My thoughts on the 2020 Speech from the colonial Throne

This afternoon, on unceded Anishinabe Algonquin territory currently the subject of treaty negotiation, a British colonial ceremony was held. With parliament only retaining British tradition, we were reminded by a "speech from the throne" that to this day the settler-state doesn't fully recognize the two groups who make up Canada: European colonialists/settlers and the peoples who had already been here for thousands of years.

As I read the text of the Speech from the Throne I noticed a few themes. I could easily put them under an overall headline of the continuation of narrowly harnessing European world views to attempt to further public policy goals.

• A  romanticization of over 150 years of the members of our European settler-state parliament dealing with challenges, with no recognition or harnessing of the experiences of the peoples who were already here for thousands of years.
• The continuation of the European entitlements vs responsibility world view around rights, which generate the wealth and power inequality at the heart of the gaps in social responsibility.
  
• A continuation of creating excessively large centralized entities which then need excessively large government regulatory and police interventions, rather than enacting policy to decentralize.

 

The speech properly recognized that we are in a series of crises, including not only COVID-19 but also climate change. There is also a crisis of legitimacy, where more Canadians are questioning the status-quo of how government has been operating.

Solving these problems requires far more change than postponing travel plans.  I believe it will require re-evaluating our world views, including abandoning the entitlement concept which allows individuals and groups to exploit resources (land, animals, people or ideas) to extract private benefit without any responsibility.  We need to think of rights as responsibilities we have to each other, not as entitlements we take from everyone and everything else.

 

Systemic racism is mentioned, but only in the unfortunately common "white" way of incorrectly believing that systemic racism relates to systems which include individual racists.  Systemic racism relates to the norms and practices within society or an organization. Good individuals can participate in systemic racism, as it is not about individual attitudes.

One large class of examples is the use of police forces as a top-down mechanism to ensure conformity to policies that deliberately avoid discussing the roots of the disputes that armed officers are thrown into. Those who are talking about defunding or abolishing the police are discussing changing our focus to solving societal problems at their roots.  This is not limited to the "war on drugs" or "war on mental illness", but many other government policy manufactured armed conflicts.

While claiming to recognize that Black Canadians and Indigenous Peoples are over-represented in the criminal justice system, the government had already stated it believed that criminal code amendments were needed for those who neglect seniors.  It is Canadian society, including the federal and provincial governments, that are neglecting seniors and yet through a "white" lens the solution is always seen to narrowly focus on criminalizing individuals.

I feel there is a similar problem with bringing up that it is unacceptable that any citizen be arbitrarily detained in relation to Michael Kovrig and Michael Spavor. The same is true of Meng Wanzhou being detained in Canada as a barely veiled part of trade and other disputes between the USA and China.

The RCMP has excessively close ties with a specific subset of foreign agencies and foreign political interests, and none of the above listed people would currently be detained if it were not for the hypocritical structural failures of the Canadian government.  The Five Eyes (FVEY) membership overlaps with the countries that opposed the Declaration on the Rights of Indigenous Peoples (Australia, Canada, New Zealand, and the United States -- all British colonies, with the UK itself being the fifth member of FVEY). This should cause us to openly question what world views and values these agencies have in common.

The government can claim in a speech that this is something for which all Canadians stand united, but that doesn't make it true.

The backward-facing discussion of "Web giants" is another example of the government trying to hide its own policy failures.  Our communications infrastructure involves government granted monopolies in the form of right-of-way for physical wired infrastructure and spectrum allocation for wireless.  Phone companies were created by provincial and federal governments, and cable companies via municipal monopolies.  While this infrastructure exists as a matter of government policy, private interests were allowed to buy up all these monopolies such that only a handful of private sector companies claim exclusivity over most of the right-of-way and spectrum.  These companies then also bought most Canadian media that would be communicated over those wires and wireless, including television stations, radio stations and newspapers. (Note: Given their lobbying record, I consider CBC to be a Bell partner and not a public service)

When companies involved in physical entertainment distribution (Book/tape/CD/DVD sellers including Amazon, DVD rental by mail including Netflix) wanted to move existing distribution online, they were blocked by these vertically integrated monopolists. When possible Canadian online competitors to cable were formed, the monopolists blocked it (convincing parliament to pass targeted legislation against already existing iCraveTV and JumpTV). The same was true even of companies that offered search engine services that could be paid by advertising. These companies that could not get big enough were forced out of existence, and those who did were forced to move into the media creation and/or distribution business in order to be allowed to exist at all in a policy world controlled by analog-era media monopolists.

So the "Web giants" are a result of failed government policy around phone and cable companies, and compounding these failures can't possibly solve anything.

I have come to believe that the only solution to this problem is structural separation. The monopolies, whether for right-of-way or spectrum, should be returned to municipalities and managed as a utility in the same way as all other critical infrastructure is.  All over-the-top (OTT) services, including two-way voice (phone) and one-way simultaneous video (cable/etc), would compete on a level playing field and no longer be legally allowed to leverage government granted monopolies.

Taxing new media to perpetuate problems caused by old-media monopolists will only make existing problems worse. This will only increase the cost of those services for Canadians, when those services are providing far better value than the old-media monopolists.

Shitts Creek was able to break the Emmy's record for the most wins of a single reason of a comedy only after it was able to break free of CBC and get wider distribution internationally on services such as Netflix. While we should be providing more stable funding to Canadian production through accountable government subsidies (not anti-competitive old-media entitlements), that money and any other subsidies should be moved entirely away from legacy OTT media companies (broadcasters, and BDU's like cable companies).

Having a "Universal Broadband Fund" is also counterproductive when that money is handed over to old-media monopolists.  Necessary government support from the provincial and federal level should only be to municipalities building their own municipal infrastructure, and never to continue the harm of allowing private-sector monopolists to gain unaccountable control over that infrastructure.  It is the local communities, through their municipalities, that should be setting infrastructure priorities and not those priorities being set in the boardroom of some distant private sector monopolist.

I was happy to hear a renewed commitment to reverse almost a hundred years of Canada's opposition to the policies that became the United Nations Declaration on the Rights of Indigenous Peoples. Canada needs to abandon its colonial period, and no longer side with Australia, New Zealand and United States as settler colonies of the United Kingdom.  We should instead be moving forward with decolonisation in order to become a republic. As a settler Canadian I do not support the continued implication that Canada was formed only by two sets of European colonists (French and English), and that these Europeans took over this land through conquest rather than being honorable with our existing treaty partners and within ongoing treaty negotiations.

My telecommunications focused brief to INDU for Canadian response to COVID-19 pandemic

On May 15th the Canadian INDU parliamentary committee published my brief to their study on the Canadian Response to the COVID-19 Pandemic.  They published a PDF version.  This is a slightly edited (turn footnotes into links) version.

Introduction

I am submitting this brief as a private citizen with over 30 years experience in the Information and Communications Technology field.

With population growth, aided by climate change, virus and other pathogen outbreaks are expected to be more common. With globalisation and increased global travel, pathogen outbreaks more easily become pandemics.

While pandemics need to be understood as a fact of life, our response to pandemics and the various costs of those responses are policy choices. There are emergency preparedness plans with considerable resources, including preparedness drills, for other types of threats such as war, terrorism or school schootings. This has not yet been the case for pathogen outbreaks or pandemics.

It seems our societies are quite willing to allocate resources to protect ourselves from fellow humans, but not from other threats.

While I believe mandatory social distancing is required to reduce the health impacts of outbreaks and pandemics, the cost of emergency measures to the economy and other aspects of society (including those waiting for surgeries, or afraid to go to hospitals) are largely due to the lack of preparedness. It is the failure to prepare that is costing the economy. The results are expected to be quite extreme, with some experts predicting that the economic impact alone may be comparable to the Great Depression. 

I believe this high cost could have been avoided.

 

Policy choices

In early April I sent a letter to David McGuinty, my MP in Ottawa South, offering my support for Universal Basic Income (UBI) and infrastructure spending as a longer-term response to this pandemic. I have been concerned that public spending has not been as focused as it could be.

What COVID-19 has made obvious is that Canada lacks infrastructure when it comes to public science and public health, as well as better communications infrastructure. This refers not only to better competition in urban environments, but also provision of equitable services to rural residents. This would be based upon a divested public utility model for the last mile, and a fully competitive model for other services.

As this is a submission to INDU, I will focus on communications infrastructure.

Complete the digital transition

During this pandemic communications infrastructure was declared an essential service. Being able to replace physical communication with Internet-based communication is critical to the physical (“social”) distancing request. Many have learnt how poor their Internet connections are when there are multiple people in the house competing for use of what telcos have convinced us is “scarce” Internet bandwidth.

Teleconference systems (such as webex, zoom, JITSI, gotomeeting, etc.) are providing what appear to be essential services, and require properly engineered and regulated networks. Previously, this level of services was limited to analog-era telephone lines. But, there is no longer any clear separation between communications infrastructure which is essential, and less essential services which run "over the top" (OTT) of that infrastructure.

During the analog-era, communications infrastructure using analog technologies needed to be purpose built. Into our homes we had wires for two-way voice communication (telephone), and another set of wires for one-way audio-video communication (Cable television, AKA: a Broadcast Distribution Undertaking or BDU), with similar purpose-specific allocations of wireless spectrum.

With digital technology the OSI layered approach upon which nearly all digital communications technology is modeled allows for structural separation such that the underlying layers of the network can be treated as a utility like every other connection into our home or offices, and the services that run over-the-top can be regulated appropriate to each specific service. It is that underlying utility which is the essential service, not every OTT service.

 

Using a layered model for road transportation as analogy

In 1994 the federal government formed the Information Highway Advisory Council (IHAC). Discussing roads and highways is an appropriate analogy to communications technology as it exposes the layers and complexity of the network, even though road transportation is simpler and less flexible than digital communications networks.

A simplification of layers built on road infrastructure might be:

 

• Road infrastructure. This is comparable to the physical network layers.
• Vehicles run "Over The Top" of those roads. This is comparable to physical devices connected to the communications network. Not all vehicles on actual highways are treated equally: Ambulances are given priority, while trucks pay a higher tax due to the increased wear they cause on the infrastructure. Yet, anyone may operate a delivery service.
• Drivers control the vehicles. This would be comparable to software authors, where software is the instructions that drive digital devices. (Note: It is software that differentiates between TCP/IP and other networking protocols. ISP's are businesses that run their own devices and provide transport of packets encapsulated within TCP/IP.)
• Passengers and parcels which would be placed in/on the vehicles for transport. This is comparable to the applications which use the network (two way or one-way audio/video/text/etc communication)

 

With transportation the roads are a mixture of municipal, provincial and federal management. Private roads including driveways connect to publicly managed infrastructure, but we don't allow specific (OTT) companies (say, Canadian Tire) to own and claim the right to control traffic over core infrastructure. For instance, if Canadian Tire Trucks were to claim priority over the 400 series of highways, at the expense of HomeDepot trucks, we could consider that a market failure. If such a thing were to occur because of an alliance between the 407ETR and Canadian Tire, then it would trigger the competition tribunal to investigate. Such a conflict of interest would be obvious. While publicly owned vehicles exist, private (corporate and individual) vehicle ownership far exceeds public. Individual citizens are allowed (in many ways actively encouraged) to personally own and drive vehicles.

If we use this road transportation analogy to go through various policy discussions the failures becomes more obvious. (See: Hiding OSI layers leading to policy failures: Net Neutrality, Encrypted Media )

 

Understanding what is Over The Top

When I use the term "over the top" (OTT) I mean it in a technological sense, not as used by the lobbyists from the analog-era incumbents. Services which operate above OSI layer 2 (or some talk of layer 2.5 as technology has advanced) are considered OTT no matter which entity is providing those services.

It is important to understand that there is actually no “other” way anymore. The Public Switched Telephone Network (PSTN) that consisted of SS7 and T1 lines, and switched by devices from companies like Nortel, is gone. All voice communications within the backbone of the voice network is based upon packet switching, rather than circuit switching.

This means that telephone service offered by Bell Canada and BDU services offered by Rogers are OTT services. They run over-the-top of Bell and Rogers’ commodity networks, using the same fibers, and often the same (IP) switching equipment as public Internet traffic. (That doesn’t mean they are connected to the Internet). Unfortunately policy makers have further privileged the analog-era incumbents by claiming that BDU services offered by Bell Canada or telephone service offered by Rogers aren't OTT, even though they are just as much OTT as when those services are provided by any other company. In particular, the last mile voice connections offered by cable companies like Rogers use VoIP technology, and all LTE voice (since “4G”) are VoIP connections, usually IPv6 links. These LTE links use private/privileged Bearer Channels unavailable to MVNOs to offer glitch-free communications.

We must adopt structural separation to ensure that appropriate public priorities are the focus of any of the underlying utility infrastructure. We also need to disallow the continued privileging of specific OTT brands who were given advantage during the analog era. They must no longer be allowed to use money (including a considerable amount of public money, often via the “rural broadband” initiatives) intended to enhance the utility infrastructure to instead subsidize their OTT services. We also must regulate each individual OTT service appropriate to the service, not allowing vertically integrated companies to circumvent this regulation.

(Note: Using the technological meanings of OTT, Bell's FiveTV is a "new media retransmitter" as excluded by section 31 to be granted the copyright exceptions granted to BDU's. This was added by Bill C-11 passed in 2002 specifically to disallow competing OTT services to be established in Canada. We would have had a Canadian Neftlix-like service before the US service emerged had the federal government not blocked this innovation.

As many people have learned during the lock-down, their VPN connections that ought to be “across” town, are often travelling thousands of kilometers to Toronto and back, because the incumbent providers are thinking like BDUs rather than utility companies.

 

Never cross-subsidize a non-essential service from an essential service

Prior to the pandemic the Standing Committee on Canadian Heritage, as well as other policy makers, were contemplating a cross-subsidy where fees intended to pay for core communications infrastructure would be subsidizing the creation of entertainment content. This is clearly a cross-subsidy of a non-essential service from an essential service.

Policy must be focused on providing subsidies to essential services, not extracting funding from essential services or increasing the costs of essential services.

 

Rural broadband

Rural areas will have been harder hit by the response to the pandemic because of poor communications infrastructure. With digital-era structural separation it would be the rural municipalities and communities themselves that set policy priorities for their communications utilities. While both provincial and federal governments should be providing assistance as they do with other infrastructure projects such as transportation, the ownership should remain in the hands of the municipalities as happens with transportation.

The importance of rural broadband has been discussed by this committee fairly regularly, so I likely do not need to repeat the importance.

Report 11 from the 2018 study specifically included on page 19 the advantage of the 6 communications infrastructure being planned by the appropriate level of government as part of transportation infrastructure, so that transportation infrastructure isn't dug-up to install communications infrastructure.

We should consider revoking the right-of-way privilege to communications incumbents via the existing CRTC regulations on fiber construction companies, as it is only the appropriate levels of government that should own the infrastructure under the ground, and on utility poles on public and private property. If a private sector entity wishes to lay cabling, they should have to negotiate with the land owners and pay appropriate ongoing rental fees for the use of the land. The incumbents seem to enjoy a privileged level of access to municipal permit processes, and in cases where another company has laid fiber, have in some cases managed to delay, or take over builds.

Report 18 from the 2019 study of M-208 specifically highlighted the importance of communications infrastructure during a crisis, as we are learning first-hand less than a year later.

While there have been successes such as CTAL , bringing together municipalities in the (Note: Près de 800 personnes découvrent la fibre optique avec CTAL, Mai 17, 2018) Antoine-Labelle regional county municipality, this needs to become the default scenario and not an exception. The federal government is promising money to rural broadband projects. These projects (Note: Government will accelerate rural broadband funds, details to come ‘soon,’ says Monsef (By AnjaKaradegilja, MAY. 1, 2020, Hill Times) need to be post-digital-transition projects where the utility layer of the infrastructure are owned by the appropriate level of government, and a properly competitive marketplace of OTT services can exist. Such a thing has existed for some time in Alberta via the Alberta SuperNet system.

 

Summary

• Digital networking has separation between layers of a network stack in a way that analog communications technology did not. Public policy must take this fundamental difference into account.
• As an essential service during emergencies, and essential for the modern economy, the lower levels of the network must be treated as a utility managed by the appropriate level of government.
• Governments managing this utility reduces costs as communications become part of transportation, water, sewar, electrical distribution, and other infrastructure projects. This avoids the need to dig multiple times, but also makes sure that growth occurs in ways that municipalities have planned.
• Governments managing this utility allows local governments, rather than distantly headquartered private sector companies (with unseen conflicts of interests), to set infrastructure priorities that meet critical public policy needs. This is especially important in rural and remote settings.

 

Perspectives on computer security and encryption from Apple, the FBI and I : Apple

Apple's perspective on computer security and encryption

This is the third in a series that started with discussing the FBI and my own use of security and encryption technology.

Apple's most lucrative product line at the moment is their iOS based distributed content delivery platform. This includes the iPhone, iPad, Apple TV, iWatch, and related hardware.  While this hardware is distributed to customers, the platform is similar to the platform I manage for my employer where hardware is distributed geographically but control remains in our hands.   This is the platform which Apple has been marketing to the content industry for decades as a safe secure platform for them to distribute their multimedia where it is Apple and not the end users which control the technology.

These devices are intended to be connected to the network, and the ongoing work to secure them is similar to any other network connected device.  The network and exploits carried out on the network don't differentiate clients and servers as much as the layperson thinks, and any network connected device must be constantly updated to deny unauthorized control.  The question of authorized control doesn't differentiate between types of devices, and it is just as easy for Apple to remotely manage an iOS device as it is for me to remotely manage the computers I do.  The major difference is in the reliability of the network connection, with mobile devices having less stable network connections than servers.  People also don't tend to turn servers off when a specific user isn't using them, but remote management and control doesn't require constant network access.

Hardware assistance for Apple's security

Apple's iPhone 5C which was discussed in the FBI vs Apple lawsuit does not include Touch ID or a Security Enclave, so it is similar to the existing control which Canadiana has of our distributed computers. While Apple remains in control of the platform, they are not as secure from malicious apps or intruders with physical access to the computers as they would like.

Secure Enclave is Apples implementation of the SecureCore and TrustZone technologies from ARM I discussed in the previous article.  This will grant Apple greater control over the technology than they had before, including greater control over the scenario where the attacker has physical access to the hardware.

Some users may find this technology will eventually make what is commonly called jailbreaking much harder, if not impossible.  Apple could opt to use Secure Enclave to disallow the people who possess the hardware from having any ability to bypass any of Apple's control.  It is critical to understand that Apple's use of this technology is not to grant the technology user more control over the hardware or their data, but to transfer any remaining control that the user might have had to Apple.  People who possess this hardware often incorrectly think of themselves as owners, even though acquiring an iOS device has become legally more similar to renting than purchasing due to anti-circumvention legislation.

People who acquire this hardware are not alone in the confusion. When James B. Comey, Director of the FBI, offered testimony in front of the Judiciary Committee he said, "In recent months, however, we have on a new scale seen mainstream products and services designed in a way that gives users sole control over access to their data."  While some people have suggested he might have been talking about Apples adoption of SecureCore and TrustZone, he is incorrectly suggesting it was "users" of these devices who would have sole control over access to data rather than Apple having additional control over the device.  It is possible that he fully understands Apple's use of technology, and wants to offer free advertising to Apple knowing that Apple is specifically not offering the service he is suggesting they are.

This is the same concern I have with the services I provide:  If law enforcement and courts believe it is the entity that possesses the hardware that is in control rather than the entity controlling the software stack with full network access then they will continue to send court orders to the wrong entity.

Law enforcement need to understand the technology better.  In the case of an iOS device, it is Apple who is the responsible entity and should be served with the warrant.  A very different scenario would be someone who is running CyanogenMod where it is the individual user (in this case, legitimately called an owner) of the device that is in control and thus they should be served with the warrant.

Limits to Apple's control

In the specific case before the courts the technology user didn't destroy the device, and there has been nothing to suggest that the user even "jailbroke" the device to bypass any of Apple's control.  The FBI currently possesses the device and will obviously be granting network access and power to the device.  This means that all the potential limits to Apple's control do not apply in this case, and thus they have full access to do anything requested of them.

In this case it appears that the FBI jailbroke the device on their own, no longer having a technical requirement to require assistance from Apple.

The law

While I may believe that lawful access all too often grants excessive access to police without adequate oversight, the law is clearly in the government's favour in this instance with the iPhone.  If we were talking about information stored on Facebook or Twitter, where the physical location and who was in control of the computer in question wasn't confusing people, the debate would not be happening at all.  Clearly Facebook is in control of their network of computers whether or not the devices are stored in locations that Facebook owns, and Apple is similarly in control of their secured platform.

There is no back-door being discussed.  All that Apple was being asked is to use their keys to the front door and access the data.  They are the entity that holds those keys, not the user of the technology who under anti-circumvention laws are denied legal access to the keys.

While Apple has been misdirecting people and stalling, and there are "engineers" who have allegedly threatened to leave Apple if the government is lawfully granted access, the situation is no different than any other of hundreds of technology companies providing services to users on a platform that the vendor rather than the user controls.  If Apple executives or individual employees are destroying evidence they should be found in contempt of court, and handled severely.

If Apple's engineering staff is not sufficient (or no longer after vigilantes resign) to solve any technical problems, then the court should order all source code and technical specifications to be disclosed to a third party who can do the require work.   If Apple refuses to disclose this information, then I would suggest that revoking their corporate charter should be the minimum on the table.

The fact that the FBI jailbroke the device should not have ended the case, and Apple should still be pursued by the government.

Politics

Adi Shamir, an award-winning cryptographer who helped create the RSA encryption algorithm in 1977, suggested that Apple "wait for a better test case to fight where the case is not so clearly in favor of the FBI."

I'm not convinced that Apple had an interest in winning the case. Apple's greatest threat to the market share for their secure vendor controlled content delivery platform comes from technology users switching to devices which they can individually control. Apple has a history of dishonestly trying to misdirect responsibility for their centralized control. While for decades it has been the confused content industry that still has some who mistakenly believe that this vendor control benefits them, a far more powerful scapegoat would be law enforcement and national security agencies.

Apple has the FBI falsely suggesting that next generation iOS devices "gives users sole control over access to their data", providing Apple with marketing for a service they don't provide and driving users to technology which the FBI and other government agencies will have easier access to through the legal system than competing technology. Whenever Apple is requested to disclose information they can claim "the Government made me do it", even though it is Apple who denied users of their services any device control in the first place.

It seems unlikely to me that the FBI didn't already have technology to "jailbreak" the device at hand.  This isn't going to be the simpler third party services available to end users, as governments will have far more resources and techniques available to them to "jailbreak" devices.  I suspect that the case was pursued for political reasons to try to push this issue forward, and likely to prop up Apple's marketing claims that they are providing technology which protects the users rather than Apple's conflicting interests.

Apple also knows that their business model and lobbying in support of anti-circumvention legislation is controversial, and them being the ones to push this case forward would provide less community opposition to the FBI than if a less divisive company were bringing the case forward.  Their involvement complicates what could have been an easy to understand set of sound bites in support of protecting technology owners rights against unreasonable search and seizure into something extremely complex to discuss.  I have been delayed in participating in the discussion as it took me a while to decide how to explain my position, and I fully expect to still get confused "but Apple are the good guys" comments to this article.

Apple's ongoing attack on technology owners interests could cause considerable damage.  If it becomes considered normal to have the vendor rather than the user be in control of communications technologies it may eventually lead (likely with Apple's continuing political lobbying) to governments outlawing citizen controlled technology which competes with Apple's vendor controlled technology.  It could be used to strengthen backwards laws which outlaw alleged device "owners" from removing non-owner locks from their devices, with the justifications moving from odd unproven theories about protecting "copyright" to even further counter-productive arguments about law enforcement and national security.

Conclusion

My answer to the question of whether I was on Apple or the FBI's side is clearly neither, as I consider them to have perspectives dangerously close to each other.  Neither are interested in allowing the wide deployment of technology that "gives users sole control over access to their data", and while their positions appear to be in opposition they are actually greatly helping each other.

Those who recognize the critical importance of secure citizen controlled communications technology should be opposing both of these entities, not siding with one or the other in a battle where the public interest loses no matter which one of those entities wins.

Perspectives on computer security and encryption from Apple, the FBI and I : my use

My perspective on computer security and encryption

This is a second article in a series that started with discussing the FBI and will end with discussing Apple.

I have worked in this industry since the early 1990's, administering Internet network connected computers.  I have worked for companies that produced firewalls, as well as worked in government departments where implementing security policies were critical.  Encryption is a critical part of what I do for clients and/or employers, as without it we could not build the services we are able to offer.

Local vs Remote Control

One of the hardest concepts to grasp with modern technology, including with fairly technical people, is the need to separate the concepts of geography and control.  With simpler technology the person who possessed something was the one who controlled it, but with modern computing this is not the case.

A big part of my current job at Canadiana is to manage a network of computers.  While some of the computers are located in the building I normally work in, most are not.  We currently have computers in Ottawa, Montreal, Toronto and Edmonton, with plans to continue to expand across the country as we grow. I control all of these computers from wherever I am at the time, whether that is physically in our main Ottawa office or when I am working from remote (I am in Sudbury as I type this).

We use Virtual Private Networking (VPN) technology to connect these computers together, and a variety of other encryption technologies used for authentication and privacy.  In order to connect to any of these computers I must possess both the required cryptographic keys as well as passphrases required to unlock those keys.   This is required to ensure that it is only authorized individuals like myself that can gain administrative access to these computers, and we need to ensure that nobody can eavesdrop on this communication and learn anything that might allow them unauthorized access.  We often are working with multiple layers of cryptography: secured ssh command-line access through VPN encrypted connections to network interfaces which don't have publicly routable addresses.

It is modern computer security and cryptography which makes this critical feature possible.  It is what allows us to know that we are able to have exclusive control over these devices regardless of their location. Any weakening of computer security, either to benefit law enforcement or some third party special interests (device manufacturers, etc), opens the technology up to other unauthorized access and makes my clients at risk.  I am not alone, and much of the modern economy and politics of society is built upon the need to continuously improve computer security and encryption.

Hardware assistance for security

We plan to expand our services beyond what we currently offer in two important ways that will impact security policies.

Currently we host our servers in partner organizations that we trust, as well as a commercial service provider. As we expand we may want to physically locate computers on networks and in server rooms of organizations that we have less trust in.  We will want security features which will protect us even from people who have physical access to the computers, to ensure that the most they could do is disable a node and not be able to abuse keys/etc stored within that node to attack other nodes in our network.

As we move from hosting digitized images towards the data which the digital humanities community need, we will have reasons to offer these communities the ability to author apps which run on our servers with faster access to the data and only need to communicate the results of complex queries to remote computers. These apps will run on our computer, but we will want to ensure that nothing that these apps can do can impact the rest of our network.  While there is a wide variety of software based virtualization technologies, we may have reason to harness hardware assistance to implement security policies.

One example is ARM architecture manufacturers which offer SecurCore and TrustZone technologies.   This allows combinations of multiple physical CPUs as well as multiple sections within a CPU being separated, allowing one to secure the other.  This can be used in conjunction with UEFI secure boot, which if implemented correctly can ensure that only software digitally signed by the owner can run on the computer.

Using separate System on Chip (SoC) technologies, the firmware loaded into a secure SoC can be instructed to erase local keys if it detects tampering.  This way encrypted data on the system could not be accessed even if the computer itself was physically compromised.  Keys could be stored in that secure zone, meaning that even if disks were removed from the server the data on them would be inaccessible.

While some companies will be able to afford to manage the software stack on each CPU within each zone, many will simply hire this from other companies.  Ideal in these environments is if the hardware vendors and software authors of the different components consider each other hostile, providing the same types of checks-and-balances within a computer that we need in our public policy spaces.  In this way the operating system might detect hostile secure zone firmware in the same way that the secure zone firmware may detect a hostile operating system, with both working together to protect the computer owner from hostile applications.

For some of us we will only put our trust in transparent and accountable FLOSS.  Genode provides good documentation on their TrustZone implementation. Open Virtualization provides a great ARM TrustZone FAQ, which describes the relationship between TrustZone and the Trusted Platform Mobile (TPM).  These are both commercially supported projects which offer both FLOSS and non-FLOSS licensing options for software which is open and accountable.

The limits of physical access

Once a computer is fully secure, there are only a few things that someone with physical access can do that is not under the control of the entity with all the security keys.

• They can disconnect the device from the network.  This doesn't grant the person with physical access control, but it does deny the remote owner the ability to issue new commands to the device.  The device can only act on instructions it already has on it, in the form of installed software.
• They can disconnect the power to the device.  This also doesn't grant the person with physical access control, but denies the ability of the remote owner to execute any commands whether the software was already installed on the device or not.
• They can destroy the device.  This also doesn't grant the person with physical access control, but denies the ability of anyone to ever control the device again.

This means that while it is possible for someone with physical access to disrupt the operations of the device, it doesn't grant them control over the device.

The Law

When I am controlling a distributed set of computers on behalf of my employer, I and my employer should not be considered above the law.  If evidence of a crime was stored on our computers, and we were served with a valid court order to present this information to law enforcement or the court, we would obviously do so.

I would not consider it a reasonable course of action to deliberately configure computers under our control to destroy evidence.  As much as we might claim we are protecting the "privacy" of our clients, I don't consider that to be a valid reason to ignore a court order.  I would consider this an example of vigilantism that would be contrary to the public interest.  When a government makes harmful demands this should be something that is fought in the courts and debated in parliaments, not something that individual citizens or corporations take on themselves.   While we might agree or disagree with any specific government in any individual case, it makes us all unsafe if we condone individuals or governments ignoring the rule of law.

When a law is wrong we work hard as citizens to fix the law, not ignore it.  While I agree there are many buggy laws deployed in every country, I consider this a reason to get politically engaged as any trustworthy citizen or corporation should.

Law enforcement and courts need to modernize their understanding of technology, most importantly the question of control in a networked computing environment.  They need to understand that the physical location of the computer is not the most important factor to determining who controls the computer, and thus who to serve warrants to.

If we deployed fully secure hardware with hardware assistance, and had security put in place to protect us against attacks by unauthorized persons with physical access (IE: wiped keys if unauthorized physical access detected), then law enforcement must be aware of this advancement.  If in the pursuit of evidence to convict a user of our services they served a warrant against the physical hosting company rather than us then they risk destroying the evidence they are trying to collect.     The warrant must be served against the entity that controls the computer, not the entity that physically houses the computer.

It must never be considered the fault of the computer owner that evidence was destroyed by law enforcement.  The current technology illiterate or technology neophyte politicians, judges and police officers are making all of us unsafe.  Technology literacy must become a requirement of those who will be trying to make or enforce laws impacting technology.


Keep reading: Apple's use of computer security and encryption

Perspectives on computer security and encryption from Apple, the FBI and I : FBI

Many people have weighed in on the Apple vs FBI case, including a speech by President Obama.  People in the technology industry have lined up in support of one or the other.

My views can't be expressed as a simple support of one position or the other.  As I believe there is a third option I am authoring this as a series of articles that discusses the issue from three perspectives:

* This article discusses FBI
* A second article discusses my use of security and encryption technology
* A third article discussing Apple

Lawful Access

I've written about the question of lawful access before, and the requirement for there to be strong oversight of police and security agencies in order for those agencies to not themselves be the risk to society that they are supposed to be reducing.  Law enforcement and security agencies must have strong court oversight, and the courts themselves must have strong citizen oversight through ensuring the number of closed court sessions are kept to an extreme minimum.

There is a conflict of interest when it comes to law enforcement and security agencies and protecting the public.  Often these agencies will confuse protecting citizens against death from protecting their lives.  They promote policies which make it easier for them to find and punish wrongdoers, but generally have no concern about the harmful consequences of those policies on the health, safety and security of citizens.

FBI Opposition to encryption

There is no better example of why there is a need for checks-and-balances than the extreme views expressed by James B. Comey, Director of the FBI.  He has for some time been suggesting that the world is "going dark" because an increasing amount of communications is encrypted.  He sees only the narrow potential downsides of this technology in that it might hide criminal activity from the FBI, and ignores the critically important features -- the very fact that the modern economy and much of modern society is built upon private communications requiring strong encryption.

If Mr Comey were a doctor, he would recommend amputating a patients head to solve a back pain problem. He would be correct in saying that after amputation the patient would no longer feel back pain, and would likely be confused why people would consider that a failure.

Fortunately in our society we don't leave extremists like him solely in charge.  Even the NSA, which does its own cracking of encryption and has been accused many times of trying to weaken or put back doors in encryption, had its director come out in favour of encryption due to the extreme views expressed by Mr Comey.  In fact, there is a rift within the US government about this issue, and it is quite a complex one that simply can't be expressed by saying individuals and agencies are picking sides between Apple or the FBI.

The FBI or any other government agency, here in North America or elsewhere, should never be given "back door" access to technology in general as that would enable them to bypass the required checks and balances which the courts and the public must be able to provide in a democratic society.  I have absolutely no respect for the position that suggests they should have no barriers to their investigations, as I do not believe democracy and the required separation of power between agencies can ever be claimed to be a barrier to protecting a democracy.


Keep reading:  My use of computer security and encryption

Protecting IT property rights not a short-term calling

I've been asked over the last decade how my activism will change once Canadian legislation that includes Paracopyright passes. Will my activism be finished, and will I admit "defeat" if a bill abrogates the government's responsibility to protect IT property rights?

At one level this could be a question about whether I will honour the law, which isn't really a fair question. Conservative MP Lee Richardson (Calgary Centre) suggests my honouring the law is optional, saying "If a digital lock is broken for personal use, it is not realistic that the creator would choose to file a law suit against the consumer, due to legal fees and time involved." I suspect the fact one of my early submissions to the government in 2001 involved documenting my circumvention of a TPM for an otherwise lawful purpose suggests that I will continue to do the same.


The more important answer is to state that our activism can not discontinue, and any passage of legislation is only one stage in an ongoing process. The United States provides examples where possible legislative wins can turn around in the courts, which suggests we will need to remain active to seek to turn any legislative losses into wins in the courts or later legislative wins.


A twitter/Google+ exchange with Jason J Kee, Director of Policy and Legal Affairs at the Entertainment Software Alliance of Canada, provides an example of this issue. Mr Kee's association includes game console manufacturers as members, with some game console manufacturers and mobile computer manufacturers being the least respective of IT property rights. Given some of his members want to legalise and legally protect activities which infringe upon the rights of technology owners, our biases in how to look at these policies will be quite different.

He challenged a suggestion I made in a Google+ posting that the USA's technological measures provisions have a tie to infringing purposes. I pointed to my reading of the DMCA which includes the following after defining access control technical measures in Title 17, § 1201, includes the following:

(c) Other Rights, Etc., Not Affected. — (1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title.

(2) Nothing in this section shall enlarge or diminish vicarious or contributory liability for copyright infringement in connection with any technology, product, service, device, component, or part thereof.

(3) Nothing in this section shall require that the design of, or design and selection of parts and components for, a consumer electronics, telecommunications, or computing product provide for a response to any particular technological measure, so long as such part or component, or the product in which such part or component is integrated, does not otherwise fall within the prohibitions of subsection (a)(2) or (b)(1).

(4) Nothing in this section shall enlarge or diminish any rights of free speech or the press for activities using consumer electronics, telecommunications, or computing products.

This is a pretty plain language suggestion that the legislators intended limits and exceptions to copyright to not be trumped by technological measures.

Mr. Kee suggested that I'm "ignoring 10+ years of jurisprudence under the DMCA which does not support your assertion #C11", "Most recent MDY v Blizzard, where 9th Cir confirmed no nexus b/t circumvention & infringement 1.usa.gov/dN3wbX #C11"

What he pointed to was "MDY INDUSTRIES v. BLIZZARD ENTERTAINMENT" appeal decision from the United States Court of Appeals for the Ninth Circuit.


In this case the court ruled that "for a licensee's violation of a contract to constitute copyright infringement, there must be a nexus between the condition and the licensor's exclusive rights of copyright." They then ignored the section of the DMCA I quoted above, and suggested that there should be no nexus between an access control and any rights or limitations in copyright. They went out of their way to ignore or reinterpret other court decisions and statements made by legislators to come to a specific decision.


We could discuss how courts are political entities, and how this Democrat dominated court is interpreting protectionist policies originating in the Clinton/Gore National Information Infrastructure Working Group on Intellectual Property Rights.

The take-away for Canadians should be that after Bill C-11 is passed, the law will continue to change. We should not resign ourselves into believing Canada will follow the USA in increasing the enabling of IT property rights infringement. It is just as likely that things will go the other way.


The MDY INDUSTRIES v. BLIZZARD ENTERTAINMENT case is in my mind a clear example of a TPM being abused to enforce contractual obligations, where one party to the contract is given excessive control over the other. In Canada there have been a number of law professors who have called attention to this issue, going as far as to suggest that this "poorly veiled attempt by the Government to strengthen the contractual rights available to copyright owners, in the guise of copyright reform" may be unconstitutional. Contract law is provincial jurisdiction, and any Paracopyright provisions that extend beyond activities that are the subject matter of copyright may be struck down by Canadian courts.

In my mind, any abuse of a technology that disables law abiding computer owners to control their computers for lawful purposes is an infringement of IT property rights. It is possible that provincial governments and courts will be called upon to clarify this aspect of tangible property rights, and weigh in favour of technology owners. They may not only strike down any legal protection of these abuses of technology in federal Copyright law, but may create legislation to legally prohibit it. This may allow owners to be able to go after infringers, providing the level of protection to technology owners that Bill C-11 alleges to provide for copyright owners.


Ensuring that these infringers won't get away with their dishonest activities when it comes to our governments, our courts, and our computers will require that we remain active in fighting to protect our rights. Setbacks at one time do not mean we should give up, and laws and interpretation of those laws change all the time.

Will you explain why DRM is bad?

I was asked on twitter to explain why DRM is bad.  Given I have spent more than a decade talking about this topic, you would think there is a simple twitter-length answer: but there isn't.


Whether you believe the acronym expands to Digital Rights Management, Digital Restrictions Management, or Dishonest Relationship Misinformation, it doesn't define a specific technology or technique.  The acronym is used to refer to non-controversial technologies such as databases describing content and eCommerce websites, to highly controversial things such as digital locks which lock out the owners of what is locked.


We can't entirely avoid using confusing terms, as people will immediately say "Aren't you talking about DRM" when you want to speak about specific harmful activities.  It is very useful to be clear whenever the time is available.


When some people are concerned about DRM they are concerned about the inability to loan electronic books, or to exercise their fair dealing rights.  While that is peripherally interesting to me, and I agree with some and disagree with other of these ideas, my main concern is impacts which are entirely outside of copyright.  I am happy to discuss (including in comments below, or on the Digital-copyright.ca site) copyright related topics, but for the purpose of this article I am going to talk about things which are unrelated to copyright.


The two techniques I have been fighting against are anti-interoperability locks on content, and non-owner locks on devices.


I believe it should be obvious why having a lock, digital or otherwise, which locks the owner out of what they own is wrong.  In our society most people have at least a minimum of respect for the concept of property rights, and believe that if locks exist it should be the owner that controls them.  Locks should certainly never be allowed to be abused to lock the owner out of what they own, and our laws should protect the owner against such scenarios.  I would be happy to discuss this more if people want, but I am honest in saying that I can't understand why people demonstrate such a lack of respect for or understanding why governments property rights in these discussions.


It shouldn't matter if what is locked is our homes, our cars, or our computers: we should never allow for digital exceptionalism where we ignore basic property rights if the property happens to be digital technology.


The anti-interoperability lock on content ties the ability to access the content to specific brands of devices.   This is harmful in a variety of ways, including being what I consider to be a textbook example of tied selling as described in section 77 of our competition act.   Governments have competition and anti-trust laws for a reason, and again we should not throw away this body of law simply because the tied selling includes something digital.


I don't believe that copyright holders should have the right to decide what brands of technology I use, or what features should exist in the technology that is created and sold.  That said, those who support this policy should recognize that in the vast majority of real-world scenarios it is not the copyright holder that controls the keys to these digital locks.  It is the vendor of the DRM system, a technology company, that controls the keys.  Any digital lock, analog or digital, protects the interests of the key-holder and not necessarily the owner.  I have observed many copyright holders switch their position from being in strong support of technological measures being added to copyright law to being strong opponents once they realized that they as copyright holders would not have the keys or any real-world control over these digital locks.


More important to me, these anti-interoperability locks tie people to non-owner locked devices, something I believe should be prohibited in law.  My primary issue in this debate is the protection of the tangible property rights of technology owners.  Even if it were copyright holders that held the keys to the digital locks on their content, and even if there was a shred of evidence that these locks reduced copyright infringement (most evidence suggests increases), I would still disagree that this justified the legalization of non-owner locks on our devices or anti-competitive behaviour that encouraged the use of non-owner locked devices.




While I believe that these two controversial locks should be prohibited in law,  Bill C-11 (and C-32 and C-61 before them) provide legal protection for them.   While these bills are called "An Act to amend the Copyright Act", the digital locks provisions are not related to the subject matter of copyright law.  In fact, these digital locks have been and will continue to be abused to circumvent the contours of existing laws including contract, e-commerce, property, competition, trade and even copyright.


We have a long way to go in this conversation.  In my mind anyone who respects contract, e-commerce, property, competition, trade, and/or copyright should be opposed to "technological measures" being added to the copyright act.  Legal protection for "technological measures" must be added to the correct law in order for them not to be abused to circumvent the law.


If a technical measure is protecting contracting terms, including a copyright license agreement, then the legal protection should be in provincial contract law.


If a technical measure is protecting electronic commerce, then the legal protection should be in provincial e-commerce law.


And so on...


Hope this helps, and sorry that there isn't a twitter-sized response to this question.  There is a lack of clarity in what the acronym means, which add to the confusion that most of the impacts of adding "technological measures" to copyright law have nothing to do with copyright.