LONDON, Ont. — A massive privacy breach — in which Elections Ontario staff lost USB data sticks with personal information on as many as 2.4 million voters — is a stunning case of how abysmally public bodies handle private data, a leading technology analyst says.

“This is a perfect example of what not to do,” said Carmi Levy, a London, Ont.-based independent technology analyst and journalist. “Despite citizens wishing that the government leads in this area, in fact the government often trails.”

The data sticks contain names, addresses and birthdates of voters in as many as 25 ridings, including Simcoe-Grey.

But Elections Ontario said Tuesday it isn’t sure exactly which ridings. It’s narrowed the list to 49.

“To our knowledge, no information has been improperly accessed,” said Greg Essensa, chief electoral officer of Ontario.

To read the data would require Elections Ontario or specialized commercial software, he said.

“However, I want to exercise the highest degree of caution.”

Essensa also said Ontarians can go to the information and privacy commissioner’s website at ipc.on.ca to learn more about how they can protect the privacy of their personal information.

That last bit of advice is “the height of irony,” Levy said.

Governments have shown they’re far less adept at electronic security than many businesses and individuals, he said.

“It’s a safe bet to say they dropped the ball on a number of levels and they got caught,” he said. “It shows how easy it is to lose control of vast amounts of data.”

Levy said even the best information-security policies “are simply words on paper” unless they’re enforced.

The USB drives were supposed to be password-protected, encoded and kept in a locked area accessible only to specific staffers. But these drives were not password-protected or encoded. And somehow, when the office area was being treated for mould in April, they weren’t in a secure area either and someone realized that the two USB drives had gone missing.

That prompted Elections Ontario to conduct a search, an internal investigation and then a third-party review.

Forensic security firm Inkster Incorporated discovered several flaws, including that standard data-security steps had been overlooked or ignored; encryption software available on the drives hadn’t been activated; and information was often transferred back and forth between secure laptops and insecure portable drives.

In addition, all staff members shared the same default password until after the USB sticks went missing -- something Inkster said called “a poor practice and a security risk.”

Essensa released a preliminary report and public apology on Tuesday.

The privacy breach is unprecedented and the largest in Ontario history, said Ontario Privacy and Information commissioner Ann Cavoukian, who said her investigation will take several weeks.

Sam Trosow, associate professor of law at Western University and a specialist in information policy, said the breach has a potential for identity theft.

“The birthdates bother me more than anything ... Having that information linked to my name can lead to the ability to discover other information.”

Voters’ lists in the U.S. are public information, even voters’ addresses and political affiliation. They don’t include birthdates, Trosow said.

“Every agency that’s holding personal data has to be aware of their responsibility in protecting it.”

Ottawa-Vanier MPP Madeleine Meilleur called it “troubling news.”

“Privacy is of outmost importance,” Meilleur said. “We hope this is investigated promptly to resolve this issue and to ensure that mistakes like this don’t happen in the future.”

- with files from Marlo Cameron

 

 

FACTBOX:

 

The ridings possibly affected by the breach are:

 

Essex

 

Etobicoke Centre

 

Kingston and the Islands

 

Nipissing

 

Ottawa West-Nepean

 

Stormont-Dundas-South Glengarry

 

Whitby-Oshawa

 

Ajaz-Pickering

 

Bruce-Grey-Owen Sound

 

Windsor West

 

York Centre

 

York West

 

Burlington

 

Davenport

 

Don Valley East

 

Don Valley West

 

Algoma-Manitoulin

 

Etobicoke Lakeshore

 

Etobicoke North

 

Haliburton-Kawartha Lakes-Brock

 

Ancaster-Dundas-Flamborough-Westdale

 

Halton

 

Hamilton Centre

 

Kitchener Centre

 

Kitchener-Conestoga

 

London-Fanshawe

 

London North Centre

 

London West

 

Mississauga South

 

Mississauga-Streetsville

 

Nepean-Carleton

 

Nickel Belt

 

Northumberland-Quinte West

 

Ottawa South

 

Ottawa-Vanier

 

Peterborough

 

Picking-Scarborough East

 

Prince Edward-Hastings

 

Sarnia-Lambton

 

Sault Ste. Marie

 

Brampton West

 

Scarborough-Agincourt

 

Simcoe-Grey

 

Simcoe-North

 

Brant

 

Timiskaming-Cochrane

 

Timmins-James Bay

 

Toronto Centre