Anybody who is even remotely privacy minded is losing their minds right now.

Why?

Because the US government (by a slim margin of 215 to 205) has decided to dismantle rules preventing ISPs from collecting data on users' online activity (including browsing history) and selling it to third parties. These rules weren't yet in effect; they were going to be in force later this year.





The response in the US was... very American. For example, the creator of Cards Against Humanity tweeted this:

If this shit passes I will buy the browser history of every congressman and congressional aide and publish it. cc @SpeakerRyan https://t.co/cOL3mx6JuG

— Max Temkin (@MaxTemkin) March 27, 2017

This tweet is almost as amusing as the Holiday Hole.

Despite our differences and their regrettable election of a Cheeto coloured mad-man, I love Americans. They're plucky.

Meanwhile in Canada...

Yes - this is a thing. I was in Ottawa recently and almost purchased Trudeau socks. Not because I'm a Liberal (I self identify and a general political nomad) but because they were socks with a PMs face on them. Ridiculous.

Canadian reporters (including the CBC) have undertaken to relieve the typical Canadian anxiety:

PIPEDA (Personal Information Protection and Electronic Documents Act) protects personal information in the hands of private companies. As opposed to the Privacy Act, which protects personal information in the hands of the government.

PIPEDA applies to any company who is collecting, using, or disclosing private information.

So... basically every company - including ISPs.

Those companies can only disclose personal information "for purposes that a reasonable person would consider are appropriate in the circumstances."

This was the reaction of every single human I spoke to about US ISPs selling user browsing history and other information:


So it's safe to say a reasonable person would NOT consider sale of the private browsing history of a Canadian to another private company (potentially outside of Canada) to be appropriate under... well... any circumstances.

Generally, disclosure of private information can only be made without the user's knowledge or consent where illegal activity is being investigated or prosecuted (there are other reasons, but that's another post).

"Personal information" means "information about an identifiable individual". That's it. The definition doesn't go into any more detail than that. Interestingly, the definition of "personal information" under the Privacy Act (Canada), specifically includes information regarding personal views/opinions, education level, etc.

If the browser information is attached to your name (or you could be identified from that browser history), it's personal information.

Let's pick on Bell. Why? Because Bell got in trouble with the Privacy Commissioner of Canada in 2013 for their "Relevant Ads Program" - there's a euphemism that makes me cringe. As part of this program Bell created profiles of individual users based on their browsing history and used that information to target ads at the individual user. It was not possible to opt out of the program (Bell would receive an opt out request and simply stop the targeted ads while continuing to collect the user's browsing history).

Bell argued the information they were gathering was "non-sensitive", but the Privacy Commissioner was having none of that. They asked, would a user visiting a website for HIV-positive individuals consider the URL to be non-sensitive?

Well done.

Bell has since scrapped the program and says that any similar program will be opt-in. Does this mean your browsing history is no longer being collected? No. Bell can still collect and store that information for one of the legitimate reasons contemplated by PIPEDA. It's worth noting the Privacy Commissioner ruled the collection of browsing history for legitimate business purposes would be ok.

Interesting.

On this note, Bell's privacy policy states that they can share your private information within their organization or with their subsidiaries. This includes potential transfer to suppliers and authorized agents outside of Canada. Here's the clause in Bell's privacy policy.

Happy International Women's Day.



A lot of people will be paying lip service to feminism today. Rather than add to the onslaught of glib little posts about the empowerment of women, I wanted to talk about something real.

Let's talk about women and the law.
Let's talk about how private practice is haemorrhaging women.
Let's talk about how to stop the bleeding.

This is me "building my practice". The more astute of you will notice I am actually ripping it down. Inspirational Quote: sometimes you have to rip out a few walls to build something new... or something like that.

On February 16, 2017, a US judge denied an application for a search warrant which included the power for police to compel anybody in the house being searched to provide their fingerprint in order to unlock their iPhone. You can read the whole decision if you like.



Before we begin, and on a serious note, it's important to point out the allegations made by police in this case are very serious; they include receiving and trafficking in child pornography. Police suspect multiple victims are/were being sexually abused and that the images of this abuse is being distributed by someone at the subject address.

That is the fire we're playing with here.

I've said it before, and I'll say it again, from the perspective of those inclined to more order than law, and from the perspective of those seeking to curtail liberties, child pornography cases are the ideal time to make new law. Ideal in the sense that the facts of the case, although important to the determination of whether or not a search warrant will be issued, are a red herring.

People know how they feel about those who create and deal in child pornography.

THEY ARE BAD!

Therefore, the end (of stopping these clearly bad people) justifies the means (of compelling someone at the subject address to put their finger on their phone to unlock it).

What's the big deal?

Won't somebody think of the children... etc.

Note: These are not herrings; real fish are gross and I didn't want to put them up here. Focus, people.

Compel someone at the subject address. That was a big part of why this application was denied. The judge took the prosecutor to task for using dated language and a simplistic view of personal electronic devises and, I kid you not, how wireless internet works.

For example, the prosecutor referred to a Blackberry as a "Personal Digital Assistant". What is this, 1995?





The application contained no discussion of wireless internet and the potential for nefarious persons to co-op the wireless connections of innocent people for the purpose of concealing their nefarious activities. Here's what the judge said:



Translation: Wireless internet is a thing. Some people give out their wifi passwords or don't have wifi passwords at all. It's possible person B could be using person A's internet without person A's knowledge. It's also possible person A and person B live in the same house and that person A doesn't know what person B is doing.

To drive this point home, the judge wrote his decision while downloading torrents on a laptop sitting outside his neighbour's house using his neighbour's wifi connection.

Just kidding. That didn't happen, but I kind of wish it did.

The application requested the usual search of a premises and the extra-ordinary authority to compel individuals to provide their fingerprints. Based on other information the prosecutor presented, they had enough information to get the regular warrant, but not enough to compel anyone at that address to provide their fingerprints to unlock their device.

The judge found the application didn't have enough information regarding the individuals at the address, including any previous criminal activities or possible links to child exploitation. The judge also found the application to be light on the technology front. The judge found there wasn't enough information on devices themselves or files that may be found on them.

"For the reasons stated, the Court does not find, under the circumstances presented here, that the government has established a proper basis to force any individual at the subject premises to provide a fingerprint or thumb print in an attempt to unlock any Apple device that may be found."

So, if the police have no information about who is in a house, what devices are in the house, who is using the internet connection, or what potential connections the people in the house have to child exploitation (if any), a judge will not allow the police to compel everyone in the house to unlock their phones with their finger prints.

YAY!



The judge went on to discuss the difference between finger prints and the act of collecting finger prints. In the US, there are no privacy rights in a finger print; however, there are Fourth Amendment protections (the right against unreasonable search/seizure) connected with how the fingerprints are obtained. Collection of fingerprints (in the context of executing a search warrant) engages Fourth Amendment protections. Forcing someone to provide their fingerprint to unlock a device is more like to collecting the fingerprint, thus engaging the Fourth Amendment. The judge found there simply was not enough information to infringe on this right.

Fifth Amendment rights (right against self incrimination) are engaged where someone is compelled to produce information that may incriminate them. For example, the state cannot compel you to decrypt a hard-drive containing information that might incriminate you (so long as the content of the hard-drive isn't a foregone conclusion - that's another post).

The judge in this case found that fingerprints in the 1960s are different than fingerprints today.



Let me explain. In 1967 the court ruled there was no Fifth Amendment protection preventing fingerprinting.  That decision was decided around the same time the IBM 2314 direct access storage facility was introduced. It was larger than most Vancouver apartments. The only thing that was portable about this elephant was the removable 29 MB disk packs.

29 MB.

I have a 128 GB iPhone. That's 128,000 MB.

I also have 50 GB of iCloud storage. That's 50,000 MB.

My Touch ID accesses all of that information as well as all my social media accounts and email account....s.

You get my point.

According to futurists in the 1960s, the future was full of silver-clad sex-bots and laser beams. There is no way they, let alone the courts, could have anticipated a seemingly unlimited amount of information pertaining to our most personal and private selves being protected only by our fingerprints.

Cell phones are not cell phones. They're minicomputers. Courts in both the US and Canada have recognized this. Our fingerprints allow access to these minicomputers. Therefore, our fingerprints, in this context, benefit from Fourth and Fifth Amendment protection.

Although this application was reviewed and denied in the US, the legal developments of our, somewhat unruly, neighbours inform our interpretations of our own equivalent laws - s.7 (Life, Liberty, and Security) and s.8 (Search and Seizure) of the Charter of Rights and Freedoms.

I would like to say the trend, in both Canada and the US, will be toward protection of privacy and non-compulsion; however, that's unlikely. Recent treatment of Canadians (and US citizens?) at the US border suggest the trend is toward compulsion. The border and our homes are two different things, but trends are trends.

The government knows you have stuff on your phone. They know they can access more stuff about you if they have access to your phone.

Do they want to know the stuff? Maybe. I'm pretty boring.

It's more likely they want you to get used to giving them the stuff without protest because you're required to do so by law...

because... child pornography.

because... Terroism.

That's right. Apparently, the University of Calgary (U of C) is in the business of blocking internet traffic now.

Because it's fall... and because I haven't posted in a while... and because litter is serious business.


**this letter has been posted with the permission of my clients, the Kitties**

Happy almost Hack-versary, AshleyMadison.com

On July 20, 2015 the hacking collective Impact Team accessed and downloaded the personal and financial data of Ashley Madison’s users - almost all 37 million of them. Impact Team attempted to hold AM hostage - their terms: shut down or the information is released. Ashley Madison did not shut down and on August 18, 2015, the Impact Team dumped 9.7 gigabytes of personal and financial data.



The hack tapped into the more base elements of our collective imagination.

Because… sex. Because… cheating. Because… drama.

I’ll also note, Impact Team’s message to the world after AM refused to shut down their site was, “prosecute them [them being Ashley Madison] and claim damages”... more on that later.

1. Ashley herself;
2. Users of the site;
3. Hackers; and
4. Retrievers (i.e. the people who, after the hackers released the data, retrieved the data from various sources)

(I am... so sorry…. I couldn’t help myself)

On February 16, 2016, Apple drew a line in the sand. As these things do often do, this line came in the form of an open letter.

The Apple Customer Letter was published on Apple's website and is signed by Apple CEO, Tim Cook. It's a response to a judicial ruling requiring Apple to assist the FBI in unlocking (decrypting) the iPhone 5c belonging to Syed Farook, a suspect in the San Bernardino shooting.

The internet is freaking out. For better or worse, the internet is the most interesting when it freaks out.

But when the internet freaks out... it's not exactly... logical. To ensure my comment is fair, reasonable, and as informed as possible .... and also because my history teacher always made me go to primary sources, whenever possible ... I read the Order.



(Obviously, this is only part of it. The whole this is here)

Apple is ordered to:

(1) Assist the FBI in enabling the search of Syed Farook's phone (including providing reasonable technical assistance).

Assist the FBI do what?

1. By-pass or disable the auto-erase function that kicks in when you've entered the incorrect passkey too many times.
2. Submit passcodes to the phone  to break the passkey; and
3. Ensure that any other software on the phone doesn't prevent the FBI from accessing the phone.

I'm going to call these the "Search Objectives".

Basically, they want to look at Syed Farook's stuff and the stuff on his iPhone is hard to get at. Apple is being ordered to help get at the stuff on the phone.

(2) In order to achieve the Search Objectives, Apple must provide "reasonable technical assistance". 

What is that?

"Reasonable technical assistance" may include:

1. Providing the FBI with signed iPhone Software file, recovery bundle, or other SIF (Software Image File) and
2. Coding the SIF

It's important to note that the "reasonable technical assistance" is not limited to (1) or (2) and could potentially include ANYTHING that helps the FBI achieve their objective of getting into the phone.

(3) The Order also outlines some requirements and limitations:

"The SIF will load and run from Random Access Memory ("RAM") and will not modify the iOS on the actual phone, the user data partition or system partition on the devise's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2 [Search Objectives]. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis."

Translation:

• Apple is being compelled to write software that will be loaded on to Farook's iPhone
• This software will boot up, but won't make any changes to the data stored on the device
• The software will disable the security feature of the iPhone that kicks in after 10 failed passcode attempts - allowing the FBI to make the billions* of attempts required to determine the right passcode. The FBI will be testing every possible pin. This process will likely take a few days. (*exaggeration for rhetorical effect - calm down people! Professional know-it-alls tell me there are approximately 10k possibilities for a four digit pin and that, worst case, it would take 13 minutes to crack. A six digit pin brings with it 1 million possible combinations and would take 22-23 hours to crack)
• The software can only work on Farook's iPhone and won't work on any other device
• The software can only assist the FBI meet the Search Objectives - nothing else
• The software can be loaded onto the device at Apple's place or the FBI's place (but the Order is silent on who determines which place is better - odd given Apple's obvious preference will be there place. Home field advantage would give the more control over how the software is used.)

If Apple thinks they can achieve the Search Objectives by another means and the FBI is OK with that - that's OK too.

Apple gets to charge a reasonable cost for providing this service.

Apple doesn't have to keep a copy of user data. The FBI is responsible for the data.

Apple had 5 days to apply to the court if it thinks anything in the Order is too burdensome.

...

and that's that.


Things you need to know:

(1) The method being proposed (creating a disk image of the content of the phone without altering any of the data) is a common forensic investigative tool. Law enforcement often investigates devices using this method. It allows them to say, "look what we found" and "we haven't tampered with any of it".

(2) The FBI is not asking for a copy of the software Apple will write - in fact it's possible the FBI will never even have access to the software (if this is all done at Apple's facility).

(3) Non-descructive collection of evidence is always preferable to destructive (or potentially destructive) methods. The FBI could access the iPhone using a risky maneuver where they drill the phone and view microchip under a microscope - BUT they would only have one chance to get it right. From the FBI's perspective, the stakes are simply too high to get the information this way.

Is this idea of someone (or some company) being ordered to help law enforcement execute a search a crrrazzaaay new thing? No. We have assistance orders in Canada (Criminal Code s.487.02). If a judge issues a warrant for the search for stuff on my phone, and I have passcode on my phone, as long as a person's (or company's) assistance is reasonably required to access the stuff they're looking for, then theoretically the judge can order the person or company to assist in busting into my phone.

I say theoretically because this issue has not yet been dealt with in Canada (obviously... otherwise you would have heard about it). BUT assistance orders have very recently been used to require telecommunications companies (like Telus) to provide subscriber information to police (H.M.Q. v TELUS). Soooo.... something like what's going on now in the US between the FBI and Apple could happen in Canada - and likely will.

The Order seems to contemplate Apple retaining the backdoor firmware (ie Apple gets to keep the key the Order is forcing them to create) while only allowing the FBI to access the data. This makes sense. Like forcing a landlord to use her master key to open the door to the apartment of an accused drug dealer, Apt. 221B, without making the landlord hand over the master key and her last three year's of income tax returns.



What if the FBI suspects apartment 221C houses the operator of a child pornography ring?

All of a sudden, the FBI is going to be really tempted to make a copy of that master key without the landlord's knowledge.

This is why the Apple Customer Letter matters.

Full disclosure: I am writing this on a mac, with my apple wireless keyboard, using apple wireless mouse, and wearing my apple watch; I'm ignoring a FaceTime call that's coming in on my iPhone and my iPad mini (at the same time - how have they not solved this yet? #firstworldproblems). The call I'm ignoring is from my husband who is calling to brag about how great his new iPad Pro is and that I should get one sooner, rather than later.

I'm a bit biased.

.... I am also broke ....

Everytime a new apple product comes out, I do this:


I am completely vested in this "whole technology thing." My practice is largely paperless. There's no turning back now. I've crossed the rubicon.

Other brands have enthusiastic followings...


But none of them have achieved the status of having a zombie horde of people with disposable income (or student loan money, as the case may be) scratching at their doors, just waiting to buy the  next Apple product. My point is, Apple isn't like other companies. They're ubiquitous. They've created the single most personal THING... ever. Our relationship with technology has changed. In essence, Apple has had a very large hand in created the very problem we're facing here - but I digress.

Together, my Apple products know EVERYTHING about me. EVERYTHING. All the information about some lawyer in Sydney, Nova Scotia may not be that powerful. BUT all the information about everyone is.

The most apt political cartoon on this was drawn by Dave Simonds and published in the Economist.


Look at this. The little guy. The big scary government people. The not so subtle reference to a brute-force attack. Absolute gold. But it's not accurate - for three reasons:

1. The FBI likely won't be wearing combat boots when they attempt to do this - think mid-priced suits and uncomfortable ties;
2. "Password Required" doesn't show up on a locked iPhone (it actually says "Touch ID or Enter Passcode" - which is an important distinction); and
3. Most importantly, there's only one phone. (I will forgive the talented Mr. Simonds for his artistic licence)

Yes, the Order is only for the one phone.

Yes, Apple will retain the software the order is forcing them to create.

Yes, .... terrorists.

BUT the law, my friends, is based on precedent and precedents are set one at a time. It's called stare decisis: the legal principle requiring judges to make decisions based on previous decisions. It ensures the law is fair, even handed... and takes hundreds of years to decide women are people.

Basically, stare decisis is how a ruling about sheep breaking on the the land of a bishop in 1803 has any bearing me suing my neighbour for snow-blowing all his snow on my lawn.

In law school we're told something frightening about precedent: hard cases make bad law.


Oliver Wendell Holmes, Jr., US Supreme Court Justice, said this (how he found time to be so brilliant, between brushing that fabulous moustache and advocating for freedom of expression, I'll never know).

The expression "hard cases make bad law" follows me around these days. Terrorists, while not personally scaring the crap out of me, are scaring the crap out of our society. Jurists aren't supposed to be affected by this fear, and let's say for the sake of argument that they're not, BUT the FBI aren't jurists - they're the government. Who is the government?

It's us.

I'm a Canadian, I don't get to vote in US elections, but I am a consumer of products from the US, which some would argue is a more poignant distinction in this age of globalization. So when I say "us", I mean... ya know... people who are not "them". What a rabbit hole.

Government is "us" in the sense that we vote, yes... and "us" in the sense that the people in power, for better or worse, have their fingers on our wrists, checking our collective pulse... and, man, our hearts are pounding. We are scared.

BOO! Terrorism.

It's ok. That was just a drill.

Whether the fear is grounded, manufactured, or Trump-ed up, is not relevant. The fact remains. We're scared. The FBI knows this. They want more tools to make us not scared, or to protect us, or whatever...  for the purpose of this post it doesn't matter why.

The point is, the FBI made the decision to request the Order. What's interesting and what is being largely ignored is the FBI made the decision at a very good, strategic time. They made it at the height of our fear. The San Bernardino shooting set up a hard case. What followed, as predictably as it always has, is bad law.

It's not "bad law" in the sense that it's over-broad or allows for the invasion of privacy beyond what the law previously allowed - not so. The Order itself is actually a reasonable application of the US's version of what is basically an assistance order. It's "bad law" in the sense that a precedent has been set to force a private company to create something in order to permit the government to break encryption.

Only on one phone? Only because... terrorism?

Don't be naive.

The Apple customer letter matters...


Because this guy is talking about "closing up" parts of the internet... whatever that means. (Note: I refuse to post ugly pictures of Donald Trump, I think his words/actions are sufficiently ugly... thank you very much).

... and whatever "closing up" the internet means is a topic for another time.

Trump also responded to the Apple Customer Letter with this:

I agree 100% with the courts. In that case, we should open it up. I think security overall — we have to open it up. And we have to use our heads. We have to use common sense. Somebody the other day called me a common-sense conservative. We have to use common sense. Our country has so many problems.

Mr. Trump ... Donald. Honestly.

Clearly, this discussion of limiting what some people can use the internet for is part of a wider debate regarding net neutrality, privacy, and freedom.

As a Canadian with an interest in American culture, I've had the opportunity to view Republicans in the wild. They appear to value freedom above all else... they also have an odd fondness for mashed potatoes that come in boxes. You'd think Mr. Trump's comments regarding privacy wouldn't resonate with voters; however, his status as a clear front-runner for the republican nomination would suggest the opposite.

Interesting times.

I, for one, would like to educate Republican voters on the connection between their right to carry a gun and their right to privacy - but that's for another time. (Spoiler: I'm going to release a series of children's books).

Someone seems to understand the importance of privacy.

Enter John McAfee. Anti-virus anti-hero, part-time YouTube sensation, and all-round interesting character.


If you think he looks more metal than nerd.... you don't know anything about computer programmers.

John McAfee isn't exactly a wilting violet. He's currently in the running to be the 2016 Libertarian Party presidential candidate (#McAfee2016). It's not exactly surprising when a Libertarian scolds the government, Mr. McAfee's response to the Order is... just ... too excellent:

And why do the best hackers on the planet not work for the FBI? Because the FBI will not hire anyone with a 24-inch purple mohawk, 10-gauge ear piercings, and a tattooed face who demands to smoke weed while working and won't work for less than a half-million dollars a year.

Aside from the half-million dollar a year part, I have one of these people living in my house (#husband). I can say from experience, if you have no idea what you're talking about and you think computers are made of blinky lights, you ignore them at your peril.

McAfee continues:

So here is my offer to the FBI. I will, free of charge, decrypt the information on the San Bernardino phone, with my team. We will primarily use social engineering, and it will take us three weeks. If you accept my offer, then you will not need to ask Apple to place a back door in its product, which will be the beginning of the end of America.

I love this guy. What a trouble maker.

Seriously though, the FBI won't take this offer. Mainly because John McAfee just insulted them, BUT also because the FBI is using Farook's phone to set a precedent. Why set the precedent?

**The following is not a conspiracy theory**

The government wants to know what's on your phone. Why? Because knowledge is power and power is awesome.

It's as simple as that. Even if the government doesn't have a specific use for the information right now, they want as much of it as they can get. They'll just, ya know, store it away for later. That's not what they're trying to do in this particular case, but the closer the government can get to knowing EVERYTHING the better (from the government's perspective).

How will this affect Canadians? Well, we all have iPhones. If you don't have an iPhone, you have a laptop. If you don't have a laptop, you have a desktop. If you don't have a desktop... then you've somehow managed to upload your consciousness to the internet and have decided to read this post (I'm flattered, thank you).

Apple has the capability to break into our phones. It's not the individual software Apple is being required to write that's the problem - Apple can likely patch/fix any specific vulnerabilities they'll exploit to break into backdoors on subsequent software updates. The real problem is the law. We've made bad law and that law can influence Canadian law. If nothing has been said on a new/novel legal question in Canada - we look to other countries for the answer - usually the US and the UK... and what poor examples they are when it comes to protecting the privacy of their citizens.

This is why the Apple Customer Letter matters to Canadians. BUT it also matters to Canadians because we, like our odd-ball cousins to the South, are a democratic country. Democracy is great, until some yahoo gets elected on platforms of closing up the internet and "opening up" our privacy. Then where are we?

As he is by many things (including cantaloupe slices), Mr. Trump was incensed by the Apple Customer Letter. He said, "Who do they think they are?"

To answer Mr. Trump's question (I never thought I'd ever type that): Who does Apple think they are?

They are our representative. We've elected them. Apple has come to power not by having their names marked on the most ballets or through some weird voodoo ritual (which is how I imagine senators are appointed), but by convincing us we want what they produce. Customers vote with their feet, and a lot of us vote Apple, and we've all voted to depend on our digital devices. They're part of our lives, there's no going back now.

Apple would have been remiss had they simply helped the FBI to break into the phone without a court Order. Resisting the FBI is basic corporate responsibility.

What about resisting the Order?

They simply must.



Apple represents a population who thinks computers are made of blinky lights. We've been rendered stupid when it comes to computers because Apple has made them work so very well (psst. knowing how to put your phone on airplane mode does not make you a computer programmer). This means Apple has taken on a significant and weighty responsibility of knowing when a change in the law could adversely affect our rights.

When I say Apple. I say the people who know what the blinky lights mean. They're in the best position now to understand what this Order means and how it will affect us.

(Oh my god I get to say it again) - "With great power comes great responsibility." - Uncle Ben 

Apple knows this.




I'd like to thank professional know-it-alls @angryMCU and @jzsavoie for their help in translating the Order and for their general know-it-all-ness (which includes sarcastic proofreading).