New federal cyber strategy skirts questions of security vs. privacy

June 13, 2018

New federal cyber strategy skirts questions of security vs. privacy

Institute For Ethical Hacking Course and Ethical Hacking Training in Pune – India

Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

Credits: ABC News

Canada’s much anticipated cyber security strategy, released Tuesday, has exposed one of the key problems facing the federal government in the digital age.

The strategy warns of the need for better encryption to safeguard data — particularly against the lightning advances of quantum computing.

But it also places an extraordinary emphasis on increased national security and combating an explosion in cyber crime, which often stymies authorities by exploiting some of the best encryption available.

So the federal government has to somehow strike a balance between securing data and fighting the encryption used to secure it. The strategy unveiled today suggests that it hasn’t struck that balance yet.

“This is a very active, ongoing discussion,” said Public Safety Minister Ralph Goodale. “Obviously, encryption is hugely valuable to protect people’s personal and private information …

“At the same time there are important questions about law enforcement and national security being able to properly conduct investigations and pursue potential criminal activity, or pursue potential threats to national security.”

The Supreme Court of Canada dipped its toe into the debate late last year, ruling that both the sender and the receiver of one-to-one text messages have an expectation of privacy, and police need a warrant in order to see both ends of the conversation.

The government has yet to draw a clear line between individual privacy and state intrusion.

“The issue about the further definition of the rules remains outstanding,” said Goodale. “It is a discussion that is not yet complete.”

New strategy, old news

A lot of things in the strategy seem incomplete, say critics.

The government re-announced its previous commitments to house all of the federal government’s cyber expertise under one roof, and named a senior official from National Defence to lead it.

It also re-stated its plan to create a national cybercrime coordination unit, something that is expected to be up and running by the fall.

Both measures appeared in last winter’s federal budget.

The University of Ottawa’s Wesley Wark, one of the country’s leading experts on cyber security and intelligence, said the dual goals of offering greater online security and allowing authorities to crack criminal encryption don’t need to be mutually exclusive.

“It’s not a zero sum game,” said Wark. “It’s not more encryption means less access” for law enforcement and security services.

With the right ground rules and legislation, both objectives can be achieved in tandem, he said.

There is a reference in the strategy to the federal government’s desire to legislate cybersecurity standards, something the previous government also wanted to do.

But officials, speaking on background prior to the launch of the strategy, said the legislation remains under review.

That puzzles Wark, who said even high-tech companies have complained about the legal vacuum.

“To be honest, I thought this was something that would be in [the strategy] in more concrete form,” he said. “There is really nothing here beyond an aspiration.

“I mean, how many times does the private sector come to government and say, ‘Regulate us’?”

Critical shortage of tech people

The last federal budget sprinkled $750 million over several departments to shore up the country’s online defences and promote closer collaboration with the high-tech sector.

The new strategy acknowledges Canada — in both its public and private sectors — is facing a critical shortage of highly-skilled tech workers and has trouble keeping ones that have already been trained. Many programmers and software engineers are lured to the U.S. by salaries and opportunity.

Federal officials said they are working with universities and schools to encourage more young people to take up coding — but no funding has been set aside for specific initiatives.

The document does not talk about increased collaboration with industry, or about making the purchase of Canadian technology a priority for the federal government — something innovation leaders have said is important.

Benjamin Bergen, executive director of the Council of Canadian Innovators, said the group had high hopes of seeing at least some of those issues addressed in the strategy.

“It’s disappointing to see lack of commitment to build Canada’s cyber sector,” he said in a statement. “Cyber is the fastest growing ICT (information and communications technology) sector in the world and domestic innovators present an opportunity for our government to grow our economy and deploy world-class technology solutions for protecting Canada’s digital borders.”

The council estimates Canada will have up to 200,000 job openings in high-tech by 2020, which presents a challenge not only for the private sector, but for the federal government as it attempts to beef up its cyber capabilities.

Goodale acknowledged the problem, but seemed content to let the business community and the education system figure it out, calling it both a huge challenge and a huge opportunity.

“This is an area that we want Canadians to seize with enthusiasm,” he said, noting that all countries are struggling to develop high-tech talent.

“This is great job opportunity for young people. The world will be demanding people with these talents and skills, who understand cybersecurity and can deliver the goods for their employers.”