Identity theft

Amanda Cupido: This is The Forefront, a Toronto Metropolitan University podcast that explores ideas for cities. I’m Amanda Cupido. 

So here’s the problem: every day, we give away our personal data away to companies that aren’t keeping it safe. The number of data breaches worldwide increases every year. According to research from the VPN service SurfShark, there have been over 207 million data breaches in Canada since 2004. That makes us 10th in the world for total breach count. 

You may have heard about some of these cyberattacks in 2023. Like the Ontario hospitals that discovered that the data of over 270,000 patients had been sold on the dark web. Or the hackers that attacked 23andme and stole the ancestry data of nearly 7 million people. Or the breach at file transfer service MoveIt, which has led to the exposure of data from a whopping 84 million people, including some from major government organizations. 

This is just a fraction of millions and millions of people who’ve had their privacy violated and their information used for unknown purposes. Erin MacDonald knows the feeling.

Erin MacDonald: I got a notice on my online banking that there had been a change on my credit report. And from that moment on it was, what I often call, a tsunami, of credit card applications, bank loans, mortgage approvals. One luxury car in Mississauga.

Amanda Cupido: Erin is a TMU grad from the entrepreneurship and small business program. In 2018, she was one of countless Canadians who had their identity stolen in an online data breach. Somehow, someone got a hold of both sides of her driver’s licence. And they used it to sign up for credit cards. A lot of credit cards. Erin watched helplessly as transactions for hundreds of thousands of dollars flooded into her bank account.

Erin MacDonald: I would say for the first week I didn’t understand what was going on. It was really confusing. But once I reached out to the credit bureau and got a better sense of what was happening, then I just kind of went into business mode where it was just doing everything I could to try to stay on top of it.

Amanda Cupido: “Staying on top of it” meant that Erin had to call each and every establishment where her information had been used and convince them that it wasn’t actually her. She says it was the most stressful experience of her life. And it took up a huge amount of time.

Erin MacDonald: For months, literally, I just didn’t even want to answer the phone because you’re expecting it to be another bank loan that you’re having to kind of now clear up and deal with or I mean, the car, the luxury car, that was huge. Like, I couldn’t believe, I mean, I had good credit. And I wasn’t typically buying luxury cars. So in that sense, too, like it was easy for people to believe that it wasn’t what it was.

Amanda Cupido: Because of the volume of the attack, Erin was able to work with the Toronto Police to resolve the issue. They told her that after hackers acquire data from these attacks, they sell it on the dark web. Then, for about three months, that data is considered easy to use without getting caught. And then they move on to their next victim.

Erin MacDonald: So it’s this constant like flow of information and people being kind of attacked. And then for an individual like me who was a victim to that, then it’s another three months at least of cleaning it up off your credit rating and chasing companies. It takes a lot of advocating for yourself when this happens and really trying to stay on top of it because ultimately, it can really devastate you.

Amanda Cupido: At the time of the attack, Erin was in the process of buying a new home. The negative impact on her credit meant that she had to put her plans on hold. But still, she knew she was lucky. She’s tech savvy, has access to the internet, speaks English as a first language, and understands the Canadian credit system well. 

Erin MacDonald: At this point, like whatever we can do to defend the front line of our privacy and our information, I think will benefit us all, especially for those people who aren’t in a position to understand the ramifications of these kinds of issues. I think that the general public are fairly naive in terms of the sheer magnitude of what is happening when it comes to cybersecurity fraud or just criminal activity. And it really will only become clear to somebody when it happens to them. 

Amanda Cupido: The more information we put online, the more hackers will be out there trying to use it for their own gain. And those hackers are only getting more sophisticated. So we have to get more sophisticated in how we protect our data.

Javaid Zahid: The current situation is that you register your cell phone to any service, like you go to Facebook and register yourself. You go to the bank, you register yourself, and your registration is based on your user ID and password. And then they give you the form. You fill that form and you provide information which they ask. That means that information goes to them. It is under their control. 

Amanda Cupido: That’s Javaid Zahid. He’s a PhD candidate at Toronto Metropolitan University. Right now, he’s working with the Computational Public Safety Lab on how quantum computing can be used for better cybersecurity. Quantum computing is really complicated, but here are the basics. Most of the computers we use these days, like your laptop or your smartphone, they use classical computing. Classical computing relies on bits, units of information that store either a zero or a one. Each bit has two possible states: on or off, up or down. In quantum computing, information is stored in qubits. Qubits can store a zero and a one at the same time. 

Javaid Zahid: So the amount of information which we can process at the same time is much more than the classical computers. 

Amanda Cupido: Javaid is working on developing a quantum wallet. The idea is that if we store our information using quantum technology, hackers will have a much more difficult time accessing it. 

Javaid Zahid: Quantum wallet is a container in which you place your information. Any kind of information. Your credentials, and credentials are like your name, your Social Security number, your photo I.D., your passport. It can be anything.

Amanda Cupido: You might be thinking that this sounds like your Apple wallet or your Paypal account. For one thing, Javaid’s quantum wallet won’t be owned by a big tech company. But more importantly, it will be much more secure than any digital wallet that currently exists because the information will be stored in such a complex form. It’s about keeping your information truly secure, and staying one step ahead of the bad actors who might want to take it from you.

Amanda Cupido: Claudette McGowan is another PhD candidate in computer science at TMU. She’s also the CEO of Protexxa, the industry partner on the quantum wallet project. 

Claudette McGowan: I have this really great party trick. I ask people to pull out their phones and see all the different compromises and hacks and security recommendations, and people are shocked when they see like a 100 or 200 or 300. And this is stuff that’s on their phone.

Amanda Cupido: Claudette sees the potential of the quantum wallet to protect our information on many levels, starting with identity. 

Claudette McGowan: Maybe it’s where you reside. Maybe it’s your age, maybe it’s the colour of your eyes. How can I put this in a way to have that digital confidence around, you know, this is really the person I’m transacting with.

Amanda Cupido: Another aspect is authentication—how strong is your password, and who has access to it? 

Claudette McGowan: So how many people do you know, you know, your four or six digit code to get into your phone. That’s not a great thing to do. Wi-Fi is a big one. People come over, they’re like, “Hey, how are you doing, Emily? What's the Wi-Fi code?” And then you give it to them. When do you ever take away that permission? So people will see they’ve got all these folks that have access to their Wi-Fi. 

Amanda Cupido: On top of protecting your identity details and passwords, the quantum wallet will also give you the power to give or take away access to the information it holds. So you might give your Wi-Fi password to a friend, but take away their access after they go home. That way, if their phone gets hacked, you aren’t vulnerable. That’s called authorization. Accounting for these three aspects—identity, authentication, and authorization—is part of what Claudette calls a “cybersecurity mindset.”

Claudette McGowan: It’s almost like thinking about a safety first mindset. So, you know, I’m going to cross the street. Am I just going to barrel across because my goal is to get to the other side? No, I’m probably going to pause. I’m going to look both ways. I’m going to make sure that, you know, I’ve ascertained that things are going to keep me alive to get to that other side and help me to meet that goal. It’s the same thing for cybersecurity, how do you protect yourself online? How do you make sure that you know the things that you want to keep close and near and dear are protected. So that mindset of, you know, I’m not going to think about it after, I’m going to think about it before I do things and make sure that, you know, I’m not only thinking about being connected, but being protected in all that I do.

Amanda Cupido: From Claudette’s perspective, we live in a world where cyberattacks are inevitable. So we should be using everything at our disposal to keep our information safe.

Claudette McGowan: We know that there’s going to be all these attacks that are based on the encryption as we know it today. So how do we make sure that we build a system, a tool, so that this new encryption method makes us more resistant to these types of attacks?

Amanda Cupido: For Claudette, what it all comes down to is peace of mind. 

Claudette McGowan: What would it mean to go to a world where people felt more digitally confident? And we believe having something that protects your identity, protects the ways to authenticate, that will give you that digital confidence. So you can be online and just be doing the thing that you’re working on, and not be working and worried at the same time.

Amanda Cupido: It’s all about putting the power of cybersecurity back in the hands of the people whose information is at risk.

Claudette McGowan: What makes me passionate is that I think this is a winnable war. I think with information, with access and opportunity and training and the right controls in place, we can turn this around. But if we don’t do anything, I can guarantee you it’s not going to get better for the small mom and pop or the massive corporation that’s not brilliant at the basics when it comes to cyber health and hygiene.

Amanda Cupido: Before we go, here’s one more thought from Claudette on why she chose TMU for her PhD.

Claudette McGowan: I’ve had the privilege of meeting some of the people in leadership roles and I just think it’s wonderful to see people who are forward thinking, and want to change the status quo, because I think we could be complacent about how things are. Or we could be, you know, a little bit more disruptive. They talk about “good trouble”. Sometimes good trouble is not a bad thing. And I like to see that the leaders there are pushing the envelope sometimes and not doing what’s easy, but doing what I believe is right.  

Amanda Cupido: This podcast was created for alumni and friends by University Advancement at Toronto Metropolitan University. Special thanks to our guests on today’s episode: Erin MacDonald, Javaid Zahid, and Claudette McGowan. This podcast was produced by me, Amanda Cupido, and Emily Morantz. Michael Allen is the editor for the show—and we’re all proud grads of TMU! The support team from the university includes Betty Quan, Haweya Fadal, Meredith Jordan, and Krishan Mehta. To learn more about the quantum wallet and the Computational Public Safety Lab, and for more episodes of this podcast and others, visit torontomu.ca/alumni/podcasts.