Civil servants' hacking claim in privacy breach led to police action, documents show

Halifax Regional Police say when the province called them, they believed something illegal had happened. What they didn't know is that the files were able to be downloaded because of an unsecured system.

'The rhetoric at the time was very strong, suggesting some form of hacking' that wasn't the case, says lawyer

Court documents recently unsealed at Halifax provincial court show police swore statements before a justice of the peace containing language that emphasized the illegality of the privacy breach. (CBC)

Court documents from a Halifax police investigation into a privacy breach at a Nova Scotia government website show provincial civil servants told investigators the province had been hacked.

The documents show Det. Const. Steve Millaire swore before a justice of the peace that, "an employee of the province discovered that someone had 'Hacked' into Province of Nova Scotia confidential files that were being stored off site at the private firm UNISYS.'"

In reality, the confidential files were posted on the province's Freedom of Information portal without any security protection, and were accessible to anyone on the internet who changed the final digits of the links to each document.

The new information comes from a sworn statement used to obtain a production order to force the internet provider Eastlink to provide the name of the subscriber who downloaded the documents.

'Sensitive in nature'

Those court documents were sealed until Tuesday when the Halifax Examiner and Cape Breton Spectator hired Halifax media lawyer David Coles to apply to unseal the court files.

The court files also show the breach was discovered by a provincial archives employee who accidentally switched the final digits of a Freedom of Information file on his work computer, and found he could see any document in the system.

In his sworn statement, Millaire says the downloaded records "would be sensitive in nature," such as Department of Child Services files, confidential business information, memos and administrative documents.

Premier Stephen McNeil described the downloading of information from the government freedom-of-information portal last month as "stealing." (CBC)

"Many of the documents obtained are very sensitive in nature and if released, could pose a risk to those named within," he wrote.

He told the justice of the peace that a provincial official requested that "due to the level of seriousness and potential media attention, this matter be dealt with as quickly as possible."

Police drop case

On Monday, police announced they will not be pursuing a criminal charge of "unauthorized use of a computer" against the 19-year-old Halifax man who downloaded 7,675 freedom of information documents.  

The teen, whose identity has not been released, told CBC News he thought the documents were all public.

He says he used an open-source program called Wget and wrote one line of script to download the documents, he says were stored in order from 1 to 7,675.

The 19-year-old at the centre of a privacy breach on the province's freedom-of-information portal says he thought the documents he downloaded were public information. ( Jonathan Hayward/Canadian Press)

Police raided the teen's home the day they announced the privacy breach, arrested his parents and siblings and took him to police headquarters for questioning.

The family's phones and computers seized during the raid have yet to be returned.

Strong rhetoric

David Fraser of the firm McInnes Cooper is acting for the teen.

He says the police response would have been "heavily influenced" by what provincial officials told them about the breach.

"Certainly the rhetoric at the time was very strong, suggesting some form of hacking, which proved not to be the case," he said.

"And if that sort of rhetoric was transferred to the police, it might be expected that that's the sort of response that they're going to have."

Halifax lawyer David Fraser who represents the teen arrested in the website privacy breach says he has more questions for the Nova Scotia government about the breach and the circumstances surrounding it. (CBC)

Halifax Regional Police say when the province called them, they believed something illegal had happened.

"When the incident was reported to the police it was certainly believed that a criminal act had taken place. That's why someone calls the police and that's why we undertook and investigation," said Supt. Jim Perrin.

Lawyer has more questions for province

However, Fraser says it was never likely a criminal conviction could ever be obtained just for downloading information from an unsecured system.

He says he has other questions moving forward.

"I think it will be very interesting to understand more about what happened on the province side in terms of why that information was publicly available on a publicly available website in the first place," he said.

About the Author

Jack Julian

Reporter

Jack Julian joined CBC Nova Scotia as an arts reporter in 1997. His news career began on the morning of Sept. 3, 1998 following the crash of Swissair 111. He is now a data journalist in Halifax, and you can reach him at (902) 456-9180, by email at jack.julian@cbc.ca or follow him on Twitter @jackjulian