• wampus@lemmy.ca
    link
    fedilink
    English
    arrow-up
    11
    ·
    19 days ago

    Canada needs infrastructure first. Then they need to update privacy legislation to say ‘sovereignty’ instead of ‘residency’.

    The govt already released a white paper last year that effectively said “If you don’t control your tech stack, including the machines its running on and where those machines are, as well as the applications and development of those applications, you’re exposed to data sovereignty risks”.

    The problem Canada faces though, is that it became so dependent on US tech that it didn’t even bother building any infrastructure – even our government agencies are running in Microsoft’s cloud, with heavy integrations with US servers/services. Like here’s a fun example: Canada’s Credit Unions generally used a company called Central1 to host their online banking previously, and Central1’s involved in things like cheque payments, AFTs, etc. Go back ~15-20 years, Central1 had internal data centers in both Vancouver and Toronto, so they could have a peering/load balancing setup with DR conditions all within Canada.

    The regulators, starting with Carolyn Rogers, basically forced C1 to hire US bankers to run the shop. Those US banker sorts decided to outsource all of Central1’s IT stuff to cloud hyper-scalers. When their CTO at the time was questioned as to why he’d given up the geographically separate/resilient and sovereign setup, the guy responded by saying something like “We went with company X for cloud, instead of company Y for cloud, because X was cheaper!”… completely ignoring the question. Those same bankers then proceeded to SERIOUSLY fuck up the online banking that the system had, an online banking setup that had previously won awards etc. They fucked it up so bad, that Central1 ended up ‘selling’ that whole pillar of their services (basically 1/3 of the services they provide to the industry)… to a fairly untested India-based multinational, that has most of its developers in the UAE. Central1’s boss got a “Business in Vancouver” award, as a result of failing so miserably… cause the business community is just that much of a stupid circle jerk. Even without their online banking component, all their services still run through US cloud service providers – so like, you use cheques with local businesses/a small community Credit Union? Yeah, that’s exposed/reliant on US cloud providers.

    Even those Regulators who contributed to this cluster fuck, put all their shit into Microsoft’s cloud sometime around 2010-2015ish. Our own government is requiring the personal information of any mortgage / loan holder in the country, get loaded into US cloud spaces. This trend isn’t slowing down/stopping either, with the recent ‘rupture’ and all the PR spin from the govt – the last open-bond credit union in BC with a back end that’s Canadian made/Canadian hosted is seemingly getting merged, so there are no financial industry options left in BC that even attempt to take data sovereignty seriously. And really, people don’t seem to care enough to move accounts/support those sorts of setups, they dont’ even care enough to ask about data sovereignty at their AGMs. Like if it was a market draw in that space, then the few businesses that took it more seriously wouldn’t be going extinct – they’d be moving forward with decoupling from US tech stacks, and gaining members/loans/deposits as a result. Like with the turn out to most of these sorts of AGMs, you’d prolly only need like 3-5 younger people to stand up and ask those sorts of questions, to have the whole thing shift – possibly even the regulators, as they attend AGMs and would be getting sent a message themselves, if they saw public demand for it. But there’s no real market demand for it.

    And that’s just the tip of the iceberg in terms of how captured one of Canada’s “Critical Infrastructure” industries is by US tech. Not only has it happened under the govts watchful eye, but the government encouraged/forced it to happen, and the government itself went down the same path.

    So basically, we dug our own graves. Or perhaps, our government/elected coop representatives dug our graves, and we encouraged them to do so. We voted them back in every time. We gave them awards for it. We gave them pay increases for selling us out. Sometimes it feels like the disdain the rich feel for regular people is warranted, given how easily manipulated, self-destructive and short-sighted we can be, but such is life.

    • twopi@lemmy.ca
      link
      fedilink
      English
      arrow-up
      2
      ·
      19 days ago

      Can you give a link to the government white paper? Would like to read it.

      • wampus@lemmy.ca
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        19 days ago

        Sure - here you go.

        I find the appendix the easiest part to parse. It basically lists their responses/mitigation attempts, and notes that they all basically fail to protect data sovereignty when stuff is foreign-centric. The encryption note doesn’t generally apply to live-service programs (eg. you “can” store fully encrypted cloud backups, so long as you control the keys – but not something like a portal for users to login/access regularly). They list masking, but also basically show it’s not realistic/practical, nor has it been attempted/tested in real world deployments. The rest are all “this mitigation doesn’t actually do anything for this issue”.