Saanich council fumbles the computer surveillance issue

Saanich council is doing a lousy job of dealing with the suburb´s bizarre political problems.

Mayor Richard Atwell complained to Saanich police on Dec. 15 that spyware had been installed on his office computer without his knowledge.

Police investigated and, apparently, decided to hire former B.C. police complaints commissioner Dirk Ryneveld for advice. They concluded no Criminal Code offence had been committed, and reported to council behind closed doors on Monday. Council released a statement Tuesday.

But it was a lame effort. Weasel words and lack of clarity are warning signs in this kind of situation.

The statement said security software had been installed on ¨a number of District of Saanich computers, including the office computer of Mayor Atwell.¨

How many computers? Three, 10, 30? Was the software placed on any councillors´ computers, or just the mayor´s? A complete report would have answered those questions.

The spyware was placed on the computers in ¨late November,¨  the statement said, based on recommendations  in a May 2014 computer system audit.

The action was after the election. An explanation of why it took six months to deal with a computer security problem, an issue that should be taken seriously, would be welcome. So would evidence – a purchase order for the software from August, for example – to show this wasn´t launched after Atwell won. Given his allegations, answering all those questions fully should have been important.

The decision that no Criminal Code charges were warranted is correct. The law lets employers spy on private communications  to protect a computer system.

But Atwell might have had better luck with a complaint to the B.C. Information and Privacy Commissioner.  B.C. privacy regulations allow overt computer monitoring by employers as a matter of course if employees are told, before the process begins, what is allowed and what isn´t and how they will be monitored. The surveillance is broad – things like websites visited.

The rules are much stricter around covert monitoring, commissioner Elizabeth Denham said in a release this week.  “This type of monitoring could take the form of tracking Internet use, logging keystrokes, or taking screen captures at set intervals as part of ongoing monitoring.¨

It´s only allowed when there is a specific investigation into wrongdoing and only after all less invasive investigative measures have been exhausted, she notes.

So far, the privacy office has found all cases of covert monitoring unjustified. None have been found to be within the province´s privacy law.

Which raises two issues.

First, Coun. Judy Brownoff said Saanich has a well-known policy that tells employees their computers may be monitored. Council should have produced that policy and shown that it was shared with Atwell and other people whose computers were being monitored under the new program.

Second, it´s unclear what sort of monitoring Saanich is doing under the initiative launched in November. Given the controversy, and the capabilities of the software apparently being used, council should have determined and reported on its security activities, especially in reference to the issue of covert versus overt surveillance as defined by the privacy commissioner.

I´m not choosing sides. Atwell´s tenure has been a mess, starting with the destructive, arrogant and expensive effort to force out the city manager.

But that simply makes it all the more important that council do its job well. It didn´t this week.