Who’s spying on the web?

The whistle-blowing WikiLeaks has a track record of revealing explosive secrets, so when three Canadian tech firms popped up on the website, it immediately raised the question: what are they hiding? WikiLeaks latest campaign, called “The Spy Files,” is aimed at exposing the use of online surveillance technologies by telecommunications companies, police forces, governments and intelligence agencies collecting private data. The site has named Canada’s Vineyard Networks, Sandvine and AdvancedIO Systems as “Western intelligence contractors,” but so far specific files have not been published online. While the companies say they have nothing to hide, the website is already causing trouble for some British and U.S. firms.

The companies named by WikiLeaks design products—both hardware and software—that facilitate a practice called deep packet inspection, a way of filtering data as it passes an inspection point within a secured or unsecured network. These programs have completely legitimate purposes, whether used to manage congested Internet traffic, to diagnose potentially destructive glitches in a massive computer system, to crack dangerous organized crime rings, or to tap into an underground terror cell. But WikiLeaks is on a crusade to pinpoint the uses that a democratic government’s law-abiding citizens may not necessarily consider ethical.

In the United Kingdom, documents from several surveillance companies have been leaked onto the Spy Files website, sparking outrage. Hampshire-based Gamma Group was shown to have been providing spying programs to Hosni Mubarak’s regime in Egypt through a third party; aptly named Hidden Technologies Systems International was discovered selling its technology to Saudi Arabia’s police force; and Creativity Software has been supplying its cellular device tracking system to an Iranian mobile phone company.

It has yet to be determined what (if anything) WikiLeaks will reveal about the three Canadian companies when it releases files in the coming months. Two of the three, Sandvine and AdvancedIO, have responded to the appearance of their names on The Spy Files, saying they are puzzled because what they do is perfectly legal (generally, their technologies manage network traffic). “We aren’t really sure why we are included in WikiLeaks, but it looks like any company that offers similar solutions is also cited,” says Sandvine spokeswoman Sacha DeGroot. “We are curious to see what documentation they will post about [us], but for now, this is a non-event.”

AdvancedIO is listed under Canada’s Controlled Goods Directorate, a federal government program that regulates possession and transfer of controlled technology, ultimately preventing their products from ending up in the wrong hands—that is, what the government deems the wrong hands. The other two companies, however, are not registered, so what they do is not controlled under Canadian law.

Robert Currie, cyberlaw expert and director of Dalhousie’s Law and Technology Institute, says this amounts to insufficient regulation over the uses of these technologies, and it poses a real danger. “I think the whole WikiLeaks effort seems to be designed to address the fact that these companies are flying under the radar because they don’t want this angle of their market known, even if they have some perfectly respectable uses.”

But Jose Fernandez, a computer scientist and professor at the École Polytechnique de Montréal, says WikiLeaks’s campaign is misguided and outing these companies worsens many problems. “These companies are selling products that 99 per cent of the time are actually very useful for very legitimate purposes, mostly defence. We need these technologies to get better, because to be honest, we are losing the battle against the bad guys in terms of cyberwarfare, cyberespionage, and cyberfraud.” He suggests that WikiLeaks has the wrong target and that Internet giants such as Google and Apple, which collect more data than the surveillance companies, and government and intelligence agencies, should be held responsible. It is, after all, how the technology is being used that may be unethical.

WikiLeaks insists the companies it has outed are “making billions selling sophisticated tracking tools to government buyers, flouting export rules, and turning a blind eye to dictatorial regimes that abuse human rights.” In the case of the Canadian firms, those remain completely unfounded allegations—and the party that appears to be suspiciously gathering private information is WikiLeaks itself.

Original Article
Source: Maclean's