Whenever you read about a dispute between a web-based service and a country, you need to ask yourself only one question: where is the server located?

BlackBerry servers are located in Canada, and data is encrypted when it is sent from one phone to another. That’s a problem for countries that want to intercept and monitor information sent across BlackBerry networks. From The Economist article:

Countries have two basic technical methods of controlling the flow of information over the internet. First, they claim legal jurisdiction over information stored on servers within their own borders. Second, they can read or block traffic moving through the choke-points where internet cables cross the border.

Neither of those options is available to countries wanting to spy on BlackBerry users, which is why Research In Motion, the makers of the BlackBerry, have been getting flack from the governments of India, Lebanon, Saudi Arabia and now the UAE:

The UAE’s Telecommunications Regulatory Authority said it would suspend BlackBerry Messenger, email and Web browsing services beginning on October 11th if RIM does not provide a solution for local messaging control.

Fortunately, Research In Motion told its customers not to worry:

The BlackBerry security architecture for enterprise customers is purposefully designed to exclude the capability for RIM or any third party to read encrypted information under any circumstances. RIM would simply be unable to accommodate any request for a copy of a customer’s encryption key since at no time does RIM, or any wireless network operator, ever possess a copy of the key.

Unfortunately, Research In Motion quickly made a deal with the government of Saudi Arabia that undoes those fine intentions:

The agreement, which would involves placing a BlackBerry server inside Saudi Arabia, would allow the government to monitor users’ messages and allay official fears the service could be used for criminal purposes.

A similar deal with the UAE is likely to follow.

Staying secure when eavesdropping is a risk: VPNs

This brings up a general point about safe internet use in any setting where third parties — including governments, your ISP, or the guy next to you in the coffee shop sharing that WiFi hotspot — may be able to peek at your communications. A commentator at The Economist’s article wisely noted that:

…one can go to any hotel in Dubai, hop on its wifi with your laptop and use your own VPN (or company VPN in my case), effectively blocking them from seeing your communications.

Although it may be illegal to do so depending on your location, and I’m in favour of following the laws in the country you’re in, using a VPN may be a good idea in some scenarios.

The best explanation of VPNs I’ve read is from HowStuffWorks.com, which suggests the analogy of the internet as an ocean and most internet traffic as being like a ferry from one island to another. When you’re on a ferry, everyone can see who you are and what you are doing. It’s public.

A VPN, on the other hand, is like a submarine that allows you to travel underwater from island to island. Some savvy observers of the ocean (your ISP, for example) may know that you are in a submarine, but they won’t know your ultimate destination or what’s inside of the submarine (i.e., the information you are transferring from your computer to the destination computer).

To use a VPN, you simply need to install VPN software on your computer (some suggestions are provided below), connect to the internet, start the VPN software, then proceed to browse the net.

Drawbacks of VPNs

As with any security solution, VPNs have some drawbacks:

1. You have to trust the VPN provider more than you trust your current connection. There’s no way around this if you’re using a commercial VPN (highly technical users can set up their own VPN servers to get around this problem, but the process is too difficult for most of us). The best assurance any VPN company can give you is something like this:
   

   What needs to be understood, is that our livelihood depends on keeping you safe and honoring your privacy. If we ever compromised that, unwillingly or with bad intent, I would imagine word would get out pretty fast. I can say that here at WiTopia, we take it very very seriously.

2. They slow your browsing/VOIPing/messaging. Because of the encryption/decryption process and because your internet communications are first routed to your VPN’s servers before being routed to the ultimate destination, you’ll probably notice some lag.

A few VPN companies

I can’t promise that these companies will keep your information secure. There is no such thing as perfect security. If it’s important to you, you need to do the background research and decide for yourself if using a VPN is safer than the alternative. That said, here are two companies that were discussed by CNET and one that a friend recommended to me:

1. WiTopia
2. HotSpotVPN
3. proXPN, which is free and has a Facebook page where the company often answers user questions

Added 10 Aug 2010: U.S. authorities are already able to tap BlackBerry messages. And Bruce Schneier noted a few days ago that:

The UAE can’t eavesdrop on BlackBerry traffic because it is encrypted between RIM’s servers and the phones. That makes sense, but conventional e-mail services are no different. Gmail, for example, is encrypted between Google’s servers and the users’ computers. So are most other webmail services. Is the mobile nature of BlackBerrys really that different? Is it really not a problem that any smart phone can access webmail through an encrypted SSL tunnel?

The Office of the Privacy Commissioner of Canada oversees Rogers’ personal information handling practices. If your privacy concerns are not addressed to your satisfaction by Rogers you may contact the Office of the Privacy Commissioner of Canada for further guidance

So, Rogers doesn’t want to consider the subject further. The reasoning is this: if the Privacy Commissioner thinks Rogers handles privacy adequately, so should Rogers’ customers.

I encourage those of you who are customers of Rogers (there may not be many of you, as the majority of this blog’s readers are American) to call them or email them for a real answer. When pressed by actual customers, Rogers is probably more likely to be responsive.

Update (23 April 2007): Rogers replied a week and a half ago with this (I apologize for the delay in posting and for the strange quote marks and other typographical oddities that have appeared in this post as a result of my use of a foreign keyboard):

Please note that Rogers does not sell nor release any confidential subscriber information, to anyone outside Rogers line of companies (who basically share the information for the purpose of providing excellent customer service to our subscribers). The private account information of our subscribers is never fraudulently used to jeopardize customer privacy concerns.

With regard to internet usage, the information is kept on the database to ensure that bandwidth is not abused. This allows us to provide high level of performance for all subscribers. The IP addresses are dynamic and can change at anytime. Also, any personal subscriber account details are only released with a court order.

As with the email I received from Shaw, this message from Rogers avoids some of the most pertinent questions I and this site’s readers would like answered (“how long does Rogers store data on its subscribers’ internet usage?” for example, or “how long are logs of what IP addresses were assigned to which customer kept?”).

I admire Rogers’ refusal to sell or release confidential subscriber information, but I worry that the company’s definition of “subscriber information” and “personal subscriber account details” don’t include internet histories. Also, if the company keeps records of bandwidth usage, it must have a way of identifying users’ internet histories even though IP addresses are dynamic. So that bit about dynamic IP addresses was, I think, a lot of smoke.

What I’d like to see from each of these ISPs, although I may not get it, is a specific confirmation or denial of the practice of selling users’ internet histories. It seems to me that none of what Rogers (or any of the others) has said thus far prohibits this.

Update (6 April 2007): Rogers has not yet responded; Telus emailed me to say they are thinking the matter over (which I think is fair); Shaw dodged the questions with this answer

The questions you asked do not directly relate to customers [sic] personal information (i.e. data relating to an IP address is not personal information as long as it is not associated with a particular customer account) and would require that we disclose confidential business information proprietary to Shaw. Therefore, we confirm that we are not in a position to provide responses to your questions, except for question 6.

In response to question 6 [Does Shaw sell internet usage data? What kind of data? If so, how is it anonymized and to whom do you sell it? What language in your privacy policy discloses this?], we advise that Shaw does not sell Internet usage data to third parties.

Shaw’s privacy policy is fairly thorough and is, I think, a good effort. However, the way that Shaw answered the questions I sent them reveals the limitations of the company’s privacy policy. Shaw’s policy describes how “Personal Information” (a category that includes customers’ names, addresses, telephone numbers, gender, credit information, payment records, and correspondence sent by the Customer to Shaw) is protected, but it appears that the company doesn’t consider “data relating to an IP address” to be personal information. Perhaps Shaw feels that as long as a customer’s name is stripped from the data, it has been thoroughly anonymized and is fit for treatment not mentioned in the privacy policy. But we know this type of anonymization isn’t good enough. New York Times made this pretty clear in its 2006 article called Face Is Exposed for AOL Searcher No. 4417749, published after AOL released what it thought were anonymized search terms.

I’ll press for more detailed answers from Shaw, and hopefully get something from Telus and Rogers soon.

————————

Original article:

Last year, when AOL was caught out for publishing its users’ search terms and phrases, many people, including me, were surprised at how much harm can be had when internet usage data, even seemingly anonymized data, is not kept confidential by those who necessarily have access to it. Internet Service Providers, or ISPs, can collect a lot of personal information about you just by keeping track of the websites you visit. It’s important, then, to know what information ISPs collect, how long they keep it, and to whom they show/sell it.

12 days ago, Ryan Singel, writing for a Wired blog, wrote that

ISPs are selling data history of their users, according to co-founder of web analytics firm, Compete, David Cancel, who told a panel of conference attendees on Tuesday that his company buys such data. Cancel says the data does not include IP addresses, but that’s not enough to truly anonymize it, as click stream data can include searches that identify a user.

Recently, Ryan has been asking questions of some of the big American ISPs (like Comcast and Verizon) to find out if any of them are selling their users’ internet usage logs. So far, AOL and Cox have answered up (with results posted in a handy web-spreadsheet visible at the page linked to above), but others haven’t. To get complete information from all of the ISPs, Ryan says

We’re asking those of you who are customers of the non-responsive ISPs to call, write, FTP or IM or Twitter your ISP and ask them to clarify how they use, store or even sell data about you. Report the results back and we’ll add it to the spreadsheet.

What to ask your ISP

Ryan has made it easy to ask your ISP what it’s up to. Along with the phone numbers and email addresses of major American ISPs, he’s written a list of questions to ask them, and I’ve reposted them here (feel free to copy and paste, then email to your ISP; change “ISP NAME” to your ISP’s actual name if you’re feeling ambitious):

Canadian ISPs

Shaw, Rogers, and Telus are the big internet service providers in Canada, and, since I live in Canada, I sent an email to all three. I’ll report whatever results I get here as well as on Ryan’s blog. If you want to email any of the Canadian ISPs, you can find their submittable help forms here: Shaw, Rogers, and Telus. If you send an email and get any sort of answer, post it in the comments below or in the comments on Ryan’s blog, called 27B Stroke 6. Just to make it ridiculously easy to send an email, I’ve altered the forms (only slightly) to be Canada specific: