“It is not you who decides if you are suspicious or not.”

UVic professor warns of data collection, rise of mass surveillance on university campuses

Walking through the library, you look around for your friends, trying to find which table they are at. You see students doing readings or shopping for outfits on their laptops. Other students are on their phones talking or texting their friends. You spot your friends with their devices out and join them, pulling out your phone and computer, ready to use them for everything from studying and reading to social media and planning your route home.

At university, it is hard to imagine life without technology. It is so embedded in students’ lives that it’s easy to forget how powerful of a tool it is. It can be used to save lives, provide information, and can now even function autonomously. This technological development has also led to  the advancement of surveillance. But not everyone knows that they can be monitored through the devices they own and use every day.

Dr. Midori Ogasawara studies and teaches at UVic on the issue of surveillance and her research shows the need for Canadians, including university students, to be more aware of mass surveillance.

“Since the COVID-19 pandemic, the area of mass surveillance has been expanding,” Ogasawara said in an interview with the Martlet. “Especially in the case of student life.”

Mass surveillance is not just a thing of the future. It is currently operational in many states and has been proven by whistleblowers such as Edward Snowden and Mark Klein, both of whom Ogasawara has interviewed. Snowden told the world of the global network of mass surveillance that was developed in the US over the last 20 years by leaking documents from the National Security Agency (NSA) back in 2013. Snowden also disclosed that the Communication Security Establishment, Canada’s version of the NSA, uses Airport Wi-Fi to surveil those coming in and out of airports.

But it doesn’t just stop at our borders and points of entry. According to Ogasawara, companies record data and store it in case the government requires it in the future. The information that can be collected includes text messages and phone calls, and authorities only need reasonable suspicion of a crime to access these records. This is thanks to the plethora of bills that have been signed in the name of security that give a wide range of powers to the government to monitor our presence through technology.

Bill C-13, known as the Protecting Canadians from Online Crime Act, gives law enforcement the authority to collect and hold data, even if someone is not under the suspicion of criminal activity. Bill C-44 (The Protection of Canada from Terrorists Act) also gives the Canadian Security Intelligence Service (CSIS) the authority to use otherwise illegal measures abroad, which gave way to Bill C-51 (the Anti-terrorism Act), allowing them to use those same measures regardless of territory. This is heavily significant to the topic of mass surveillance, as Bill C-44 was the catalyst for the CSIS to collect information and monitor citizens within Canada. Finally, Bill C-59 (The National Security Act) was adopted in 2019, further broadening the online surveillance capabilities of intelligence agencies in Canada.

According to Ogasawara, not only are these measures worrying, but they show disregard to the rights and freedoms that Canadians are promised. Instead, they favour the protection of Canada’s national security.

It is also well-documented that governments use surveillance to monitor activists. The UVic community is known for its activism, as many students participate in protests, movements, and walkouts. Thus, if a student participates in a rally, follows a certain Instagram account, or subscribes to a Facebook page, their data could be combed through. The government’s ability to collect and store data from online activity bypasses the need for conventional criminal suspicion.

“It is not you who decides if you are suspicious or not,” said Ogasawara.

However, according to Ogasawara, the government has no way of accessing personal data directly. Instead, they turn to companies to gain access. Major telephone service providers such as Telus and Rogers collect and store their customers’ data on behalf of the government. But for students, there are even more ways that data can be collected. Companies such as Zoom, Microsoft, and Google all collect and store data, and cooperate with the government. Any information sent or received using these services could be accessed by the government.

Ogasawara also noted that these large corporations use the data collected themselves, sometimes even without users’ permission or knowledge. The major problem here lies in their privacy policies, which allows for data to be collected and used at their discretion.

Zoom is one company that has a very broad range of uses for data. Zoom allows third-party vendors and resellers to access personal data, as well as uses it for legal and marketing purposes. Brightspace, the online learning platform used at UVic, also collects data and uses it for marketing, and asks for permission from users to allow third-parties to access it.

UVic is also a part of this data collection, although UVic’s privacy policy is, by most standards, more straightforward. UVic collects personal information on students that visit their websites and who attend the university. According to UVic’s Protection of Privacy Policy, the university can use this information to “administer a program or activity, provide a service, or determine someone’s eligibility for a benefit or suitability for a job.” In most instances, the privacy policy requires consent from the student before this data can be shared. However, there are exceptions in legal instances, like when the Freedom of Information and Protection of Privacy Act is invoked.

UVic employs a Chief Information Security Officer, who deals with information security protection as well as incidents such as unauthorized access, recovering information, or halting access to certain systems. Even if such breaches occur, the UVic Information Security Policy does not require the university to notify those whose information has been accessed illegally, nor does it have a protocol to make incidents known to the broader UVic community.

With mass surveillance, also comes the rise of surveillance capitalism. This refers to the way companies use data to make suggestions about products or services based on online behaviour (i.e. targeted ads).

According to Ogasawara, it goes even deeper than that. Companies are trying to modify consumer behaviour, not just through marketing, but also politically. For example, The Facebook–Cambridge Analytica scandal was brought about by the consulting firm’s use of information collected from Facebook users without their consent to influence presidential campaigns in the 2016 US election. Ogasawara finds the implications of this concerning. Not only is it worrying that they were able to do this in the first place, but it  creates echo chambers of thought, as well as the opportunity for collectors of this information to influence others in various ways.

Ogasawara says there are numerous ways to combat this type of surveillance, especially by companies.

The Digital Charter Implementation Act is a bill that was introduced to Canadian Parliament in November 2021. Also known as Bill C-27, it incorporates the Consumer Privacy Protection Act, which seeks to give Canadians more control over their data, including the ability to request the disposal of personal information when it is no longer needed. The bill is currently in its second reading in the House of Commons, and Ogasawara believes it would greatly benefit those who care about their digital footprint and help regulate companies’ use of private information.

Moreover, students themselves can take measures to restrict the amount of data that websites and companies can access.

“As an individual … you can do many things,” said Ogasawara. “You can change the settings of cookies, you can change [your privacy settings].”

The university offers a program to help students learn about cybersecurity. The initiative, called UVic CyberAware, provides information on safe computing habits that can help protect students’ data.

Ogasawara also suggests end-to-end encryption for online messages as a way to protect your communication from surveillance. End-to-end encryption encodes messages, making them indecipherable until the message is received by the intended recipient. Signal is a messaging app that became popular during the Black Lives Matter protests for its end-to-end encryption. According to Ogasawara, apps such as Signal would be highly beneficial to the large number of UVic students who participate in activist movements.

It’s easy to scroll to the bottom of the terms and conditions page and click “accept all” when cookie requests pop up. However, the next time you’re in the library texting your friends, scrolling through social media, or doing research, it may be worth the extra time to take Ogasawara’s advice and pay attention to what you’re agreeing to.