Re-thinking networked privacy, security, identity and access control in our surveillance states

Mass surveillance activities by the security agencies of the Five Eyes countries (e.g. NSA, CSEC, etc) pose a significant challenge to those who care about the privacy, security and other democratic rights related to our burgeoning digitally mediated communications. The on-going media coverage of the Snowden documents has brought unprecedented attention to longstanding concerns about whether and how individuals can exercise effective control over their personal information as we increasingly lead our lives on-line. The revelations are also undermining comfortable assumptions about the institutions and infrastructures we depend on for the efficient and equitable functioning of a democratic society. We've seen agencies mandated to protect our networks compromise once trusted security standards, and secretly hoard vulnerabilities for later exploitation rather than fix them. We are witnesses to government and their corporate partners secretly accessing massive amounts of our data, and grudgingly acknowledge their activities only when forced to by whistleblowers. How can we restore trust in the organizations we interact with and hand our personal data to on a daily basis? How can we require them to be more open, transparent and accountable? What are the technically viable options that can help achieve the reliable protections that many regard as fundamental and wish they could take for granted? Drawing on recent research, this talk will review some of the key surveillance challenges we face in the areas of internet routing and identity authentication. The IXmaps.ca project provides a mapping tool for visualizing the routes data packets take across the internet backbone, and in particular where one's own traffic may be subject to NSA interception at key internet routing choke points. It further documents patterns of "boomerang routing", whereby domestic Canadian traffic is often routed via the US, exposing it to foreign surveillance, and compares the data privacy transparency of the various carriers which handle this traffic en route.