Canadian and American governments look at Internet security; coordination possible

Governments on both sides of the Canada-U.S. border have released discussion papers on the need for online security in the wake of the terrorist attacks last year. But there is much uncertainty in the affected sectors because details are so vague. Last month, the Government of Canada released its Lawful Access consultation white paper. The 21-page document examines technological changes affecting the wireline, wireless and Internet markets. "As information and communications flow more easily around the world, they are also challenging existing legal provisions, agreements and techniques," the paper states. "Borders are no longer boundaries to this flow, and criminals are increasingly located in places other than where their acts produce their effects. In the face of these developments, law enforcement and national security agencies need modern and effective capabilities to support their investigative or intelligence gathering efforts." The report notes that Canada does not currently have any legal mechanism that forces service providers to have systems in place for data interception. Even though police or national security officials may have obtained proper warrants for specific intercepts, service providers may still not hand over the information. The draft paper suggests that upgraded systems be installed that would provide for such access. "The central tenet of the proposal is that service providers would be required to have the technical capability to provide access to the entirety of a specific telecommunication transmitted over their facilities, subject to a lawful authority to intercept," it says. "This would include the content and the telecommunications-associated specific data associated with that telecommunication." David Elder, assistant general counsel at Bell Canada, finds it hard to make specific comments, since many details will be handled by the regulation-making process. Nevertheless, he is happy that the government did not go overboard in some areas. "We are pleased to see that there is no mandated data retention," Elder tells Network Letter. "They have provided for preservation orders and for production orders but those are going to be sort of target-specific and that will only cover existing data that a carrier an ISP would currently keep for its own purposes. We’re not required to retain any particular types of information, just so it’s available for law enforcement." Elder’s uncertainty is shared by others in the industry. Jay Thomson, president of the Canadian Association of Internet Providers, laid out his concerns in an email to Decima Publishing Inc."We really don’t know yet what is being asked of us with these proposals: what are we expected to do, is it really necessary, how costly will it be, who will bear these costs, and what impact will the proposals have on our customers and, for example, their privacy rights?" Industry speaks with one voice The government is attempting to ease some of that trepidation by holding discussions with service providers, as recently as last week. Elder is hopeful that the industry will speak with one voice. "We have had informal discussions with some and we’re continuing to reach out and see if we can have some kind of an industry consensus position," he reveals. "Most of the interests I think are pretty well the same. Our networks are different and where we are in terms of infrastructure capability might be a little different but I think our interests are fundamentally the same." One item of concern is the cost of upgrading the network detection systems. Objections have been raised that the expenses incurred by smaller ISPs could be quite onerous. Bell’s legal counsel says the same objections can be raised by larger carriers. "It could be quite a burden on big ISPs and that’s a part we’re drilling down on," Elder offers. The governmental paper proposes harmonizing the Internet standards with those of wireline phones. It wants to create a specific production order that would allow the surrender of data extending beyond the current sections of the Criminal Code covering telephony. "The standard for Internet traffic data should be more in line with that required for telephone records and dial number recorders in light of the lower expectation of privacy in a telephone number or Internet address, as opposed to the content of a communication," the document states. There are currently many international proposals to handle security in the high-tech sector. The Council of Europe has written a treaty called the Convention on Cyber-Crime, which has been signed by 33 countries, including Canada (NL, Mar. 25/02). Before complete ratification can take place, however, Canada must make amendments to the Criminal Code. Last week, the White House issued a draft version of its National Strategy to Secure Cyberspace. Most of the comments have to deal with American interests at the federal, state, local and private levels. But tucked in near the end of the 58-page discussion paper is a suggestion to implement a continental strategy. "Particular emphasis will be put on ensuring that North America will be a ‘Safe Cyber Zone,’" the document says. "Working with Canada and Mexico to identify best practices for securing the many shared and connected information networks that underpin telecommunications, energy, transportation, and banking and finance systems, emergency service, food, public health, and water systems, the United States will seek coordinated solutions to ensure the integrity and reliability of those systems critical to Americans’ way of life." The need for cybersecurity is not limited to North America. The Bush administration cites concerns about actions in other nations. "While the Internet has grown enormously and globally, it has also grown increasingly insecure. People in almost every country on the globe can access a network that, in turn, is ultimately connected to networks that run critical functions in the United States. Cyber attacks on U.S. information networks occur regularly and can have serious consequences such as disrupting critical operations, causing loss of revenue and intellectual property, or loss of life." In another section, the paper states, "Cyberspace security is an international challenge that is not bounded by any physical national boundary. The operations of multiple sectors cross international borders. As a result, global infrastructure sectors are initiating efforts to promote the availability, integrity, and reliability of their common information systems." The Canadian government, in addition to holding meetings with interested parties, is inviting comments on its discussion paper. A deadline of November 15 is listed in the document, although Elder reports hearing rumours that the cut-off date may be extended. For more information on this topic, see the Sept. 3/02 issue of Report on Wireless and the Sept. 6/02 issue of Canadian NEW MEDIA.

Canadian and American governments look at Internet security; coordination possible

News | 09/23/2002 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us