UVic employee data theft preventable, says second external audit

Former privacy commissioner gives university 29 recommendations to boost security measures, employee training

A detailed privacy review, commissioned by the University of Victoria after confidential employee information was stolen in January, says the major data breach was a preventable incident.

The report, written by the province’s former Information and Privacy Commissioner David Flaherty, lists 29 recommendations to prevent similar incidents in the future.

“This major data breach should not have happened if the established data loss prevention and protection measures had been followed. In my view, the university was prepared to prevent such an occurrence,” Flaherty wrote in his report, released Friday.

On January 7 or 8, thieves targeted the payroll department in the non-alarmed Administrative Services Building, and stole a number of electronics. Among them was an unencrypted USB flash drive.

That flash drive held the names, banking information and social insurance numbers of all 11,841 employees on UVic’s payroll since 2010.

Given the volume of sensitive information on the device, “(the) protections in place for the flash drive were not ‘reasonable’ in the circumstances,” Flaherty wrote. The device was stored in a locked room, in a locked safe, in a locked cabinet.

Flaherty’s report came two months after the province’s current Information and Privacy Commissioner released similar investigative findings.

Elizabeth Denham said there is “no rationale” that the information wasn’t digitally secure, and that the university breached the Freedom of Information and Protection of Privacy Act when it failed to protect its employees’ personal information.

Flaherty’s report, covers a wide scope of recommendations, from administrative duty priorities to auditing security measures.

Among Flaherty’s recommendations is mandatory annual privacy and security training for all university non-academic staff who handle personal information.

“Existing … materials demonstrate that plenty of university training has been prepared, but evidently it was not targeted well enough, or repeated often enough, to prevent inadequate security practices that resulted in a data theft and a major breach,” he wrote.

He also recommended that the university continually invest in hardware and software to protect data that requires security. And back-up data should be stored off site.

“The stolen USB flash drive should not have been stored on campus in the first place, since its main purpose was business continuity … in the event of a natural disaster or other disruption, including flooding of buildings and labour strife,” Flaherty wrote.

Additionally, he recommended the university stop storing social insurance numbers.

“Data minimization has to become more than a buzzword at the university. … The stolen USB flash drive did not have to include social insurance numbers, because other means of unique identification were in place,” Flaherty wrote. “Payroll put the numbers on the flash drive for purposes of convenience in the event of a crisis. The unwise thought was that the employed would remember their SIN but not their (work ID) number.”

An attached internal assessment, conducted by UVic professor Jamie Cassels, reads that the university responded well to the data breach.

The activities and planning processes underway do demonstrate that steps are being taken to identify and catalogue storage systems containing personal information, and to assess and improve the protection of that information.

“They show that the university has plans for reviewing information security, physical security, privacy and records management policies on an ongoing basis,” Cassels wrote. “The various activities and initiatives, planned and ongoing, all seem appropriate, effective and sufficient.”

A press release from UVic says they are “considering how best to implement (Flaherty’s) recommendations,” and added that they have already taken some preventative steps.

A Saanich police investigation into the theft is still ongoing.

The majority of the electronics that were stolen were recovered in late January, but the flash drive in question is still outstanding. They were found destroyed in a garbage bag in a Canada Post drop box atop Bear Mountain in Langford.

Affixed to the bag was a dubious apology note: “The information on these devices was not copied, distributed, or exploited. We want to part of everyday people living in fear that their personal information is being used against them to take they’re (sic) hard earned money,” the letter read. But police aren’t buying it.

“We think this is a ruse by someone who wants to allay the public’s fears. But what they may have done is transferred the data, they’ll sit on it, and then go ahead and start defrauding people in a couple of months,” said Sgt. Dean Jantzen said in January.

Police say four current and former UVic employees claimed to have money stolen from their bank accounts following the data breach, but investigators have since determined three incidents to be unrelated. The fourth cannot be confirmed or discredited as being related to the data theft.

To read Flaherty’s full report, and see a list of all 29 recommendations, visit uvic.ca/infobreach.

kslavin@saanichnews.com

Just Posted

An example of the forest land in the Port Renfrew and Fairy Creek area of Vancouver Island is shown on May 11, 2021. THE CANADIAN PRESS/Jen Osborne
Old-growth logging opponents launch hunger strike as arrests continue at Fairy Creek

Zain Haq says the hunger strikers will gather today at Burrard Street in downtown Vancouver

The City of Victoria is hoping to ring in the summer by celebrating local art and offering some distanced, live music to surprise people in parks, plazas and other public spaces. (Photo courtesy of the City of Victoria)
Live, pop-up concerts and local art being showcased in Victoria this summer

People will see surprise serenades at 16 locations throughout the summer

An example of the forest land in the Port Renfrew and Fairy Creek area of Vancouver Island is shown on May 11, 2021. THE CANADIAN PRESS/Jen Osborne
Old-growth logging opponents launch hunger strike as arrests continue at Fairy Creek

Zain Haq says the hunger strikers will gather today at Burrard Street in downtown Vancouver

The 14th annual Oak Bay Young Exceptional Star (YES) awards June 3. (Christine van Reeuwyk/News Staff)
Oak Bay celebrates its Young Exceptional Stars with outdoor award ceremony

Nine young people recognized in 14th annual awards

Jada Benwell and Connor Larkey are the valedictorians of the 2021 graduating class at Parkland Secondary School. (Wolf Depner/News Staff)
Pandemic taught lessons in perseverance for North Saanich high schoolers

Parkland Secondary School to release 2021 grad ceremony video on June 25

Canadian Prime Minister Justin Trudeau participates in a plenary session at the G7 Summit in Carbis Bay, England on Friday June 11, 2021. THE CANADIAN PRESS/Adrian Wyld
Canada donating 13M surplus COVID-19 vaccine doses to poor countries

Trudeau says the government will pay for 87 million shots to be distributed to poor countries

Premier John Horgan speaks as provincial health officer Dr. Bonnie Henry, right, and health minister Adrian Dix look on during a press conference to update on the province’s fall pandemic preparedness plan during a press conference from the press theatre at Legislature in Victoria, Wednesday, Sept. 9, 2020. THE CANADIAN PRESS/Chad Hipolito
B.C. officials to provide details on Step 2 of COVID reopening plan Monday

Step 2 could allow for larger gatherings and a resumption of recreational travel

Indigenous Services Minister Marc Miller is seen during a news conference, Wednesday May 19, 2021 in Ottawa. THE CANADIAN PRESS/Adrian Wyld
Indigenous child-welfare battle heads to court despite calls for Ottawa to drop cases

Feds are poised to argue against two Canadian Human Rights Tribunal rulings

The Great Ogopogo Bathtub Race has been held in Summerland as a fundraising event. Do you know which Canadian city introduced this sport? (Black Press file photo)
QUIZ: A summer’s day at the water

How much do you know about boats, lakes and water?

Two-year-old Ivy McLeod laughs while playing with Lucky the puppy outside their Chilliwack home on Thursday, June 10, 2021. (Jenna Hauck/ Chilliwack Progress)
VIDEO: B.C. family finds ‘perfect’ puppy with limb difference for 2-year-old Ivy

Ivy has special bond with Lucky the puppy who was also born with limb difference

A million-dollar ticket was sold to an individual in Vernon from the Lotto Max draw Friday, June 11, 2021. (Photo courtesy of BCLC)
Lottery ticket worth $1 million sold in Vernon

One lucky individual holds one of 20 tickets worth $1 million from Friday’s Lotto Max draw

“65 years, I’ve carried the stories in my mind and live it every day,” says Jack Kruger. (Athena Bonneau)
‘Maybe this time they will listen’: Survivor shares stories from B.C. residential school

Jack Kruger, living in Syilx territory, wasn’t surprised by news of 215 children’s remains found on the grounds of the former Kamloops Indian Residential School

A logging truck carries its load down the Elaho Valley near in Squamish, B.C. in this file photo. THE CANADIAN PRESS/Chuck Stoody
Squamish Nation calls for old-growth logging moratorium in its territory

The nation says 44% of old-growth forests in its 6,900-square kilometre territory are protected while the rest remain at risk

Most Read