Bruce, you mention five-year prison terms for security breaches.

Not in this country.

In Canada, you don’t go to prison for a security breach unless and until the prosecution can prove that the unauthorized release of sensitive information caused actual harm.

Wild indignation from government officials and party apparatchiks does not constitute “actual harm”.