Law, Privacy and Surveillance in Canada in the Post-Snowden Era

Michael Geist

• Publisher: University of Ottawa Press
• Year: 2015
• Print ISBN: 9780776622071
• eBook ISBN: 9780776621821
• Topic: Law
• Subtopic: Cyber Security
• Index: Law

Years of surveillance-related leaks from US whistleblower Edward Snowden have fuelled an international debate on privacy, spying, and Internet surveillance. Much of the focus has centered on the role of the US National Security Agency, yet there is an important Canadian side to the story. The Communications Security Establishment, the Canadian counterpart to the NSA, has played an active role in surveillance activities both at home and abroad, raising a host of challenging legal and policy questions.

With contributions by leading experts in the field, Law, Privacy and Surveillance in Canada in the Post-Snowden Era is the right book at the right time: From the effectiveness of accountability and oversight programs to the legal issues raised by metadata collection to the privacy challenges surrounding new technologies, this book explores current issues torn from the headlines with a uniquely Canadian perspective.

PART I

UNDERSTANDING SURVEILLANCE

CHAPTER I

Canadian Internet “Boomerang” Traffic and Mass NSA Surveillance: Responding to Privacy and Network Sovereignty Challenges¹

Andrew Clement and Jonathan A. Obar

Introduction

The 2013 revelations of US National Security Agency (NSA) surveillance programs that whistle-blower Edward Snowden’s release of hitherto secret internal documents brought to public attention have sparked a storm of controversy.² Their breathtaking scope, scale, and questionable legality have led many countries to urgently assess the risks of NSA surveillance and to consider various actions to better protect the privacy of their citizens as well as their national sovereignty.

Given the large proportion of international Internet communications routed through the United States³ where foreigners’ data receives scant legal protection, a major focus of controversy is the NSA’s mass (near total) Internet traffic interception capability.⁴ Besides the extraordinary technical prowess the United States is able to deploy in the service of its perceived surveillance and security needs, it also enjoys a strategic advantage in that a disproportionate share of international data communications passes through it. This is an advantage the NSA is well aware of, as noted in a presentation deck for the top-secret PRISM program: “Much the world’s communications flow through the U.S. …Your target’s communications could easily be flowing into and through the U.S.” See Figure 1.⁵

Figure 1: U.S. as World’s Telecommunications Backbone

Source: Washington Post

Well-founded suspicions about this surveillance potential have been reported for years, but the Snowden revelations now strongly reinforce the serious allegations of clandestine spying that author James Bamford, retired AT&T technician Mark Klein and others have raised.⁶ Given Canada’s proximity to the United States and the structure of the North American Internet, it isn’t just Canada’s international traffic that is subject to suspicionless, dragnet NSA surveillance. Due to a phenomenon we term “boomerang routing”⁷ — when Internet traffic originating and terminating in the same country transits another — a great deal of Canadian domestic Internet communications boomerang through the United States and are subject to NSA surveillance.⁸

This chapter examines the phenomenon of Canada-to-US-to-Canada boomerang traffic, focusing specifically on the privacy and related risks associated with NSA surveillance as well as the policy implications and remedial responses. As public understanding of how the Internet operates is generally inadequate for discussing the policy dimensions of Internet backbone surveillance, we begin with a brief overview of the technical aspects of Internet routing and then show how surveillance capabilities can be built into relatively few “choke points” yet capture the great bulk of Internet traffic. In contradistinction to the common metaphor of the Internet as a spaceless, featureless “cloud,” we demonstrate that, with interception points in under twenty major cities, the NSA is capable of intercepting a large proportion of US Internet traffic. We turn then to Canadian Internet routing patterns, showing that boomerang routing is commonplace, that such routing exposes Canadians’ data to NSA surveillance, and that Internet users across Canada conducting a wide range of everyday communications are subject to it. Even communications between public institutions across the street from each other can be routinely exposed to NSA interception. Both to collect data about these Internet routing patterns and reveal its physical, geographic characteristics, we draw on a research-based Internet analysis and visualization tool known as IXmaps, developed to map Internet exchange points and the traffic routed through them. The software tool found at IXmaps.ca⁹ aggregates crowd-sourced Internet users’ “traceroutes” and shows them where their personal traffic is likely to have been intercepted by the NSA.

The next section considers the policy implications of Canadian boomerang traffic, especially from the point of view of its privacy risks. We also consider the economic inefficiencies and point to the broader issue of the impairment of Canada’s network sovereignty. The final major section offers possible remedies for the various negative aspects of boomerang routing. To reduce boomerang traffic, we propose several ways for keeping domestic data within Canadian networks and legal jurisdiction. Building public Internet exchange points in Canada would contribute to keeping domestic traffic inside national boundaries while promoting more efficient routing. To mitigate the privacy and democratic governance risks in particular, we advance ideas for greater transparency and accountability on the part of telecommunications carriers and government agencies. While recognizing the need to address the risks from mass surveillance by Canadian state agencies as well as to develop stronger international regimes for protecting privacy, freedom of expression, and civil liberties online, we close by calling for a greater assertion of Canadian network sovereignty within the norms of a free and democratic society.

NSA Interception of Canadian Internet Traffic

The almost weekly revelations from the Snowden trove of yet more NSA surveillance programs contributes to the strong and accurate impression that the NSA has largely succeeded in Director Keith Alexander’s reported mission to “collect it all,”¹⁰ and developed a global, ubiquitous spying infrastructure capable of capturing the details of nearly everyone’s electronic transactions. However, it is hard for all but the most dedicated and technically sophisticated observer to keep track of the various programs and their particular characteristics. The details matter in terms of who is targeted, the types of information collected, the relevant legal jurisdictions, the parties implicated and the possible remedies. The PRISM program in which the NSA has partnered with nine major Internet companies, such as Google, Facebook, Twitter, Microsoft, and Apple, to obtain “direct” access to stored personal data, is among the best known.¹¹ However, the NSA programs that intercept Internet communications in transit, while less well reported, are arguably the most significant in terms of their potential impact because they can capture data from all Internet users across a wide range of on-line activities. It is these programs for capturing data “on the fly” that we examine in this chapter. To understand them and their implications, it is helpful to understand how Internet data is routed.

The Internet Is Not a Cloud: Routing Basics

Unlike the telephone system, which relies on establishing a continuous dedicated circuit between the two ends of the communication path, all Internet communication is based on packet switching. Every e-mail message, voice conversation, video, image, web page, etc., is broken into in a series of small data packets. Each packet consists of two parts: a header, containing among other items, source and destination IP addresses, much like the return and to addresses on a conventional piece of mail; and a payload, containing the content. Each packet “hops” from the originator through a succession of routers, with each router examining the packet header to determine the destination and then passing the packet to the next router in the intended direction, again much like the conventional postal service routes mail. At the destination, the packets are reassembled into the original message. The response, whether it is a web page, video, file transfer, etc., consists of another set of data packets, that individually hop their way through a succession of routers back to the originator. These routers and the links between them constitute the Internet backbone.

It is commonplace to refer to the Internet as a “cloud,” as a seemingly boundaryless ethereal space in which physical location of wires and equipment is largely irrelevant. While this metaphor may be helpful in marketing Internet services, it does not well serve understanding how the Internet actually works, especially in matters of public policy around state surveillance. In fact, Internet traffic switching is mainly done by massive banks of routers crammed into large anonymous buildings located in the downtown core of major cities. These switching centres are linked by bundles of fibre optic cables each capable of transmitting tens of billions of bits per second¹² Mainly large telecommunication companies own these cables and routers, and the policies they adopt for who can connect to their networks and on what terms fundamentally determines how the Internet operates. And gaining access to the routers and cables to intercept the data packets streaming through them for surveillance purposes typically requires obtaining the cooperation of these often giant telecommunications enterprises.

NSA Internet Backbone Surveillance

The New York Times first reported the interception of US domestic communications by the NSA in late 2005.¹³ But it wasn’t until Mark Klein, a recently retired AT&T technician, revealed the exist...

Table of contents

• Cover
• Title Page
• Copyright
• Contents
• Acknowledgements
• Introduction
• Part I: Understanding Surveillance
• Part II: Legal Issues
• Part III: Reforms and Accountability
• About the Contributors