||They've got your number
Cutting-edge technologies work as tattle-tales for a surveillance-minded state, Canadian privacy advocates warn
Montreal Gazette | July 23 2004
Many Canadians became aware that late-model cars are equipped with "black box" technology during a recent high-profile trial in which a motorist was jailed in the death of a university student in Montreal.
Black box data showed that Eric Gauthier was driving at 157 kilometres an hour just seconds before he struck and killed Yacine Zinet. The trial marked the first time that car data recorders have been accepted as evidence in a Canadian courtroom.
Some find it disturbing that the technology used to convict Gauthier is tame in terms of what is out there to help us, it's said, but available for use against us.
"There is a widening and yawning gap between the surveillance that is actually happening and people's understanding for the capacity for surveillance. People just have no clue, and I'm describing intelligent people," says Stephanie Perrin, president of Digital Discretion Inc. in Montreal.
"At the very broad level, we have a society that thinks it's democratic and absolutely has no concept of what the technology does."
Personal information often lies dormant in huge data banks that people contribute to constantly -- through use of everyday items such as credit cards and telephones. Increasingly, corporate, government and law enforcement entities sift through that material with sophisticated data-mining programs, looking for relationships between individuals and whatever interests them.
Calling it a vast violation of privacy, the U.S. Congress last year killed the Pentagon's post-9/11 Total Information Awareness project to create a supercomputer that could plow through merged databanks containing the private information of U.S. citizens.
Examples of data-mining of privileged information surface with alarming regularity. Canadians this year learned that private companies have been mining confidential medical databanks, looking for "volunteers" for clinical trials.
Cellular telephones and vehicles can be tracked, too. The term telematics refers to any marriage of location-tracking technologies, such as global positioning systems, with wireless communications, such as cellphones. Applications include General Motors' OnStar program. The Telematics Research Group estimates that by 2008, more than 40 per cent of new vehicles in the United States will have some form of telematics.
There is no question that law enforcement agencies have used tracking technology to solve crimes, possibly save lives. It's all relative. Knowing exactly where employees are may be reasonable in a hazardous chemical plant but less reasonable in an insurance office.
"Even though I'm a screaming privacy advocate, there is an argument on the other side for this stuff. That's what makes it so difficult and so easy to give everything away," says Perrin, formerly the chief privacy officer at Montreal's Zero Knowledge tech firm.
The technology that helped convict Gauthier is designed to assess airbag efficiency by capturing and recording the vehicle's speed five seconds before the airbag is deployed. In terms of tattle-tale technology it's relatively limited and provides data after the fact. That's not the case with an array of other ventures already in play.
The e-Plate project underway in Britain uses a tiny device embedded in a licence plate to transmit a unique identification number. Vehicles can be tracked in real time or as they go past, over or through fixed points. Multiple licence plates can be "read simultaneously by a single reader at speeds of up to 320 km/h up to 100 metres away," according to the supplier of the device.
The scheme uses radio frequency identification (RFID), one controversial technology or software application that is trickling into North America, particularly in the marketplace. Simply put, RFID tags -- microchips as small as a grain of sand -- contain a unique 96-bit code chock full of information that can be read and stored by RFID readers.
The American who envisioned new uses for radio waves, Kevin Ashton, wanted to create "an Internet of things" where every thing has a unique number and can be linked to a network that can be connected to a computer.
Championed by corporations internationally, RFID technology has been red flagged as an "object of intense concern and attention" by government privacy officials around the world, says Canada's privacy commissioner, Jennifer Stoddart.
"They are far more potentially invasive than video-surveillance cameras because they can be literally embedded in your daily life, almost embedded in you, certainly in the clothes you are wearing," Stoddart says.
They can streamline the supply chain and thus slash labour costs, but they can also be used to track pets, livestock, employees, and philandering mates.
They just don't discriminate. They have been used in all kinds of situations, put into the ID tags of VIPs at high-level conferences and employed to track prisoners. In Asia, quarantined SARS patients were tracked using such chips.
One of the people tracking RFIDs most closely is Katherine Albrecht, founder of the New Hampshire-based Consumers Against Supermarket Privacy Invasion and Numbering.
RFID technology "creates the possibility for everything to be essentially monitored all the time," says Albrecht, who bought an RFID reader on the Internet, proving that they already can be easily acquired by anyone, including criminals or paid snoops amassing information contained in live RFID tags.
Perrin shares Albrecht's concern on this front.
"It's (also about) security and industrial espionage. (RFIDs) are a stupid technology and not usually encrypted. Most people don't run around with scanners, trying to read people's RFID tags but there is nothing to prevent them.
"If I can scan an airport waiting lounge and find out who the people are by scanning their (employer-issued RFID-embedded) ID cards, that is interesting information."
And, Albrecht adds, there are plenty of folks interested in knowing exactly where in your house your new plasma TV is located.
"It has taken far more time and effort to wire the world with telephone and Internet cables than it will take to wire the world with RFID because RFID readers are simply plugged into the existing infrastructure," she says.
Even if RFIDs only tracked purchases, they'd generate huge databanks ripe for abuse, says Albrecht, who also objects to supermarket loyalty cards, in part because of the databanks they generate.
She cited the case of a Californian shopper who slipped on spilled yogurt, shattered a kneecap and tried to sue the supermarket.
"They threatened to use his alcohol purchases in court and paint him as a falling-down drunk because they had all his records," she says.
A grocer in New Mexico turned over -- under subpoena -- a customer's records to Drug Enforcement Agency investors who were interested in his purchases of small plastic bags, she says.
"Most folks who are looking at (RFIDs) hope to simplify the supply chain. That doesn't make it any less dangerous in the long run because there are other people who are going to use the fruits of their labour to do other things with the technology," Albrecht warns.
If she can't prevent retailers from using RFIDs, she wants them clearly labelled and disabled as they leave stores. One thing that has made Albrecht's battle against what she describes as deliberate misinformation about RFIDs easier is that some of its major proponents say one thing and do another.
A German supermarket chain said they didn't have RFID-embedded loyalty cards, which when combined with RFID tags on packages enabled them to track every item a shopper purchased at their stores plus items purchased at other chains using the same loyalty cards. But Albrecht proved they did.
In the United States, Wal-Mart has claimed that RFIDs are now being used only on cases or pallets in warehouses but Albrecht has found live RFID tags on individual items on store shelves. Last November, Wal-Mart and Procter & Gamble photographed unsuspecting consumers as they selected lipsticks. Each tube had an RFID tag.
Kevin Grohn, a spokesperson for Wal-Mart Canada, says that there is no "timeline" for the introduction of item-level RFID tags in the United States nor for their introduction to Canada.
About 140 Wal-Mart suppliers use or soon will use RFIDs on shipping cases, he says. Many of those also ship to Canada so RFID-tagged goods are entering the country, he says.
But even Canadian Wal-Mart stores aren't yet equipped with RFID readers, he says.
RFIDs, like other technology, can be misused, Stoddart says. If it is used to track people or if it transmits personal information, those practices would come under applicable provincial and federal legislation, she says.
People have to be notified that RFIDs are attached to products they may buy, allowing them to refuse them or disable them so they don't collect or transmit personal information.
"What concerns me most is the fact that if we don't act fairly soon to have a public debate, a public awareness and discussion of (RFIDs and other potential invasive technologies), they may soon become ubiquitous and then lower our general societal expectation of privacy at a time when, due to the international situation, we already have great pressures on privacy," Stoddart says.
Her office is in the process of designing a public education program on privacy issues that may be launched this winter.
- - -
Privacy Timeline: The Data Trail
It's hard to travel incognito these days. As you go about your business, you leave a trail of data for others to collect, merge, mine, analyse and even sell, often without our knowledge or consent. And we are increasingly subject to electronic or visual surveillance, often without our knowledge or express consent.
7 a.m. An e-mail arrives from your favourite travel site suggesting your two children would like you to take advantage of low airfares to Disneyland. You book your flight with Credit Card A.
7:30 a.m. You call the toll-free number of a hotel chain, using your a loyalty card for a discount rate. The telephone operator -- in Georgia -- asks whether you'd like the usual adjoining suite for your children. You get a further discount with your air miles card. You pay with Credit Card A.
8 a.m. You telephone your sister, who is teaching English in Turkey. Your call is electronically monitored and scanned for words of interest by one or more agencies.
8:30 a.m. Like many vehicles, your car is equipped with an event-data recorder or "black box." The expressway you drive along to work is monitored by Transport Quebec. In zoom mode, the cameras are capable of reading your licence plates. (Toll highways such as Toronto's 407 use devices that identify you and your payment pass.)
8:45 a.m. Caught in a traffic jam, you call your boss. Cellular phone calls can be easily intercepted. Newer models can also signal your exact whereabouts in urban settings. The duration and destination of your calls are recorded.
9:15 a.m. Enter office parking lot. An entry/payment card records time, cameras monitor garage.
9.20 a.m. Enter office with "swipe" card that identifies you and records entry time; some active ID cards enable others to locate you anywhere in the building.
9:30 a.m. Log onto computer. You leave "cookies" at the Internet sites you visit. Your employer can determine where you have been and what you have written in any e-mails or on the company Intranet. Computer software can also record and store keyboard-stroke speed, length of use, etc.
9:45 a.m. Your incoming call from your former boyfriend may be monitored, an offshoot of "quality control" concerns. The phone also displays numbers of callers and keeps track of its use.
11 a.m. You take the company car to visit a supplier. Many company cars are equipped with some form of telematics or geo-positioning devices that can detail vehicle location.
Noon Stop at an automated banking machine to pay bills, get cash with ABM card. Surveillance cameras record your visit.
12:35 p.m. Doctor's appointment. Health cards will soon contain small computer chips recording complete medical history. Doctor's diagnosis may need to be disclosed to insurance company with details sent to centralized registry run by insurance companies.
1 p.m. Pick up prescription. Pay with Credit Card A. Some provinces have online drug networks that share your drug history across the province and may be disclosed to police tracking drug abuse. Some national pharmacy chains have their own in-house drug networks.
1:30 p.m. You have your second interview for a job with a U.S. firm during which you are asked to provide a urine sample. It reveals use of targeted drugs but not impairment; sample may also reveal use of legal drugs such as antidepressants.
2 p.m. Your health club has officially banned the use of photo cellphones on the premises but you notice the teenager next to you in the weight room answering hers.
3 p.m. Spend the rest of your free afternoon shopping. At the Big Box store, you use your membership card, which has been recording your weekly purchases for five years. You pay with credit card.
4 p.m. At the department store, where your purchases have been tracked for 10 years, you use your store credit card and your air miles card.
4:30 p.m. Stop to pick up video at a store, which has been compiling your viewing preferences for five years. Pay with ABM card. Some video stores/magazine publishers/specialty stores may sell subscription lists to database-list marketers.
8 p.m. Visit your public library, taking out books on your children's cards.
8:30 p.m. You and your spouse attend a political fundraiser. You have your cellphones on as you drive to the hotel in your spouse's company car and park in a garage monitored by surveillance cameras.
In addition to the television news crew, political organizers film most of the event. You make a $200 contribution to the candidate. Political contributions of more than $100 are listed in public records. You pay by a cheque, which is processed and recorded by your bank.
1 a.m. You and your mate tune into the light-porn channel available via your satellite dish provider, which has been tracking your viewing preferences for three years.
(Sources: Published news reports, Office of the Privacy Commissioner of Canada)