Slashdot Mirror
Canada Wants To Keep Federal Data Within National Borders (thestack.com)
An anonymous reader quotes a report from The Stack: Canada has released its latest federal cloud adoption strategy, now available for public comment, which includes policy concerning the storing of sensitive government information on Canadian citizens within national borders. The newly-published [Government of Canada Cloud Adoption Strategy] requires that only data which the government has categorized as "unclassified," or harmless to national and personal security, will be allowed outside of the country. This information will still be subject to strict encryption rules. The new strategy, which has been in development over the last year, stipulates that all personal data stored by the government on Canadian citizens, such as social insurance numbers and critical federal information, must be stored in Canada-based data centers in order to retain "sovereign control."
sovereign control served here
Is somebody trying to make an argument against the idea?
“He’s not deformed, he’s just drunk!”
this is actually a requirement in several Provincial Privacy acts. Nova Scotia for example is not allowed to store any personally identifiable information outside of Canada. The feds arnt bound to follow Provincial acts, but its not surprising they would follow what others are doing already.
Its specifically the Patriot act that led to the NS Clause.
During the 2011 census, for instance, 89-year-old Ontario resident Audrey Tobias said she would not fill out the questionnaire because an information technology contract linked to it had been awarded to an American company, Lockheed Martin. Tobias was charged with violating the Statistics Act, but eventually acquitted.
Now that it's back, time to make sure that your data stays your data.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
...Canada is buying another computer to go with the one they already have?
British Columbia already has this rule; government data (including university data for researchers) must be kept on Canadian servers. There's some wiggle room for opting in to US storage, though.
I think it's important legislation, and it motivates some good duplication of infrastructure within Canada. It makes it harder to abdicate our responsibility to data and makes it just a bit harder for US subpoenas to get a hold of it.
The government was also able to jail you for refusing to fill in previous long-form census. I refused in writing in both 2006 and 2011, on the grounds that in 2006 some of the questions were inappropriate, and in 2011 because some of the questions required information on your parent's ethnicity, which if they want it, they can ask them directly. Long distance charges will definitely apply since they were long dead.
Threats disappeared after I told them that the census taker had violated the census act by having one of her children along when trying to con me into filling it in. And keeping info stored on an insecure laptop. I also told them that I could prove that the "92 year non-disclosure policy" was a total lie, that researchers are given access to the raw data after a mere 7 years, so please take me to court.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Nobody sane the world over wants their data exposed to the USA.
Hard to protect against for sure, but still a worthwhile goal to shoot for.
Yes :(
Translation: the Canadian government wants to be able to spy on its citizens easily.
Domestically storing the *government* curated data that the *government* already controls doesn't provide much of a spying advantage.
Anyways, Canada doesn't have to spy on its citizens. We let the NSA and the MI5 etc spy on our citizens, just like CSEC and the MI5 etc spy on US citizens in a giant circle jerk including Australia and New Zealand.
Yes, but they aren't allowed to contribute to election campaigns or political parties; only people are. Trade unions are also not allowed to contribute to election campaigns or political parties.
-- I ignore anonymous replies to my comments and postings.
This is data that should be nationally controlled and protected. Keeping it with borders makes sense.
The US doesn't have a law. It has regulations the amount to the same. So do other countries.
All the big brother conspiracists, please give the rest of us a break.
Ugh... let me clarify. The are legal entities/persons separate from the people who run them and/or the shareholders. But in terms of something like the Citizens United case, no they are not people.
-- I ignore anonymous replies to my comments and postings.
There are treatments for your condition.
The world's burning. Moped Jesus spotted on I50. Details at 11.
This is most likely a question of protectionism (giving contracts to your own data centers) with a privacy smokscreen. It has a coincidental privacy benefit.
Real lawyers write in C++
You realize we have a population roughly 1/10th of the US, right? That's a fair number of people to datamine.
Yes, they are able to jail you. But - over the entire history of the law, there were about 11 people actually charged, and they were just fined - $1000 or so.
The census is important. In fact, there was no long form in 2011 because the Conservative government changed it from mandatory to voluntary. This had the unfortunate side effect that there is no usable data to be mined from the 2011 census.
As for the release of raw data - it's collective data, not individual forms. The 92 year rule is for individual forms - so in 92 years, the complete form is released how you filled it in. But the census data is of importance to many people, groups and organizations, and that's aggregated. After 7 years, the aggregated data is available to researchers who want a snapshot of the Canadian population to study what they need to study. But they don't have access to the individual forms you fill out, only the aggregated data. And only subsets of it - what they need for their research. No one other than Statistics Canada can see the full data set, and once the forms are tallied, no one can see the raw forms or individual data either (until 92 years later).
Before it was gutted by the Harper Conservatives, Statistics Canada is/was one of the most premier data collecting and analysis organizations. It's why the chief statistician resigned after elimination of the long form - he knew that the law would render the 2011 data completely worthless. It's partly why we're in the situation we're in with school closures in one city, school overcrowding in others, etc. Because the only usable data dates back to 2006.
Doesn't really help if the servers are in Canada but the people accessing them are in Mumbai does it ?
The people in Mumbai won't have the security clearance to access the data in the first place.
You have it right. The OP is just smoke and drama.
Achille Talon
Hop!
It's good to see a well written and thoughtful response on the requirement for the long form census. The data is instrumental for so many organizations and for governments of all levels (local, provincial, federal) to develop policies and programs to meet the needs of Canadian citizens.
The people in Mumbai won't have the security clearance to access the data in the first place.
They do tend to have the ability to manage the credentials to grant you access to the applications that consume the data. I've seen this approach leave massive holes in healthcare and outsourcing; where there are stipulations about keeping data in the country.
The GP's point is that physical storage/location is only one piece of the puzzle. Separation of duty as you describe is another, regular audits and monitoring, management of encryption keys, securing the network paths (there a lot of hops that bounce back and forth between the US and Canada), etc
Wearing pants should always be optional.
It is illegal in some provinces (including Quebec) to ask your neighbors for personal information about you. Even a licensed private investigator can't. Of course, too many people don't know that, so they acquiesce, rather than calling the cops.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
I saw no reason whatsoever to ask about ANYONE'S ethnicity. Why? Are we going to deprive people of services because of their ethnic background? No? Then why are you asking?
They came up with all sorts of reasons, and I told them flat out it was racist, not needed, and years from now people will be shocked that we ever asked this sort of divisive question.
So the next census, instead of asking for mine, they asked for my parents, which is invasion of their privacy, even if they're dead.
40 years ago the city came around with their census, asking what language I and my then wife spoke at home. "English." So we'll put your children down as english too. "No, you shouldn't be separating people by language, so put them down as french, just to fuck you up." I had enough even back then of separatists trying to classify people based on language. It's neither needed nor right.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
They would have lost in court. had several legal defenses prepared, one being that it was statistically possible to identify individuals in randomized data by making repeated queries and varying the area covered. Would make it very easy to identify the income of individuals, whether they were adopted, etc. Making the data available for research within 7 years (and sometimes immediately) should be a no-no.
That the census taker violated the census act is just gravy on top. No judge is going to throw someone in jail for refusing to cooperate with a census taker who has demonstrated that they can't take even the most basic precautions.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
The raw, anonymized data can be de-anonymized, Plenty of ways to do it. And no, not all data was anonymized for research purposes. Just like it wasn't being held in confidence for 92 years. They admitted it.
As for school closures, etc., that needs data at the local level on an annual basis. Not something every 5 years that takes another couple of years to compile and release. Schools can easily figure this out by applications for enrollment the next year. Linger-term trends, they already have year-over-year data, far more granular than what the census could ever provide. They tried to make that argument, it was bogus then, and it's bogus now.
Blame incompetent administrators, people not willing to be flexible with school boundaries, language, etc. The 5-year census is irrelevant.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Naive question: how many of those people (in each country) are human, rather than corporate persons?
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
It actually sounds rather Trumpish.
Of course people will make excuses for them because they are a socialist utopia.
Whoa,whoa, lets not get carried away now. Sure, our dear Lords do provide us with subsidized Tim Horton's coffee "drink" and provide us with "health care", but they also force us to watch pugilistic hockey matches, won't let us purchase assault rifles all willy-nilly and force us to watch Celine Dion and Justin Bieber specials on CBC. I would hardly call it a utopia.
Some governments think this kind of security is a bad thing, and and wrote in a clause of the Trans-Pacific Partnership treaty to prohibit it.
See also http://www.canadianunderwriter...
davecb@spamcop.net
This is the GOVERNMENT's data. For that reason, for you who's attention span is 15 minutes, a year or two ago, the UK government decided against the cloud, because they could not be assured that UK government data would remain on UK government soil.
You disagree? Really? So it's ok if all of the personal and economic data, including your tax returns, winds up in a data center in China, or Russia, or, for those outside the US, in the US? And you're going to tell me that EVERY SINGLE PERSON who has login or physical access to *all* the servers and their storage has at least some minimal security clearance from your country?
Give me a break.
mark
They would have lost in court. had several legal defenses prepared, one being that it was statistically possible to identify individuals in randomized data by making repeated queries and varying the area covered
Clearly you've never actually worked with the census data. As part of one of my university courses, I queried the data set for information related to national origin and religion for a particular neighbourhood. You can not define the area arbitrarily, it's broken up into minimum sized zones to prevent the kinds of attacks that you are talking about.
The folks at Stats Canada are smart. You, clearly, aren't as smart as you think you are.
...si hoc legere nimium eruditionis habes...
And others have access to the raw data after 7 years. You're not the only person in the world, you know (oops, apparently you didn't).
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Its often smaller sub sets of open or worked on data that gets pooled.
e.g. a cold call pretending to be a gov official with a limited list of personal information.
http://www.smh.com.au/business...
Domestic spying is now "Benign Information Gathering"
First I've heard of "sovereign control" which sounds like BS to me.
Anyway this issue has been around for a very long time now and isn't really all that complicated. I've looked into a number of cloud based systems as possible solutions for government projects, but they all run into the same problem.
Bottom line is that Canada has quite good Privacy Laws. The Government as custodian of a lot of personal information has a responsibility to ensure that that information is protected.
The issue first came about really as soon as the US passed the Patriot Act. It effectively gives the US government access to information stored on US soil (for a variety of reasons and methods), as it it subject to US law. So I guess you could call that "sovereign control"... but really all that means is that due to US law essentially not being compatible with Canadian law, it is required to keep things on Canadian soil.
There has been various attempts by US companies to get around this, such as providing technology and the means to host it yourself in your own cloud, but really that sort of defeats one of the big reasons for using cloud technology in the first place (i.e. you don't have to bother hosting it yourself or have to have the infrastructure to do it).
Anyway this issue has been around for a long time. The Feds probably just got around to adopting a "strategy" to guide consistent application of existing policy. I suspect probably because you had some rogue project managers using US based cloud services because it was easier and cheaper than going though the proper processes...
Should be the policy of all nations, countries, states and unions.
Stats Canada isn't allowed to ask CRA for any information. However if on your tax return you check the appropriate box then you give the CRA permission to share some basic information with Stats Canada. Government departments aren't allowed to share information between themselves. That's why there was a big deal made a few years ago when the government was trying to build a big database with all of our information from as many sources as available.