Civil servants' hacking claim in privacy breach led to police action, documents show

Court documents from a Halifax police investigation into a privacy breach at a Nova Scotia government website show provincial civil servants told investigators the province had been hacked.

The documents show Det. Const. Steve Millaire swore before a justice of the peace that, "an employee of the province discovered that someone had 'Hacked' into Province of Nova Scotia confidential files that were being stored off site at the private firm UNISYS.'"

In reality, the confidential files were posted on the province's Freedom of Information portal without any security protection, and were accessible to anyone on the internet who changed the final digits of the links to each document.

The new information comes from a sworn statement used to obtain a production order to force the internet provider Eastlink to provide the name of the subscriber who downloaded the documents.

'Sensitive in nature'

Those court documents were sealed until Tuesday when the Halifax Examiner and Cape Breton Spectator hired Halifax media lawyer David Coles to apply to unseal the court files.

The court files also show the breach was discovered by a provincial archives employee who accidentally switched the final digits of a Freedom of Information file on his work computer, and found he could see any document in the system.

In his sworn statement, Millaire says the downloaded records "would be sensitive in nature," such as Department of Child Services files, confidential business information, memos and administrative documents.

"Many of the documents obtained are very sensitive in nature and if released, could pose a risk to those named within," he wrote.

He told the justice of the peace that a provincial official requested that "due to the level of seriousness and potential media attention, this matter be dealt with as quickly as possible."

Police drop case

On Monday, police announced they will not be pursuing a criminal charge of "unauthorized use of a computer" against the 19-year-old Halifax man who downloaded 7,675 freedom of information documents.  

The teen, whose identity has not been released, told CBC News he thought the documents were all public.

He says he used an open-source program called Wget and wrote one line of script to download the documents, he says were stored in order from 1 to 7,675.

Police raided the teen's home the day they announced the privacy breach, arrested his parents and siblings and took him to police headquarters for questioning.

The family's phones and computers seized during the raid have yet to be returned.

Strong rhetoric

David Fraser of the firm McInnes Cooper is acting for the teen.

He says the police response would have been "heavily influenced" by what provincial officials told them about the breach.

"Certainly the rhetoric at the time was very strong, suggesting some form of hacking, which proved not to be the case," he said.

"And if that sort of rhetoric was transferred to the police, it might be expected that that's the sort of response that they're going to have."

Halifax Regional Police say when the province called them, they believed something illegal had happened.

"When the incident was reported to the police it was certainly believed that a criminal act had taken place. That's why someone calls the police and that's why we undertook and investigation," said Supt. Jim Perrin.

Lawyer has more questions for province

However, Fraser says it was never likely a criminal conviction could ever be obtained just for downloading information from an unsecured system.

He says he has other questions moving forward.

"I think it will be very interesting to understand more about what happened on the province side in terms of why that information was publicly available on a publicly available website in the first place," he said.