OTTAWA–Democratic Institutions Minister Karina Gould says it’s not the time to implement basic privacy and security rules for political parties’ collection of Canadians’ personal data, despite warning that those parties are vulnerable to cyber attacks.

Speaking with the Star on Friday, Gould said she decided on a voluntary approach for parties to meet and discuss vulnerabilities with the Communications Security Establishment, Canada’s electronic spying and cyber defence agency.

“I think it’s important that we respect the independence of political parties, and we ensure that they are able to make those decisions (around cyber security),” Gould said in an interview.

“I know that political parties do take this issue seriously, and will be working to ensure that the data they have is protected, and they’re doing their utmost to ensure that their security practices are up to speed.”

There are virtually no rules governing how Canada’s political parties collect, store and use information about individual voters gleaned from door-to-door outreach efforts, e-mail campaigns and Elections Canada data.

The major political parties, including the governing Liberals, have developed sophisticated data and digital campaigns to help with voter identification and to decide where to focus their efforts and resources.

For years, the Conservatives were dominant in the data-driven campaign. In 2015, data operations was one of the key factors cited by Liberals in their surprise majority win.

But while Ottawa strictly regulates federal department and agencies’ use of Canadians’ personal information and has rules governing private companies’ collection of data, political parties are largely left to their own devices.

Any breach of party databases could result in significant privacy breaches for Canadian voters. For example, U.S. security firm UpGuard alleged Monday that a data company working for the Republican National Committee exposed “sensitive personal details” about 198 million American voters.

According to UpGuard, the information was stored in an unsecured database online. It included data such as names, phone numbers, home addresses, as well as information about ethnicity and religion “modeled” by the contracting company.

On Friday, Canada’s Communications Security Establishment identified political parties, politicians and media companies, as uniquely vulnerable targets for cyber attacks and potential foreign meddling.

“Political parties and politicians use smartphones, devices and computers to handle and store personal and political information,” reads a report prepared by CSE, in anticipation of cyber attacks in the 2019 election.

“This can include databases with detailed personal information about millions of Canadians, both registered voters and political donors . . . . Personal and political information is valuable, enticing adversaries to use cyber espionage to gain access.”

CSE has made its security experts available for a voluntary meeting with all registered political parties in Ottawa on Tuesday and has committed to providing continuing advice to parties with seats in the House of Commons.

But CSE cannot directly assist in parties’ cyber defence operations, only advise them. And it’s up to parties to take that advice or ignore it and to make decisions on how many resources they will commit to cyber defence.

The three major parties have said they take protecting their systems and databases seriously. But there is no oversight to vindicate those claims.

Loading... Loading... Loading... Loading... Loading... Loading...

When asked if Canadians will just have to trust parties to protect voter data, Gould replied that “democracy is based on trust.”

“With regards to the government, it’s important that we have a trusted relationship with political parties and it’s not a priority of the government to go in and tell political parties what to do,” Gould said.

“However, what I do think is particularly important about (the CSE report), is about Canadians knowing what these threats are.

“Because ultimately what these threats are trying to do is undermine the integrity and the trust that Canadians have in the (democratic) system and the process.”