Big Brother is watching you

Governments and private sector are reading your e-mail and monitoring the sites you visit

Laura Landon
The Ottawa Citizen

If you think your Web-browsing, chat-room-chatting, telephone-talking habits are unlikely to fall under the prying digital eyes of Big Brother -- think again.

Experts say governments and the private sector have the technology to read your e-mail and find out what Web sites you have been visiting.

And they are using it.

A study this year by the American Management Association says that 54 per cent of major U.S. companies monitor their employees' Internet use, while 38 per cent store and review e-mail messages. It also says 88 per cent of companies that do any kind of electronic surveillance (and according to the survey, a whopping 78 per cent of companies perform some kind of surveillance, from listening in on phone calls to reviewing phone logs) inform their workers of the monitoring.

Government, too, is in on the action. The FBI, for example, last week unveiled its e-mail-scanning snoop program called Carnivore.

A few months ago, Britain admitted to sinking $62 million into a similar e-mail monitoring system, located in the headquarters of its MI5 spy agency. The Government Technical Assistance Centre, is capable of tracking all the Web-cruising and e-mail messages sent and received in the country.

And looming over all surveillance programs is Echelon -- a global satellite web whose Canadian centre is located just outside of Ottawa, at the Canadian Forces Station Leitrim. Echelon monitors phone calls, faxes and Internet communications by zeroing in on key words. This electronic snooping has a wide variety of uses, from monitoring employees to police investigation to marketing.

One of the latest tricks is to monitor traffic on Web sites in search of information useful to people who want to market goods.

Last week, for instance, Robert Cook, director of market surveillance for the Toronto Stock Exchange, said the TSE is testing a program to digitally eavesdrop on live, text-based conversations occurring in Internet chat rooms. The TSE already looks in on Internet discussion groups.

The FBI's Carnivore is used for criminal investigations. It "digests" huge quantities of e-mail to cull the meaty pieces it wants.

Internet service providers are angry because in order for the program to work, the FBI has to plug it directly into their server. And privacy advocates are nervous because it gives the government the ability to monitor every e-mail coming and going from that server.

But Echelon is the mother of all surveillance systems.

Although its existence is repeatedly denied by the five countries which run it -- Canada, the United States, Britain, New Zealand and Australia -- its existence has been extensively detailed by researchers and former intelligence workers, including former Canadian spy Mike Frost and retired U.S. National Security Agency worker Wayne Madsen.

Earlier this year, tales of Echelon prompted a leading U.S. military analyst to say that if you place an international phone call, you shouldn't be surprised if the U.S. National Security Agency is listening. "Most people just don't realize how pervasive government surveillance is," said John Pike, military analyst with the Washington-based Federation of American Scientists.

But on a more tangible level, monitoring programs that can be installed in any personal computer are cheap, fuss-free and easy to come by.

For instance, for just $99 U.S., your boss can read your mind with a program called "Investigator."

"I guess in essence what it's doing is watching your thought process, because even if you take a word out and add another one, it records that," said Richard Eaton, president of the Washington state-based WinWhatWhere Corp. and designer of the program.

Investigator is one of a handful of new computer surveillance programs that intercepts keystrokes before they hit the computer screen, monitoring even deleted or unsent e-mail messages and documents. Undetectable on a hard drive, it records every tappity-tap on a keyboard, every Web site visit and every document you open from a disc or CD-ROM, recording when you started each activity and how long you lingered.

It even picks up on keywords such as "union" or "boss," and fires off an electronic alert to your watchful employer.

Next month, the company will launch an updated version of the program, capable of capturing conversations taking place in a virtual chat room and on instant messaging.

While workplace monitoring has been big business in the United States for a while, it's just beginning to creep north.

Investigator has roughly 100 users in Canada -- compared to 8,000 in the U.S. -- but interest is growing, says Mr. Eaton. In Ontario, 15 organizations with anywhere from one to 200 monitored computers use the program.

"I can't tell you what they're doing with it and who they are," said Mr. Eaton, though he said they include private subscribers, an accounting firm, a dotcom business, retail companies, manufacturers and government. The program works its covert wonders in Oakville, Toronto, Pickering, Etobicoke, Burlington, London and New Liskeard. A handful of government agencies in London, Toronto, Saskatoon and Montreal use the program, said Mr. Eaton, though he won't identify which agencies.

The "rules" around electronic workplace surveillance in Canada -- set out by the Treasury Board in its 1998 Policy on the Use of Electronic Networks -- aren't hard and fast.

Using rights set out in the Privacy Act and the Charter of Rights and Freedoms, the policy says that workers -- whether they're using private or government computers -- have a "reasonable expectation" of privacy in the workplace. Standards of "reasonable expectation" could be diluted, however, by simply notifying workers they're being monitored.

Public sector workers have more recourse than private sector workers, although a new federal act coming into effect Jan. 1 will eventually extend to private sector workplaces. People who feel they are being unfairly monitored can complain to the Office of the Privacy Commissioner, which can investigate, although a representative with the office said personal complaints and investigations seldom happen.

In the U.S., workplace computer monitoring has been around for a while. People gather statistics on it and there are countless organizations dedicated to promoting electronic privacy.

"It's an issue that will come up again and again," said Sarah Andrews, a policy analyst with the Washington-based Electronic Privacy Information Centre, which tracks global Internet privacy. "It seems a bit pre-emptive to just monitor everybody. It creates a climate based on fear rather than trust where employees are presumed guilty of illegal conduct or wasting company time even before they've done anything," she said.

Exxon Mobil Corp., Delta Airlines and Ernst & Young have all said they use the Investigator program. "This is the United States: There really is no expectation of privacy for employees using computers," said Mr. Eaton of WinWhatWhere Corp.

A recent Angus Reid survey of 1,000 Americans supports his claim. According to the survey (which has a three-per-cent margin of error), while 57 per cent of respondents admitted to personal Web surfing at work, 73 per cent said they thought their employers had a right to track their online activities.

But in Canada, the situation is a little fuzzier, and we often rely on U.S. data as a yardstick for how prevalent workplace computer surveillance is.

"I think most people believe the trend is similar here," said Michael Geist, who teaches Internet law at the University of Ottawa. "The reality is this is getting very cheap and very easy and that an increasing number of employees are using this technology simply because they can."

Programs such as Investigator raise concerns because they go so far beyond what most employees would expect from e-mail or Web surfing monitoring, said Mr. Geist.

"We can all think of a scenario whereby an employee jots off an angry e-mail to their boss, and before hitting the send button, thinks the better of it and deletes it," said Mr. Geist. "The reality is that this program is still going to capture that, so in many ways it is the type of program that is able to penetrate a person's thought process."

It twigs other concerns, too, he said: "Where does an employer's right to monitor stop?" Should employees who work from home face similar monitoring? Do companies such as Ford, which give personal computers to many of their workers, own the material on those computers?

He points to a U.S. legal case involving Northwest Airlines, a company which believed some of its employees were behind an illegal strike action. "The company was able to convince a judge to allow them to go into these employees' homes and confiscate their personal computers -- not company computers -- in an effort to uncover whether there was e-mail evidence behind this sick out."

Electronic privacy is a green issue, said Mark Ellis, a lawyer with the Toronto firm Donahue, Ernst & Young. Over the past two years, he's been involved in firing 12 people who "surfed the dark side of the Web" or sent inappropriate e-mails. Mostly, he said, they didn't cover their tracks well enough, adding that records of e-mail and Web visits are usually buried deep in the seldom-probed bowels of a computer.

Programs such as Investigator -- which he says are "pervasive" in Canada -- will eventually force the privacy issue before the courts.

"I think there's going to be a barnburner of a case sooner or later that's going to say, 'Listen, this is too secret; this is too intrusive; and there is a deemed confidentiality when a person is talking privately, even through e-mail."