"People will be concerned. But the reality is, (the CRA) is probably a lot safer place to have the data than on their own PC at home," said O'Higgins. "But whenever there is such an aggregation of data, it becomes a target."

It's not for a lack of effective security software on the market that it has taken the CRA a long time to identify a better tool, so it sounds like the agency could be hindered by its own procurement process, said O'Higgins. It's often easier, he explained, for the government to deal with vendors with which it has a standing arrangement, something that can take a long time to put in place, instead of just going out and purchasing the software.

But the fact that the CRA understands the importance of IT security, said O'Higgins, makes this particularly surprising. "So that's why it's all bizarre. But strange things happen with all the process and bureaucracy."