What: 

Canadian federal government agencies, like many government agencies around the world, often request user data from telecommunications agencies for the purpose of surveillance. With few regulations in place that force governments or corporations to explain how Canadians' telecommunications information is accessed or processed, the Citizen Lab along with its’ partners, worked over the course of a year to compile and disseminate lawfully accessible data that showed how often, for what reasons, and on what legal grounds telecommunications companies in Canada provided their subscribers' data to state agencies.

Who: 

Christopher Parsons of the Citizen Lab, and collaborators

Where: 

Canada

The Surveillance Practice: 

In Canada, millions of state requests for data from telecommunications companies are made annually for the purpose of surveillance.  As a result of work done by Christopher Parsons of Citizen Lab and the organization’s partners, Canadians have a better understanding of domestic state surveillance operations than they did just one year ago.
 
To date, Canadians have learned how often some Canadian federal government agencies make requests of telecommunications providers. It has been revealed that some agencies have ceased recording the numbers of their requests, and that millions of state requests for data from telecommunications companies are made annually.  In 2011 alone, over a million requests for customer information were made—which, by Canadian standards, is proportionally very high.  This information has brought an awareness to surveillance issues in Canada, broad public rejection of increased surveillance powers, and a number of telecommunications companies changing their practices with respect to the voluntary sharing of customer information to law enforcement.

The Campaign: 

The Citizen Lab and its partners have consulted with companies, governments officials, coalition partners, and the general public in order to obtain concrete evidence and numbers regarding data requests.  Their goal is to compile enough data so that an informed debate about state surveillance practices—both current and proposed—can take place.
 
Citizen Lab has also worked actively with investigative journalists, technologists, lawyers, regulators, members of parliament, civil advocacy organizations, academics, corporate professionals, and citizens. Together, they’ve sent detailed questionnaires to corporations, generated thousands of personal data access requests from customers to Internet service providers, filed dozens of access to information requests to government agencies, and helped develop questions to ask government agencies. In aggregate, these methods provided a concrete understanding of the government’s surveillance activities. When the findings were released, the Canadian government and telecommunications companies felt an increased pressure to change some of their practices for the better.
 
As their research continues, the multi-sectorial team continues to learn about the role(s) that corporations play, and will know even more as companies respond to individuals' personal data requests. As a result of the data requests, they’re hoping to discover how companies collect, retain, handle, and disclose the data collected in the course of routine operations.

The Strategy: 

Citizen Lab collaborated with a variety of groups and organizations who used divergent methodologies and strategies to bring about greater transparency. Only by using all of their diverse skills, capabilities, and knowledge could they gather bits of data that, once combined, gave them a better picture of what was happening in Canada.
 
Politicians: Working with parliamentarians has been critically important because members of Parliament can place questions on the Parliamentary order paper, which must be responded to by federal government agencies within 45 business days. Christopher worked with the office of parliament member Charmaine Borg to develop questions that were meant to unearth what government agencies were doing to monitor Canadians’ telecommunications and why they were doing it.
 
Academics and civil society: In collaboration with academic and civil society partners, the team developed a comprehensive questionnaire that was sent to Canada’s leading telecommunications companies.  It spanned three pages and included ten primary questions and twenty-one sub-questions. In it were inquiries about corporate data collection, handling, and disclosure policies, including the regularity at which data was disclosed to third parties.
 
Journalists: The team worked with investigative journalists to help shape new access to information requests that have been sent to the government. At the same time they filed requests for hundreds of previously completed requests and then shared those with a group of government, civil society, academic, and citizen researchers who study various aspects of state surveillance using DocCloud. In aggregate, this work has both generated new information through the recently-filed requests as well as helped to unearth information in past requests as the various analysts identify data that stands out to them, but which might not have stood out to others who read the same documents.

Technologists: Working with technologists and civil society, they developed a letter that subscribers could send to their telecommunications companies and request access to the information that the companies stored about them. They first developed and posted a template letter on the Citizen Lab website and then developed an easy-to-use and privacy-protective web app to empower Canadians to exercise their rights.

The web app lets individuals “opt in” to be contacted by Open Media (the app’s outreach partner) and, subsequently, let Open Media and its associates evaluate the effectiveness of the letters and information learned.  Emergent from both of these techniques they learned about corporate handling of personal information.

Lawyers: Working with lawyers in different civil society groups was the key to ensuring that questionnaires, interpretations of responses, and so forth were legally compelling and avoided errors in logic and law. The lawyers identified regulatory paths that could be used in subsequent stages of the research to enhance Canadians' privacy while rendering transparent existing state activities.
 
Regulators: It was important to communicate with regulators in the privacy fields who offer guidance on possible ways of accessing data.  They also enlightened Citizen Lab with expert information about privacy law and government surveillance practices.
 
To spread the word, Citizen Lab adopted a critical, but balanced and objective, approach to their messaging. They focused on explaining the practical and broader democratic significance of current corporate and governmental surveillance practices and policies, and which policies were needed to maintain democratic freedoms.
 
One of the campaign goals is to ensure that the full impact and import of surveillance activities does not get obscured behind vague or inaccessible terminology. The team made a point of explaining often-vague terms, such as metadata, or technical identifiers linked with cell phones or Internet communications, so that they were more readily understood by the general public. Furthermore, they explained how metadata operates as structured, easily-queried data whereas “content” data is often more challenging to query or analyze—with the goal of ultimately explaining why government agencies are focused on so-called metadata, and less upon content, and why metadata is as, if not more, revealing than the content of communications.
 
Chris at Citizen Lab, along with some of his coalition partners, identified the implications for democracy when data or policies were not disclosed upon request.  When it came to talking with organizations and institutions, Citizen Lab praised them if responsive to questions asked of them.  

The combination of the recent Snowden revelations, a Canadian public who has been debating lawful access laws for a decade, and a general mistrust of Internet service providers, has created a journalistic space that’s well primed for data-driven research into how, why, and how often telecommunications providers assist government agencies.
 
At a broader level, a number of telecommunications companies are changing their practices with respect to sharing consumer data with government agencies. In aggregate, the campaign has encouraged one of Canada's three large telecommunications providers to issue a transparency report, another to comprehensively respond to the questionnaire they sent in January while also committing to issue a transparency report, and another to promise they will release a transparency report this summer.

Lessons Learned: 
  • When collecting evidence, experiment using a variety of methods to see what, in combination, produces useful empirical data and what doesn't. The only way you’ll be able to engage in this experimentation is with a wide-range of collaborators and partners associated with this line of research.
  • No single person's or organization's skill-sets are sufficient to render transparent how state surveillance occurs; only by using all parties’ diverse skills, capabilities, and knowledge can you gather bits of data that, once combined, give a better picture of what is happening.