8 ms·

Canada has the power to backdoor telecom networks for surveillance. All host nations do for their infrastructure as part of the RAN Architecture https://en.wiki

Canada has the power to backdoor telecom networks for surveillance. All host nations do for their infrastructure as part of the RAN Architecture https://en.wikipedia.org/wiki/Lawful_interception https://en.wikipedia.org/wiki/Lawful_interception What Canada seems to actually want is a way of doing this without legal oversight or recourse to traditional legal gatekeeping like warrants.

mrandish 2y ago
Given the rapidly declining state of individual privacy, when discussing these extensions it helps to be specific about the authorized agency and context. For example, these days, it's pretty much a given that NSA-type spy agencies are already getting all of whatever electronic communications they want with little friction. In the US there are certain supposed safeguards against surveilling US citizens domestically but we've already seen how quickly and easily these have been circumvented by using partner 'five eyes' agencies and commercial data brokers. While this is obviously problematic, to me, it's even worse if domestic law enforcement agencies gain new ways to remove friction like warrant requirements or at least the need to make specific per-instance requests (which are possible to (in theory) be tracked and reviewed to detect over-use and abuse). The idea of domestic law enforcement agencies gaining access to "full take" feeds of everything enabling them to retrospectively build massive connection trees of metadata which can be searched is downright terrifying.
- jonny_eh 2y ago
  Good insight. The difference between the NSA and local cops is that the NSA won't be looking for some bullshit to use as an excuse to arrest or harass you.
  - somenameforme 2y ago
    Nope, but they will be looking for your nudes. [1] [1] - https://www.independent.co.uk/tech/nude-photos-of-strangers-are-a-fringe-benefit-for-nsa-employees-says-snowden-9614097.html https://www.independent.co.uk/tech/nude-photos-of-strangers-...
    - exe34 2y ago
      [flagged]
  - sqeaky 2y ago
    There are just fewer of them, I suspect they are harassing someone.
  - thsksbd 2y ago
    Of course not. The dragnet surveillance is not to bother with your doobie habit. You and I and most of us are irrelevant losers doe the NSA They dragnet surveil to get dirt on the ten thousand or so lawmakers that matter.
    - always2slow 2y ago
      While your presentation is probably getting you downvoted, this is the real problem. They use this information to control/influence government officials or people with power.
    - marcosdumay 2y ago
      > lawmakers that matter And journalists, and people that see something and may want to wristleblow, and people that know commercial secrets (yes, they've been caught doing commercial spying). There are more categories here. And, of course, there's always the danger that the one random person that you didn't see eye to eye earlier just happens to work there.
    - Liquix 2y ago
      they dragnet surveil to build an increasingly accurate stockpile of data on an increasing number of people. everything is catalogued and filed away, nothing is discarded. at some point in the past or future, this data has been/will be weaponized via ML and used in the best interest of whomever controls it (the government), not in the best interest of the surveilled masses. this is why it is important to care about your privacy on the internet.
      - thsksbd 2y ago
        Also. Its very scary the workd we live in
      - deleted 2y ago
        [deleted]
  - sneak 2y ago
    Unless you’re a journalist publishing information about the federal government that they don’t like. Then they’ll imprison you indefinitely without trial. The bar is higher for them to wield “some bullshit” against you, but rest assured, they still will. It’s been more than a decade since Assange has been free.
  - wubrr 2y ago
    > The difference between the NSA and local cops is that the NSA won't be looking for some bullshit to use as an excuse to arrest or harass you. No, the difference is NSA is much more capable and has much less oversight (not that cops have much oversight or accountability).
esafak 2y ago
What's RAN? It's not in the link.
- kevin_nisbet 2y ago
  Radio Access Network - basically think the cell phone towers and the equipment for those towers.
kevin_nisbet 2y ago
I was going to add the same thing, this isn't only something the telecom providers do, the equipment providers include lawful intercept features as part of the equipment, the telecom just has to setup access. I don't have a chance to check right now, but I think this is even part of the published standards.
thsksbd 2y ago
Furthermore, Canada doesn't have a (real) constitution since the TP they have since 1982 has a "not withstanding" clause, meaning parliament can just ignore their equivalent of the Bill of Rights
- oldpersonintx 2y ago
  [dead]
- SECProto 2y ago
  Note that the notwithstanding clause has never been used by the federal government (the "parliament" you referenced). It's a shitty clause, and should be removed but it was put in at the behest of certain province(s) as the only way to get the Charter of Rights and Freedoms at all, and has only been used by provincial governments (aka legislatures, though a few provinces do call them "provincial Parliament").
  - glitchc 2y ago
    What prevents its use by the federal government? If the answer is "nothing", then it's only a matter of time.
    - Galxeagle 2y ago
      Political blowback has been enough to keep the power in check - it significantly raises the visibility of the attempted action whenever it's invoked(1) and historically has been associated with a political hit. It also has a 5-year sunset/renewal requirement, and can only override certain sections. I think everyone would generally agree a constitution would be stronger without it, but even if 'it's only a matter of time', it's played out as a pretty decent compromise to actually get the charter signed ~45 years earlier than potentially no charter at all. Canada generally relies on trust and good behaviour more than the US system of checks-and-balances - the most obvious difference is that our Prime Minister plays the role of both US president (head of exec) and congress (technically just the House equivalent, but the senate equivalent is much weaker) (1) https://www.cbc.ca/news/politics/notwithstanding-clause-doug-ford-bill-21-analysis-wherry-1.6645107 https://www.cbc.ca/news/politics/notwithstanding-clause-doug...
deleted 2y ago
[deleted]
incomingpain 2y ago
Canada already has lawful intercept. This is totally their goal.
torginus 2y ago
How? Doesn't HTTPS offer E2E interception? Do they have the ability to compromise that, or can they 'merely' ask the owner of the endpoint you are talking to to rat you out?
- dietr1ch 2y ago
  Can you have true E2E encryption without knowing your peer's public key in advance? They could cheat by sending you to talk to someone else in a "private" manner. An offline attack against the host's keys that relies on undisclosed vulnerabilities, or an online one against their infra that abuses recent CVEs and bad security also seem possible.
  - Manuel_D 2y ago
    Wouldn't this involve breaking the trust chain? You can't just redirect HTTPS traffic to a separate host with a different key. If the government demanded the peer's private key then this is possible. But you can't just arbitrarily redirect traffic without resulting in a cert error.
    - eddd-ddde 2y ago
      You don't even have to ask the peer. Because of the same chain of trust, you can just ask the root authority to give you a certificate for peer's identity.
- frabbit 2y ago
  Doesn't HTTPS offer E2E _interception_? A slip of keyboard I assume?
protocolture 2y ago
Usually the difference is where the interception occurs. For instance, most countries have had the ability to intercept signals since there have been signals. What they want is to root the OS / Application, and transmit home the unencrypted contents of messages before encryption or after decryption. They cant just walk into a business and order that however, they need the power to compel businesses to implement these changes. Thats why these things end up super vague.

mrandish 2y ago

Given the rapidly declining state of individual privacy, when discussing these extensions it helps to be specific about the authorized agency and context. For example, these days, it's pretty much a given that NSA-type spy agencies are already getting all of whatever electronic communications they want with little friction. In the US there are certain supposed safeguards against surveilling US citizens domestically but we've already seen how quickly and easily these have been circumvented by using partner 'five eyes' agencies and commercial data brokers. While this is obviously problematic, to me, it's even worse if domestic law enforcement agencies gain new ways to remove friction like warrant requirements or at least the need to make specific per-instance requests (which are possible to (in theory) be tracked and reviewed to detect over-use and abuse). The idea of domestic law enforcement agencies gaining access to "full take" feeds of everything enabling them to retrospectively build massive connection trees of metadata which can be searched is downright terrifying.

jonny_eh 2y ago
Good insight. The difference between the NSA and local cops is that the NSA won't be looking for some bullshit to use as an excuse to arrest or harass you.
- somenameforme 2y ago
  Nope, but they will be looking for your nudes. [1] [1] - https://www.independent.co.uk/tech/nude-photos-of-strangers-are-a-fringe-benefit-for-nsa-employees-says-snowden-9614097.html https://www.independent.co.uk/tech/nude-photos-of-strangers-...
  - exe34 2y ago
    [flagged]
- sqeaky 2y ago
  There are just fewer of them, I suspect they are harassing someone.
- thsksbd 2y ago
  Of course not. The dragnet surveillance is not to bother with your doobie habit. You and I and most of us are irrelevant losers doe the NSA They dragnet surveil to get dirt on the ten thousand or so lawmakers that matter.
  - always2slow 2y ago
    While your presentation is probably getting you downvoted, this is the real problem. They use this information to control/influence government officials or people with power.
  - marcosdumay 2y ago
    > lawmakers that matter And journalists, and people that see something and may want to wristleblow, and people that know commercial secrets (yes, they've been caught doing commercial spying). There are more categories here. And, of course, there's always the danger that the one random person that you didn't see eye to eye earlier just happens to work there.
  - Liquix 2y ago
    they dragnet surveil to build an increasingly accurate stockpile of data on an increasing number of people. everything is catalogued and filed away, nothing is discarded. at some point in the past or future, this data has been/will be weaponized via ML and used in the best interest of whomever controls it (the government), not in the best interest of the surveilled masses. this is why it is important to care about your privacy on the internet.
    - thsksbd 2y ago
      Also. Its very scary the workd we live in
    - deleted 2y ago
      [deleted]
- sneak 2y ago
  Unless you’re a journalist publishing information about the federal government that they don’t like. Then they’ll imprison you indefinitely without trial. The bar is higher for them to wield “some bullshit” against you, but rest assured, they still will. It’s been more than a decade since Assange has been free.
- wubrr 2y ago
  > The difference between the NSA and local cops is that the NSA won't be looking for some bullshit to use as an excuse to arrest or harass you. No, the difference is NSA is much more capable and has much less oversight (not that cops have much oversight or accountability).

esafak 2y ago

What's RAN? It's not in the link.

kevin_nisbet 2y ago
Radio Access Network - basically think the cell phone towers and the equipment for those towers.

kevin_nisbet 2y ago

I was going to add the same thing, this isn't only something the telecom providers do, the equipment providers include lawful intercept features as part of the equipment, the telecom just has to setup access. I don't have a chance to check right now, but I think this is even part of the published standards.

thsksbd 2y ago

Furthermore, Canada doesn't have a (real) constitution since the TP they have since 1982 has a "not withstanding" clause, meaning parliament can just ignore their equivalent of the Bill of Rights

oldpersonintx 2y ago
[dead]
SECProto 2y ago
Note that the notwithstanding clause has never been used by the federal government (the "parliament" you referenced). It's a shitty clause, and should be removed but it was put in at the behest of certain province(s) as the only way to get the Charter of Rights and Freedoms at all, and has only been used by provincial governments (aka legislatures, though a few provinces do call them "provincial Parliament").
- glitchc 2y ago
  What prevents its use by the federal government? If the answer is "nothing", then it's only a matter of time.
  - Galxeagle 2y ago
    Political blowback has been enough to keep the power in check - it significantly raises the visibility of the attempted action whenever it's invoked(1) and historically has been associated with a political hit. It also has a 5-year sunset/renewal requirement, and can only override certain sections. I think everyone would generally agree a constitution would be stronger without it, but even if 'it's only a matter of time', it's played out as a pretty decent compromise to actually get the charter signed ~45 years earlier than potentially no charter at all. Canada generally relies on trust and good behaviour more than the US system of checks-and-balances - the most obvious difference is that our Prime Minister plays the role of both US president (head of exec) and congress (technically just the House equivalent, but the senate equivalent is much weaker) (1) https://www.cbc.ca/news/politics/notwithstanding-clause-doug-ford-bill-21-analysis-wherry-1.6645107 https://www.cbc.ca/news/politics/notwithstanding-clause-doug...

deleted 2y ago

[deleted]

incomingpain 2y ago

Canada already has lawful intercept. This is totally their goal.

torginus 2y ago

How? Doesn't HTTPS offer E2E interception? Do they have the ability to compromise that, or can they 'merely' ask the owner of the endpoint you are talking to to rat you out?

dietr1ch 2y ago
Can you have true E2E encryption without knowing your peer's public key in advance? They could cheat by sending you to talk to someone else in a "private" manner. An offline attack against the host's keys that relies on undisclosed vulnerabilities, or an online one against their infra that abuses recent CVEs and bad security also seem possible.
- Manuel_D 2y ago
  Wouldn't this involve breaking the trust chain? You can't just redirect HTTPS traffic to a separate host with a different key. If the government demanded the peer's private key then this is possible. But you can't just arbitrarily redirect traffic without resulting in a cert error.
  - eddd-ddde 2y ago
    You don't even have to ask the peer. Because of the same chain of trust, you can just ask the root authority to give you a certificate for peer's identity.
frabbit 2y ago
Doesn't HTTPS offer E2E _interception_? A slip of keyboard I assume?

protocolture 2y ago

Usually the difference is where the interception occurs. For instance, most countries have had the ability to intercept signals since there have been signals. What they want is to root the OS / Application, and transmit home the unencrypted contents of messages before encryption or after decryption. They cant just walk into a business and order that however, they need the power to compel businesses to implement these changes. Thats why these things end up super vague.