The Cost of Public Sector Breaches in Canada: Understanding the Risks and Solutions

Introduction

In recent years, the Canadian public sector has consistently failed when it comes to protecting the personal information of Canadian citizens. As figures were released in 2020 showing the extent to which these breaches were occurring, the government faced a lot of criticism from the general public and the media. This led to some extra measures being taken at the governmental level in order to mitigate these risks and be more transparent about the breaches. Let’s look into the details of these data breaches to better understand how the problems could be addressed from an infrastructure perspective.

Overview of the breaches

According to the documents released in 2020, Canadian Federal Departments and Agencies have mishandled personal information belonging to a total of 144,000 Canadians in less than two years. This is a staggering number and a clear indication that something must be done to protect the personal information of Canadian citizens. The following are some of the agencies involved in this unfortunate situation:

• Department of National Defence (DND)
• Public Health Agency of Canada (PHAC)
• Employment and Social Development Canada (ESDC)
• Immigration, Refugees and Citizenship Canada (IRCC)
• Canada Post (CP)
• Public Services and Procurement Canada (PSPC)
• Health Canada
• Canada Revenue Agency (CRA)

There are several reasons why the personal information was mishandled, and of course, it varies based on the different standards that were implemented in the different departments. However, one thing is certain: all of these entities were breached and therefore all should improve their systems as well as their internal policies. Additionally, there is general consensus on the fact that staff training and awareness on these themes are lacking across the sector and more can be done from a human resources perspective. In fact, the majority of the reported breaches seem to usually be the result of human error—which is probably due to the fact that the people handling the data are not aware of the risks involved and do not take the necessary precautions to protect the information they manage.

The cost of these breaches

Compared to data breaches that occur in the private sector, these incidents are much more costly to society for a number of reasons. First of all, the government ends up having to pay tens of millions of dollars of taxpayers’ money in lawsuit settlements as happened in this case. And even though they might get compensated for the damages, the affected individuals may still suffer from identity theft, financial fraud, and other negative consequences. These breaches involved lost or misdirected passports and birth certificates, which are crucial documents for identity verification. These incidents also negatively affect the level of trust that individuals have towards their government: differently from what happens in the private sector, where it’s the individual who chooses to give away personal information, individuals here are forced to do so and then have to pay the consequences for a choice they didn’t really make.

How to prevent these data breaches

Regardless of whether you are a government agency, a multinational corporation, or simply a small business, you need to implement modern solutions in order to protect the data of your users. This is true not only on the user interface with stricter password requirements and multi-factor authentication but also at the back-end level—specifically when it comes to employees being able to give access to bad actors.

That’s why passwordless solutions are ideal in these cases. They use a combination of biometric authentication and device-based authentication, making it nearly impossible for attackers to gain unauthorized access to sensitive information. While some use fingerprint scanning as their form of biometric authentication, other solutions implement alternatives such as face recognition and voice recognition, which are all far more secure than traditional passwords. Device-based authentication involves verifying the user’s device, making it impossible for attackers to use stolen credentials on another device.

By embracing passwordless authentication systems, authorities in Canada and across the world could take a significant step towards improving their security and protecting the personal information of their citizens.