By Canadian Press

Nova Scotia notifies police after new alleged breaches of website

Apr 30, 2018 | 12:12 PM

HALIFAX — Eleven fresh instances of “unusual activity” on Nova Scotia’s freedom-of-information website were detected after a young man allegedly breached the site in early March, the province confirmed Monday.

But the teenager’s lawyer and the province’s opposition parties say the revelation in a government news release is hardly surprising given gaping gaps in security.

Earlier this month a 19-year-old was arrested on police claims he’d violated a rarely used portion of the Criminal Code that prohibits people from “fraudulently” making “unauthorized use of a computer.”

Lawyer David Fraser, said his client used simple programming to collect public material — and if he retrieved private material, it was an unintended consequence of the lack of proper security features.

Fraser has repeatedly said there was no malevolent intent, that the teenager and his family suffered unnecessary stress from a police raid involving 15 officers, and he’s optimistic charges won’t proceed.

Meaningful Mementos

Remembering Someone You've Lost at Christmas

Dec 03, 2024

Seasonal Sorrow

How Do You Get Through The Holidays When You're Grieving?

Nov 01, 2024

Upcoming Events at Oliver's

Grief & Loss and Estate Planning Seminars

Oct 02, 2024

The province’s latest revelations of activity on the site says they came from different, local internet protocol addresses than the 19-year-old’s original address.

The Department of Internal Services has once again handed over information to the Halifax police, who have confirmed they received it on April 21 and will investigate.

Jeff Conrad, the deputy minister of Internal Services, said in an interview that the 900 documents downloaded in the latest cases were among the previous 7,000 documents accessed in the alleged March 3 and 4 breaches.

Conrad said that 53 people once again had “sensitive personal information” accessed, including information from applications for personal information citizens made via the government system. Citizens can use the portal to apply for personal files that government agencies are holding.

“We’ve notified 53 people their material may have been seen by more than one person and we’ve notified them to take advantage of credit monitoring as a result of that possibility,” he said.

However, Fraser — a privacy lawyer who has took on the young man’s case due to his concerns about the potential prosecution — said he’s not in the least taken aback by the latest news.

“It cannot be surprising that when you put documents up in public, on a public website without any security or authentication, they will be read or downloaded. That’s how the internet works,” he wrote.

Meanwhile, the opposition Tories said the latest news release is a reminder of the Liberal government’s poor performance in protecting personal information.

Interim leader Karla MacFarlane said the double breach of the same information proves, “the Liberals left the portal wide open. They used full force to arrest a 19-year-old kid but now they must be left scratching their heads.”

“How can he reasonably expect Nova Scotians to trust him when information like their birthdates, social insurance numbers and home addresses have been so carelessly protected.”

When asked whether the website lacked basic security or password features, Conrad said he can’t comment because multiple investigations are underway.

“At this point we’re focused on providing information to those most affected. … We haven’t got to the stage of delving deeply into what happened. That will be a future step in our process.”

Both the province’s privacy commissioner and the auditor general are considering whether the province upheld its own privacy procedures in the way the website was designed.

The freedom-of-information website is hosted by the information technology company Unisys, and it provides security measures as part of its hosting contract with the province.

Conrad said after the investigations are completed there will be assessments of contracts with service providers like Unisys.

“We’ll determine what we need to do in terms of next contract, and what language we need to put in them.”

The site is being tested to ensure that remedies are in place to prevent further breaches, said the deputy minister.

He said he couldn’t provide a date on when the fixes would be in place and the website would resume normal operations.

Followt (at)mtuttoncporg on Twitter.

Michael Tutton, The Canadian Press