I've consulted to the Canadian Government on both a data science project and on cyber security as well. The technical people inside GC know what they need and i

I've consulted to the Canadian Government on both a data science project and on cyber security as well. The technical people inside GC know what they need and it isn't IBM building custom software for something like payroll. They should use off the shelf stuff for the 95% of employees that have run of the mill circumstances and just use humans to handle the super long tail of bespoke needs that no other Canadian employer has to deal with. The problem is that the political side of the government doesn't trust their own technical staff and they get convinced by these horrible consulting companies like IBM that the only way to write good software is to spend hundreds of millions on it but don't worry it will pay for itself with all the cost savings on staff. They try to minimize risk through bureaucracy but they end up getting the opposite of what they want. Less useable, less secure software at 50x the price. What they would do if they understood software is communicate to the public about how good software projects need fast iteration and that mistakes might be made sometimes, but that the important thing is that they are easy and fast to fix and that there are risk mitigation strategies to stop mass leaks when penetrators get into networks. Also, the CSE should just be empowered to take GC servers offline whenever they don't conform to a predefined list of security practices. It's 2018 the fact that all of GC isn't on HTTPS / HSTS is quite frustrating and it requires all departments to get on HSTS preload lists because of the stupid way gc.ca is a subdomain of .ca.