Last month we learned the Canadian government, for reasons still unknown, is making 1.2 million annual user data requests to telecom companies. Now it's come out that it's also stalking people on Facebook and Twitter, according to Canada’s privacy commissioner Chantal Bernier.
In a February letter obtained by press this week, addressed to Treasury Board President and MP Tony Clement, Bernier wrote that the government is scooping up user data, possibly violating Canadian privacy law. The Privacy Act stipulates that data collection, even of public information, is off limits except on official government business.
“It has come to my attention,” Bernier wrote, “an increasing number of government institutions are collecting publicly available personal information from social networking sites without any direct relation to a program or activity," Bernier wrote.
“We are seeing evidence that personal information is being collected by government institutions from social media sites without regard for accuracy, currency and accountability,” she wrote, adding that just because information is public, it doesn't mean it's not personal.
Under Canadian law, all citizens retain a "privacy interest" even if data is publicly accessible online—much in the same way a license plate can be seen in public, but citizens expect their plates will not be tracked or surveyed without legal context. Other than rare exceptions, citizens must be notified if their data is being banked.
Given social media users have a “certain expectation of privacy,” she wrote it’s incumbent on government departments logging the data to rigorously justify why they’re gathering it, and to store it securely.
Screenshot of the Chantal Bernier's letter to Tony Clement
While Edward Snowden's leaks made it common knowledge that government agencies in the US monitor citizen accounts on social media, in Canada government surveillance has remained largely in the shadows. Besides minor scandals involving CSEC spying on the Brazilian natural resources department and grabbing citizen metadata through an unnamed airport wifi, the country has remained largely scandal-free.
But over the last two weeks, startling revelations from the privacy commissioner first suggested that Canadian telco companies are sharing user data with law enforcement at an alarming rate, and now, that the government is spying on citizens' social media.
In a report reviewing Canadian intelligence agencies—made a little less than two weeks before her letter was sent—Bernier recommended the government consider rigorous new oversights to their intelligence-gathering ethics.
Bernier contended that intelligence agencies are faced with an “increasingly complex threat environment," requiring cyber-surveillance of some kind. But she added that the mass gathering of intelligence is always subject to privacy law.
She suggested the Treasury Board develop “clear, mandatory guidance to articulate what constitutes ‘publicly available’ personal information” and a framework around when the information can be collected for intelligence purposes.
But Clement fired back, claiming data is merely “aggregated” to track the general opinions of Canadians and the information isn’t tied to any personal accounts.
Christopher Parsons, a cybersurveillance researcher at the Canadian nonprofit Citizen Lab, said the kind of social media surveillance used varied depending on the government agency. Law enforcement might use specialized and automated tools developed to monitor and react to events on social media, while political officials might be checking to see if citizens like new policies.
Parsons agreed that "some federal agencies are likely breaking the Privacy Act, because data is being collected without clear purpose,” he told me in an email. “Canadians don't lose all their privacy rights just because data is made public and, unfortunately, the government doesn't seem to realize this nuance of Canadian law. Hopefully they'll come to their senses soon."