Friday, January 29, 2010

Bureaucrats bungled privacy breach, review finds

The first reviews into a major privacy breach last year paint a picture of government bumbling that's so bizarre it's literally had to believe.
Imagine the police show up at your workplace and arrest an employee. That's what happened in the Ministry of Children and Families in Victoria last April 7.
They took him away and, armed with a search warrant, went through his house. The next day, the RCMP told the ministry they had found government files with names, addresses, social insurance numbers and other personal information in his house - everything needed for identity theft.
Anywhere I've worked, that would be a big deal. For sure, the bosses all the way up the chain would be told about it by the line managers.
Not in government. His bosses told him to stay home for a few days and then he was sick for a couple of weeks. His manager met with an HR person and talked about the kind of files found in his home. They never noticed, apparently, that the files were actually from the Housing Ministry, which the employee had transferred from 18 months earlier.
So they concluded he had just taken some work home. He was back on the job April 27.
They weren't the only ones to know about the investigation. The Finance Ministry risk management officers had been told in February. They never took the issue anywhere near senior management either.
That's baffling. Either those involved were incompetent, government bureaucracy is incredibly rigid or people have decided its best, for whatever reason, to keep the senior managers in the dark. Or they were hoping to cover up the problem. (The last assumption is supported by the fact that even though managers were advised to report the breach to the privacy commissioner in July, they didn't.)
Three weeks after the employee returned to work, his managers and the HR people got around to a meeting to talk about why police had arrested him.
The issue wasn't just about the files. The government had hired the man as Richard Ernest Wainwright. But the RCMP found had two drivers' licences, the other in the name of Richard Perran.
At the May meeting, he was asked about that. He wanted to distance himself from his past, Wainright said. But the stunningly incurious managers didn't ask him why. They didn't ask why he had the files at home. They seem, based on the review, quite useless.
By July, the managers knew more. As Perran, he had a criminal record from 2006 for fraud and identity theft.
Again, most managers might have considered that, those files and the RCMP investigation and, even if they didn't do anything, alerted more senior managers - probably the deputy minister, the top manager in the ministry.
But they didn't. Wainwright was a good employee so they decided to support him.
Finally, in August, an assistant deputy minister in the housing ministry was briefed on everything - the criminal record, the files, the fact there was no reason for him to have them. The ADM did nothing and didn't act on a recommendation that he notify the Ministry of Children and Families.
On Oct. 16, finally, the employee was suspended without pay.
On Oct. 20, Citizens Services Ben Stewart - and the Public Affairs Bureau - were notified. The employee was fired. So was his wife, who also had a sensitive job.
But the public wasn't told about any of this.
And it took until Dec. 4 - and a lot of pressure - before the government announced reviews of all this.
They found, unsurprisingly, that had been a big mess.
"The entire course of events is illustrative of a series of missed opportunities and inaction, related to gaps in information, mistaken assumptions, limited knowledge and insufficient awareness," the review found.
There were lots of meetings, but departments didn't share information, managers didn't seek answers to obvious questions and no one acted. No one would be fired, because no one did anything glaringly wrong, the government says.
Read the reviews on the citizens' services ministry website. You'll feel much more nervous about government's competence.
Footnote: These were internal reviews. A more useful report could come from the province's privacy commissioner. But that has been delayed, in part because the government hired commissioner David Loukidelis as deputy attorney general but failed to have a replacement acting commissioner in place immediately.


Norman Farrell said...

Isn't this the government that praises its own good business and management skills?

Paul, are you old enough to remember the faded old concept of individual ministerial responsibility?

This eroded tradition held that cabinet ministers bear the ultimate responsibility for actions of their ministry. They were expected to resign in the event of misdeeds by anyone in the department. Allegedly, that promoted closer scrutiny of underlings within the department

paul said...

I am that old. A Times Colonist editorial in November called for Stewart to resign.
Be accountable for the breach


"Citizens' Services Minister Ben Stewart should resign over the government's handling of a security breach that exposed 1,400 British Columbians to the risk of identify theft and fraud.
Stewart is not necessarily responsible for the fact that an employee took sensitive personal information home, although the act raises questions about safeguards to protect individual privacy.
But he is responsible for the government's subsequent actions, including the lengthy delay in notifying the 1,400 people that their privacy had been compromised and identity theft was possible. He is accountable because, weeks after being notified, he has no answers about how this happened."
The rest is at

Anonymous said...

All this from the most open and accountable government in B.C's history. What a bad joke this government has become. That's what happens when corporate criminals are put in charge.

Anonymous said...

Paul, please look at this news report from the Interior a couple weeks ago. You may see some disturbing trends in this government.

Anyone who reads this Jan 6, 2010 article from the Kamloops Daily News, should ask themselves how it is that a video of an elderly person being assaulted in care can be "permanently banned" to the extent that the contents cannot even be described by anyone - ever.

How is it that a Health Authority can have such power, and that the acts captured on that video are not subject to government or police investigation? No staff were called to account, no police investigation, nothing. Does staff privacy trump everything else, including the safety of elders in care? This is beyond bizarre, it's downright frightening.

What these incidents reveal is a pattern of Campbell's "leadership". Ostensibly these actions (ignoring criminal wrong-doing, permanent bans on videos showing care staff abuse of elderly patients) are taken to "protect staff" but in reality this absence of "curiosity" by government managers is being done to protect the government organizations.

What is actually going on is that the civil service (and the police) are being turned into agents of the politicians in power, and not of the people. This is not simply a coincidence of incidents of astounding ignorance on the part of professional government managers.

Oh yes, and did the other media pick up this Kamloops story? Nope. What is going on in BC?

Anonymous said...

The previous poster stated "this is not simply a coincidence of incidents of astounding ignorance on the part of professional government MANAGERS". Quite so! In keeping with the Campbell govt. corporate attitude, the ranks of Managers and Executives have swelled as has their salaries. The people of BC are not getting value for this money. Meanwhile, the current job cuts and the ones to come are mostly at the worker/ front line level, the civil servants actually looking to serve the people of BC. Sad.

Anonymous said...

I hope you`re all enjoying your golden decade, you deserve it.

Anonymous said...

Why is it that there was no calls for accountability or even editorials calling for the captain to do the honourable thing when the Queen of the North sank? Why such a double standard ? Lives were lost when the Queen of the North sank and nobody seems to care to this very day that the Captain has refused to come forward and take the responsibility for his ship. I suppose had there been personal records from welfare clients on the ships bridge when it went down, then maybe it might be more of a big deal.

Anonymous said...

Maybe the last poster doesn't get it, or doesn't want to. His comparison would make more sense if the ship's captain had a previous record for being impaired at the helm of a ship during a prior collision; changed his name to get a new captain's position; was still known to be having problems staying away from alcohol; and the ferry authority and senior bureaucrats in several government ministries had known about it for several months before the Queen sank...well then, OK.