N.S. privacy watchdog investigating after Russian site shows surveillance video of school

Nova Scotia privacy commissioner Catherine Tully launcheds an investigation into the use of webcam surveillance at a Cape Breton school that unintentionally broadcast hundreds of thousands of pictures of students to the internet.

'It's time for us to take a hard look at cameras,' says Catherine Tully

Nova Scotia privacy commissioner Catherine Tully says video surveillance cameras trained on public spaces around Nova Scotia may be breaking privacy laws. (CBC)

Nova Scotia privacy commissioner Catherine Tully has launched an investigation into the use of webcam surveillance at a Cape Breton school that unintentionally broadcast hundreds of thousands of pictures of students to the internet.

A CBC News investigation revealed the security lapse that led to images recorded at the Rankin School of the Narrows in Iona ending up on the Russian-registered website insecam.org, which displays links to thousands of web security cameras around the world.

Tully is looking into whether the cameras are in compliance with Nova Scotia's privacy laws.

Images of children near washrooms, in hallways and in the school yard being made public are concerning, she told CBC News on Thursday.

Students gathered at the water fountain were clearly visible in the camera footage. CBC News has blurred the video to protect the identities of the students. (CBC)

"It's time for us to take a hard look at cameras," said Tully. 

"What appears to have happened in Nova Scotia over the last 10 years or so is a lot of cameras were installed, but there wasn't a lot of privacy impact or evaluation done."

Taking another look at cameras

She said it's time for Nova Scotia's guidelines on video surveillance to be re-evaluated, and pointed to two key issues. 

"First, there are too many cameras and they are collecting information that does not need to be collected for the purpose identified," she said, adding that it is also too easy for people to access images recorded on the cameras.

Tully said passwords need to be encrypted and the length of time images are kept should be limited so they are less likely to be accessed.

'I don't blame anybody,' says parent

The primary to Grade 12 school sent students home with a note to parents telling them of the security breach. The note said the school board had addressed the issue and put a password in place.

Charlene Chaisson, who has two children enrolled at the Rankin school, said her son appeared in several of the images that CBC obtained.

One camera was pointed towards the school's yard and parking lot. (CBC)

"All I can add is that although it's my son in the image and it's alarming, I don't blame anybody for it happening. Things get hacked all the time and hopefully now the cameras are secure."

Her husband, Rodney Chaisson, said he didn't think children were put at risk.

"The images are sort of hallway images, they weren't in private areas."

He said he approves of having cameras in schools. "In the world we live in, we don't have much choice. In some of the bigger schools, it's a security and safety issue. You need to have cameras in the schools."

Lack of adequate security is common

Daniel Tobok, a cybersecurity expert in Toronto, said the problem of webcam images being streamed around the world is common.

Who's watching? Nova Scotia's privacy commissioner recommends owners of video surveillance cameras check to see if the images are being broadcast online. (CBC)

He blames the way the webcams are connected directly to the internet.

Even if they are password protected, normally the passwords are very simple and there aren't firewalls or other barriers to keep them from being accessed, he said. That includes home security cameras.

Residents can unintentionally expose themselves to outside scrutiny when they install security cameras.

"I don't think everybody should stop using internet-based cameras ... but I think we need to start focusing on security: how to set it up, not to use your standard admin passwords and have someone with a security background configure those devices," said Tobok.

Tully echoed the advice.

"I highly recommend if you have installed a video surveillance system ... check your security and make sure that you're not broadcasting to the world," she said.

with files from Jack Julian and Tom Murphy