The Canadian government was clearly concerned by dangers associated with storing potentially sensitive emails outside the country. Invoking a national security exception, one of its requirements for the single email system was that it be hosted in Canada on a secured server. As U.S. companies later noted, this effectively excluded them from bidding on the contract.
“As U.S. companies later noted, this effectively excluded them from bidding on the contract.”
Oh, boo hoo. Too bad, so sad.
Lots of Canadian companies are excluded from bidding on US government contracts because they are foreign and therefore their personnel cannot be given US security clearances.
Rightly so too.
But it works both ways: Canada is quite entitled to reject foreign companies for the same reason.
I applaud the Canadian government for actually appearing to have thought this one through.
The ease with which the NSA can access private information without having to use due process of law is very disturbing. Plus when they are caught, no-one cares which is even more disturbing.
Smart people will keep their ‘electronic foot print’ as much as possible within the ambit of their own control.
With relatively cheap local storage solutions; and ubiquitous routers, keeping your most sensitive electronic stuff local, rather than on server clouds, will be an attractive option.
With FBI/CIA/NSA, not to mention FSB/KGB and various other intelligence gathering assets (ie Chinese) one’s expectation of ‘privacy’ would be diminishing with each passing day.
Pretty soon the ‘intelligence community’ will be telling you what brand of underwear you should be sporting.
Cheers
Hans Rupprecht, Commander in Chief
1st Saint Nicolaas Army
Army Group “True North”
“The ease with which the NSA can access private information without having to use due process of law is very disturbing.”
Two things:
1. The NSA cannot access private information on US citizens without due process of law. The argument of course is over whether the existing due process of law itself is either sufficient or fully constitutional.
2. The NSA can certainly access the private information of foreigners (i.e., non-US citizens living outside the US); they’re not covered by the US Constitution. Simply put: it’s not illegal for sovereign countries to spy on one another.
JJM “The argument of course is over whether the existing due process of law itself is either sufficient or fully constitutional.”
Like I said.
Contrary to the Canadian government’s requirement for a “made in Canada” solution to email messaging – IMO there’s no such thing. By design Internet communications will always take the most opportunistic route, meaning they may well be routed through the USA or even Europe for that matter. Without robust encryption any message is vulnerable to eavesdropping or interception by curious parties. Regardless of where the destination mail server resides.
The fact is, the USA PATRIOT Act allows for the collection of data going into, or out of, the US.
Four Things:
Hans: That requires everyone to be a sysadmin, or worse yet a SAN admin. I have a scratch-built 9TB storage array in my closet because I can; the average person who just wants to store photos of the kids for Grandma isn’t going to make use of that option.
JJM: Yes, the NSA can access private information on US citizens without due process of law. They have the technical capability to do so. The issue is whether they have been doing so, and whether the justifications they use are constitutional. But there is nothing physically preventing them from doing so.
NeoLuddite: It’s quite possible to use Internet protocols on an isolated or gatewayed network. The vast majority of email the Canadian government sends is internal, and there’s no technical reason that it can’t be entirely self-contained. The fact that encrypted email is not as ubiquitous and easy to set up as encrypted web sites is a major technology lapse, IMHO.
Generally: Geist is being a bit alarmist; while the government absolutely should, yes, maintain absolute control over its internal communications, for the average small business or private individual there are tradeoffs between security and convenience/expense. GMail means I don’t have to maintain a mail archive or worry about which computer I’m checking my mail on. Salesforce.com means I don’t have to set up a data center for my small business just to host a CRM system. For many businesses, the cloud is just another outsourcing partner and all that that implies. It’s no more and no less risky than allowing FedEx to deliver your packages instead of sending your nephew cross-town in a van.
“Contrary to the Canadian government’s requirement for a ‘made in Canada’ solution to email messaging – IMO there’s no such thing. By design Internet communications will always take the most opportunistic route, meaning they may well be routed through the USA or even Europe for that matter. Without robust encryption any message is vulnerable to eavesdropping or interception by curious parties. Regardless of where the destination mail server resides.”
Quite correct. If you hook up to the Internet, you risk “eavesdropping or interception by curious parties” outside the writ of Canadian privacy laws.
But still, there’s no reason not to ensure your information is at least stored in Canadian servers rather than some foreign-based system.
“Yes, the NSA can access private information on US citizens without due process of law. They have the technical capability to do so. The issue is whether they have been doing so, and whether the justifications they use are constitutional. But there is nothing physically preventing them from doing so.”
That’s an odd line of reasoning.
It’s like saying a police constable can gun down people without due process of law simply because he carries a sidearm.
and encrypted BBM ain’t good enuf?
Inside story on what is really going on in USA. Informative video.
http://usawatchdog.com/united-states-definitely-wants-war-in-ukraine-paul-craig-roberts/
On a personal note, my company’s subscription to a US database, available only to licenced PI’s and law enforcement, was cancelled last year due to new Homeland Security rules, on the basis that our server was not located in the territorial US. We had been a subscriber for 12 years and the loss of that database has cost me a lot of money. But…their country, their information…their rules. Just the way things go sometimes.
But I cannot fault the Canadian government’s position on this matter…our country, our information..what’s good for the goose etc…..
Bruce in case you haven’t already gone down this road – it’s common to rent servers in the US aka colocation.
Anything we post on the internet is public. A wise person avoids stating anything that might be violently threatening to anyone, seditious, or treasonous. That’s just common sense.
JJM said: “The NSA cannot access private information on US citizens without due process of law.”
Have you learned nothing from the revelations of Edward Snowden? They can and do access private information whenever they want, and for trivial reasons as well. We also know that certain companies and individuals have been getting helpful hints about the activities of their business competition. That story surfaced a while ago, its a beauty.
Then there’s the “Mission Creep” aspect which has other police organizations using Federal data intercepts for their own purposes. Indeed, city and state level police forces in the USA are using data generated by NSA, its been showing up in trials all over the country.
This week we have the CIA accused by Big Dem Dianne Feinstein of spying on Congress and the Senate.
Frankly, the Canadian government would have to be composed of idiots and English majors to even consider using tech companies with servers outside Canada. We may in fact see the big telcos put brand new fiber optic across Canada rather than allow traffic to enter the US system, given the freakish behavior of Washington.
How else are telcos going to be able to assure a customer like Bombardier that their mail isn’t being read by the NSA and forwarded to Boeing?
Secure computer systems do not connect to the internet.
Two things:
1. The NSA cannot access private information on US citizens without due process of law. The argument of course is over whether the existing due process of law itself is either sufficient or fully constitutional.
The NSA does precisely that, It stores all info it can, from everyone, and data mines when it wants,
2. The NSA can certainly access the private information of foreigners (i.e., non-US citizens living outside the US); they’re not covered by the US Constitution. Simply put: it’s not illegal for sovereign countries to spy on one another.
Don’t be naïve, please.