Security protocols on surveillance cameras at a Cape Breton school remain out of date, months after images of its students were unintentionally broadcast on the internet, Nova Scotia's privacy commissioner Catherine Tully says.
Tully's report on the matter found there were "inadequate passwords and insufficient technical controls" behind the initial breach. While passwords have been changed, Tully said the school has still not placed the streams behind a firewall or equivalent protection, and two of the cameras are no longer supported by manufacturer security updates.
"Security problems arise constantly, they change, people hack things in different ways, so you have to be nimble, you have to adjust your technology to adapt to those risks, and they can no longer do that with the existing cameras," she said.
"Reasonable security requires that they [those cameras] be behind a firewall. The manufacturers of the camera recommend them, but they haven't done that yet."
However, on Thursday, Beth MacIsaac, superintendent of the Cape Breton-Victoria Regional School Board (CBVRSB), said all cameras in the board are behind a firewall.
"We would like our parents and students to know that we take their privacy very seriously, which is why we've passworded all of our security cameras and they're now behind firewalls as well," said MacIsaac.
This was news to Tully, who said the school board received an advance, embargoed copy of her report on Sept. 18. The board then asked for an extension of three weeks to respond to the report.
During that time, the board did not inform Tully that the cameras were behind the firewall, but Tully said she was "delighted" to hear the board complied with the recommendation.
Tully's report follows a CBC News investigation in May that showed how insecure web cameras at Rankin School of the Narrows, in Iona, broadcast hundreds of thousands of high-definition pictures of students.
Student safety at risk
Tully said in the report published on Thursday that if video surveillance is used, it must be properly secured.
"When video surveillance images from the Rankin School were streamed on the internet for all to see, this was a violation of Nova Scotia's privacy laws. Video surveillance images of schoolchildren streaming unsecured to the internet created a risk to student safety."
The security lapse led to images ending up on the Russian-registered website insecam.org, and included images of children near washrooms, in hallways and in the schoolyard.
Particular concern: washroom camera
The cameras were only made secure after CBC News alerted the school and CBVRSB of the problem. The board then changed the passwords.
Tully said of particular concern was the camera outside the washroom.
According to the report, that particular camera was placed in that spot over concerns about repeated incidents inside the washroom involving a student. The report did not specify what those incidents involved.
"This is not an either-or situation. We need to have safety, but we also have a right to privacy. So we need to work out how can this happen with both things being respected," she said.
MacIsaac said that particular camera outside of the washroom has since been disabled.
The privacy commissioner said though every board in the province used video surveillance in some way, none had conducted a privacy impact assessment into whether it was in compliance with privacy laws.
Tully said in her report that every board has now agreed to develop a privacy impact assessment — except the CBVRSB. The board has 30 days to review the recommendations in the report and decide whether to participate in the PIA process.
"While I'm disappointed that they weren't able to agree to that, I'm endlessly optimistic that they will in fact agree to the recommendations, they'll attend the privacy impact assessment workshop and we'll figure this out together," said Tully.
However, on Thursday, both Education Minister Zach Churchill and MacIsaac confirmed the CBVRSB will be attending the workshop.
Churchill also said the government is considering creating provincewide policy on security cameras and privacy in schools.
Tully has recommended several changes, including that the board:
- Develop a privacy breach policy.
- Further secure its cameras, for example, using a firewall.
- Provide privacy training.
- Disable the camera located outside the boys' washroom at Rankin School.
- Replace two exterior cameras that are no longer supported by the manufacturer.
She also said the board should take a look at its rationale for having the cameras in the first place. Tully said in the report that the board had not established that video surveillance is authorized under the Privacy Act.