Poor security controls led to camera breach at Nova Scotia school, report finds

The Canadian Press
Thursday October 12, 2017
Written by The Canadian Press
HALIFAX — Inadequate passwords and insufficient technical controls led to video surveillance images of Cape Breton schoolchildren being live streamed on the internet, Nova Scotia's information and privacy commissioner says.
 
Catherine Tully's report says the video system at the Rankin School of the Narrows in Iona, N.S., was breached when a link to the live feed from one school camera was picked up and distributed by a Russian website that specializes in linking non-secured video surveillance cameras.

Tully says an unsecured technical vulnerability enabled viewers to access the school's other two cameras as well.
The report says the Cape Breton-Victoria Regional School Board changed the passwords on its cameras once it learned of the breach, however Tully found the board still hasn't implemented adequate technical or administrative controls to reduce the risk of future breaches.

“If video surveillance is used, it must be properly secured,” Tully said in a news release.

“When video surveillance images from the Rankin school were streamed on the internet for all to see, this was a violation of Nova Scotia's privacy laws. Video surveillance images of schoolchildren streaming unsecured to the internet created a risk to student safety.”
 
Tully began her investigation in May after it was revealed that detailed images of pupils at the school, aged five to 18, were appearing on the website.

Her report, released Thursday, recommends several changes to the board's technical security practices.

They include the development of a privacy breach policy, the securing of cameras behind a firewall, the replacement of two exterior cameras, and the immediate disabling of a video surveillance camera outside the boys' washroom at the school.

The report also considers the school board's rationale for using video surveillance. Tully found that the board hadn't established whether its system is legally authorized under the Freedom of Information and Protection of Privacy Act.
Tully said all school boards in the province had implemented video surveillance without conducting a privacy impact assessment to ensure compliance with the law.

She notes boards have used surveillance tools as the technology has become cheaper and easier to use in order to “ensure the safety of children.”
 
Tully said safety is of “fundamental importance,” but video surveillance is highly invasive.

“It is essential that school boards conduct a thorough privacy impact assessment of their video surveillance systems in order to find the proper balance between ensuring the safety of children while respecting their privacy,” she said.

The Cape Breton-Victoria Regional School Board has 30 days to respond to the commissioner's recommendations.

— Keith Doucette

News from © Canadian Press Enterprises Inc. 2017

Add comment


Security code
Refresh

Subscription Centre

 
New Subscription
 
Already a Subscriber
 
Customer Service
 
View Digital Magazine Renew

Latest Events

CPTED Basic (Level 1)
October 23-25, 2017
CPTED Advanced (Level 2)
October 26-28, 2017
Anixter Showcase
October 27, 2017
SecTor 2017
November 13-15, 2017
ISC East
November 15-16, 2017