will be doing that for them. By running binary installers (legitimate or illegitimate doesn't matter), by installing software that employs DRM, or by surfing to dodgy sites.

There are basically two ways: you can follow Stallman's lead, or you can get accustomed to the fact that there's a lot going on on your box that you don't get told about. Get used to it or go sourcecode-FOSS exclusively.

the article is correct

[peawormsworth]

It appears that the Act is trying to prevent installation of programs that 'do things' without the computer users consent. Where 'do things' are things like collecting and transmitting private data from the owners pc. It does not seem to prevent a computer from releasing this data when the user has been specifically informed and agreed to the conditions.

The suggested amendments by the corporate interests suggest that programs should be able to be installed without the computer owners permission or knowledge. And that these programs should be able to monitor the activities of the user and report secretly without the owners knowledge whenever the program suspects that the user is breaking 'any law'. Where 'any law' is: "any law of Canada, of a province or municipality of Canada or of a foreign state".

Logical conclusion:
- these corporations want to install programs that monitor and control your computer usage and secretly collect this information.
- these corporations want to limit the usability of your computer when it conflicts with their interests (profits).
- these corporations want you to abide by arbitrary laws of foreign states!!! Circumventing our own legal process.

A reasonable solution:
- do NOT allow these changes to be implemented into the Act.
- require these corporations to provide all users with consent prior to installing what is effectively corporate backed spyware. After all... with the existing act, the corporations are still allowed to have these programs installed on your computer. The only difference is that as the law stands, you will be informed about it and you will be able to decide whether or not you want to install software that would allow them to monitor and control what you can do with your own computer.
- do not allow foreign states to dictate how we are allowed to operate our own computers within our own borders.