Thanks, Ira.
My name is Matt Anthony. I'm the vice-president of security remediation services. I've been working in information security for over 20 years. I'm honoured to be here today to address the committee. I'll keep my remarks focused on two main areas.
Firstly, I'd like to address the issue of e-government, specifically the pace and volume of change. There have been great successes. Ira has already mentioned tax filing. You can do anything from tax filing to pet registrations at all levels of government. I think we're seeing real advantages from some of those, but I also see that fear of missing out and reputation enhancement are drivers for a lot of the initiatives that influence the adoption of and adaptation to electronic government services.
Mark Zuckerberg, the founder of Facebook, is famous for saying, “Move fast and break things”. While that was taken on as a mantra for global developers in all areas of business and the private sector, I don't think the Government of Canada should or could have that same kind of capability to move fast and break things. Herjavec Group's cyber-incident response teams have see the direct impact of moving fast and breaking things. We come back and sweep some of that up. Breaches are large, costly and very damaging.
Adding to that, there is a global skills shortage in the core capabilities needed to securely govern, develop, test, deploy and maintain complex software systems. Current published figures show that there'll be about three and a half million cybersecurity job openings by 2021—that's worldwide, obviously. The global digital transformation is in direct tension with that. There are more projects, more services and more data being created, stored, managed and mined. Canada and Canadian governments will feel this tension very directly.
The committee has heard a great deal about three case studies. Ira mentioned this already, and I've heard some talk in the corridors about a couple of them. They are Sidewalk Toronto, Estonia and Australia.
I want to address the Estonian example briefly, because it's been held up as a high-water mark for digital transformation, but Estonia has had a few major advantages in doing this that Canada doesn't enjoy. They have a very small population, a very small geography, a relatively green field in the post-Soviet era for technology and a relatively homogenous population accustomed to central control.
When I talk about those things, I think you can reflect on Canada not having many of those advantages in trying to do these kinds of services. The model would look very different for Canada.
While that transformation appears successful, we also don't know a whole lot about the security and privacy concerns. The political and cultural aspects of what would be expected, including how much we might learn about security and privacy aspects, might not be evident for years, or even longer than that. I caution against using Estonia as a North Star for our transformations in Canada.
You can't stand still, obviously, and we have to move forward, but my hope is that we go slowly enough to be assured that the changes we do are fully governed and secured to the appropriate level. Go carefully according to strong principles. Wait for the necessary technology, such as AI and automation controls, to support us better. Don't allow fear of missing out in international comparisons to cause us to hurry ahead of our abilities and capabilities.
Secondly, I'd like to briefly address information-sharing. I want to commend the data strategy road map, in that there are six most important things laid out in that document. I can't do much more than say that they are precise and correct. I would like to amplify them.
The concepts are simple: develop a strategy; provide clarity on data stewardship; develop standards and guidelines for governance; improve recruitment to gather the needed skills; and, develop technology systems that support the strategy. Those are all easy to say, but enormously difficult to do, individually and severally.
In 1984, Stewart Brand presciently wrote, “Information wants to be free.” At the time, he was talking about how the technology costs were going lower and lower, but now it has become synonymous with the difficult problem of keeping access control. Once information is beyond the source's control, it will tend to get distributed widely. It follows, then, that secondary and tertiary uses of the government's data need to be as acutely and astutely controlled as primary use is.
The government faces a monumental task in understanding and managing legacy data and systems. Reconciling inconsistent or undocumented consents for use, information silos, usage rules, data structures, identity platforms and administrative processes will each also be monumental in scale.
I believe that taking a greenfield approach may be advantageous, that is, by establishing rules clearly for new data collection and allowing legacy data to be integrated in the future, as capabilities such as AI and other data collection and tagging can be paired with lower costs for transformation through automation. Don't rush to data lake models, as unexpected de-anonymization and information correlations will emerge—I've seen them—some of which may be contrary to public policy, law or intent.
There are a lot of assertions being made that opportunities will emerge and efficiencies will be achieved by aggressively mining, aggregating and sharing data. I urge the committee to show evidence for that. It's easy to get caught up in the rush to take that approach.
You cannot stand still, but I advise, indeed urge, the committee and industry to slow down, be more careful and do not allow ambition to overshadow capability. Go slowly enough to fully understand, measure and manage information risks. Remember, criminals like data, and breaches are messy, complicated and very expensive.
Thank you.