Canadians not terribly savvy about digital privacy, poll finds

We all delete our internet browser history from time to time, and most of us have, at some point, removed something we've posted online.

But encryption? Virtual private networks? Not so much.

A poll conducted by CBC News and the Toronto Star this month found that hardly anyone in Canada said they use more advanced personal security tools.

This means that when it comes to digital security and privacy, Canadians really aren't too savvy.

"There are so many unauthorized uses of people's data and data breaches and hacking — it's just grown exponentially," said Ann Cavoukian, the former Ontario privacy commissioner and now the executive director of the Privacy and Big Data Institute at Ryerson University.

"Ordinary, law-abiding citizens" should be in control of their own information, said Cavoukian.

• 'I don't know that we can help you': RCMP boss 'consumed' with 'inability' to investigate in digital world
• Snapchat, Skype, BBM not protecting users' privacy, says Amnesty International
• Tape over your laptop camera? Why it might not be as paranoid as it seems

The poll discovered that 81 per cent of Canadians have cleared cookies — that is, data about you that websites and browsers can store — and erased their internet browser history.

But only 15 per cent have used encryption, which is considered one of the safest way to share digital data. It scrambles a user's data to block any person, internet service provider or agency from snooping on you.

The poll also found that only 17 per cent have used services that allow them to hide their online identity, which could include virtual private networks (VPNs), which can disguise a user's location.

Despite years of highly publicized data hacks, the fact that so few Canadians take these kinds of security measures is "troubling," said Cavoukian.

• Hackers used 'internet of things' devices to cause Friday's massive DDoS cyberattack

"There are times when you have to be distrustful online," said Cavoukian.

Some encryption baked in

Many programs, such as Gmail and iMessage, have encryption baked into their functionality, so the user doesn't have to worry about it. But many others, such as Snapchat and Blackberry's BBM messaging service, do not offer it as a default. 

In a recent report, Amnesty International said this lack of security can have serious human rights repercussions because it leaves users vulnerable to spying from government agencies and cybercriminals.

If encryption is considered to be a basic level of online protection, why do so many Canadians fail to use it?

In short, it's often a pain to use, said Molly Sauter, a PhD candidate at McGill University and the author of The Coming Swarm: DDoS Actions, Hacktivism, and Civil Disobedience on the Internet.

Encryption often not user-friendly

Certain kinds of encryption, like PGP for email (which stands for Pretty Good Privacy), or a slightly more user-friendly version known as GPG (the less amusingly named GNU Privacy Guard), take the average person a lot of time and effort to set up.

"I hate using it and I'm a security person," said Sauter.

Ideally, said Sauter, companies will start taking user security and privacy more seriously by guaranteeing encryption.

On top of tools like PGP or GPG, Sauter recommends using Signal, a free mobile application made by the non-profit security company Open Whisper Systems that encrypts texts and phone calls.

"Yesterday I spent some time getting my whole family on Signal," said Sauter.

[The Tor Network] will keep governments from watching you online — and it also keeps companies from collecting information about your web browsing.- Kate Krauss, spokesperson for the Tor Project

Kate Krauss, a spokesperson for the Tor Project, which advocates for online anonymity, also recommends Signal, as well as the Tor Network, for internet browsing.

Krauss says Tor can hide a user's online activity. It's frequently used by investigative reporters as well as activists who live in countries that restrict what the average citizen can access online.

• Canadian tech company Netsweeper helped Bahrain censor websites, says report

"This will keep governments from watching you online — and it also keeps companies from collecting information about your web browsing. That pair of shoes you decided not to buy on Amazon will stop following you around the internet if you use Tor," Krauss said.

Sauter agreed that it's a good tool, but said it's not the easiest to use, and it can be a bit overkill for the average web user. 

Awareness is key

Even if people don't want to go through the hassle of downloading a new app or figuring out PGP, Sauter said they should at least be more aware of the security risks of digital technology.

"I don't need the person who sells me coffee in the morning to know what PGP means, but I would like them to understand that there is a consumer report for this, and organizations like the ACLU [American Civil Liberties Union] and EFF [Electronic Frontier Foundation] can make recommendations based on expert knowledge."

Sauter said people should treat a new digital device or application in the same way they treat buying a new refrigerator or car — by doing a bit of research first.

Men more likely to protect privacy

The poll also highlighted some differences between how men and women behave online.

Men, who reported being less likely to trust agencies like the RCMP, police forces and the justice system, were more likely than women to take steps to protect their privacy online.

"If you are more trusting, then you wouldn't feel the need to take these additional measures to protect your online identity," said Cavoukian.

She said it's important to let that "filter of privacy" go through your mind whenever you're using digital communications.

"I used to tell my staff, if what you put in an email, if you're not comfortable with it appearing on the front page of the Globe and Mail, don't do it," said Cavoukian. "That's what always guides me because the most innocent communication in the wrong hands can take on a completely different flavour."