Wednesday, January 14, 2015

Saanich council fumbles the computer surveillance issue

Saanich council is doing a lousy job of dealing with the suburb´s bizarre political problems.
Mayor Richard Atwell complained to Saanich police on Dec. 15 that spyware had been installed on his office computer without his knowledge.
Police investigated and, apparently, decided to hire former B.C. police complaints commissioner Dirk Ryneveld for advice. They concluded no Criminal Code offence had been committed, and reported to council behind closed doors on Monday. Council released a statement Tuesday.
But it was a lame effort. Weasel words and lack of clarity are warning signs in this kind of situation.
The statement said security software had been installed on ¨a number of District of Saanich computers, including the office computer of Mayor Atwell.¨
How many computers? Three, 10, 30? Was the software placed on any councillors´ computers, or just the mayor´s? A complete report would have answered those questions.
The spyware was placed on the computers in ¨late November,¨  the statement said, based on recommendations  in a May 2014 computer system audit.
The action was after the election. An explanation of why it took six months to deal with a computer security problem, an issue that should be taken seriously, would be welcome. So would evidence – a purchase order for the software from August, for example – to show this wasn´t launched after Atwell won. Given his allegations, answering all those questions fully should have been important.
The decision that no Criminal Code charges were warranted is correct. The law lets employers spy on private communications  to protect a computer system.
But Atwell might have had better luck with a complaint to the B.C. Information and Privacy Commissioner.  B.C. privacy regulations allow overt computer monitoring by employers as a matter of course if employees are told, before the process begins, what is allowed and what isn´t and how they will be monitored. The surveillance is broad – things like websites visited.
The rules are much stricter around covert monitoring, commissioner Elizabeth Denham said in a release this week.  “This type of monitoring could take the form of tracking Internet use, logging keystrokes, or taking screen captures at set intervals as part of ongoing monitoring.¨
It´s only allowed when there is a specific investigation into wrongdoing and only after all less invasive investigative measures have been exhausted, she notes.
So far, the privacy office has found all cases of covert monitoring unjustified. None have been found to be within the province´s privacy law.
Which raises two issues.
First, Coun. Judy Brownoff said Saanich has a well-known policy that tells employees their computers may be monitored. Council should have produced that policy and shown that it was shared with Atwell and other people whose computers were being monitored under the new program.
Second, it´s unclear what sort of monitoring Saanich is doing under the initiative launched in November. Given the controversy, and the capabilities of the software apparently being used, council should have determined and reported on its security activities, especially in reference to the issue of covert versus overt surveillance as defined by the privacy commissioner.
I´m not choosing sides. Atwell´s tenure has been a mess, starting with the destructive, arrogant and expensive effort to force out the city manager.
But that simply makes it all the more important that council do its job well. It didn´t this week.

13 comments:

Michael Geoghegan said...

Section 184 of the Criminal Code makes it clear that what Saanich did was illegal. As for the dismissal of the CAO it was a hostile council that made it such a mess, Mayor Richard Atwell retained lawyer Troy DeSouza and tried to do things in a professional manner.

paul said...

Not really, Michael. We don´t know what Saanich has or hasn´t done, and Sect. 184 gives organizations a lot of latitude in monitoring computer use. (Unlike BC privacy laws.)
And Richard Atwell´s attempt to force the city manager out was wrong on every level. Council hires and fires under the COmmunity Charter, not the mayor.

Michael Geoghegan said...

Yes which is why Mayor Atwell tried to discuss the resolution of this matter with council but was rebuffed. In any event a good column far more insightful than what we are getting from our local TC newspaper.

Bryan Gilbert said...

Did you see this? https://www.oipc.bc.ca/news-releases/1740 “The second type of monitoring is covert, which is done without an employee’s knowledge. This type of monitoring could take the form of tracking Internet use, logging keystrokes, or taking screen captures at set intervals as part of ongoing monitoring. The threshold for covert monitoring is very high, and may be part of a specific workplace investigation once all other less intrusive measures have been exhausted.
“Decisions about whether employee monitoring is authorized under privacy law are context-specific and will depend on the circumstances of each case. That being said, there have been no cases brought before this Office where covert monitoring was found to be justified under privacy law."

Liza Miles said...

Well said. For those of us who voted in change I am appalled at the current goings on and, in my opinion the attempt to discredit the new mayor for personal reasons by the old guard.

Michael Geoghegan said...

http://mgcltd.blogspot.ca/2015/01/respected-former-councilor-carol-pickup.html?spref=fb

Anonymous said...

it would be nice to get objective news on this, but it doesn't seem as if the Time colonist is capable of that. No one is coming off looking good on this. It would be interesting to find out whether this is a case of old boys being unhappy about losing power or is there something to hide.

Unknown said...
This comment has been removed by a blog administrator.
Smith said...
This comment has been removed by a blog administrator.
Paul william said...
This comment has been removed by a blog administrator.
Paul william said...
This comment has been removed by a blog administrator.
Paul william said...
This comment has been removed by a blog administrator.
Paul william said...
This comment has been removed by a blog administrator.