UVic employee data theft preventable, says second external audit

Former privacy commissioner gives university 29 recommendations to boost security measures, employee training

A detailed privacy review, commissioned by the University of Victoria after confidential employee information was stolen in January, says the major data breach was a preventable incident.

The report, written by the province’s former Information and Privacy Commissioner David Flaherty, lists 29 recommendations to prevent similar incidents in the future.

“This major data breach should not have happened if the established data loss prevention and protection measures had been followed. In my view, the university was prepared to prevent such an occurrence,” Flaherty wrote in his report, released Friday.

On January 7 or 8, thieves targeted the payroll department in the non-alarmed Administrative Services Building, and stole a number of electronics. Among them was an unencrypted USB flash drive.

That flash drive held the names, banking information and social insurance numbers of all 11,841 employees on UVic’s payroll since 2010.

Given the volume of sensitive information on the device, “(the) protections in place for the flash drive were not ‘reasonable’ in the circumstances,” Flaherty wrote. The device was stored in a locked room, in a locked safe, in a locked cabinet.

Flaherty’s report came two months after the province’s current Information and Privacy Commissioner released similar investigative findings.

Elizabeth Denham said there is “no rationale” that the information wasn’t digitally secure, and that the university breached the Freedom of Information and Protection of Privacy Act when it failed to protect its employees’ personal information.

Flaherty’s report, covers a wide scope of recommendations, from administrative duty priorities to auditing security measures.

Among Flaherty’s recommendations is mandatory annual privacy and security training for all university non-academic staff who handle personal information.

“Existing … materials demonstrate that plenty of university training has been prepared, but evidently it was not targeted well enough, or repeated often enough, to prevent inadequate security practices that resulted in a data theft and a major breach,” he wrote.

He also recommended that the university continually invest in hardware and software to protect data that requires security. And back-up data should be stored off site.

“The stolen USB flash drive should not have been stored on campus in the first place, since its main purpose was business continuity … in the event of a natural disaster or other disruption, including flooding of buildings and labour strife,” Flaherty wrote.

Additionally, he recommended the university stop storing social insurance numbers.

“Data minimization has to become more than a buzzword at the university. … The stolen USB flash drive did not have to include social insurance numbers, because other means of unique identification were in place,” Flaherty wrote. “Payroll put the numbers on the flash drive for purposes of convenience in the event of a crisis. The unwise thought was that the employed would remember their SIN but not their (work ID) number.”

An attached internal assessment, conducted by UVic professor Jamie Cassels, reads that the university responded well to the data breach.

The activities and planning processes underway do demonstrate that steps are being taken to identify and catalogue storage systems containing personal information, and to assess and improve the protection of that information.

“They show that the university has plans for reviewing information security, physical security, privacy and records management policies on an ongoing basis,” Cassels wrote. “The various activities and initiatives, planned and ongoing, all seem appropriate, effective and sufficient.”

A press release from UVic says they are “considering how best to implement (Flaherty’s) recommendations,” and added that they have already taken some preventative steps.

A Saanich police investigation into the theft is still ongoing.

The majority of the electronics that were stolen were recovered in late January, but the flash drive in question is still outstanding. They were found destroyed in a garbage bag in a Canada Post drop box atop Bear Mountain in Langford.

Affixed to the bag was a dubious apology note: “The information on these devices was not copied, distributed, or exploited. We want to part of everyday people living in fear that their personal information is being used against them to take they’re (sic) hard earned money,” the letter read. But police aren’t buying it.

“We think this is a ruse by someone who wants to allay the public’s fears. But what they may have done is transferred the data, they’ll sit on it, and then go ahead and start defrauding people in a couple of months,” said Sgt. Dean Jantzen said in January.

Police say four current and former UVic employees claimed to have money stolen from their bank accounts following the data breach, but investigators have since determined three incidents to be unrelated. The fourth cannot be confirmed or discredited as being related to the data theft.

To read Flaherty’s full report, and see a list of all 29 recommendations, visit uvic.ca/infobreach.

kslavin@saanichnews.com

Just Posted

The City of Victoria is proposing a northern contraction from Haultain Street to Bay Street with a western contraction from Cook Street to Chambers Street for Fernwood. (Illustration/Google Maps)
Community association calls for input on Victoria boundary changes

City of Victoria proposes changes to neighbourhood borders

After seizing a handgun from his home on Tuesday, Victoria police arrested a wanted man on Wednesday after he fled officers on his bike. (Black Press Media file photo)
Man wanted on several warrants flees Victoria officers on bike

He was arrested after a brief struggle, transported to hospital with injuries

Divyesh Nagarajan, third from the left, has founded the Be My Friend project to bring support and companionship to vulnerable youth and address North Saanich’s food security challenges. (Courtesy of Divyesh Nagarajan)
Greater Victoria teen looks to connect vulnerable youth with a buddy, bolster food security

Be My Friend project was founded by St. Michaels University School student Divyesh Nagarajan

These are just a handful of Vancouver Island’s missing person cases. Clockwise from top left: Lisa Marie Young, Lindsey Nicholls, Micheal Dunahee, Jesokah Adkens, Belinda Cameron and Emma Fillipoff. (File photos courtesy of family members and police departments)
Gorge skull fragment could bring closure to one Greater Victoria missing person case

Skeletal remains found in Greater Victoria have not yet been identified

(Black Press Media file photo)
UPDATE: Sooke Road reopens after gas leak at Colwood Corners

SD62 warns afternoon buses could be delayed

B.C. Labour Minister Harry Bains in the B.C. legislature, May 13, 2019. (Hansard TV)
VIDEO: B.C. to provide 3 days of sick pay for COVID-19 absences

Province will support employers on cost, labour minister says

A nurse asks screening questions at an immunization appointment in Nanaimo earlier this year. (Shawn Wagar/Island Health photo)
Island Health appreciates nurses answering the call in challenging times

Health authority draws attention to National Nursing Week

BC Housing minister David Eby. (THE CANADIAN PRESS/Chad Hipolito)
Eby jabs back against Penticton mayor’s ad urging BC Premier to intervene in shelter dispute

Eby writes that Penticton’s ‘serious’ social issues won’t improve under leadership of the mayor

Provincial health officer Dr. Bonnie Henry updates B.C.’s COVID-19 situation at the B.C. legislature, April 29, 2021. (B.C. government)
B.C.’s COVID-19 rate creeps up again, 600 new cases Wednesday

One more death, 423 people in hospital with virus

B.C. Agriculture Minister Lana Popham takes questions in the B.C. legislature in 2017. (Hansard TV)
UPDATE: B.C. will fund another year of fresh fruit, vegetables, milk in schools

John Horgan government working on school meal program

Vancouver mayor-elect Kennedy Stewart addresses supporters in Vancouver on Sunday, Oct. 21, 2018. THE CANADIAN PRESS/Darryl Dyck
Vancouver mayor says there’s no time to redo details of drug decriminalization plan

Kennedy Stewart says a federal election could see the small window of opportunity close on the city’s bid for an exemption from criminal provisions on simple possession of small amounts of drugs

Premier Mike Horgan received his first dose of a COVID-19 vaccine. (Facebook/John Horgan)
More than 50% of people eligible in B.C. have received 1st vaccine dose

‘We’ve made extraordinary progress together over the past few weeks,’ says Premier Horgan

The Independent Investigations Office of B.C. is investigating the shooting of a Tla-o-qui-aht First Nation woman in the Ucluelet First Nation community of Hitacu on May 8. (Black Press Media file photo)
Indigenous woman shot by police was holding a replica gun, says Ucluelet First Nation

Woman has been identified as a member of the Tla-o-qui-aht First Nation

Most Read