Politics

Checking the Numbers Behind BC CareCard Fraud

/ Christopher Parsons / 1 Comment

Image by ivers

On January 7, 2013, the British Columbia government (re)announced that the province’s new identity card, the BC Services Card, would be arriving on February 15, 2013. To date, the Office of the Information and Privacy Commissioner of British Columbia has not released her analysis of the Services Card. To date, the provincial government has been particularly recalcitrant in releasing any information about the cards short of press releases. Though members of civil society are concerned about the card it remains unclear whether they can mobilize to effectively delay or stop the card: indeed, this lack of capacity is something that is explicitly recognized in government documents that were released by ICBC.

This will be the first of a few posts on the proposed Services Card. In aggregate, the posts will examine pragmatic (e.g. fraud, security, biometric privacy) and principled (access to information problems, lack of democratic discussion surrounding the cards, secret usage of citizens’ data, function creep) criticisms of the Services Card. This particular post examines the government’s misleading claims surrounding CareCard fraud. Specifically, I interrogate the government’s assertion that there are many more CareCards in circulation than there are residents and statements that fraud presently costs the province $260 million/year or more. I conclude by stating that the government ought to clearly tell citizens what is driving the cards, given that the primary driver is almost certainly not medical fraud.

Continue reading →

The Danger of Fetishizing BlackBerry Messenger Security

/ Christopher Parsons / 5 Comments

BlackBerry Bold 9780Research in Motion has a problem. For years they promoted themselves as a top-notch mobile security company. During those initial years most of their products were pitched at enterprise users.

Then RIM got into the consumer market.

Most consumers equate RIM’s products with security, email, BlackBerry Messenger (BBM), and a tepid suite of other smartphone features. Most of the people who report on the company tend to agonize over the fact that RIM complies with government surveillance laws. Such reports inevitably emerge each time that the public realizes that RIM meets its lawful access requirements for consumer-line products.

In this post, I want to briefly address some of the BBM-related security concerns and try to (again) correct the record surrounding the security promises of the messaging service. After outlining the deficits of consumer BBM products I briefly argue that we need to avoid fetishizing technology, encryption, or the law, and should instead focus on the democratic implications of the lawful access-style laws that governments use to access citizens’ communications.

In the interest of full disclose: I have family and friends who work at Research In Motion. I haven’t spoken to any of them concerning this post or its contents. None directly work on either BBM or RIM’s encryption systems.

Continue reading →

The Danger Online Voting Poses to Democratic Legitimacy

/ Christopher Parsons

Vote Mob @ Memorial University of Newfoundland Online voting is a serious issue that Canadians need to remain aware of and/or become educated about. I’ve previously written about issues surrounding Internet-based voting, and was recently interviewed about online elections in light of problems that the National Democratic Party (NDP) had during their 2012 leadership convention. While I’m generally happy with how the interview played out – and thankful to colleagues for linking me up with the radio station I spoke on – there were a few items that didn’t get covered in the interview because of time limitations. This post is meant to take up those missed items, as well as let you go and listen to the interview for yourself.

Public Dialogue Concerning the NDP Leadership ‘Attack’

There are claims that the attacks against the NDP’s online voting system were “sophisticated” and that “the required organization and the demonstrated orchestration of the attack indicates that this was a deliberate effort to disrupt or negate the election by a knowledgeable person or group.” Neither of these statements are entirely fair or particularly accurate. Publicly disclosed information indicates that around 10,000 IP addresses were used to launch a small Distributed Denial of Service (DDoS) attack against the voting system used during the NDP’s convention. To be clear: this is a relatively tiny botnet.

While such a botnet might justifiably overwhelm some small business networks, or other organizations that haven’t seen the need to establish protections against DDoS scenarios, it absolutely should not be capable of compromising an electoral process. Such a process should be significantly hardened: scalable infrastructure ought to have been adopted, and all services ought to be sitting behind a defensible security perimeter. To give you an understanding of just how cheap a botnet (of a much larger size) can be: in 2009, a 80,000-120,000 machine botnet would run around $200/day. You even got a 3-minute trial window! In 2010, VeriSign’s iDefence Intelligence Operations Team reported that a comparable botnet would run around $9/hr or $67/day.

If a few Google searches and a couple hundred dollars from a Paypal account can get you a small botnet (and give you access to technical support to help launch the attack, depending on who you rent your bots from) then we’re not dealing with a particularly sophisticated individual or group, or an individual or group that necessarily possesses very much knowledge about this kinds of attacks. Certainly the action of hiring a botnet demonstrates intent but it’s an incredibly amateurish attempt, and one that should have been easily stopped by the vendor in question.

Continue reading →

Unpacking the Potential Costs of Bill C-30

/ Christopher Parsons / 6 Comments

Expense Sheet The Government of Canada has, at least temporarily, backed away from pushing through its tabled lawful access legislation. While many critiques of the legislation abound – some of which I’ve recently noted surrounding warrantless access to subscriber information – there have been limited critiques of the actual financial costs associated with the bill. While some public commentators have suggested that the legislation will threaten small Internet service providers’ financial viability, there has yet to be a formal, detailed, and public financial accounting of lawful access-related costs.

I’m incapable of offering this accounting. The same is true for every other Canadian, whether they are a government bureaucrat, private citizen, corporate agent, or government Minister, because the legislation itself remains murky. Thus, rather than suggest that the legislation will cost X dollars, in this post I outline why people cannot cost out the bill if they solely rely on existing public information.

I begin this post by quickly outlining what the Canadian government suggests that the legislation will cost. Having done so, I move to critique the origins of the government’s numbers. This entails first examining the issue of interception capabilities, second, of storage costs, and third, of the status of Telecommunication Service Providers’ existing lawful access capacities. I conclude by noting the lack of clarity surrounding C-30’s breadth and the need for clarity during the legislative, rather than regulation-setting, stage of the bill’s development.

Continue reading →

Canadian Sovereignty Online – one year later

/ Christopher Parsons

internet down :( Last year a group of academics, technologists, and members of the public sent a public letter (.pdf) to the Canadian Internet Registration Authority (CIRA), Canadian Radio-television Telecommunications Commission (CRTC) and Canadian Parliament. The letter raised concerns in light of the US government’s unilateral pre-trial domain seizures. Specifically, we asked that these institutions develop a plan by December 31, 2011 that would ensure that Canadians would retain a right to self-determination when it comes to digital policy; we wanted these bodies to plan how to limit the harms generated by US domain seizures of web properties.

To date we have not formally heard from any of these institutions. Unfortunately, domain seizures and US digital imperialism has gotten worse, not better, in the interim. In response, a group of us associated with Digital Policy Canada have prepared another public letter for CIRA’s Canadian Internet Forum. It is titled, “Canadian Sovereignty Online – one year later,” (.pdf) and in the letter we argue that Canadian domains could be seized by the American government on copyright infringement grounds, even if a Canadian were legally (under Canadian law) making content available.

To achieve digital autonomy – and thus defend Canada’s sovereign rights – we believe that CIRA should embark not only on policy development, but also technical development of tools that can protect Canadian interests when they are challenged. We also believe that CIRA should invest in educational processes to raise awareness about the threats and challenges facing the contemporary Internet and DNS ecosystem. Such a three-pronged effort would entrench and support national self-determination surrounding sovereign digital policy actions, while also educating Canadians about digital sovereignty. In aggregate, these efforts will serve to protect Canada’s long-term cultural, economic, and political interests, and we maintain that the means of doing so are within CIRA’s organizational mandate.

Click here to download a full copy of the public letter (.pdf)

(Un)Lawful Access Forum in Ottawa

/ Christopher Parsons

I’ll be speaking at a forum about Canada’s forthcoming lawful access legislation on February 8 at St. Paul University. From 6pm-7pm there will be the formal book launch of the Canadian Centre for Policy Alternatives’ recent title, The Internet Tree: The State of Telecom Policy in Canada 3.0. Those attending the forum may be particularly interested in the two chapters on surveillance (one of which I authored). The lawful access event runs from 7-10PM. From 7:00-7:30 the organizers will be showing the mini-documentaries “(Un)Lawful Access” and “Moving Towards a Surveillance Society.” Following this, there will be two panels to discuss the expected legislation. The first (which I’m on) runs from 7:30-8:30 and discusses the technical elements of the forthcoming legislation. The panel is composed of myself, Kirsten R. Embree, Stephen McCammon, and John Lawford. The second panel runs from 8:45 to 9:30, and focuses on the political dimensions of the legislation. Panelists include Charlie Angus and Elizabeth May, with Michael Geist moderating. The final 30 minutes are devoted to summarizing the forum, outlining actions that are taking place, and suggesting continuing activities.

For more information about the event, see Unlawfulaccess.ca, and register for the event on Facebook. You can also download/print/share copies of the poster for the event. This will be a really great event, and the mixture of formally separated technical and political panels should do a great job in outlining the range of issues that lawful access legislation touches upon.