Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada's tax revenue agency tries to ToS itself out of hacking liability

riskybiznews.substack.com

Post reply on HN
Print view View original

81–90 of 192 posts

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#81

Post by bombcar »

throwawaysleep wrote: post #39
tpmx wrote: post #15

Earlier quoted context omitted.

In first few the years following the 2000/2001 dotcom crash the Swedish Tax Agency realized they had a golden opportunity to move away from expensive and fickle consultants to a competent in-house team of long-term employed developers. They pulled it off really well. The effect is still visible - web services are well designed in a simple and efficient way and generally just work. I think now (and the next year or tw…

Canadians would throw a fit about it though. Government employees earning over 100K triggers a lot of people.

I’ve often thought that exempting government employees from paying tax would be a decent way to slip them some extra income.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#82

Post by throwaway742 »

beached_whale wrote: post #46
chucksmash wrote: post #27

Earlier quoted context omitted.

> The DUI checkpoints up in BC are wild too, I'm glad they are banned in Washington and Oregon. Suspicionless stopping of cars en masse followed by interrogation by police seems like an overreach. I was just wondering about these (in the US) the other day. When I was growing up, I seem to remember them being a thing and going through them as a passenger but in 20+ years of driving, including on NYE/July 4 and late at…

The US has CBP checks on roads, doesn’t it?

I refuse to comply with those.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#83

Post by nickff »

slickrick216 wrote: post #76
rkagerer wrote: post #53

If you pay attention to ToS's, you'll find companies are increasingly trying to pull stunts like this. The CRA's terms are objectionable, yet sadly benign compared to other reprehensible terms I've seen gating the web. Lawyers are copying each other's tactics and propogating dark patterns that I doubt will stand the test of litigation (but will cost some poor sap a lot of money and time to get there). Indemnity claus…

Yeah like you say this isn’t a new phenomenon. In some cases they even try to shield themselves with legislation. For example let’s look at Ireland. [0] Ireland tries to exclude itself from GDPR https://www.thejournal.ie/data-protection-bill-2018-3853647-... [1] Entire health system compromised and possibly majority of PHI data exfiltrated https://www.hse.ie/eng/services/publications/conti-cyber-att... [2] Irish heal…

Re: [0]

My understanding is that member states (and perhaps all sovereigns) are not required to comply with GDPR unless they explicitly choose to.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#84

Post by Retric »

sporedro wrote: post #68
Retric wrote: post #59

Earlier quoted context omitted.

The standard with dog bites is “reasonable precautions” to prevent them, thus a good fence that failed because it was hit by a meteor could be a perfectly reasonable defense. People don’t build structures with rocks falling from the sky in mind. On the other hand a fence the dog can open or climb over is not, which of course depends on the dog. I suspect the same would be considered for computer security. Hacker News…

Genuine question, would you not be held responsible in the US if a meteor hit your fence allowing your dog to get out and bite someone? I know that it was unpreventable but isn’t it still your dog and your responsibility?

Nothing is absolutely guaranteed in the US legal system, but as I understand it it’s not legally your responsibility.

In the same way you may generally be responsible if you rear end someone, but if it was caused by someone rear ending you then that’s not your fault. That may seem obvious, but if someone stoped several car lengths back to lower the risk of someone getting hit if you’re rear ended. Thus the standard is reasonable precautions rather than requiring people to do absolutely anything possible.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#85

Post by Kranar »

j_not_j wrote: post #72
Kranar wrote: post #36

Earlier quoted context omitted.

The CRA is its own department, like any other department. It is structured and operates just like any other government department as opposed to a private business. They are not at the behest of the Treasury Board because the Treasury Board is a committee, not an administration or agency. The board has no executive authority whatsoever and exists to give advice to Cabinet rather than to perform or execute a duty. Howe…

I recommend you look up the purpose of Treasury Board. They are the corporate treasurer of GoC. All expenditure requests go through them and if insufficiently justified then Treasury rejects them. And the requesting department/division/establishment must resubmit. It even applies to CF/DND too. (In some countries/companies this function is called the comptroller or the controller.)

I think you have a some what confused understanding of what the various roles and duties of these government bodies are. Whatever the purpose of the Treasury Board is (which you do not seem to fully understand since they are not a corporate treasurer), it has nothing to do with whether the CRA operates as a corporation. Furthermore, the CRA is not subservient to any other federal department as it is its own department chaired by the Minister of National Revenue.

Canada does have government bodies that are corporations, as I said the Bank of Canada is one of them, Canada Post is another. The full list can be found here:

https://www.canada.ca/en/treasury-board-secretariat/services...

The CRA is no where on that list.

Here's a bit of a challenge for you to help you clarify your understanding of this. Find one single semi-authoritative source that refers to the CRA as a corporation or describes the operation of the CRA as being like that of a corporation. I'll even take an informal source.

You won't find any, since no one describes the CRA as a corporation and doing so is just confusing. You made it up, and given that Canada does have bodies that operate as corporations, you shouldn't be surprised that making something up like this will elicit disagreement.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#86

Post by cscurmudgeon »

InitialLastName wrote: post #60
Jensson wrote: post #58

Earlier quoted context omitted.

But that basic insurance is extremely overpriced compared to similar insurances in other countries, and it is mandatory so you have to pay it.

If it's overpriced (relative to payouts) and the funds get returned to the population at large (through public services and mitigation of indirect damage caused by drivers) then that sounds like a very effective way to get drivers to pay for their externalized costs (in a way that other countries' privatized, profit-limited insurance schemes doesn't afford).

But, does it?

> mitigation of indirect damage caused by drivers

But, private insurance covers that.

> through public services

Examples?

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#87

Post by matbilodeau »

nickff wrote: post #77
matbilodeau wrote: post #75

Fortunately, contracts in Quebec are dependent of the Civil Code. Terms of service match the definition of a contract. I am eager to see if such practices by any level of government will pass the test of tribunals and current jurisprudence. Excerpts : 1458 Every person has a duty to honour his contractual undertakings. Where he fails in this duty, he is liable for any bodily, moral or material injury he causes to the…

IANAL... but... I don't think that the CRA is subject to Quebec law, and believe that the CRA may exercise sovereign immunity, though I'm not sure that it has done so in the past.

That's where 3149 would come in. Maybe even 3150 if you have "ID theft" insurance.

3149. Québec authorities also have jurisdiction to hear an action based on a consumer contract or a contract of employment if the consumer or worker has his domicile or residence in Québec; the waiver of such jurisdiction by the consumer or worker may not be set up against him.

3150. Québec authorities also have jurisdiction to hear an action based on a contract of insurance where the holder, the insured or the beneficiary of the contract is domiciled or resident in Québec, the contract covers an insurable interest situated in Québec or the loss took place in Québec.

https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l...

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#88

Post by mitthrowaway2 »

goosedragons wrote: post #63
greenshackle2 wrote: post #25

Earlier quoted context omitted.

You can still mail in paper forms.

But they might still "email" any reassessment or whatever to your account if you setup paperless beforehand..

Generally the CRA will only email a notice that there is a new message waiting for you on their site; you have to log in to their site to access the message. As far as security practices go, I won't complain about that.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#89

Post by brasic »

matbilodeau wrote: post #87
nickff wrote: post #77

Earlier quoted context omitted.

IANAL... but... I don't think that the CRA is subject to Quebec law, and believe that the CRA may exercise sovereign immunity, though I'm not sure that it has done so in the past.

That's where 3149 would come in. Maybe even 3150 if you have "ID theft" insurance. 3149. Québec authorities also have jurisdiction to hear an action based on a consumer contract or a contract of employment if the consumer or worker has his domicile or residence in Québec; the waiver of such jurisdiction by the consumer or worker may not be set up against him. 3150. Québec authorities also have jurisdiction to hear an…

Why would the TOS of a site operated by a national government agency qualify as a “consumer contract or a contract of employment”? And why would a provincial law constrain the actions of the federal government?

https://en.m.wikipedia.org/wiki/Paramountcy_(Canada)

As GP noted, sovereign immunity might be relevant here.

Re: Canada's tax revenue agency tries to ToS itself out of hacking liability

#90

Post by vkou »

idiotsecant wrote: post #65
Scoundreller wrote: post #38

Earlier quoted context omitted.

> Suspicionless stopping of cars en masse followed by interrogation by police seems like an overreach. I’m pretty sure Canadian DUI checkpoints are limited to interrogations about alcohol/drug intoxication (edit: and a few matters regarding the vehicle itself) unless something else is offered/observed. Supreme Court basically agreed that they are warrantless and detainments without reasonable suspicion, but considere…

> limited to interrogations about alcohol/drug intoxication (edit: and a few matters regarding the vehicle itself) unless something else is offered/observed. Which in effect means that they are unlimited. They make wide use of drug detecting dogs. If a drug dog indicates you might have contraband, that allows further intervention. It is widely known that drug dogs can , worst case, be trained to hit when a hit is not…

> Drug dogs are basically a override-the-law get you into jail free card, and any system that allows them as evidence of probable cause basically does not require probable cause.

Police dogs manufacturing search warrants is more of an American problem than a Canadian problem.

You might have more rights on paper in the US, but in many respects, you have more of them in practice in Canada. The letter of the law matters way less than how the law is implemented in practice. Public culture, legal culture, political culture, and policing culture all play into this.

The right to bear arms is enshrined in the constitution, yet there's no shortage of people who have been executed for 'reaching for an (often imaginary) gun' during a 'routine traffic stop' that, oddly enough, predominantly targets minorities...

Post reply on HN