TRANSCRIPTION 🔗
WEBVTT
00:00:00.640 --> 00:00:04.080
Welcome to the Functional Government Podcast.
00:00:04.320 --> 00:00:11.359
According to the Pew Research Center, only 47% of Americans think their fellow citizens are morally good.
00:00:11.759 --> 00:00:13.919
Canadians, on the other hand, trust their neighbors.
00:00:14.080 --> 00:00:17.039
92% of us think other Canadians can be trusted.
00:00:17.280 --> 00:00:19.519
Our government gets no such love.
00:00:19.839 --> 00:00:25.280
Less than 50% of us trust the federal government, and only 17% trust politicians.
00:00:25.519 --> 00:00:26.480
And you know what?
00:00:26.800 --> 00:00:27.359
Fair.
00:00:27.519 --> 00:00:29.440
We have plenty of reasons not to.
00:00:29.760 --> 00:00:37.679
Phoenix turned paying civil servants into a$5 billion lottery where the prizes are underpaid, overpaid, and not paid at all.
00:00:37.920 --> 00:00:48.240
A 2020 credential breach that hit 48,000 people happened because nobody thought multi-factor authentication was worth a fraction of a dollar per account.
00:00:48.479 --> 00:01:06.159
And in My Native Quebec, a 2023 rollout of the Société de l'Assurance Automobile du Québec SACS online portal cost more than$1.1 billion, double its projection, with a judge recently ruling that top management knowingly lied to the government for years.
00:01:06.400 --> 00:01:14.000
So it's no surprise that when someone says digital identity, many Canadians think of the one ring.
00:01:15.359 --> 00:01:17.599
Digital identity is a hot potato.
00:01:17.840 --> 00:01:20.799
The Conservatives passed a resolution opposing it.
00:01:20.959 --> 00:01:25.280
They said it would increase surveillance, profiling, and centralized personal data.
00:01:25.519 --> 00:01:35.040
The Liberals went to Parliament and read directly from a script: the government of Canada is not implementing a federal or national digital identification credential.
00:01:35.519 --> 00:01:41.439
The BC Civil Liberties Association calls this kind of work the mother load of all databases.
00:01:41.599 --> 00:01:47.519
So everyone agrees, digital identity is dangerous, nobody's building it, and we can all go home.
00:01:48.640 --> 00:01:53.280
Except Estonia has a single login for government services.
00:01:53.519 --> 00:01:56.640
They save 2% of GDP every year.
00:01:56.879 --> 00:02:00.319
Citizens get five working days back annually.
00:02:00.560 --> 00:02:03.359
You update your address once and every department knows.
00:02:03.519 --> 00:02:07.120
And you get to see what your government knows about you, even more.
00:02:07.280 --> 00:02:18.159
You get to see when the government touches your file by law, a timestamp of who and why that's tamper-proof and available in real time.
00:02:19.120 --> 00:02:21.039
So Estonia is the exception, right?
00:02:21.199 --> 00:02:25.919
Well, Ukraine centralized its government interfaces to something called the DIA app.
00:02:26.400 --> 00:02:28.080
Zelensky campaigned on it.
00:02:28.240 --> 00:02:33.840
It started small with driver's licenses and car registration, and then gradually expanded features.
00:02:34.000 --> 00:02:37.919
And when Russia invaded, the country didn't shut it down, they expanded it.
00:02:38.080 --> 00:02:40.240
It became a tool of digital resilience.
00:02:40.400 --> 00:02:47.680
Within days, Ukraine added services for displaced people, property damage claims, and even reporting enemy movements.
00:02:48.159 --> 00:02:59.680
DIA has 20 million users, 130 services behind a single, secure, multi-factor login, and it even supports passport biometrics.
00:03:00.000 --> 00:03:02.319
And it was built during an act of war.
00:03:03.120 --> 00:03:06.719
Maybe the question isn't whether digital identity is dangerous.
00:03:06.879 --> 00:03:10.319
Maybe the question is what fragmentation is costing us.
00:03:11.199 --> 00:03:15.759
To properly understand this, you need to recognize that digital identity isn't one thing.
00:03:15.919 --> 00:03:18.479
There's authentication, which is proving who you are.
00:03:18.719 --> 00:03:21.840
Each government service has its own username and password.
00:03:21.919 --> 00:03:27.759
And in 2004, the federal government of Canada built a thing called GC Key to try and fix this.
00:03:28.000 --> 00:03:31.280
But the Canada Revenue Agency said, no thanks, we'll build our own.
00:03:31.439 --> 00:03:38.080
And then we added logging in with your bank, which was easier, but it's still weird to trust a private for-profit company with your government login.
00:03:38.479 --> 00:03:42.080
And then the government in 2019 announces Sign In Canada.
00:03:42.159 --> 00:03:50.400
It's now 2026 and the project has been renamed GC Sign In, and it's in pilot with a handful of departments, and the CRA still hasn't joined.
00:03:50.719 --> 00:03:56.879
Budget 2024 allocated$25.1 million to this problem over five years.
00:03:57.120 --> 00:04:03.039
Having so many logins in the current government platform means that hackers only have to find the weakest link.
00:04:03.199 --> 00:04:05.199
It's like having a house of 60 doors.
00:04:05.360 --> 00:04:07.039
You can't guard them all properly.
00:04:07.199 --> 00:04:12.080
In 2020, a credential stuffing attack compromised 48,000 Canadians.
00:04:12.319 --> 00:04:15.199
Social insurance numbers, banking details, tax returns.
00:04:15.360 --> 00:04:24.160
One victim had$40,000 in fraudulent CERB and unemployment insurance claims filed under their identity.
00:04:24.399 --> 00:04:26.480
The CRA sent that person a bill.
00:04:26.720 --> 00:04:36.639
$6,018.97 in taxes and interest on money criminals stole through a government security failure.
00:04:37.199 --> 00:04:40.639
Years later, he's still fighting to clear his name.
00:04:41.279 --> 00:04:44.160
The system hasn't failed us once, it just keeps failing.
00:04:45.040 --> 00:04:47.519
But authentication only proves who you are.
00:04:47.680 --> 00:04:49.120
It doesn't sign you into a service.
00:04:49.199
Load full transcript
--> 00:04:51.360
For that, you need something called single sign-on.
00:04:51.759 --> 00:04:56.800
If you read the fine print on GC Key, it says GC Key is not an account.
00:04:57.120 --> 00:04:59.279
It's just an authentication service.
00:05:00.240 --> 00:05:05.279
You may need to separately register for each individual program and service.
00:05:05.680 --> 00:05:10.000
It even says, do not bookmark pages after you have signed in.
00:05:10.639 --> 00:05:16.000
This makes government services really hard to navigate, and plenty of people profit from that complexity.
00:05:16.319 --> 00:05:20.240
Tax filing services that charge you to navigate CRA's labyrinth.
00:05:20.480 --> 00:05:24.800
Immigration consultants who charge you thousands because the process is deliberately opaque.
00:05:25.040 --> 00:05:28.720
Grant writers extracting money from impossible programs.
00:05:29.040 --> 00:05:35.600
These people aren't adding value, they're extracting rent from the friction that exists within our government services.
00:05:35.839 --> 00:05:38.720
In a well-designed system, your taxes would be automatic.
00:05:38.879 --> 00:05:40.800
The government already knows what you earned.
00:05:40.959 --> 00:05:44.959
You wouldn't need an expert to tell you which benefits you qualify, because the system would tell you.
00:05:45.199 --> 00:05:50.959
But we've built something so complicated that navigating it has become an industry.
00:05:51.199 --> 00:05:56.160
And it costs us billions of dollars and years of human life.
00:05:56.560 --> 00:06:00.319
Then there's the next problem single source of truth.
00:06:00.560 --> 00:06:08.079
Once you're authenticated, so I know who you are, and you're authorized, so I know what you can do, I need to clean things up.
00:06:08.319 --> 00:06:16.079
I need one authoritative record of something like your address, rather than dozens of outdated records scattered across departments.
00:06:16.800 --> 00:06:23.439
That's hard too, because in Canada we have a law preventing departments from sharing information with one another unless it's necessary.
00:06:23.680 --> 00:06:30.959
That law was written around the time we invented the internet, before we knew every citizen would have apps in their pockets.
00:06:31.199 --> 00:06:40.800
And this means that when you update your address of the CRA or Service Canada or Canada Post or your bank or any one of dozens of other services, nothing is in sync.
00:06:41.040 --> 00:06:44.079
In fact, you become the synchronization layer.
00:06:44.240 --> 00:06:47.600
We have over 200 portals with 60 separate logins.
00:06:47.920 --> 00:06:56.480
That means 60 separate security perimeters to guard and 60 separate copies of your personal information, each one out of date because you haven't updated it yet.
00:06:57.040 --> 00:07:02.160
And there's a final piece to this digital identity thing, which is ask me once.
00:07:02.560 --> 00:07:08.800
Ask me once is a policy in some countries that says the government may only ask you once for a piece of information.
00:07:09.040 --> 00:07:11.439
That only works if there's a single source of truth.
00:07:11.600 --> 00:07:14.000
It doesn't work if your address is in ten places.
00:07:14.160 --> 00:07:17.279
But what it does is force government apps to work better.
00:07:17.519 --> 00:07:34.079
When you have a baby, you register the birth of the province, you apply for a social insurance number, you update your taxes for the Child Canada benefit, apply for parental leave through EI, update your health card, and three other things you'll forget until a letter arrives demanding to know why you didn't.
00:07:34.560 --> 00:07:38.160
In Estonia, you register the birth once.
00:07:38.480 --> 00:07:39.759
Benefits arrive.
00:07:39.920 --> 00:07:41.759
It's called the once-only principle.
00:07:41.839 --> 00:07:42.639
It's law.
00:07:42.879 --> 00:07:45.920
The government cannot ask you for information it already has.
00:07:46.000 --> 00:07:47.519
You tell them once.
00:07:47.759 --> 00:07:51.600
Every department that needs it queries the authoritative source.
00:07:51.759 --> 00:07:57.120
No copies, no re-entering data, no separately update your address with each department.
00:07:57.360 --> 00:07:58.959
The UK does this too.
00:07:59.120 --> 00:08:10.000
When someone dies in England, the family notifies once, and 2.4 million updates flow automatically to partner organizations every year.
00:08:10.240 --> 00:08:16.879
Meanwhile, here in Canada, we spend weeks proving to seven departments that we had a baby while caring for that baby.
00:08:17.120 --> 00:08:21.279
Our government treats you like a stranger who might be lying about having a child.
00:08:21.759 --> 00:08:26.639
And then finally, there's access logging, the right to see who's looked at your data and why.
00:08:27.040 --> 00:08:32.000
Except in Canada, we can't have any of these things, and everyone will tell you it's for your privacy.
00:08:32.240 --> 00:08:35.840
Plenty of Canadians think their government is big brother, and they're not wrong.
00:08:36.000 --> 00:08:43.360
The government already knows enormous amount your income, your employment, immigration status, health claims, travel, benefits, debts.
00:08:43.679 --> 00:08:48.559
But you have almost no way to find out what the government knows about you.
00:08:49.039 --> 00:08:52.000
Try writing an access to information request.
00:08:52.159 --> 00:08:55.759
You need to know what you're looking for per department in writing.
00:08:56.000 --> 00:09:01.360
The legal timeline is 30 days to get you an answer, but the actual average is 83 days.
00:09:01.519 --> 00:09:09.759
In Ontario, it's 182 days, and adjudicators found 59% of cases involve wrongful withholding.
00:09:10.080 --> 00:09:14.399
The Globe and Mail called this a broken affront to democracy.
00:09:14.720 --> 00:09:22.399
The current system gives the government maximum access to your information, and it gives you nearly zero visibility into what it has.
00:09:22.639 --> 00:09:32.720
And yet somehow, thanks to a bunch of special interest groups, we've been convinced that chopping it all up protects our privacy when in fact it makes it easier for the government to hide it.
00:09:32.960 --> 00:09:36.879
In Estonia, when a government employee accesses your file, you see it.
00:09:37.120 --> 00:09:39.919
In real time, time stamped and tamper proof.
00:09:40.080 --> 00:09:44.000
That's not Big Brother watching you, that's you watching Big Brother.
00:09:44.240 --> 00:09:45.919
We built the opposite.
00:09:46.240 --> 00:09:50.879
Maximum data collection, minimum citizen visibility, and we called it freedom.
00:09:51.039 --> 00:09:55.600
Countries that implement these systems save 1 to 2% of their GDP.
00:09:55.919 --> 00:09:59.919
For Canada, that's$22 to$40 billion a year.
00:10:00.159 --> 00:10:04.879
Even at a quarter of that, we're talking more than the entire federal housing budget.
00:10:05.200 --> 00:10:10.559
I said at the outset that we trust each other more than other countries, but we don't trust our government.
00:10:10.799 --> 00:10:12.000
It's worse than that.
00:10:12.159 --> 00:10:22.240
The current system erodes the trust we have in each other by forcing us into adversarial relationships with institutions and polarizing us politically.
00:10:22.480 --> 00:10:39.600
The fix isn't a moonshot, it's a login button, a legal framework saying departments must share instead of hoarding, passing laws that make it illegal for the government to ask you for data it already has, and the political will to make the tax authority get on board.
00:10:40.720 --> 00:10:42.960
Political will is the hard part.
00:10:43.200 --> 00:10:47.679
Because the debate we're having, should we build digital identity is the wrong question.
00:10:47.919 --> 00:10:49.519
We already have digital identity.
00:10:49.600 --> 00:10:55.840
It's 60 broken systems, each with your data, none of them talking to each other, none of them letting you see what's inside.
00:10:56.080 --> 00:10:59.039
The real question is whether we want one that works.
00:10:59.200 --> 00:11:04.000
One that gives you visibility into what the government knows about you instead of keeping you blind.
00:11:04.240 --> 00:11:09.840
One that saves you the time and money of proving you exist to department after department, year after year.
00:11:10.080 --> 00:11:15.600
One that costs billions less, delivers billions more, and gives you back your life.
00:11:16.080 --> 00:11:20.080
Right now we're choosing 60 passwords and calling it freedom.
00:11:20.399 --> 00:11:24.000
Thanks for joining us on the Functional Government Podcast.