Canadians taking a few extra days to file their taxes have a Collingwood grad from West Vancouver to thank.
Justin Bull, 23, a computer science graduate and self-described cyber "security nut," was among those who first recognized that the Canada Revenue Agency was vulnerable to the Heartbleed software bug and notified the tax department before the government website was shut down.
Bull says if the tax department had acted sooner, it may have been able to prevent the security breech that led to the social insurance numbers of 900 Canadian tax filers being stolen by a cyber hacker over a six-hour period.
"It was a race against time," said Bull. "They got compromised in a very severe way."
Because the Canada Revenue Agency had to shut down its online tax filing system for five days, the deadline for tax filing was moved from the usual date of April 30 to midnight on May 5. Bull says he's had a few tardy tax filers thank him for that.
The former West Vancouver man, who now works as a computer programmer in Toronto, said he first found out about the Heartbleed software bug early in the week of April 7. As a programmer with an interest in online security, Bull said he subscribes to a mailing list that sends out bulletins on cyber security.
Not long after he read about the Heartbleed bug, Bull said he realized how serious the problem was.
Essentially, a small flaw in encryption software used by many companies and government agencies allowed a hacker to break in and request information.
What came back was random, but might include user names and passwords, or - in the case of the tax department - social insurance numbers for recently uploaded tax returns.
Bull said using a simple programming test, he first checked to see if his banks and gmail systems were safe. They were. But when he checked the tax department's website, it was still vulnerable.
Bull said when he first tried to contact the agency as well as a federal government service that deals with cyber terrorism, he wasn't able to get anyone on the phone.
Eventually he managed to talk to someone in the technical branch of the tax department, who assured Bull he would fast track the concern.
Bull said so far he hasn't got an acknowledgement from the tax department that his tip led to identification of the problem.
The tax department has also not revealed when the SI N numbers were stolen - before or after Bull's phone call.
A 19-year-old hacker from Ontario has since been arrested for the data breach.
Meanwhile, Bull said he's making use of the extra five days from the Canada Revenue Agency to get his own taxes filed.
