Transparent Lives: Surveillance in Canada

TRANSPARENT LIVES

THE NEW TRANSPARENCY PROJECT

Transparent Lives

Surveillance in Canada

Editors:

COLIN J. BENNETT,

KEVIN D. HAGGERTY,

DAVID LYON,

VALERIE STEEVES

Copyright © 2014

Colin J. Bennett, Kevin D. Haggerty, David Lyon, and Valerie Steeves

Published by AU Press, Athabasca University

1200, 10011 – 109 Street, Edmonton, AB T5J 3S8

ISBN 978-1-927356-77-7 (print)  978-1-927356-78-4 (PDF)  978-1-927356-79-1 (epub)  doi:10.15215/aupress/9781927356777.01

Cover and interior design by Marvin Harder, marvinharder.com

Printed and bound in Canada by Friesens

Library and Archives Canada Cataloguing in Publication

          Transparent lives : surveillance in Canada / editors, Colin J. Bennett, Kevin D. Haggerty, David Lyon, Valerie Steeves.

The New Transparency Project.

Includes bibliographical references and index.

Issued in print and electronic formats.

ISBN 978-1-927356-77-7 (pbk.).—ISBN 978-1-927356-78-4 (pdf).—ISBN 978-1-927356-79-1 (epub)

          1. Electronic surveillance—Canada. 2. Privacy, Right of—Canada. 3. Social control—Canada. I. Bennett, Colin J. (Colin John), 1955-, editor of compilation II. Haggerty, Kevin D., editor of compilation III. Lyon, David, 1948-, editor of compilation IV. Steeves, Valerie M., 1959-, editor of compilation

JC599.C3T73 2014            323.44’820971            C2013-908668-4

                                                                             C2013-908669-2

This book has been published with the help of a grant from the Federation for the Humanities and Social Sciences, through the Awards to Scholarly Publications Program, using funds provided by the Social Sciences and Humanities Research Council of Canada. We acknowledge the financial support of the Government of Canada through the Canada Book Fund (CBF) for our publishing activities.

Assistance provided by the Government of Alberta, Alberta Multimedia Development Fund.

Please contact AU Press, Athabasca University at [email protected] for permissions and copyright information.

Contents

Preface

Acknowledgements

Introduction

How Canadian Lives Became Transparent to Watching Eyes

TREND 1 Expanding Surveillance

From the Atypical to the Routine

TREND 2 Securitization and Surveillance

From Privacy Rights to Security Risks

TREND 3 The Blurring of Sectors

From Public Versus Private to Public with Private

TREND 4 The Growing Ambiguity of Personal Information

From Personally Identified to Personally Identifiable

TREND 5 Expanding Mobile and Location-Based Surveillance

From Who You Are to Where You Are

TREND 6 Globalizing Surveillance

From the Domestic to the Worldwide

TREND 7 Embedding Surveillance in Everyday Environments

From the Surveillance of People to the Surveillance of Things

TREND 8 Going Biometric

From Surveillance of the Body to Surveillance in the Body

TREND 9 Watching by the People

From Them to Us

Conclusion

What Can Be Done?

APPENDIX 1 Surveillance and Privacy Law: FAQS

APPENDIX 2 Surveillance Movies

APPENDIX 3 How to Protect Your Privacy Online: FAQS

APPENDIX 4 Canadian NGOS Concerned with Surveillance, Privacy, and Civil Liberties

APPENDIX 5 Further Reading

List of Contributors

Index

Preface

Transparent Lives: Surveillance in Canada details nine key trends in the processing of personal information, trends that are evident throughout the world. They affect all Canadians, but few citizens are aware of how, when, for what purpose, or with what consequences their personal data are used by large organizations. Hence the title: Transparent Lives. This book demonstrates that our lives are open and visible to organizations as never before and that in every area of life—as citizens, consumers, workers, and travellers—this makes a difference.

That difference is summed up in the subtitle of this book: Surveillance in Canada. By surveillance, we mean any systematic focus on personal information in order to influence, manage, entitle, or control those persons whose information is collected. Whether we are claiming health benefits in the clinic, using our loyalty cards in the store, performing our daily duties in the workplace, checking our messages on a smartphone, or waiting in the security line to board a plane, our data are collected, stored, classified, revealed, or even sold to others in ways that may variously guide our purchases, channel our choices, delay our departure, ensure that we are fairly or unfairly treated, or reward or punish our behaviour.

As organizations become more digital, they seek more personal data in order to increase efficiency, productivity, oversight, and control. As organizations find that they save money or increase their appeal to clients through their digital efforts, they intensify their use of new technologies and techniques to identify specific categories of people so that different groups can be treated differently. For instance, loyalty cards reward repeat customers, welfare payments are tightly targeted, street cameras see minorities and youth disproportionately in urban areas, and customers seeking coffee can quickly learn where the nearest Starbucks is located.

In these examples, as in those used throughout this book, surveillance is understood as an organizational tool that has ambiguous consequences. It is not simply good or bad, helpful or harmful. At the same time, neither is it ever neutral. This volume shines a light on how key surveillance trends produce outcomes that call for care in using personal data, especially by those who process sensitive information but also by those whose data are disclosed on a daily—even moment-by-moment—basis. The book draws attention to urgent questions of privacy, fairness, and justice.

What Are the Key Trends?

What Can Be Done?

We do not live in a police state. Canada has a fairly good track record of limiting unnecessary surveillance and promoting privacy, although in recent years, events such as the advent of no-fly lists and police access to personal data online have dented our reputation. Our privacy commissions (federal and provincial) are the envy of many countries, and individuals and agencies routinely question apparently egregious lapses in care with personal data in Canada.

Transparent Lives is concerned, above all, with unnecessary, excessive, and sometimes illegal processing of personal data. To oppose the growth of surveillance is to raise questions about abuses that often arise from the thoughtless extension of some legitimate surveillance to other areas. This is often referred to as function creep or even mission creep. Although some general protections exist, the main forms of resistance to unwanted or unwarranted surveillance happen when a specific issue comes into the public spotlight. At that time, several different responses typically occur, each of which is valuable. Together, they can be formidable.

We have a number of assets to draw upon in meeting the challenges we face. Canadians have some strong protections under the Canadian Charter of Rights and Freedoms (1982); the federal Privacy Act (1982), which pertains to government; the Personal Information Protection and Electronic Documents Act (PIPEDA, 2004), which relates to commerce; and several provincial laws. The privacy commissioners at federal and provincial levels have been vigilant in their efforts to ensure that privacy laws are observed in spirit as well as letter. Privacy professionals and NGOS have buttressed the available protections and may also act as whistleblowers on specific issues. However, such protections can only be effective when supported by an informed and active citizenry. Ordinary citizens, along with educational initiatives, have a vital role to play in exposing and questioning surveillance and in pressing for privacy.

Transparent Lives demonstrates dramatically just how visible we have all become to myriad organizations and what this means—for better or for worse—for how we conduct our everyday lives. The irony is that as we have become more transparent to organizations, they have become less transparent to us. The politics of personal data involves making surveillance processes more visible to us so that we can engage democratically to seek fairness for all. Our hope is that this book will stimulate action toward greater accountability within organizations. In a digital age, data, especially personal data, are profoundly political.

Acknowledgements

This book is the work of many people, each of whom is committed to its message and has agreed to trust the editors and their assistant with the final product. It is collaboratively written to maximize its reliability and collectively edited to ensure its readability. The main authors are Colin J. Bennett, Andrew Clement, Aaron Doyle, Kevin D. Haggerty, Stéphane Leman-Langlois, David Lyon, David Murakami Wood, Benjamin J. Muller, Laureen Snider, and Valerie Steeves. In addition, other professors, postdoctoral fellows, and graduate students contributed to some sections of the text, including the appendixes, and also suggested possible illustrations. These are Ciara Bracken-Roche, Art Cockfield, Alexander Cybulski, Ian McCuaig, Jeffrey Monaghan, Jonathan Obar, Caroline Pelletier, Sachil Singh, and Dan Trottier. A number of privacy and surveillance experts kindly ran their critical eyes over the manuscript: Robin Bayley, Jay Handelman, Peter Hope-Tindall, Philippa Lawson, Pierrot Péladeau, Blaine Price, Chris Prince, Roch Tassé, Micheal Vonn, and Yijun Yu. At Athabasca University Press, we were ably assisted by Pamela MacFarland Holway, Kathy Killoh, Morgan Tunzelmann, and Megan Hall. And the project simply would not have been possible without the editorial assistance of Anne Linscott and Emily Smith and the administrative help of Joan Sharpe in the Surveillance Studies Centre at Queen’s University.

The New Transparency: Surveillance and Social Sorting, a multidisciplinary research program, is a Major Collaborative Research Initiative involving several Canadian universities as well as the Open University in the United Kingdom and is fully funded by the Social Sciences and Humanities Research Council of Canada (SSHRC). The research team examines a variety of different aspects of processing personal information in today’s digital world (see www.sscqueens.org/projects/the-new-transparency/about/), but we have been committed from the start to offering back to Canadians the outcome of our investigations in an accessible format. We are grateful for the ongoing support of SSHRC, as well as for that of the entire NewT team and our partners, particularly the Office of the Privacy Commissioner and the International Civil Liberties Monitoring Group.

TRANSPARENT LIVES

Introduction

How Canadian Lives Became Transparent to Watching Eyes

Today, our lives are transparent to others in unprecedented ways. In Canada, as elsewhere, many kinds of organizations watch what we do, keep tabs on us, check our details, and track our movements. Almost everything we do generates an electronic record: we cannot go online, walk downtown, attend a university class, pay with a credit card, hop on an airplane, or make a phone call without data being captured. Personal information is picked up, processed, stored, retrieved, bought, sold, exchanged. Our lives—or rather, those traces and trails of data, those fragments of reality to which our lives can be reduced—are visible as never before, to other individuals, to public and private organizations, to machines.

Do we care? Some shrug off this loss of privacy as an inevitable consequence of living in a digital world. Some say, So what? In the days when people lived in villages and small towns, their lives were forever open to personal scrutiny. What we have today is just a new electronic form of the same kind of public knowledge of private lives. Others—in particular, those who use personal data to make money—dismiss any worries as misplaced. For example, as early as 1999, Scott McNealy of the giant computer company Sun Microsystems claimed, You have zero privacy anyway. Get over it.¹ In 2010, Facebook’s Mark Zuckerberg memorably declared: People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time.²

In what follows, we will see that such responses range from inadequate to wrong. Surveillance does matter. It confronts us with questions that will not go away and that cannot simply be shrugged off. Yes, surveillance has exploded in a digital world, but what are its actual effects? Do we know? Yes, people in villages knew that details of their lives were open to public scrutiny, but now it is large government and business organizations, not only our neighbours, that probe our lives, and they do so on a massive scale. Yes, systems like Sun Microsystems work to diminish privacy in some settings, but zero privacy? This assumes that systems are all-knowing and that people cannot resist, which is clearly not the case. Yes, social media help to push the privacy envelope, but the social norm is much more complex and consequential than Zuckerberg cares to think. These simplistic (not to mention self-serving) responses to a complex situation fail to grasp the personal, social, and political consequences of surveillance. As Canadian Internet guru Don Tapscott says, With radical transparency, all of our identities and behaviours become flattened and observable by others—and we lose control.³

The New Transparency, the title of the seven-year research project that prompted this book, was chosen to drive home the point that we are visible to others as never before.⁴ The extent to which personal information is gathered, processed, and retained is unparalleled in human history—a fact that may produce feelings of discomfort or uncertainty about our own lives. I did not intend that photo to be seen by a potential employer, we may realize in hindsight. Why is this store asking for my phone number yet again? But the subtitle of the research project is Surveillance and Social Sorting. This phrase is meant to spotlight not only our discomfort at being exposed—surveilled—but also a second issue: What happens to us when our personal information is collected and used by others? Having a sense of control over our public persona is vitally important, as are the ways in which we are profiled and categorized, because such processes have an impact on our life chances and choices. We are treated differently depending on our profiles, and such treatment, in turn, changes our present and our future. This is social sorting.

The we here refers to Canadians. Surveillance, of course, knows no national boundaries. But while similar processes occur in other countries, this book spotlights how surveillance is being augmented and intensified in Canada. And Canadians do care. For instance, more than half (55 percent) of Canadians polled in 2012 said that they object to police and intelligence services, even with a court order, obtaining information from content posted on social media sites. Two-thirds of Canadians polled in the same year disagreed with the statement that the police and intelligence agencies should have more powers to ensure security even if it means Canadians have to give up some personal privacy safeguards.⁵ And 90 percent object to companies like Google selling their information to others.⁶ As surveillance spreads, Canadians need to know not just about specific and spectacular cases of privacy invasion or security breaches but also about the key trends in surveillance. We badly need a way to put our experiences, our anxieties, and our hopes about the treatment of personal data in context. And we need to communicate these trends to policy makers, technical experts, information officers, educators, and the like so that we all have a voice in shaping the future of digitally dependent Canada.

What Is Surveillance?

Not long ago, the word surveillance conjured up a mental image of agents in trench coats with raised collars shadowing suspects through dingy streets or placing hidden bugs in the homes of their targets. Today, all that has changed. Not that such things no longer happen; they do. But surveillance is much, much broader than that. Bureaucracies have always, for the sake of efficiency and enlarged capacity, kept files and stored information on individuals. Now, computer and communication technologies take this much further. For instance, whereas yesterday’s filing cabinets for paper documents created single silos of information that only a few could access, with today’s searchable networked databases, information now grows and flows in ways that would have been unimaginable to the office clerks of yesteryear. And, today, information is easy to access: a few keywords and clicks, and—voilà!—entire biographies can be made to appear.

It does not stop there. It is not just that more personal information is circulating and is being used in new ways to promote today’s political and economic priorities and to manage risk. In Canada, for example, novel ways of thinking about our border with the United States as a security perimeter have had concrete consequences: personal information now flows more freely south, the security of international trade is now a key purpose of security efforts, and risk-management criteria help to determine who is—and who is not—allowed to travel freely based on the radio frequency identification (RFID) tags embedded in passports or on the images collected from full-body scanners.

What happens to personal information is crucial, then. People with certain kinds of profiles pass with greater ease than others. And this is true not only at the border but also in the marketplace. Your frequent flyer card at the airport and your loyalty card in the supermarket are the visible tip of a hidden iceberg. If that iceberg were exposed, it would show a series of systems constantly busy collecting and sorting troves of data. At the airport, some Canadians discover that they are on a no-fly list (called Passenger Protect in Canada), while others can daydream their way through security checks.⁷ On the phone to a customer service agent, some consumers discover that they are unexpectedly rewarded, while others cannot get past the Your call is important to us … holding position. Surveillance underlies all of these processes.

Surveillance today is not just a matter of tracking bad or dangerous people. Statistics and software together turn surveillance into a way of classifying people based on whatever personal data are available. Yesterday’s target was a person; today’s target is a profile. Yet, as we have seen, that profile packs a punch. You soon know if the profile associated with you is categorized as risky or reliable, one to be rewarded or rebuffed. But how did it happen? What information pushes your profile in one direction, not another? Surveillance was once literally watching; now, it is also seeing with data. How those data are collected, manipulated, and acted on is pivotal.

So what exactly is surveillance? We define it as any systematic focus on personal information in order to influence, manage, entitle, or control those whose information is collected. Put this way, it is clear that surveillance can be good or bad, acceptable or not. But it is also clear that surveillance is more than peeping at, snooping, or eavesdropping on others. Surveillance is a dominant organizational practice that often results in people being categorized in ways that facilitate different forms of treatment for different individuals. From Google to Homeland Security, from Revenue Canada to the RCMP, this sort of surveillance is central. Perhaps we should say, this sorting of surveillance, because the big question is how we are socially sorted by surveillance today.

At the same time, the rapid expansion of many kinds of surveillance has prompted or facilitated its further growth in new directions.⁸ Most of this volume is about surveillance by organizations that gather data on individuals and populations, profiling them for various purposes. However, ordinary individuals are engaging in an increasing amount of small-scale surveillance. They may set up home security systems, or install nanny cams (video cameras hidden in such things as teddy bears or clocks), or track others using social media (see Trend 9). Still others may try to return the gaze of organizations as they watch for abusive or illegal organizational practices. The decisive difference between individuals and organizations is the kind of power available to each. Even though ordinary Facebook users have access to the largest facial-recognition system in the world (Facebook’s tag suggestion), they do not control the algorithms that classify people into groups for differential treatment. This is why the social sorting dimension, available primarily to large organizations, is vital for understanding contemporary surveillance.

Surveillance is now a ubiquitous and complex phenomenon. On the one hand, it is the routine way in which many organizations work, often with benign consequences. On the other hand, surveillance is a form of power that affects everyone, sometimes as identifiable individuals and sometimes as whole populations. Some groups are touched by surveillance more than others, but in all cases the balance of power between individuals and organizations shifts with the growth of new surveillance practices and processes. So while surveillance may produce good or bad outcomes, it is never neutral. And the issues are far too important to leave to bureaucrats, politicians, or technical experts. In what follows, much of the focus is on the questionable aspects of surveillance, and we conclude with how we might rise to the new challenges before us.

Surveillance in Canada: The Context

As in any country in the world, surveillance is vital to government and commerce in Canada. Indeed, with its early commitment in the 1960s to high technology and to the growth of an information infrastructure, as seen in the country’s use of mainframe computers and its pan-Canadian telephone grid, Canada was a leader in processing personal information. Operational efficiency was seen as a key goal. From the beginning, however, it was also clear that socio-political values influenced how computerization occurred and thus how different groups were affected.⁹ As early as 1940, the Dominion Bureau of Statistics (predecessor to Statistics Canada) used punch cards and sorting and tabulating machines for the National Registration process to determine who