Security experts trusted by the federal government are warning that Conservative cabinet ministers should stop using iPads after new research found the popular devices are easily hacked.
The warning comes on the heels of a major cyber attack that targeted Canada’s financial information at Finance Canada and Treasury Board.
Officials at Cygnos – an Ottawa-based firm that federal departments hire regularly for security advice – said they felt compelled to contact The Globe and Mail in response to a report that a growing number of cabinet ministers and senior officials are using the tablets.
“Sensitive government information is going to leak out and become documented on something like WikiLeaks,” Salim Douba, the chief technical officer for Cygnos, said in an interview.
Cygnos completed a research project two weeks ago on behalf of a health organization that wanted to know whether the tablets could store client health records securely. The study concluded that hackers who get hold of an iPad can use widely available “jail breaking” techniques to bypass passwords. Mr. Douba said the tablets may also be vulnerable to remote hacking because the web browser does not have the same level of virus protection that would be found on most laptop or desktop computers – a point other security experts dispute.
“We did the research,” he said. “I’m afraid that if I was asked to give advice to one of those ministers, I would say: ‘Don’t.’ Because we know enough that we have asked lesser circles not to use them.”
The research was focused on the first-generation iPad, but Mr. Douba said it does not appear that Apple Inc. addressed the security issues with its second-generation iPad released this week. A spokesman for Treasury Board President Stockwell Day responded by saying that security aspects are part of federal pilot projects testing the viability of using iPads or other tablets for senior officials in 15 government departments.
German researchers at the Fraunhofer Institute for Secure Information Technology outlined findings similar to those of Cygnos last month. Their report warned that “great portions” of data on iPads and iPhones can easily be hacked.
Major U.S. and Canadian firms appear to be satisfied with the security of the devices. A recent survey by Forrester, a U.S. tech research firm, found that 30 per cent of North American companies are already using tablet computers.
A spokesperson for Apple Inc. declined comment for this story.
Forrester vice-president Chenxi Wang indicated in an email that iPads aren’t yet suited for all uses.
“I don’t believe iPads are secure enough for regulated industry or governments who handle highly sensitive data, but they can be made to be highly secure, with additional technologies,” she wrote.
Rich Mogull, a researcher with Securosis, dismissed Cygnos’ concerns about Apple’s web-browser as “fear-based speculation.” While no device is perfect, he said strong encryption and proper security settings can address many risks.
Mr. Day, the iPad-carrying Treasury Board president, recently said the device proved to be a cost-saver in his department because it replaces the need for him to carry around printed briefing material. He also said documents are more secure on an iPad because the device is protected by a password if it is lost.
