#dp&s

I won't make any bones about it... I'm really, really loving the fact that the Supreme Court of Canada is doing for Canadians what the Conservative Party of Canada should be doing.  I won't turn this into a diatribe (at least I'll try REALLY hard not to, because you 8 followers of mine are pretty awesome even if you don't know it), but it strikes a very hollow note when the SCC has to weigh in on case law that reduces all Canadians to surveillance targets.  The constant fight to keep your own privacy becomes a major hassle when legislative efforts come to the fore that compel your ISP to funnel information to police/investigative agencies simply because they ask for it, regardless of whether they have a warrant.   There are a bunch of different ways around this (which I'll talk about in another rant blog), but when the average user is subject to this level of intrusion (let's call it what it plainly is), we're all fundamentally diminished.   Our laws in Canada (as defined by the Charter of Rights and Freedoms) secure our fundamental right to security of person, and freedom from unreasonable search and seizure (sections 7 & 8).  These have been undermined by the interpretation that because Canadians enter into a contract with ISPs, the information transferred between the ISP and other points on the internet on behalf of the subscriber is fully available to police on request, simply because police request it. This formed the basis of a constitutional challenge, and a rather ugly black-mark on the Ministry of Justice.  Some information obtained (illegally) was used to convict Matthew David Spencer in 2007 of several charges surrounding Child Pornography, namely accessing and providing access.  

Judgments of the Supreme Court of Canada - R. v. Spencer

CBC News - Internet users' privacy upheld by Canada's top court

VICE News - Canada's Top Court Just Ruled Online User Data is Inherently Private

Here's the part where I post the nasty details (see the SCC link for the full text of the decision): Spencer was charged with several child-porn related offences, all of which he was found guilty and convicted for.   The one that triggered the appeals was the "making available" charge.  In this case, it required the ISP divulging when, to whom and what was transferred.   In the interest of being fully transparent, and hopefully not misunderstood; I think Spencer is a loathsome piece of garbage that deserves jail time for what he did. What he did is beneath contempt, and I think his actions deserve a long sentence and separation from the rest of society for the protection of children. I know other than for a larger matter, I could not make a positive defence for this fellow in light of the evidence.   That being said, I don't think we need to heap on convictions from illegally gotten evidence, either.   Spencer is going to jail for possession of child-porn, the appeal for 'making available' is dismissed, and a new trial is ordered.  Within the scope of the law and the constitution, I can see this going no further, the other convictions will stand, and the new trial likely won't go anywhere. So much the better.  To be sure, I don't like the idea that the 'net as I know it is being used for illegal activities that extend far beyond simple copyright infringement.  It's repulsive to me that it's being used aid in the commission of crimes like drug trading, money laundering, ransom, fraud, human trafficking or child-porn trading.  It's as repugnant that people that use the internet for wholly innocent purposes would be subject to review only because they're using the internet. 

We have to worry about this for the immediate future: don't doubt that there are some gears grinding to create a new law that will compel provision of data. There are two bills making their way through the parliamentary machine Bill C-13 and Bill S-4 that would further legitimize casual access to information, had this ruling not been handed down.  As it stands, C-13 will be essentially Dead-On-Arrival as the SCC's ruling effectively undercuts the no-warrant search power. Bill S-4 is a little more slippery as it opens the door to other laws being altered.  As it is currently a law in force, it would have to be separately challenged.  This all is a greater umbrella that essentially back-stops mining of data on you for 'just cuz' reasons. Somehow that doesn't sit well with me. 

I think the solution to this situation is a lot more nuanced. It's going to take a TON more work to divine the solution from either whole-cloth or existing laws as frame-work, and really make it work.  I don't want to deprive police or investigators of the tools they need to work, but I also don't want to hand over carte-Blanche to do what they will and trust their best intentions and tender mercies while they can break the law that constrains the rest of us.  We need a solution that not only finds a balance, but also stays that way.  While our core values as Canadians may stay the same, technology doesn't. 

We've got a lot of work to do if we want to find a lawful, and constitutional balance.  It's going to take a lot of talk with, and maybe a bit of hectoring of MPs to make sure that the solution is found.  Who's with me?   

... or I really shouldn't rag too hard on Apple devices.  I have some pretty strongly held (but I like to think they're well-founded) opinions on the cellphone OS wars.  I strongly distrust a black-box/Security-through-obscurity approach to security.  It depends on the issuing company to not only acknowledge that their product may be vulnerable, but also working with CERT teams to catch, rectify and push fixes for major issues.  This said, the only open source mobile OS, Android is FAR from perfect.  It does, in fact, have the lion's share of the mobile malware market.  

Case in point: Android/Simplocker.A malware. This can fairly easily infect an unprotected device, and it will encrypt picture, video and text files, demand a small 'fine' as pretext to unencrypting the files, and then allow you to carry on.  The nature of this is seemingly political, but that doesn't decrease the shock value.  For further details, hit the link on the picture, if it weren't a massive pain in the posterior, it'd be quite the feat of coding.     The major differentiation between the two major players in mobile is that Android has many options for detection, halting of, and mitigating malware attacks.  The onus is on the user, but if you've read my blog, you'll know that I really do prefer individual users being in control of this on their own devices.   Seeing as how I've met my quota for words that I set for myself, I'll say that Ransomware is popping up for mobile devices after most people believing it wouldn't be possible/applicable.  If you have an Android device, I really recommend getting some sort of an AV/Malware solution for it...  Do it TODAY.  I have personal recommendations, but in reality something is better than nothing.  Note, you don't usually have to pay for a good AV solution, but that may offer premium features like scheduled scanning, automatic updates, etc.  This is where there is an element of trial and error.   My recommendations. in order: Eset Mobile Security & Antivirus, Sophos Free Antivirus and Security, Kaspersky Security for Mobile, and others... if they make a PC solution it's a fair bet their mobile version will be as good. 

.. or, Google gets amnesia, because EU courts said so.  Hi gang!

For all 7 of you following me, I'm sorry I haven't updated in an age or two, mainly because I'm actually working and enjoying the decrease in overall hours spent doing not related to education, the drop from 70-75 hours a week to 37.5 hours a week is... pretty awesome. I'm not going to lie.

Anyhow, if you're worried about big data, online bullying, etc. I can't give you a panacea (other than to leave it off-line if there's any question as to the embarrassment factor) but I can point you at what I'll call Google's amnesia page:

https://support.google.com/legal/contact/lr_eudpa?product=websearch

... if you haven't, consider this a friendly boot in the butt. But this, is considerably less friendly: Comcast left the vulnerability open for about 24 hours.   For those of you keeping score, that's 24 free, and unfettered hours that your email servers were wide open for exploitation by anyone that knew how to.  By the way, us Canadians are NOT safe either: Good ol' Ma Bell was laid bare using the same sort of hack, by the same people.  This was the same group that hacked SnapChat not too long ago.  What to do now?  Well, you need to basically start checking your account, but first, CHANGE YOUR PASSWORD!