Canadian privacy experts are concerned the federal government’s plan to develop an online passport application process could put personal information at risk and open a new angle of attack for fraudsters.
IBM Canada has been awarded the $1.5-million contract to create software that would allow Canadians to apply for a passport using their smartphones, tablets or computers.
The new platform would also allow applicants to pay fees and upload their passport photos securely, according to a statement from Immigration, Refugees and Citizenship Canada (IRCC).
They will attempt to exploit the program very quickly, very intensely to obtain the most fraudulent passports they can in the least amount of time.- Benoît Dupont, l’Université de Montréal
But privacy and data protection experts worry that personal information may be stored on foreign servers, providing an appealing target to criminals.
Sébastien Gambs, a professor in the information technology department of l’Université de Québec à Montréal and Canada Research Chair on privacy and data protection, said there are real concerns about where the data will be stored, a detail neither the government nor IBM Canada has divulged, though the tender identifies Amazon Web Services (AWS), the cloud computing branch of the American online retail giant.
“Even when we do business with an American company that agrees to store data within Canada, under the [U.S.] CLOUD Act, data could eventually be transferred out of the country,” Gambs said in French.
In a statement, AWS said its clients retain full ownership and control of their data, including who may access that information.
In a separate statement, IRCC said “the privacy of Canadians and the safety of their personal information will be an absolute priority.”