Murphy's Logic: More protection needed for personal information

CTV News

2 days ago

Digital technology has changed our lives in so many ways; notably the amount of personal and private information we have and the way we share it. Where once we had only addresses, a phone number, a few bank accounts and a social insurance number attached to our names, we now have several, if not dozens, of online accounts, usernames and passwords, including those used to manage our confidential financial dealings with government, banks and utilities. We're exhorted to protect this information by choosing complex passwords, each one different for every account – and changing them often. But many of us don't do it because mere mortals can't keep it all straight. Small time crooks and fraudsters know this and have used their considerable, if misguided talents, to rip us off.
Now this criminal conduct has been corporatized, resulting in large-scale data breaches like the recent hacking of Nova Scotia Power's customer database. Information is stolen with a threat to post it on the dark web – where even more criminals can harvest our secrets – unless a ransom is paid. We have no way of knowing how often this happens, how often ransoms are paid.
The cyber crooks are now so good at what they do, so sneaky, that in a letter to its customers, NSP acknowledges it didn't even notice this massive data breach for five weeks.
There are two separate issues here: the hacking and the failure to notice it.
With their huge databases and ability to pay, corporations and governments are going to be targeted by crooks demanding ransom. They have to do a better job protecting their data – our data – and monitoring for security breaches. It's unacceptable and frankly baffling that Nova Scotia Power didn't notice this breach for more than a month. That reveals a serious shortcoming in their own security. The company must accept responsibility, including financial liability for fraud committed on its customers while it was asleep at the switch. No pun intended. And this cost should not be downloaded to its customers, whose data was stolen. It's also time for government to pass laws limiting the amount of personal information that can be demanded and collected by third parties and stored in databases. Let's mandate the use of facial recognition and fingerprints and two factor authentication, so that we can keep our personal information and our money to ourselves.