The Nova Scotia government received a cyber-security award this week.
But it wasn’t a good one.
The Electronic Frontier Foundation, an online non-profit group championing privacy, free expression and innovation, handed the government and police in Halifax the 2019 What the Swat? award.
The award stems from the arrest of a 19-year-old Halifax man in April for accessing 7,000 documents from the province’s freedom of information website. Data accessed included birth dates, social insurance numbers, addresses and government-services client information.
Police charged the man with unauthorized use of a computer.
“The Canadian teen had just downloaded a host of public records from openly available URLs on a government website,” reads the award notification.
“At the heart of the ordeal was some seriously terrible security practices by Nova Scotia officials.”
Though the data was all supposed to be private personal information, the government had been storing it on a website that only required the changing of a number in the URL to access.
At the time, Internal Services Minister Patricia Arab said of the data breach, “This is not great news.”
The charges were later dropped.
“What Nova Scotian officials should have done upon learning about leaks in their own public records website’s problems was apologize to the public, thank the teen who found these gaping holes in their digital security practices, and implement proper restrictions to protect people’s private information,” reads the award.
“They didn’t do any of that, and instead sought to improperly bring the force of Canada’s criminal hacking law down on the very person who brought the problem to light.”
During Thursday’s question period, the opposition pounced on the government over the award and the incident.
“Unfortunately, because of this government’s inept handling of the FOIPOP portal, we are being recognized internationally for terrible security practices,” PC MLA Chris d’Entremont said. “For almost a year, this situation has been an embarrassment.”