Revelations that Canada’s top cybersecurity agency tracked public Wi-Fi users at a Canadian airport has renewed public concerns of apparent erosion in the privacy of Canadians.
Former National Security Agency contractor Edward Snowden released a document showing the CSEC (Communications Security Establishment Canada) collected ‘metadata’ of unsuspecting airline passengers for several days – even after they had left the terminal. The captured metadata - data about other data - included information about communication activities, such as locations where users accessed free Internet services, email addresses of outgoing and incoming messages, and phone numbers of outgoing and incoming calls – all, according to CSEC, legally gathered, ostensibly for the security of Canada and Canadians.
Such invasions of privacy inevitably sound alarm bells in the media, and raise concerns among an uneasy public. A 2013 study commissioned by the Office of the Privacy Commissioner of Canada shows that two-thirds of Canadians are significantly concerned about the protection of their privacy, and one-quarter have an extreme level of concern.
Yet many today routinely hand over private information online with little knowledge about how it will be used, or who will use it. Personal information is collected and shared by retail, travel, banking, and financial service providers, employers, and government – not to mention online social networks – who, in some cases, also track our online activities.
For Associate Professor Dr. Jacquelyn Burkell at Western University, there is an underlying logic to our decisions to trade some privacy to gain convenience, security, or other benefits.
“I think a large part of why they’re willing to do it, quite frankly, is because the risks that we’re running are not risks that are immediately evident to us. The negative consequences are at best probabilistic – we may never experience them,” explained Dr. Burkell in an interview with CBC’s The Current in February.
Much of Dr. Burkell’s recent work at Western’s Faculty of Information and Media Studies focuses on privacy in the online context and the evolving social norms that govern the sharing of information. She co-leads GRAND’s PrivNM project on Usable Privacy and Security in New Media Environments. Combining computer science, psychological, social, and legal perspectives together, PrivNM addresses some of the challenges of privacy and security in new media environments. One of the project’s overarching goals has been to use social sciences and legal research to inform public policy. An advocate for “privacy by design,” PrivNM seeks to embed privacy and security considerations into the very design of technologies and organizational practices.
As part of that research, Dr. Burkell prepared a report for the Privacy Commissioner of Canada on online social networks in October 2012 examining how privacy is being governed in online social networks such as Facebook. Her research suggests that many of those who participate in social networking use these spaces to create profiles expressly for public distribution. Participants also generally agree that such profiles are social in nature, intended to support and extend online and offline social relationships.
“While participants would no doubt be outraged by the kind of wholesale governmental surveillance revealed by Snowdon,” said Dr. Burkell, “They expect and indeed participate in relatively unrestricted sharing of online social profiles to a broad audience that extends well beyond their network of family, friends, and acquaintances.
For interim privacy commissioner Chantal Bernier, many Canadians do seem to have an informed understanding of how their personal information is exploited. An increasing number of consumers are even looking to cash in on the harvesting of their personal information by companies. A study from Microsoft Corp. shows 32 per cent of Canadians would be willing to sell their digital data to the right company for the right price and 45 per cent would sell at least some of it.
"Canadians yes, want to remain in control. They understand there is a monetary value to their personal information and they want to make sure they get their value for it," Bernier said in an interview with the CBC.
At the same time, according to Dr. Burkell, the potential hazards of sharing personal information online – from concrete risks such as identity theft to more esoteric risks such the erosion of personal autonomy as a result of surveillance – are too remote to influence our decisions, especially when compared with the immediate and tangible benefits of that same sharing. This is especially true when the collection, sharing, and analysis of personal information occur invisibly, without our consent or even our knowledge.
“Quite frankly, from an individual perspective, we still feel – many of us – as if we have privacy. And on a day-to-day basis … the kind of surveillance we’re under, the kind of oversight we’re under is not evident to us,” commented Dr. Burkell.
Without seeing the consequences of spying or surveillance, public concern will remain muted. When stories do break about privacy breaches, public outrage will tend to dissipate quickly over time.
As for the fallout of these latest revelations? “I suspect what you’ll see is a very short term drop in the use of Wi-Fi, but it’s going to go right back up to where it was.”
Though the specific issue of CSEC tracking of Canadians using free airport Wi-Fi will continue to rise and fall relatively quickly in the public consciousness, the underlying policy issues remain.
“In particular, as Chantal Bernier points out, we need to develop policies and legislative frameworks that take into account both public attitudes and technological advances.”
Advances and expansions in the tracking metadata, for example, now offer security establishments such as the CSEC the potential to construct a fairly comprehensive profile of a person's life.
“These most recent revelations raise a critical issue: should Canadians be protected from the unregulated surveillance of metadata, or the data about communication traffic rather than content?”
-30-
Media Contact:
Spencer Rose
Communications Officer
GRAND NCE