‘Arbitrary’ limits in Industry Canada transparency guidelines: critics

Industry Canada’s new guidelines for transparency reports released by telecom companies put unnecessary limits on how information should be reported, according to two academics with expertise in privacy and surveillance. “There is no general legal impediment to making these reports, which means the government shouldn’t be imposing any ad hoc restrictions,” Tamir Israel, a lawyer with the Samuel-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), said in a phone interview. The document, released Tuesday, sets out categories of disclosure companies should report, and says reports can include “the number of requests received from government authorities, the number of requests fulfilled, the number of requests rejected or contested; and the number of persons or accounts whose information was disclosed.” The guidelines also set out limitations on information that should be reported, including stipulating that if the number of disclosures is under 100, transparency reports should classify it as “0-100.” The document also states that reports “should not differentiate between law enforcement, national security, and regulatory agencies.” Additionally, it says data should be aggregated on a Canada-wise basis and “aggregated such that service type and its associated network technology are not distinguishable,” among other limits. “The limitation provisions will ensure that transparency reporting does not impair or compromise national security or criminal investigations, and the safety and security of Canada and its citizens,” Industry Canada said in the document. Chris Parsons, a researcher at the University of Toronot's Citizen Lab, said one of the issues with the report is that “this is the government establishing what they consider to be the ceiling of reports, so the most detail possible, and in the process they’re not saying, ‘Here is the minimum you have to do if you’re going to release these reports.' ” The guidelines are also missing information that would give context to the numbers, he said. “So how law enforcement gains access to this, how much it costs law enforcement to gain access to this, the retention period —it’s all that combined with the numbers that I think you get an actual holistic transparency report.” Parsons added that “absent that, you get a partial report at best, and it leaves a large number of questions.” Parsons said that “combining federal and provincial and even municipal government requests in one body of numbers prevents Canadians from understanding what level of government is actually involved in conducting this surveillance,” and called that restriction, as well as the limits on reporting the specific numbers of disclosures if the total is under 100, “deeply problematic.” Companies such as TekSavvy Solutions Inc. have already reported specific numbers under 100 in previous reports, “and there is no evidence that their release of that information has damaged any investigation whatsoever,” he said, adding that international companies such as Google Inc. and Facebook Inc. often report less than 100 Canadian requests in their report. “There is no evidence that I know of, and certainly none that the government has publicly disclosed, where revealing more granular numbers have endangered any of their investigations,” Parsons said. “Why is that cut-off there? What is the rationale? How is it not just an arbitrary, pulled-out-of-a-hat number?” Israel agreed, stating that the restriction on reporting numbers less than 100 is “very arbitrary,” and has “no real justification.” He added that the restriction on differentiating between law enforcement, national security and regulatory agencies is “actually contrary to … what transparency reports in other countries do on a regular basis.” There is also no rationale, he argued, for restricting companies from breaking down information on a geographic basis, or by type of network, which would make for “helpful” information. Israel did praise the government for taking the initiative to standardize the reports, given that variation between the different companies’ reports means it’s difficult to compare the information. At the same time, he said, the government should have broken down the categories into more specific sub-categories, so that, for example, disclosures of information like the numbers dialed by a user and a user’s metadata aren’t grouped together, since those are “categorically fairly different things.” Having more specific categories would provide more insight into how sensitive the information that’s being revealed is without compromising any investigations, he said. The Office of the Privacy Commissioner said in a press release Tuesday that the guidelines are “a very positive step in informing Canadians about how often, and in what circumstances, businesses provide customer information to law enforcement and security agencies.” It added that it has also asked federal government departments to issue reports of their own regarding the requests they’ve made to organizations in the private sector for information about their customers. “The OPC is of the view that Canada needs a consistent reporting structure and standardized nomenclature for the various categories of personal information and disclosures to government,” it said in an analysis of the reports that have been issued thus far. “While legal obligations and/or regulations could impose such requirements, the reporting regime advanced by Industry Canada is a good first step and we expect to see widespread adoption and compliance.” It also noted in its press release that the document was developed “in consultation with the , government departments and industry stakeholders.” Parsons criticized the government for not consulting with civil society groups involved in these issues, including Citizens Lab and CIPPIC. Both of those organizations sent letters to telecommunications companies in 2013 requesting information about their disclosure of information to government. The responses they received included few details, the academics said in March 2014, though Telus Corp., Rogers Communications Inc. and TekSavvy began issuing transparency reports later that year. Rogers’ most recent report was released in April 2015 and Telus’ in May. “You can go through a pretty lengthy list of different civil society bodies who have been very proactive in trying to understand and encourage transparency around these issues, and based on my quick reach-out to people this morning when it came out, because we were all so shocked, no one knew it was coming, and no one knew it was under development,” he said. “None of us were consulted, and so none of us had the opportunity to raise those issues and possibly improve what the government ended up releasing today.” Israel also said there are “shortcomings in the substance of this document which maybe could have been avoided had there been an actual discussion with civil society in particular.” — With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Derek Abma at dabma@thewirereport.ca

‘Arbitrary’ limits in Industry Canada transparency guidelines: critics

News | June 30, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

‘Arbitrary’ limits in Industry Canada transparency guidelines: critics

News | June 30, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us