CBSA moving data to Amazon cloud amid security concerns

The Canada Border Services Agency (CBSA) is seeking assistance in moving certain data on Amazon.com Inc.’s cloud services, just as the e-commerce giant comes under scrutiny after a hack of its servers leaked millions of personal data records at an American bank. Late last month, the CBSA put out a notice saying it requires expertise to migrate a chunk of its data to Amazon cloud services. The border agency said it is seeking to move to the cloud its Protect B applications -- which the government defines as information that, if compromised, “could cause serious injury to an individual, organization or government.” The deadline for response to the notice was last week. The supplier notice came late last month, around the same time as reports that one of the United States’ largest banks was hit with a massive breach of personal information. A former employee of Amazon’s cloud services exploited a cloud vulnerability to steal the data of some 106 million Capital One credit cards records. A U.S. senator has since sent a letter to Amazon requesting information about the hack, according to the Wall Street Journal. The newspaper reports that Amazon said its cloud products weren’t the cause of the breach. The hack puts the question of hosting such sensitive government data on commercial cloud services into sharp focus, and comes just months after Amazon and Facebook Inc. acknowledged that millions of social media users’ data were exposed to the public via Amazon’s cloud servers in April. Cybersecurity company UpGuard, which tracks these types of vulnerabilities, said the situation highlights the “inherent problem with mass information collection.” Amazon Canada did not respond in time to a request for comment. According to a report in the Toronto Star, the federal government said there were over 200 significant privacy breaches affecting the personal information of thousands of Canadians and Canadian businesses in 2017. “From a security perspective, no server, whether government or private sector, is guaranteed to never be breached, and there is a reasonable argument to be made that the commercial service has the capacity and motivation, given their business model, to enforce robust security,” Brenda McPhail, director of privacy, technology and surveillance project at the Canadian Civil Liberties Association, said in an email. McPhail, however, notes that Amazon Web Services has many products under its umbrella, including facial recognition technology known as Rekognition, which has been marketed to police and security agencies in the United States. While not suggesting that the CBSA will use that type of technology, she said the border agency should “be open about the reasons Amazon is their vendor and which of the many services provided under the AWS umbrella that they are contemplating using to collect, store, or analyse Canadians’ data.” The CBSA did not respond in time to questions about why they chose Amazon, what technology they hope to use, what concerns were raised about Amazon, and whether they consulted with the office of the privacy commissioner about uploading data to the private cloud. In an emailed statement, OPC spokesman Vito Pilieci said the CBSA has not consulted with their office about hosting data on Amazon cloud services, but Pilieci said the privacy watchdog has advised other institutions to observe the policy guidance released by the Treasury Board of Canada Secretariat -- which works with Shared Services Canada to divvy funds for these projects -- when dealing with personal information in the cloud. Since new data breach reporting rules came into effect in November 2018, the OPC said in June that privacy breach reports increased five-fold. The CBSA’s contract looks to improve security and notes in the services tender that services should offer “robust security features and internationally recognized certifications that would be a challenge for the CBSA to deliver on its own.” It also hopes to improve service performance by “dramatically” reducing time to “meet business and technical requirements,” get access to better technologies like analytics tools, and to be able to rapidly access resources to carry out projects to completion. “Cloud computing, utilizing AWS cloud services, will provide an efficient and effective way to access servers, storage, databases and a broad set of application services over the Internet,” the CBSA award notice said. Ultimately, McPhail said the CBSA and the government must ensure that sufficient information about how they are keeping data secure and safe is being made public. McPhail’s colleague Cara Zwibel added in an email that one concern is that the government has previously said these foreign tech firms need to be better regulated, so “how willing will the government be to regulate corporations on whom they rely heavily for key services?” The CBSA’s request for proposals is part of the federal government’s years-old cloud-first initiative, which will see it move a trove of data from on-premise data centres to the internet. The exception is with more sensitive data, such as classified and top secret information. The government has come under criticism from tech companies for not adopting the cloud for that kind of information, this publication reported. The government issued a direction for the secure use of commercial cloud services in November 2017, which is only allowed for data up to the Protected B level -- below classified, confidential secret and topic secret on the security rung. Since late 2017, Shared Services awarded eight cloud service providers -- including Microsoft Corp., Alphabet Inc., IBM Corp., and Amazon -- with contracts to host unclassified government data. The cloud-first policy seeks to address three major concerns: ageing information technology infrastructure, security gaps and a lack of keeping up with emerging technology. The United States government, by contrast, is already on its way to having top secret military intelligence hosting on a commercial cloud provider. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

CBSA moving data to Amazon cloud amid security concerns

News | 08/13/2019 6:52 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

MP plans legislation to protect workers from ‘bossware’

News | 03/07/2023 1:32 pm EST

On privacy, Telus exec criticizes media; says Canada should avoid ‘overly-prescriptive’ laws

News | 11/23/2022 6:30 pm EST

Regulating TSPs, not suppliers, in cybersecurity bill will be ineffective: Telus exec

News | 11/22/2022 3:55 pm EST

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us