Internet Providers are Keeping Canadians In the Dark About Their Privacy

​When it comes to transparency, a new report suggests that Canadian internet providers are lagging behind their US counterparts and others worldwide, which have become increasingly forthcoming in terms of what they know about who is scooping up user data and how.

The report, from researchers at the university-led New Transparency Project, rated 43 internet companies based on ten criteria that included: whether or not they've publicly committed to comply with Canadian privacy laws, how open they are about the data they give to law enforcement, and if they tell customers whether or not their data is routed through the US—where it lies outside Canadian protections on personal data.

The results weren't great.

The companies in the report included Canadian internet providers both big and small, as well as foreign "transit carriers" that work behind the scenes to route Canadian traffic through US networks such as AT&T. Of all these companies, the highest scorer was Teksavvy, an independent internet service provider in Ontario. It got five stars out of a possible ten.

"After the Snowden revelations, Microsoft, AT&T, and so on were all shown to be working closely with the NSA, and they've suffered reputational damage that they're trying to repair by getting stars on these kinds of reports," said Andrew Clement, a professor at the University of Toronto and one of the report's authors. "We're trying to get Canadian carriers to follow suit, while recognizing full well that this only touches the surface and that what they're doing behind the scenes and the arrangements they have with security agencies is far more concerning—we just don't have access to that." "We're trying to flush them out," Clement continued.

So, what can Canadian companies do to get more stars? For a start, they could issue annual transparency reports. So far, only a handful of companies in Canada issue such reports, such as Rogers and Teksavvy, but not Bell. Parallel initiatives in the US, such as the Electronic Frontier Foundation's "Who's Got Your Back?" rating system, have resulted in greater consumer accountability on the privacy front, Clement said.

In addition, Canadian companies could be more proactive about informing customers when their data has been requested by a third party, instead of placing the onus on users to ask, as is currently the case. OpenMedia, a Canadian telecommunications advocacy group, has even started a site to help citizens file such requests.

The report is timely in light of the national debate surrounding Bill C-51, a bill considered by many to be dangerously overbroad in the legal allowances it gives spies to do their jobs; over and over, it states that they can do "any thing." The bill was proposed by the country's incumbent Conservative party, supported by the opposition Liberal party, and it appears likely that the bill will pass.

"Telecom carriers need to be out there demonstrating that they're concerned about their subscribers privacy, and resist the encroachments of secret surveillance—secret to the extent that we don't know anything about what's being done, how it's justified, and what the accountabilities are," said Clement. "It's really quite worrisome. Telecom companies should be seen as advocates for privacy."

The crux of this matter, Clement said, is the idea of Canadian data sovereignty. Once data is routed through the US, it falls outside of Canadian law under the Personal Information Protection and Electronic Documents Act (PIPEDA), which places limits on what kinds of personal data can be collected and how.

The real trick, beyond being more transparent about where data is routed, Clement said, is to keep it inside Canada in the first place.

"Basically, Canadians have no protections against the NSA and GCHQ and so on," he said. "As we show in the report, traffic from Toronto going back into Toronto goes through New York. It's quite egregious from a technical and economic point of view—the game the carriers play." "I'm hoping Canadians will become more aware of how the internet works from that point of view, and the risks they are exposed to due to these backroom deals between the carriers and security agencies."

With legislation such as Bill C-51, and the surreptitious activities of its security agencies, Canada is edging closer to a troubling new age of surveillance—and it's more important than ever that the internet companies be transparent about how their data is used.