An article by Kathryn May of The Ottawa Citizen exposes the “Secure Channel” boondoggle. This is the same project that was mentioned in the 2003 Auditor Generals’ report (Chapter 1—Information Technology: Government On-Line, The Secure Channel project ), but this chapter was overshadowed by the problems in the sponsorship program.
One of the frustrating things is that this program requires that citizens give up security on their own computers in order to (only theoretically) grant the Government more security.
If you go to the “system requirements” of an example service you will find that only those people using specific browsers and are willing to download and run an undocumented Java application can use the service (That is Java, not Javascript!). This Java Application is considered proprietary knowledge, and is unavailable for an open and transparent security audit. We have to essentially blindly trust the sole-supply vendors to the Government of Canada that this software is not malware (spyware, etc), and will not infect our computers.
The document encourages people to click on “always” when their own system warns them about the possibility of installing insecure software and whether they should trust a new unknown digital signature. This new signature is from Entrust, not the Government of Canada. By clicking “always” you are essentialy blindly trusting the Entrust corporation in the future to run any software they wish on your computer, and your computer will no longer warn you about unknown software that happened to be signed by them. I have seen nothing from this company thus far that suggests they are trustworthy, and in fact tend to try to keep critical security details secret and unauditable.
You can see more bad security advise on the ePass technology FAQ page.
While bypassing security is necessary to get this software to work, it is very bad advise to encourage less technical average citizens to get into the habit of clicking “always” when they get this type of security warning. They may do so on other sites, incorrectly believing that what the government told them to do earlier was always safe.
I can find nothing in the documentation that indicates the settings for platforms other than Apple Macintosh or Microsoft Windows. For those of us that want the transparency and accountability of Free/Libre and Open Source Software, it may simply not work.
What is the government’s advise to those in this increasingly common situation?
“If your system configuration and settings are not compatible or you choose not to upgrade or change them at this time, you can still use Government services by phone, fax, mail, or in person.”
Obviously I’m never going to choose to change my system configuration to run Microsoft or Apple software, no matter how much unpaid advertisement for these platforms that the Canadian government wants to offer. There will be more peple in the future moving to diverse platforms (Will this work on Google’s Android smartphone? Why not?), so authoring software only compatible with the top two legacy desktop platforms is a very dumb idea.
We saw related problems with ePass during the recent census, when anyone not using specific Microsoft or Apple controlled computers were excluded from the online census. Any attempt to get any documentation on SEAL (“Session Encryption with Automated Login”, a critical part of that system) was met with refusals from the government. Public commentary on the lack of computability with Linux caused a patch to fix that narrow problem, but I’ve not heard anyone tell us that any of the documentation of any of this allegedly “secure” system has ever been released for public peer review.
Any “security” scheme that requires that private citizens run unaccountable software on their computers is by any reasonable definition not a secure system. It may protect the security of the Government (and even that is debatable, given the non-transparency and unaccountability of the policy implemented in the software), but it does so by circumventing the security policy of the citizens interacting with the system.
I have been recommending for years that this project should just be shut down and restarted with a requirements specification that meets the needs of both the government departments that will be hosting services, as well as outside technology specialists representing the interests of the general public. This wasn’t done for “Secure Channel”, and I don’t believe pumping more money into this boondoggle before requirements and criteria for success is documented is anything but a government handout to the proprietary vendors (including Bell and Entrust) who hold this contract and exclusive rights on the software.
—
Russell McOrmond is a self employed consultant, policy coordinator for CLUE: Canada’s Association for Free/Libre and Open Source Software, co-coordinator for Getting Open Source Logic INto Governments (GOSLING), and host for Digital Copyright Canada.