Privacy breach may involve 25 Ontario ridings

(File Photo)

(File Photo)

Debora Van Brenk, QMI Agency

, Last Updated: 10:34 PM ET

LONDON, Ont. — A massive privacy breach -- in which Elections Ontario staff lost USB data sticks with personal information on as many as 2.4 million voters -- is a stunning case of how abysmally public bodies handle private data, a leading technology analyst says.

“This is a perfect example of what not to do,” said Carmi Levy of London. “Despite citizens wishing that the government leads in this area, in fact the government often trails.”

The data sticks contain names, addresses and birthdates of voters in as many as 25 ridings.

But Elections Ontario said Tuesday it isn’t sure exactly which ridings. It’s narrowed the list to 49.

“To our knowledge, no information has been improperly accessed,” said Greg Essensa, chief electoral officer of Ontario.

To read the data would require Elections Ontario or specialized commercial software, he said.

“However, I want to exercise the highest degree of caution.”

Essensa also said Ontarians can go to the information and privacy commissioner’s website at ipc.on.ca to learn more about how they can protect the privacy of their personal information.

That last bit of advice is “the height of irony,” Levy said.

Governments have shown they’re far less adept at electronic security than many businesses and individuals, he said.

“It’s a safe bet to say they dropped the ball on a number of levels and they got caught,” he said. “It shows how easy it is to lose control of vast amounts of data.”

Levy said even the best information-security policies “are simply words on paper” unless they’re enforced.

The USB drives were supposed to be password-protected, encoded and kept in a locked area accessible only to specific staffers. But these drives were not password-protected or encoded. And somehow, when the office area was being treated for mould in April, they weren’t in a secure area either and someone realized that the two USB drives had gone missing.

That prompted Elections Ontario to conduct a search, an internal investigation and then a third-party review.

Forensic security firm Inkster Incorporated discovered several flaws, including that standard data-security steps had been overlooked or ignored; encryption software available on the drives hadn’t been activated; and information was often transferred back and forth between secure laptops and insecure portable drives.

In addition, all staff members shared the same default password until after the USB sticks went missing -- something Inkster said called “a poor practice and a security risk.”

Essensa released a preliminary report and public apology on Tuesday.

The privacy breach is unprecedented and the largest in Ontario history, said Ontario Privacy and Information commissioner Ann Cavoukian, who said her investigation will take several weeks.

Sam Trosow, associate professor of law at Western University and a specialist in information policy, said the breach has a potential for identity theft.

“The birthdates bother me more than anything ... Having that information linked to my name can lead to the ability to discover other information.”

Voters’ lists in the U.S. are public information, even voters’ addresses and political affiliation. They don’t include birthdates, Trosow said.

“Every agency that’s holding personal data has to be aware of their responsibility in protecting it.”

Ottawa-Vanier MPP Madeleine Meilleur called it “troubling news.”

“Privacy is of outmost importance,” Meilleur said. “We hope this is investigated promptly to resolve this issue and to ensure that mistakes like this don’t happen in the future.”

- with files from Marlo Cameron

deb.vanbrenk@sunmedia.ca

The ridings possibly affected by the breach are:

  • Essex
  • Etobicoke Centre
  • Kingston and the Islands
  • Nipissing
  • Ottawa West-Nepean
  • Stormont-Dundas-South Glengarry
  • Whitby-Oshawa
  • Ajaz-Pickering
  • Bruce-Grey-Owen Sound
  • Windsor West
  • York Centre
  • York West
  • Burlington
  • Davenport
  • Don Valley East
  • Don Valley West
  • Algoma-Manitoulin
  • Etobicoke Lakeshore
  • Etobicoke North
  • Haliburton-Kawartha Lakes-Brock
  • Ancaster-Dundas-Flamborough-Westdale
  • Halton
  • Hamilton Centre
  • Kitchener Centre
  • Kitchener-Conestoga
  • London-Fanshawe
  • London North Centre
  • London West
  • Mississauga South
  • Mississauga-Streetsville
  • Nepean-Carleton
  • Nickel Belt
  • Northumberland-Quinte West
  • Ottawa South
  • Ottawa-Vanier
  • Peterborough
  • Picking-Scarborough East
  • Prince Edward-Hastings
  • Sarnia-Lambton
  • Sault Ste. Marie
  • Brampton West
  • Scarborough-Agincourt
  • Simcoe-Grey
  • Simcoe-North
  • Brant
  • Timiskaming-Cochrane
  • Timmins-James Bay
  • Toronto Centre

Videos

Photos