Photo Credit: ()

Natalie Bravo is anÌęIPilogueÌęWriter and a 2L JD Candidate atÌęOsgoodeÌęHall Law School.Ìę

Ìę

(FRT) is an increasingly popular and controversial tool used by public authorities and commercial institutions. FRT increases surveillance methods for investigative or security work. FRT easily collects vast quantities of biometric information with minimal cost or effort. Sensitive identity-based data is particularly valuable.

These databases and data collection methods are not without risk. Reports of and Canadian privacy law violations weaken the argument for implementing FRT. On June 10, 2021, issued a on FRT and -related surveillance as it pertains to the Canadian public. The special report specifically investigates the RCMP’s use of Clearview AI (with FRT), pursuant to section .

What is Clearview?

(“Clearview”) is an American-based entity that has amassed a wide catalogue of facial images with associated location information. Users with Clearview accounts can access the images for matching purposes. In October 2019, the RCMP confirmed that it . The OPC subsequently received a complaint under the . Clearview also has their

Canadian Legislation

The OPC investigation and report engages the Privacy Act, specifically : “No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.”

Further, applies to “private-sector organizations across Canada that collect, use or disclose personal information in the course of a .” Commercial activity is defined by law as “any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”

, , and have their own privacy laws that may apply instead of PIPEDA. Most organizations within these provinces rely on provincial privacy laws, except for “,” or “ (FWUBs) such as banks, telecommunications and transportation companies,” .

2020 Investigation into Clearview

On February 21, 2020, the OPC, along with privacy authorities in , , and (“the Offices”), began investigating Clearview, their FRT database, and database disclosures pursuant to . Clearview’s collection practice was found to contravene privacy laws in all investigating jurisdictions. This investigation provided much of the backdrop for the subsequent RCMP investigation. As outlined in the , the Offices set out to identify whether Clearview:

1. “obtained requisite consent to collect, use and disclose personal information; and
2. collected, used and disclosed personal information for an appropriate purpose.”

The Commission d'accĂšs Ă  l'information (CAI) also sought to determine if Clearview had:

• “reported the creation of a database of biometric characteristics or measurements.”

The OPC’s February 2021 report of Clearview’s facial recognition tool identified .

“C±ô±đČč°ù±čŸ±±đ·É:

1. “scrapes” images of faces and associated data from publicly accessible online sources (including social media), and stores that information in its database;
2. creates biometric identifiers in the form of numerical representations for each image;

• allows users to upload an image, which is then assessed against those biometric identifiers and matched to images in its database; and

1. provides a list of results, containing all matching images and metadata. If a user clicks on any of these results, they are directed to the original source page of the image.”

The OPC found that Clearview’s database contains over , including pictures of Canadian faces (including children) collected without their knowledge or consent. Clearview allows law authorities and commercial entities to match people to online images within their database. The OPC found that the large image database “The OPC stated that police authorities can “essentially” subject billions of people Ìęto a non-consensual .

The OPC concluded that Clearview’s operations harm Canadians as they may detriment individuals whose photos are used without their explicit and informed consent. The method in which images were scraped from web pages was also found to be “”, among other Clearview activities.

The OPC provided three recommendations for Clearview to better comply with federal and provincial privacy laws: cease offering its facial recognition tool to clients in Canada; (ii) cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada; and (iii) delete images and biometric facial arrays collected from individuals in Canada in its possession.”

, noting that they had withdrawn from Canada during the investigation, and did not commit to the recommendations. Clearview also suggested that the OPC should suspend the investigation and not publish the report.

RCMP Investigation in the Special Report:

As Clearview was clearly found to contravene privacy laws, the RCMP’s use of Clearview technology was also the Privacy Act’s collection policies.

Curiously, ; that was false and concerned the OPC. According to , the RCMP made hundreds of search requests through the database on at least 19 accounts. The OPC assessed the RCMP’s They found that the RCMP failed to properly ensure that their use of Clearview technology complied with the Privacy Act. Further, the RCMP did not report any system implemented to “ Clearview’s data. This represented a serious lack of care regarding the sensitive information collected. Ultimately, the OPC recommended “ within a year to handle (any) novel collections of data.

The RCMP that they violated section 4 of the Privacy Act. In fact, they argued that under the Act, they do not have a duty to ensure legal compliance of private third parties like Clearview. However, they did agree to OPC’s recommendations in an effort to improve operations.

Soon after the OPC launched their RCMP investigation, the RCMP internally worked to some of the issues. They restricted their use of Clearview and started the “National Technology Onboarding Program” to look into how novel investigative techniques comply with the Privacy Act and the . As of July 2020, Clearview stopped offering its services to Canada, and the RCMP stopped using it altogether.

In light of this , the OPC published the “” (“the Draft”) to provide provincial, regional, federal, and municipal police agencies with more detailed privacy compliance information. The guide offers a with various related guidance, and data management related to , , , , , and more.

The OPC also offers up-to-date information on the accuracy of FRT and algorithms, emphasizing the . In the same way, the guide underlines “.” In other words, agencies should only collect and retain what is necessary, rather than cast a wide net. The is a rather thorough document with many references to specific case law and related authority. It demonstrates the importance of privacy in Canadian society and the seriousness in which Canadian officials deal with consent, surveillance, and novel technology. FRT may evolve into a useful tool, but until it meets the recommendations of the OPC, the RCMP will need some constructive and careful effort to use FRT again.

The post A 24/7 Police Line-up: Clearview AI, the RCMP, and Privacy Laws appeared first on IPOsgoode.

Cybercrime is a growing global problem that no company or country can tackle alone. At any given time, an estimated 150Ìę000 viruses and other types of malicious code are circulating across the internet, infecting more than a million people every day.

Anti-virus software developer McAfee counts 75 million unique pieces of malicious malware code on its databases, with botnets spewing out spam that account for a third of all the emails sent every day. Bots are one of the most sophisticated and popular types of cybercrime today. They allow hackers to take control of many computers at a time, and turn them into “zombie” computers, which operate as part of a powerful “botnet” to spread viruses, generate spam, and commit other types of online crime and fraud. The worldwide cost of cybercrime is estimated at over €750 billion annually in wasted time, lost business opportunities and the expense of fixing problems.

In addition to developing wider cybersecurity strategies for Europe, the European Commission takes concrete actions to tackle cyber security risks, and pools resources with national governments, industry, universities and NGOs, to develop innovative technologies to improve cybersecurity.

For the period 2007-2013, the European Commission has spent about €350 million in cyber security research; from 2013 to 2020, €400 million is earmarked to support key enabling & industrial technologies such as cyber security, privacy and trust technologies, and an additional €450 million is earmarked for ‘Secure Societies’ research which includes aspects of cybersecurity.

The following EU-funded projects address the big issues facing cybersecurity: cost, speed and long-term security; helping to keep computer users one step ahead of the hackers, Trojans and viruses plaguing the online world today.Ìęto read more.

The post Digital Agenda: European Commission Supports Research on Cyber Security appeared first on IPOsgoode.

by announcing it may pull out of China. In the meantime, it would no longer enforce China’s information suppression and screening platform. Ultimately, if Google leaves China, it will do so because the country’s government would not tolerate Google running without filters. this as Google possibly being the first of other American corporations standing up for freedom of speech and information in a country sorely lacking both. However, closer investigation of the allegation paints a more complex picture. The issue revolves around freedom of information on the Net, privacy rights, and intellectual property rights (IPR).

Google that hackers accessed the Gmail accounts of Chinese human rights activists. However, this was limited to a few email addresses. Furthermore, the information only included account creation dates and subject lines. They did not extend to the content of those email accounts. Hence, although privacy and freedom of information on the Net are an issue in this particular case, an objective evaluation points to another central problem.

In fact, it seems that Google is particularly miffed about the hackers’ alleged breach and extraction of its intellectual property, along with that of other international corporations. The Official Google blog states: “As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses--including the Internet, finance, technology, media and chemical sectors--have been similarly targeted.”

Google can afford to state its opinion on the dreadful state of IP protection in China. Other corporations aren’t so privileged. Even though the online market in China has immense potential, Google only makes about 1% of its revenue there. The same might not be said for other major companies. Hence, Google’s statement might reflect the hushed view of many other corporations operating in China. The first response of the Chinese government has been that “”. Nothing has been stated directly on intellectual property rights.

China joined the World Trade Organization (WTO) in 2001. Afterward, it amended its legal system to with the WTO Agreement on Traded-Related Aspects of Intellectual Property Rights (TRIPs). Hence, at least in theory, China does have a legal system for dealing with IPR. It also has an obligation under TRIPS to enforce and protect intellectual property.

IfÌęChina does not enforce IPR, it is breaching its obligations under TRIPs. Furthermore, such a state of matters will discourage future business and innovation in the country. There will simply be less incentive for companies to move or continue operating in China. This applies especially to IP brought in from abroad. Like privacy and freedom of speech, intellectual property is also a right. Ultimately, all rights can be traced to a notion of dignity for the person and society at large. Perhaps it is naive for companies to think that in a country where other rights are foregone, IP rights will be respected and enforced. On the other hand, it is important to note that China does have set up to comply with its WTO obligations. This consists of an administrative procedure and a criminal or civil judicial avenue available for complainants. At this point, it is important for China to show the world that its judicial system does in fact work when it comes to IPR. As others have said before me, for different reasons, the ball is in China’s Court(s).

The post Secure IPR essential for China's Growth appeared first on IPOsgoode.

e-Government, e-Commerce, online banking, Facebook – What do these have in common? All these services and functions are made possible by the fact that they are able to associate our activities with our identities. As our reliance on technology continues to grow, the ability to authenticate one’s identity becomes critical in even the most routine social interactions. In this posting, I would like to focus on identity theft specifically in the digital realm.

On October 27, 2009, Canada granted the of Bill S-4, a new addition to the Criminal Code that creates three new offences that are directly linked to the early stages of identity theft:

• Obtaining and possessing identity information with the intent to use the information deceptively, dishonestly or fraudulently in the commission of a crime.
• Trafficking in identity information, an offence that targets those who transfer or sell information to another person with knowledge of, or recklessness as to, the possible criminal use of the information.
• Unlawfully possessing or trafficking in government-issued identity documents that contain the information of another person.

Each of these offences carries both the potential for imprisonment for up to five years, as well as restitution for victims of identity theft.

These are welcome changes in the law that provides law enforcement powerful tools to use in their fight against identity theft.

However, it begs the question – Are they enough to protect you and I?

What if the perpetrator isn’t under the jurisdiction of the Canadian courts? ()

Hi, my password is ‘password’. What’s yours?

Given the high reward and relatively low risk involved with identity theft, attacks and attackers are becoming increasingly sophisticated. There have been reputable claims that even organizations such as crime syndicates and terrorists have become involved, beyond the usual suspects of individually motivated small-time cyber-criminals.

Identity theft can occur in many ways, ranging from complex exploitations of underlying technology flaws to simple common sense, such as brute force (a large number of attempts) or dictionary attacks (trying commonly used passwords). Aside from the sites that are extremely well protected, generally the common sense attacks have worked, often with humiliating and/or devastating results (Case studies: , , ).

Come on in, my door is wide open

While it is important to empower law enforcement with the ability to properly prosecute these offences, I believe that there should equally be an onus on the victims (both corporate and individuals) to ensure that their private information is properly stored and secure.

In this day and age, there are many good tools and leading practices to help users and corporations secure their information properly (e.g. / , Windows Updates, encryption, VPN). It is not likely to stop the most determined attackers, but provides a means of protection against the most common and often very simple attacks.

Given their ubiquity and relatively low cost (as compared to the cost of an adverse effect), it is my opinion that not taking the diligence to secure your information is similar to leaving your front door unlocked. I’m not going so far as to say that unsecured victims are negligent in their own right, but it would be prudent of the government to also enact legislation that would in effect require a higher standard of cybersecurity amongst the general public.

If we, the targets, take the appropriate steps, hopefully the future won't end up looking like .

The post It’s not me, it’s you appeared first on IPOsgoode.