See Something, Say Something? The State of Coordinated Vulnerability Disclosure in Canada’s Federal Government

Back to the list of Speakers and Sessions

Countries around the world like the US, the UK and the Netherlands have all adopted coordinated vulnerability disclosure (CVD) frameworks to better secure government computer systems. CVD is an approach to vulnerability disclosure that provides good faith external security researchers a procedure for disclosing security flaws. However, the topic has largely remained understudied and underutilized in the Canadian context, leaving federal government institutions potentially more vulnerable in the face of internal and external threat actors. This talk identifies best practices and the policy frameworks needed to harness the efforts of security researchers who find and disclose security flaws in Canada’s federal government software, web applications, and potentially hardware, vehicles and critical infrastructures before adversaries do.

Our research confirms that Canada is falling behind when it comes to the use of transparent and clear CVD frameworks in comparison to jurisdictions across the globe. Numerous federal laws, including criminal and copyright legislation, may also have a chilling effect on security research in Canada, with deficient whistleblowing protection laws that could otherwise protect people who disclose security vulnerabilities. Our work identifies the need for increased transparency and explicit regulation in Canada’s current approach to vulnerability disclosure at the federal level.


Florian Martin-Bariteau University Research Chair in Technology and Society, University of Ottawa

Stephanie Tran Policy and Research Assistant, Ryerson Leadership Lab

Stephanie is a Policy and Research Assistant at the Cybersecure Policy Exchange and Ryerson Leadership Lab. She is an experienced researcher with over five years of experience analyzing public policy and human rights issues related to digital technologies, with past experience working for the Citizen Lab, Amnesty International Canada, the United Nations Office for the Coordination of Humanitarian Affairs (UN OCHA) and more. She is a trained computer programmer, having earned a Diploma in Computer Programming from Seneca College. She also holds a dual degree Master of Public Policy (Digital, New Technology and Public Affairs Policy stream) from Sciences Po in Paris, and a Master of Global Affairs from the University of Toronto. She earned her BA degree from the University of Toronto specializing in Peace, Conflict and Justice.

Yuan Stevens Policy Lead on Technology, Cybersecurity and Democracy; Research Affiliate, Ryerson Leadership Lab and Cybersecure Policy Exchange at Ryerson University; Data & Society Research Institute

Yuan (rhymes with Suzanne) Stevens works at the intersections of law, policy, and technology with a focus on privacy and cybersecurity. She holds the position of Policy Lead on Technology, Cybersecurity and Democracy at the action-oriented think tank Ryerson Leadership Lab at Ryerson University. Her work equips society with the ability to understand and patch up harmful vulnerabilities in sociotechnical and legal systems. Based in Montréal, she is a research fellow at McGill University’s Centre for Media, Technology & Democracy and research affiliate at Data & Society Research Institute. She received her BCL/JD from McGill University in 2017. She serves on the board of directors for Open Privacy Research Institute, Head & Hands in Montréal, and previously worked at the Berkman Klein Center for Internet & Society at Harvard University.