4 ms·

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more de

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere. http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-being-railroaded-in-privacy-breach-to-cover-government-slip-1.4616972 http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...

eigenvector 9y ago
Yes, it's really not clear that any crime was committed. The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server - not simply downloading data. It seems like overreach by the police to distract from the fact that the government failed to secure private data. [1] http://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.html http://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.h...
- inetknght 9y ago
  Honestly, I'd like to see the kid's lawyers push back and claim damages against the province and its contractors. How else shall we force problems like this to be fixed?
- kazinator 9y ago
  Anyone familiar with the Streisand effect would have predicted that this would in fact result in this failure getting as much attention as the circumstances can imaginably furnish.
- jt2190 9y ago
  > The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server. Not quite. The test is: > Everyone is guilty... who, fraudulently and without colour of right, obtains, directly or indirectly, any computer service (including... the storage or retrieval of computer data) The Crown can argue that the documents were retrieved/obtained using manipulation of the server (since the public URLs were manipulated to find non-public URLs.)
dgudkov 9y ago
>"Unfortunately, what had happened is someone went in through the URL and just sequentially went through every document available on the portal," she said. It's not clear if the links to the documents with sensitive information were public or not. Yes, it's absolutely stupid to have security by obscurity, but from a legal point of view abusing someone's stupidity may look like a crime. The story, while sad, doesn't look black and white to me as CBC tries to paint it.
- consp 9y ago
  I'm not familiar with the Canadian legal system, but most countries have entrapment laws which forbid prosecution if there was no way for the suspect to know it was illegal and no criminal intent was involved. The "public, free, information, disclosure" words would make this a slam dunk if Canada has some of those laws.

eigenvector 9y ago

Yes, it's really not clear that any crime was committed. The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server - not simply downloading data. It seems like overreach by the police to distract from the fact that the government failed to secure private data. [1] http://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.html http://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.h...

inetknght 9y ago
Honestly, I'd like to see the kid's lawyers push back and claim damages against the province and its contractors. How else shall we force problems like this to be fixed?
kazinator 9y ago
Anyone familiar with the Streisand effect would have predicted that this would in fact result in this failure getting as much attention as the circumstances can imaginably furnish.
jt2190 9y ago
> The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server. Not quite. The test is: > Everyone is guilty... who, fraudulently and without colour of right, obtains, directly or indirectly, any computer service (including... the storage or retrieval of computer data) The Crown can argue that the documents were retrieved/obtained using manipulation of the server (since the public URLs were manipulated to find non-public URLs.)

dgudkov 9y ago

>"Unfortunately, what had happened is someone went in through the URL and just sequentially went through every document available on the portal," she said. It's not clear if the links to the documents with sensitive information were public or not. Yes, it's absolutely stupid to have security by obscurity, but from a legal point of view abusing someone's stupidity may look like a crime. The story, while sad, doesn't look black and white to me as CBC tries to paint it.

consp 9y ago
I'm not familiar with the Canadian legal system, but most countries have entrapment laws which forbid prosecution if there was no way for the suspect to know it was illegal and no criminal intent was involved. The "public, free, information, disclosure" words would make this a slam dunk if Canada has some of those laws.