Teen charged in Nova Scotia government breach says he had 'no malicious intent'

[Frosty124]

http://www.cbc.ca/news/canada/nova-scotia/freedom-of-information-request-privacy-breach-teen-speaks-out-1.4621970

https://archive.fo/si7b7

 

15 officers raided the family home last Wednesday morning
The teen has been charged with "unauthorized use of a computer," which carries a possible 10-year prison sentence, for downloading approximately 7,000 freedom-of-information releases

The provincial government says about 250 of those contain Nova Scotians' sensitive personal information.

On Friday, the premier accused the teenager of "stealing" the information. But in an interview with CBC News, the 19-year-old says he thought he was downloading an archive of public information that was supposed to be freely available on the internet

"The website had a number at the end, and I was able to change the last digit of the number to a different number and was able to see a certificate for someone else's animal that they adopted," he said "I decided these are all transparency documents that the government is displaying. I decided to download all of them just to save," it took a single line of code and a few hours of computer time to copy 7,000 freedom-of-information requests "I didn't do anything to try to hide myself. I didn't think any of this would be wrong if it's all public information. Since it was public, I thought it was free to just download, to save,"

It wasn't the first website the 19-year-old had saved for general interest he has around 30 terabytes of online data on hard drives in his home, the equivalent of "millions" of web pages. He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate.
"I preserve things, I archive the internet. I have history on my computer, and all of that should be saved and preserved,"

The teenager says since he was downloading public records off a public website, it all feels unfair. "I just had no malicious intent and I shouldn't be charged for this," he said

[Frosty124]

• The mother says she, her husband, and two of her kids were corralled in the living room.
• "They read us our rights and told us not to talk," she said.
• "Our daughter, she was really traumatized, really bad — brought her to tears, the way they conducted this," said the father.
• She says at one point there were 15 officers in the home.
• "People were going into the kitchen, were going into the dining room, going upstairs. They went into the basement. They were [traipsing] through the house, everywhere," the mother said.
• "They rifled through everything. They turned over mattresses, they took drawers and emptied out drawers, they went through personal papers, pictures," she said. "It was totally devastating and traumatic."
• She says police seized her son's computers, plus her husband's cellphone and work computers, which has left him unable to do his job.
• They also seized her younger son's desktop computer, after he was arrested on the street walking to high school.
• Officers took her 13-year-old daughter to question her in a police car.
• "My little ones are asking, 'Will I be able to get a job because we were arrested?'" she said
• Supt. Jim Perrin said last week police rarely charge people with unauthorized use of a computer, but that it was the right offence in this case
• On Friday, Nova Scotia Premier Stephen McNeil said the person who downloaded the documents 'stole' the information.

[Beef Boss]

I doubt anything good will come out of this, mostly because I doubt their government would admit how big of a flaw they over looked... And they'd use the fact that he downloaded "30 terabytes" of data against him. 

[SpaceGhostC2C]

So, let's see: according to that account the sequence was:

• types a website address
• it takes him to a website
• writes script to enter addresses and be taken to websites
• => he is a criminal

I honestly hope there is much more to this story than that... Unfortunately, it wouldn't be the first time if there isn't...

[Clanscorpia]

@TheRandomness @leadeater This should be in news

[WkdPaul]

1 hour ago, SpaceGhostC2C said:

I honestly hope there is much more to this story than that... Unfortunately, it wouldn't be the first time if there isn't...

There's a lot more to this, this whole situation is completely ridiculous!

 

• The website was the province FOIA distribution system.
• All FOIA documents HAVE to be reviewed and, if needed, redacted to avoid leaks of personal information since those documents become public after release.
• The government (unintentionally?) published sensitive personal information of citizen through that FOIA website.
• They were publishing those documents without any security measures (no need to login to the website and the PDFs were not encrypted)
• They were also using sequential document and web address IDs (like seriously??? I helped with a commercial website in 2006 or 2007 and we intentionally avoided sequential IDs SPECIFICALLY for this reason!!!).
• ... I wouldn't be surprised there was more!

I hope the family will sue the government for putting them through this, all because of their (NS gov) obvious incompetence!

Edited April 18, 2018 by wkdpaul

[Syntaxvgm]

4 hours ago, Frosty124 said:

"unauthorized use of a computer,"

Ah, often the computer equivalent of "I consented at the time, but have since changed my mind so it's rape"

[Xander Cousins]

4 hours ago, Frosty124 said:

"The website had a number at the end, and I was able to change the last digit of the number to a different number and was able to see a certificate for someone else's animal that they adopted," he said "I decided these are all transparency documents that the government is displaying. I decided to download all of them just to save," it took a single line of code and a few hours of computer time to copy 7,000 freedom-of-information requests "I didn't do anything to try to hide myself. I didn't think any of this would be wrong if it's all public information. Since it was public, I thought it was free to just download, to save,"

Sooo here the thing this case is odd, as the site had what it seems like next to nothing for security as the boy was able to download Multiple documents mearly by writing a script that would change the last number on the address then request to save a document to a folder. He technically hasn't got himself charged with anything to do with the Computer misuse act but could be something to do with the data protection act as in retrospect he doesn't have any reason to be holding onto said data.

[piemadd]

Though change.org doesn't have any actual power, this can help get out the word. I'm from the states, and this is completely ridiculous. I might as well go and download a bunch of public files from my local government to prove my point.

 

https://www.change.org/p/nova-scotia-government-drop-all-charges-against-nova-scotia-teen-who-downloaded-public-information/share_for_starters?just_created=true

[SpaceGhostC2C]

1 hour ago, wkdpaul said:

There's a lot more to this, this whole situation is completely ridiculous!

• (...)

I hope the family will sue the government for putting them through this, all because of their (NS gov) obvious incompetence!

 

[WkdPaul]

1 hour ago, Implosivetech said:

Though change.org doesn't have any actual power, this can help get out the word. I'm from the states, and this is completely ridiculous. I might as well go and download a bunch of public files from my local government to prove my point.

 

https://www.change.org/p/nova-scotia-government-drop-all-charges-against-nova-scotia-teen-who-downloaded-public-information/share_for_starters?just_created=true

Yeah that won't do much, it's in the legal system now.

 

Even though the justice system is separate from the legislature, contacting your local member of parliament might have more of an effect (your NS mp for anyone in NS and your federal mp for anyone outside of NS).

 

NS members of parliament ;

https://nslegislature.ca/members

 

Federal MPs;

http://www.ourcommons.ca/Parliamentarians/en/members

[Majinhoju]

Yeah, this whole thing is pretty messed up.

Putting files on a "Freedom of Information" portal with no security or authentication then having them downloaded is their screw up, not the teen's.  Heck, Google and other bots probably have probably already seen these files too.  And given how the family was pretty much terrorized by the police and had their house torn apart, and 13 year old questioned as well, I'd be seeking lawyers and getting ready to sue to like crazy if I were the father.