The Canadian tech industry is pushing back against a decision to charge a 19-year-old man over his role in the data breach of a Nova Scotia government website.
A crowdfunding campaign has been launched with the goal of creating a legal defence fund for the teen. Technology experts — including the board of the Atlantic Security Conference — have already contributed to the campaign.
As of 3:30 p.m. on Wednesday the fund had raised nearly $4,000. Industry experts have also begun publishing letters of support online for the 19-year-old.
READ MORE: Halifax police make arrest after Nova Scotia FOI website breached, personal information exposed
Dragos Ruiu, an Edmonton-based security technology specialist, is the man behind the crowdfunding campaign.
He says that the teen — who has yet to be named by Halifax Regional Police — deserves to have the best defence possible against charges he describes as a “travesty.”
“Prosecuting this action is really problematic for professionals who do this kind of thing all the time,” Ruiu said in a phone interview on Wednesday.
“It could cause all sorts of problems if this case goes forward.”
WATCH: N.S. Opposition ‘strongly considering’ calling for minister’s resignation over information breach
Charges behind the breach
The teen is facing one count of unauthorized access of a computer after police say he was involved in a “data breach” of the government’s freedom of information (FOIPOP) portal.
The charge, which the Halifax Regional Police says is “seldom laid,” carries a maximum punishment of 10 years in prison.
The government said the data breach — which occurred between March 3 and March 5 — resulted in more than 7,000 documents being accessed and downloaded by a “non-authorized person.”
The province says that 250 of the documents contain highly sensitive personal information such as birth dates, addresses and social insurance numbers.
Evan d’Entremont, an IT security professional, has written on his blog that the breach would’ve been fairly easy to carry out.
D’Entremont alleges that accessing the data would have been as simple as changing the document ID number at the end of a URL.
READ MORE: Halifax law firm looking into possible class action over N.S. data breach
Legal defence
Ruiu says that the teen was charged at all should be concerning to the Canadian tech industry and it’s for that reason that the teen should have an excellent legal team.
“It’s really quite important that an appropriate defence be put up in this case and no precedents are set,” Ruiu said.
“I have three boys and my oldest is 15 and beginning to be curious. Instead of this being a 19-year-old in Nova Scotia it could’ve been a colleague of mine in Edmonton or Vancouver. It could’ve been one of my boys.”
David Fraser, a leading technology and privacy lawyer with McInnes Cooper, says he is now assisting the teen in his legal defence.
“I am hopeful that as the file is transferred to the crown prosecutors, they will make the call to withdraw the charges that – I think – never should have been laid in the first place,” Fraser told Global News.
Halifax police don’t appear to be open to dropping the case.
At a press conference on Wednesday, Supt. Jim Perrin said police have yet to lay an information before the court and also said, “when the investigation is completed we’ll probably have more to say about it.”
Since the search, the young man and his family have told the CBC he thought he was accessing public files from the freedom-of-information portal, and had no intent to take personal information. The teenager told the broadcaster he was looking for information from public documents about a teachers’ labour dispute last year.
He said he wrote a few simple lines of code to download files, rather than transferring them one by one.
Experts on cyber law have told the Canadian Press that if the teenager’s account is correct, the arrests and the family’s allegations that 15 officers descended on their home and left it in disarray may be a case of police “overreach.”
READ MORE: Police ‘overreached’ in arrest of N.S. man accused in breach of website
While the case proceeds, the government has said that the FOIPOP website will not be back online anytime soon.
The province told Global News that the first patch for the website’s security issues was received by Unisys on April 13. It’s now undergoing testing before being passed on to the province, which will conduct its own testing.
An additional third party will also review the updated system.
“There is currently no set timeline attached to the service going back online for the public, as this will depend on the results of this process,” Brian Taylor, a spokesperson for Nova Scotia’s internal services department.
— With files from the Canadian Press
Comments