• Addressed to: Commission d’accès à l’information du Québec (Quebec’s access to information commission) and of Canada
• By: Hackfest Communication and its participants:
  • Sam Harper
  • Coralie Grozner
  • Eric Hogue

Quebec is on its way to becoming a champion of security breaches. Many companies and organizations, such as Promutuel, the STM, the Ordre des Ingénieurs du Québec, HelpOX and many others, are falling victim to criminal groups using ransomware and other computer tools that allow them to steal data and extort their victims. Most of these breaches are not disclosed to the public, and a large number of these victims pay the ransoms. It is a lucrative market and, without a concerted response, it will only keep growing.

The Hackfest community is made up of people interested in cybersecurity. They are individuals who want to share their knowledge in the fields of information technology and cybersecurity. What we have in common is an awareness of the risks we are all exposed to when personal information is leaked. We care deeply about respecting confidentiality and security, and about putting appropriate measures in place to preserve them. We are speaking out because we believe this goal can be achieved through collaboration and greater transparency.

Disclosure obligation

Bill 64 is a step in the right direction. It will set out the obligation to disclose when a company is the victim of a security breach. We welcome the requirement to put clear privacy policies in place and the fact that the operator of a business is made responsible for protecting the personal information it holds.

Unfortunately, it seems to us that it leaves a lot of leeway to companies that want to avoid the obligation to disclose a “confidentiality incident.” The bill stipulates that a company is required to notify the Commission and the affected person only if the incident causes “serious injury.” We are currently seeing breaches, and their severity, being trivialized. We believe the balance should tip the other way, and that every “confidentiality incident” should be reported unless doing so would cause “serious injury.”

Knowledge sharing as a means of defence

It is rare for a company to disclose the technical information surrounding security breaches. Yet the community would benefit from a more open sharing of this information. While taking into account the need not to disclose sensitive or harmful information, a technical report should be required. What means did the criminals use? What software or organizational vulnerabilities were exploited? What types of data were stolen? How was the breach discovered?

Bill 64 provides for an obligation to take “reasonable” measures to ensure the security of personal information. These measures come at a cost. It would be interesting to know what percentage of their budget organizations and companies devote to cybersecurity. This information would allow customers to make an informed choice by choosing the companies that truly care about the security of their data.

Discouraging ransom payments

Ransomware is a lucrative business. As long as we pay, we will continue to be the victims of these attacks. Moreover, it is misguided to rely on criminal groups’ promises to destroy stolen data. A victim who pays once is a prime target for a second attack.

Deterrent administrative and monetary penalties

We are pleased to see monetary penalties introduced in Bill 64. Unfortunately, as long as the cost of inaction remains lower than the cost of an effective cybersecurity program, some will prioritize inaction. Penalties must be deterrent and large enough to encourage companies that do not take the threat seriously to invest adequately in cybersecurity.

We are aware that not all companies have the same means. However, keeping personal data is a choice that comes with responsibility. These penalties should therefore be paired with the possibility for SMEs to benefit from consulting services suited to their means.

Security breaches and data leaks are part of the new reality. The consequences for affected companies and their customers are serious. It is therefore essential to take this threat seriously and put the necessary measures in place to stem this scourge.