ONE LIE IS ENOUGH TO QUESTION ALL TRUTHS.
2020: NO PASSWORD REQUIRED: CAS whistleblower cleared of hacking charges. By Gary Dimmock.
Denham’s life took a rapid turn in April 2016 when police broke through her garage door to execute a search warrant to seize phones, computers, a gaming system, and USB sticks — anything that could store evidence related to her access to the website.
In the early-morning raid, Denham said they put her husband in handcuffs.
“I woke up to police in my bedroom and after I yelled for them to take the ‘cuffs off of him, they did. They also wouldn’t let me call a lawyer.”
Kelley Denham was accused of hacking confidential information from the Family and Children's Services of Lanark Leeds, and Grenville website. The courts have exonerated her. WAYNE CUDDINGTON / Ottawa Citizen/ Postmedia.
She was found not guilty on several charges:
• Mischief over $5,000 (section 430 (1) of the Criminal Code of Canada (CCA);
• Mischief of data (section 430 (5) of the CCA);
• Unauthorized use of a computer (section 342 of the CCA);
• Publication of identifying information (section 85 (3) of the Child and Family Services Act of Ontario — CFSA); and,
• Another charge under section 76 of the CFSA, referring to identifying parties to a protected hearing.
MAR. 21, 2018 THE FOLLOWING CHARGES AGAINST KELLEY DENHAM WERE DROPPED:
1) Theft under $5000 - s. 334 Criminal Code of Canada
2) Traffick in identity Information - s. 402.2(2) Criminal Code of Canada
After a completely impartial four-month investigation (?), Denham was charged with hacking and identifying children involved in court proceedings, when in fact she did neither, and earlier this week Ontario Court Justice Charles D. Anderson acquitted her of all charges and cleared her name after trial.
The SF police claimed to have taken four months to investigate a crime that never happened...?
When Denham first publicized the absence of security on the child-welfare agency’s website, they shut it down and figured it was time to hire a computer security expert.
At the time, the agency’s program manager in charge of the website was Margaret Row. The child-welfare agency hired Margaret Row’s son-in-law, David Schmidt, to investigate what happened and fix any breach of security even though there wasn’t one, according to undisputed facts in the judge’s decision.
(WHY DIDN'T FCSLLG CALL THE MINISTRIES CYBERSECURITY EXPERTS AT NO EXTRA COST TO THEIR BUDGET AND THE TAXPAYERS?)
The judge noted that the CAS did not take appropriate measures to secure private information. The judge also noted there were no special computer skills or deception required to access the files, which were not marked as confidential and came with no warnings or disclaimers.
The information was publicly available, the judge ruled. He said there was no hacking and Denham didn’t break any Children’s Aid Society (CAS) laws about identifying children involved in court proceedings.
https://ottawacitizen.com/news/local-news/it-was-four-years-of-my-life-on-hold-cas-whistleblower-cleared-of-hacking-charges
https://www.insideottawavalley.com/news-story/10014328-smiths-falls-kelley-denham-acquitted-in-family-and-children-s-services-computer-case/
https://www.recorder.ca/news/local-news/cas-whistleblower-acquitted
https://canoe.com/news/local-news/it-was-four-years-of-my-life-on-hold-cas-whistleblower-cleared-of-hacking-charges/wcm/2f3b7325-e10e-438e-add8-c078b7508921
https://fcsllg.ca/wp-content/uploads/2019/09/2018-2019-FCSLLG-Annual-Report-2019.pdf
:::
2016: Police probe leak of IDs of Lanark, Leeds and Grenville children's aid clients over web.
Lemay said the person behind the breach is likely a disgruntled client who was “looking to embarrass us.”
(SO WHO'S THE DISGRUNTLED PARTY NOW ?)
Family and Children’s Services of Lanark, Leeds and Grenville "learned" of the breach at 1:42 p.m. on Monday after the agency was notified by a client and a member of the community that the members-only Smiths Falls Swapshop Facebook page had a link to the list of names, said Family and Children’s Services executive director Raymond Lemay.
The agency immediately contacted police and other authorities and worked with them to contain the breach.
“To the best of our knowledge the file is no longer live, but we are having the situation monitored.” (YOU SHOULD SEE THE BIG BOX OF FAMILY'S UNITED POSTS THAT ARE RUMORED TO HAVE BEEN COLLECTED BY TAMMY SHEPHERD OF FCSLLG)
Lemay said there was a previous breach of the agency in February which did not involve the release of confidential information.
Ransomware attacks hit two Ontario children’s aid societies
(One lie is enough to question all truth! Big or small, lies are lies!)
Family and Children’s Services of Lanark, Leeds and Grenville — alleged they saw an English ransom message flash on their computer screens, demanding $60,000, when they tried to access their database in November.
“It encrypted most of our servers,” says the Lanark agency’s executive director, Raymond Lemay. “No data was taken out of our system. It was just an attempt by whatever you call these people to get a ransom.”
Lemay says his agency didn’t pay up. He says it used an offline backup of computer files to get the agency up and running again in about eight hours.
Cybersecurity experts from the province’s Ministry of Children and Youth Services, along with a private internet security firm, swooped into the agency to neutralize the malware in the infected servers.
“It took them about three weeks to find the needle in the haystack,” Lemay says.
The ransomware attack locked the agencies out of local online files that contained private information on the children and families they serve.
https://www.thestar.com/news/insight/2018/02/22/ransomware-attacks-hit-two-ontario-childrens-aid-societies.html
https://www.cira.ca/blog/cybersecurity/weekly-web-security-warning-even-children-arent-safe
http://www.safetravelsmagazine.com/2018/02/26/quick-read-ransomware-attacks-hit-two-ontario-childrens-aid-societies/
The person responsible was a children’s aid client who has been embroiled in a campaign against the agency, including posting hours-long YouTube videos of her interactions with members of the staff that can be seen here: https://www.youtube.com/channel/UCjZ_knKT_FWLiUecMh3FFbw
(AND WHO'S EMBROILED IN A CAMPAIGN AGAINST WHO?)
Not only did FCSLLG allege to the media Kelley Denham/Jane Doe Hacker had committed a number of criminal acts resulting in Denham being charged, FCSLLG also initiated a complaint against Denham with the Ontario college of social workers and launched a claim for damages against Denham should the class action members be awarded any damages.
http://www.casprivacybreach.com/
https://ottawa.ctvnews.ca/names-of-285-people-referred-to-children-s-aid-in-lanark-leeds-and-grenville-posted-online-1.2865944
Emotions regarding Children’s Aid Societies can run high, but there is no excuse for anyone to deliberately expose clients, said Lemay. Although there have been other examples of clients who have taken their disputes with children’s aid societies to the internet, Lemay know of no other incidents in which confidential lists of names have been released.
The February breach was investigated and the agency’s data systems were reviewed by an external consultant, who assured the agency that its documents were secure.
The woman involved also received a lawyer’s letter.
“She had to know that this was illegal,” said Lemay.
The names released in the most recent breach are those of referrals made to the agency between April and November 2015. The list would have been available only to members of the board. The agency typically has about 1,000 clients a year.
Lemay apologized for the release of the information, and said the agency takes privacy very seriously and will take steps to improve its processes and systems.
Caroline Newton, a spokeswoman for the Ontario Association of Children’s Aid Societies, says she is unaware of any other data breach at any of the province’s 47 children’s aid societies. Although there have been cases of children in care or their parents releasing information through social media, Newton can’t recall any recent cases where anyone has been prosecuted for releasing sensitive information.
However, all of the association’s member societies are aware of the need for information to be protected, said Newton. The province is also revamping the Child and Family Services Act.
“We live in an era where there are people determined to hack through security systems. Everybody has to be prepared for it,” said Newton.
Identifying those who are involved with children’s aid is illegal under the Child and Family Services Act. Releasing this information carries a fine of up to $10,000 and three years in jail.
Family and Children’s Services of Lanark, Leeds and Grenville is answering questions from the public and current and former clients at 1-855-667-2726.
WATCH THE VIDEO: "The authors of their own misfortunes."
The audio in the video is a copy of the non-emergency call obtained through the freedom of information act that sent three police officers racing through the streets of Smiths Falls one beautiful Monday morning about five years ago. The events in this video were the beginning of Families United Ontario's advocacy for other families being abused and molested by a system gone terribly wrong.
https://www.facebook.com/FamiliesUnitedOntario/videos/502236246652811/
https://ottawacitizen.com/news/local-news/police-probe-leak-of-ids-of-lanark-leeds-and-grenville-childrens-aid-clients-over-web
Parents Thank Smiths Falls Police After Missing Son Found Safe..
https://unpublishedottawa.com/letter/107146/parents-thank-smiths-falls-police-after-missing-son-found-safe
Ontario CAS Dirty Tricks.
https://unpublishedottawa.com/letter/153438/ontario-cas-dirty-tricks
One lie is enough to question all truths.
:::
Family and Children's services of Lanark, Leeds and Grenville
Mission & Values
MISSION
Our mission is to contribute to the wellbeing of children, youth and families by:
Protecting children and youth from abuse and neglect
Supporting families
Providing a consistent, supportive environment for children and youth
Actively engaging with our community to achieve positive outcomes
VALUES
Our values require us to:
Treat all people with dignity and respect
Collaborate with all to achieve our mission
Integrate learning into all that we do
Be accountable for the valuable resource entrusted to us
VISION
Our Vision is: Every child, youth and family shall live in a safe environment, be valued and have opportunity to develop to their fullest potential.
EVERY PERSON IN ONTARIO HAS A DUTY
Every person in Ontario has a duty to report child abuse if they have reasonable grounds to suspect it is occurring. Don’t hesitate to call us for more information if you think a child needs protection.
If you’d like to volunteer at an upcoming event or make a donation to help us cover our current legal fees and other expenses, please contact us at 1‑855‑667‑2726.
https://fcsllg.ca/about-us/mission-values/
https://fcsllg.ca/accountability/
https://fcsllg.ca/news-events/
:::
The Fascinating Reason Why Liars Keep On Lying.
You know how your mom always told you not to start lying because one fib would lead to more? Part of that age-old advice stems from the simple fact you usually have to keep lying to cover the initial untruths you dished out. But as Alice Park of Time reports, neuroscience now shows that we all should listen to Mom to keep our emotional sense of right, wrong and self, too.
Once a liar, always a liar, the old saying goes. Turns out there’s some scientific truth to that: researchers have tracked down how the brain makes lying easier as the untruths build up, providing some biological evidence for why small lies often balloon into ever larger ones.
In a study published in Nature Neuroscience, Tali Sharot from the department of experimental psychology at University College London and her colleagues devised a clever study to test people’s dishonest tendencies while scanning their brains in an fMRI machine. The 80 people in the study were shown pennies in a glass jar and given different incentives to guide whether they lied or told the truth to a fellow partner about how much money was contained in the jar. In some conditions, both the participant and the partner benefited if the participant lied; in others, just the participant benefited from his fib, or just the partner benefited (with no cost to either). In another set of scenarios, either the participant or partner benefited, but at the expense of the other if the participant lied. In each case, Sharot documented the changes in the people’s brains as they made their decisions.
They found that when people were dishonest, activity in a part of the brain called the amygdala—the hub of emotional processing and arousal—changed. With each scenario, the more dishonestly the participant advised his partner, the less activated the amygdala was on the fMRI. That may be because lying triggers emotional arousal and activates the amygdala (the part of the brain affected in cases of PDST), but with each additional lie, the arousal and conflict of telling an untruth diminishes, making it easier to lie.
Sharot also found that the amygdala became less active mostly when people lied to benefit themselves. In other words, self-interest seems to fuel dishonesty.
“Part of the emotional arousal we see when people lie is because of the conflict between how people see themselves and their actions,” Sharot said during a briefing discussing the results. “So I lie for self-benefit, but at the same time it doesn’t fit the way I want to view myself, which is as an honest person. It’s possible that we learn from the arousal signal…with less emotional arousal, perhaps I’m less likely to see the act as incongruent with my own self perception.”
The researchers were even able to map out how each lie led to less amygdala activation and found that the decrease could predict how much the person’s dishonesty would escalate in the next trial. Biology seems to back up the warnings parents give to their kids: that one lie just leads to another.
https://time.com/4540707/lying-lies-brain/
https://www.inc.com/wanda-thibodeaux/this-brain-study-shows-why-its-so-easy-to-keep-lyi.html
https://www.nationalgeographic.com/magazine/2017/06/lying-hoax-false-fibs-science/
https://www.youtube.com/watch?v=pFQQVXVDgK8
:::
Court Refuses to Apply Liability Policies’ Electronic Data Exclusions, Cites Lack of Jurisprudence.
Laridae v. Co-operators, 2020 ONSC 2198 (CanLII)
Earlier in May, in Laridae v. Co-operators, 2020 ONSC 2198, an Ontario court was hesitant to offer guidance on the proper application of two “electronic data exclusions” that expressly withdrew coverage for the misappropriation and display of electronic information on the internet. At issue were allegations arising from particularly egregious hacking incidents involving a child protection agency’s website. Noting an apparent lack of guiding authority (“there is no jurisprudence on the proper interpretation of data exclusion clauses”), Pollak J. ordered a liability insurer to separately defend the named and additional insureds.
https://www.canliiconnects.org/en/commentaries/71352
https://www.canliiconnects.org/en/cases/2020onsc2198
:::
Canada: Novel Case On Data Exclusion Interpreted In Favour Of Insureds
An Ontario judge recently interpreted a data exclusion in favour of the insureds, ordering the insurer to defend claims arising out of an alleged website security breach.1 A website owned by Family and Children's Services of Lanark, Leeds and Grenville ("FCS"), was breached when an unauthorized party downloaded and published documents stored in a secured section of the website, which contained personal information about individuals who had been the subject of FCS investigations. A broadly worded claim was subsequently brought against FCS, alleging damages resulting from defamation, breach of privacy and other causes of action. Laridae Communications Inc. had provided advice to FCS on the design and security of FCS's website. FCS issued a third-party claim against Laridae.
Footnotes: 1 Laridae v Co-Operators, 2020 ONSC 2198.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
https://www.mondaq.com/canada/insurance-laws-and-products/942318/novel-case-on-data-exclusion-interpreted-in-favour-of-insureds
:::
2020: How the lack of cyber case law worked against an insurer in a $75-million data breach lawsuit.
The lack of cyber case law worked against an insurer in the Ontario Superior Court of Justice recently, with the court deciding that The Co-operators has a duty to defend two parties named in a $75-million cyber breach class action lawsuit.
https://www.canadianunderwriter.ca/insurance/how-the-lack-of-cyber-caselaw-worked-against-an-insurer-in-a-75-million-data-breach-lawsuit-1004179343/
:::
Cyber Crime Investigations: Bridging the Gaps Between Security Professionals, Law Enforcement, and Prosecutors Paperback – April 4 2007.
https://www.amazon.ca/Cyber-Crime-Investigations-Professionals-Enforcement/dp/1597491330
https://www.researchgate.net/figure/Cybercrime-investigation-framework_fig3_312324333
https://www.slideshare.net/karnikaseth/cybercrime-investigations-and-it-act2000
Blackstone's Handbook of Cyber Crime Investigation Paperback – March 30 2017.
This authoritative Handbook provides a clear and detailed introduction to cyber crime, offering you an effective operational guide to the complexities and challenges of investigating cyber-related crimes.
https://cata.ca/2018/cyber-crime-fighting-centres/
Concise and accessible, this book is an ideal reference and resource for all operational police officers, the extended police family and partners working to keep communities safe from the online phenomenon of cyber crime.
https://www.amazon.ca/Blackstones-Handbook-Cyber-Crime-Investigation/dp/0198723903
:::
What Are The Consequences Of Filing A False Report To Your Insurance Company In Canada And To The Police (if your employed by a children's aid society that is)
What are the offences someone can be charged with under the Criminal Code of Canada for filing a false police report or lying to the police?
The offence under the Criminal Code which would be most applicable is committing public mischief under section 140. That section states:
140 (1) Every one commits public mischief who, with intent to mislead, causes a peace officer to enter on or continue an investigation by...
making a false statement that accuses some other person of having committed an offence;
doing anything intended to cause some other person to be suspected of having committed an offence that the other person has not committed, or to divert suspicion from himself;
The purpose of the law is to discourage and punish false reporting and of course to prohibit people from falsely accusing others. Making a false statement transpires when the person makes the statement with the intention of misleading justice. One cannot be convicted if it is determined that they genuinely believed the statement to be true at the time it was made.
In addition to public mischief, there are several other offences under the Criminal Code that a person could find themselves charged with if they file a false police report or lie to the police. These include the following:
Perjury under section 131 of the Code if the person, with intent to mislead, knowingly gives a false statement under oath, affirmation, by affidavit, solemn declaration or deposition;
Fabricating Evidence under section 137 of the Code if the person, with intent to mislead, fabricates anything (such as a police report) with the intent that it shall be used as evidence in a judicial proceeding; and
Obstructing Justice under section 139 (2) of the Code if the person wilfully attempts to obstruct, pervert or defeat the course of justice.
These offences involving the misleading of justice and which include lying to the authorities are taken very seriously. This is clear when looking at the potential and maximum penalties under the Code. Perjury and fabricating evidence are indictable offences with potential prison terms of up to 14 years, while obstruct justice under 139 (2) of the Criminal Code is an indictable offence with a maximum sentence of imprisonment for 10 years.
https://laws-lois.justice.gc.ca/eng/acts/C-46/
The penalties for committing public mischief are outlined at section 140(2) of the Criminal Code. If the Crown Attorney perceives the case as serious and elects to proceed by indictment, then an accused who is found guilty is potentially liable to imprisonment for a term not exceeding five years. If the Crown decides to proceed summarily (less serious case) and an accused is found guilty then they are liable to a fine of not more than five thousand dollars or to a term of imprisonment not exceeding six months or to both. The actual punishment imposed for those convicted will vary according to the facts of each case and the circumstances of each offender.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
https://www.mondaq.com/canada/crime/787224/what-are-the-consequences-of-filing-a-false-police-report-in-canada
:::
THE ONTARIO COURT OF JUSTICE. BETWEEN: HER MAJESTY THE QUEEN -and- KELLY J. DENHAM
APPEARANCES: FOR THE CROWN: Mr. Corbella
FOR THE DEFENDANT: Mr. Mansour
REASONS FOR JUDGMENT
These are reasons for judgment concerning Kelly J. Denham who stands charged with the following counts under the Criminal Code of Canada, and the Child and Family Services Act of Ontario, specifically:
- Criminal Code s. 430(1.1)(c): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with the lawful use of computer data of the Family and Child Services of Lanark, Leeds and Grenville.
- Criminal Code s. 430(1.1)(d): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with a person in the lawful use of computer data, or denied access to computer data to a person who was entitled to access it.
2 - Criminal Code s. 342.1(1)(c): that between 31 January 2016 and 18 April 2016, she did fraudulently and without colour of right, use, or cause to be used, directly or indirectly a computer system with intent to commit an offence under s. 430 in relation to computer data.
And under the Child and Family Services Act
- Child and Family Services Act of Ontario s. 76: that on 18 April 2016 she published information that has the effect of identifying a witness at, or a participant in a hearing, or a party to a hearing, to wit; the names of clients of Family and Children Services.
- Child and Family Services Act of Ontario s. 45(8): on 18 April 2016 did publish information that has the effect of identifying a child who is a witness at, or a participant in a hearing, or the subject of a proceeding, or the child’s parents, or foster parents, or a member of the child’s family, to wit; the names of clients of Family and Children Services.
The trial took place before me at Perth. It was agreed by counsel that the information alleging offences under the Criminal Code would be tried together with the information under the Child and Family Services Act of Ontario, with the evidence received applying to both.
At the conclusion of the evidence on 15 August 2019, counsel requested and I agreed to an adjournment for oral and written argument. Argument was finally 3 concluded on 17 December 2019, and the matter was adjourned ultimately to this date for judgement.
Overview of the Evidence:
The facts are not disputed.
It is common ground that Ms. Denham had dealings with the Family and Children Services of Lanark Leeds and Grenville, hereinafter referred to by its initials as FCSLLG, an agency accredited and operating under the Child and Family Services Act of Ontario. Those dealings commenced in April 2015. Ms. Denham soon became dissatisfied with the actions of the FCSLLG.
In January 2016, Ms. Denham complained in writing to FCSLLG, andsubsequently met with the Director. That meeting was secretly taped by Ms. Denham.
The FCSLLG on its own initiative had by this time established a computer web site. The object of the website was twofold; they wished to create a public portal that would be open to the public to provide an overview of the applicable legislation of child protection and the agencies role within the community in fulfilling that role, and a private portal to disseminate private information concerning the FCSLLG and its activities that would be available only to its board members.
4 In reality the website created by FCSLLG did not contain an adequate or any firewall limiting access to the portal containing private information. No special skills or deceptive techniques were necessary to gain access to the board information intended to be private. Nor were there any warnings or disclaimers that the information in the private portal was private or confidential and intended only to be seen by the intended restricted group. In effect the information intended for sole use of the FCSLLG board was available to any interested person.
It is acknowledged that Ms. Denham accessed the FCSLLG website and entered what was intended to be the private portal. She thereby gained access to the confidential FCSLLG board information including an Excel spreadsheet that contained the names of mothers and families who had been referred to sought out FCSLLG for service.
In early February 2016 FCSLLG became aware that a video of the meeting between Ms. Denham and its Director entitled “Full Interview with Director of Service” had been posted to You Tube. During the video various FCSLLG documents that it had considered private and confidential were shown on the screen.
When this came to the attention of FCSLLG in early February 2016 FCSLLG shut the website down and hired David Schmidt, the son-in-law of Margaret Row who at the time was employed by FCSLLG as a program manager
5 charged with the responsibility of oversight of the computer site, and instructed him to determine how this had happened and rectify any breach of security.
Mr. Schmidt gave evidence at trial and was qualified on consent as an expert in the field of computers in general and in website security analysis.
In his investigation of the website, Mr. Schmidt discovered that two IP addresses associated with Ms. Denham had accessed the FCSLLG website files.
He further reported on the inherent lack of security in the website and made recommendations to correct and secure the private information.
Mr. Schmidt determined that 252 discrete files that the FCSLLG intended to be private had in fact been downloaded, and the defense does not dispute that the accused accessed and downloaded the material.
FCSLLG implemented some but not all of Mr. Schmidt’s recommendations.
In particular Mr. Schmidt advised that the two-portal system in place on the single website should be separated to provide full security. He recommended that there be two distinct and separate websites, one for each task.
Contrary to that recommendation, the private Board portal containing the private documentation intended for Board eyes only remained on the single website, however attempts were made to close the file directory through which it was determined that Ms. Denham had obtained access to the private documentation intended for Board use only. FCSLLG took the position at the time that, contrary
6 to the report of Mr. Schmidt, that this was sufficient security to put the website back on line.
In fact, the actions of the FCSLLG, did not secure the private information.
On April 18, 2016, Ms. Denham posted a hyperlink of a spreadsheet (0-5intake-stats.xslsx) that contained the names of 285 mothers of children who had had interactions with FCSLLG on the Facebook account of “Smiths Falls Swap Shop”.
Smiths Falls Swap Shop is a private group that requires permission for membership and has some minor limiting conditions for membership and agreement that group rules be followed.
The link, if clicked, provided direct access to the document on the FCSLLG website. Two women, amongst others, accessed the material and seeing their names complained to FCSLLG concerning the privacy breach. Another woman accessed the link and complained to both FCSLLG and to the police.
FCSLLG on being advised of this fresh breach again shut the website down and contacted the police.
These charges are the result.
THE LAW AND THE SPECIFIC CHARGES:
In argument the Crown quite properly cautioned that the competence of the FCSLLG in the manner in which it dealt with the establishment and maintenance
7 of the confidentiality of its clients is not the issue. I agree. The issue is simply whether or not the Crown has established beyond a reasonable doubt that in her actions the accused has violated all elements of the various counts before the Court.
As to the charges under s. 430(1.1) of the Criminal Code, the section provides that:
Everyone commits mischief who willfully
(a) destroys or alters computer data
(b) renders computer data meaningless, useless or ineffective
(c) obstructs, interrupts or interferes with the lawful use of computer
data; or
(d) obstructs, interrupts or interferes with a person in the lawful use of
computer data or denies access to computer data to a person who is
entitled to access to it.
The accused is charged under subsections (c) and (d) as set out above.
The accused is also charged under s. 342.1(1)(c), which provides:
Everyone who, fraudulently and without color of right,
(a) obtains, directly or indirectly any computer service;
(b) …intercepts or causes to be intercepted, directly or indirectly, any
function of a computer system;
(c) uses or causes to be used, directly or indirectly, a computer system
with intent to commit an offence under paragraph (a) or (b) or an
offence under section 430 in relation to data or a computer system,”
Section 342.1(2) defines computer system and data as:
computer system means a devise that, or a group of interconnected or related
devises, one or more of which,
(a) contains computer programs or other data, and
(b) pursuant to computer programs,
(i)performs logic and control, and
(ii)may perform any other function;
8 data means representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer system
To succeed in relation to the charges under s. 430(1.1) the Crown is required to satisfy the criminal burden and prove, that Ms. Denham; obstructed interrupted or interfered with the lawful use of computer data (subsection (c)), and/or that she obstructed, interrupted or interfered with a person in the lawful use of computer data or denied access to computer data to a person entitled to access to it, and that she did so willfully, that is with knowledge or recklessness as to the consequences of her actions.
The Crown’s theory in relation to the criminal counts casts FCSLLG as a victim that as a result of the actions of the accused was obliged to: shut down their website and disable the hyperlink to confidential material; hire a consultant; delete documents; issue a cease and desist letter to the administrator of the Facebook page where the link was posted; and notify proper authorities.
Factually the Crown likens the situation to a victim failing to lock its back door and an accused entering and committing mischief to the interior. The rhetorical analogy is not particularly helpful to the analysis. The facts and the applicable law in the charging sections are specific and determinative of the issues.
9 The defense argued the matter on the basis that the actions of the accused were not fraudulent and fraud is a necessary element of the offence; and further that the actions of the accused did not obstruct, interrupt or interfere with the computer data.
I note first of all that the focus of these sections is on computer data not hardware or the computer program employed, and I find there was here no obstruction, interruption or interference with the data. Interference is defined in the Dictionary of Canadian Law (Thomson Carswell (third edition) 2004), as: “To obstruct; to disrupt.”
On the facts, the accused copied various documents, specifically she copied 252 documents from the FCSLLG website and the hyperlink which, if followed by others by a simple click, would lead them directly to and open spreadsheet (0-5intake-stats.xslsx), information that FCSLLG intended to be private.
She did not however alter or destroy any computer data on the website of the FCSLLG. The documents remained available and unaltered at all times. Their delivery was temporarily interrupted at the election of the FCSLLG, once it became apparent that the documents were accessible by the world at large. But the closure of the website was the result of decisions made by FCSLLG once they became aware of the shortcomings of their security provisions. While off line the data remained intact and unaltered.
10 I note that in R. v. Livingston, [2018] O.J. No. 254, the obstruction interruption or interference with the data involved the deliberate erasure or deletion of data, while in R. v. Charania [2012] O.J. No. 5113 a case where an unauthorized user name and password were employed to copy personnel records, the court specifically based its finding not on the taking of the documents, but on the fact that doing so resulted in the complainant being locked out of the computer system.
The locking out however was not, as is the case before us, of a decision by the complainant to do so because of a perceived breach of its privacy, but rather an automatic computer programing function, beyond the control of the complainant.
The automatic computer function activated by the accused denied access to the complainant. The court held; “In this case, the Crown has specifically proven … that (the accused) actually obstructed and interfered with (the complainant’s) lawful use of data by preventing her from accessing data on the Ritz Villa computer system…The finding of guilt is not based upon the confidentiality of the data in (the complainants’) email account.” (para 120) I cannot find any obstruction, interruption or interference to the data. In the first instance the accused took a picture or copy of the data found on the site. In the second she took a picture or copy of the hyperlink leading to the spread sheet data and posted that to the Smiths Falls Swap Shop web site.
It is common ground that the FCSLLG closed down the website on two occasions in order to investigate the supposed security breach and to address the
11 and then readdress and remedy the problem. The evidence shows and I find as a fact that the FCSLLG was in total control of the website. The FCSLLG created it, operated it and chose to shut it down. The cause of the shutdown was the system’s inherent security defect. The accused may have discovered the security shortcomings, she did not however cause those shortcomings nor the shutdown. I agree.
The FCSLLG witnesses, Mr. Lemay, Ms. Row, acknowledge that on learning of the inadequacies with the security of the Website, the site was shut down. They acknowledge further that the site would have been closed regardless of the manner in which the security inadequacies were brought to the agency’s attention. The accused demonstrated the inadequacies, but did not create them.
Her actions then must be seen on the light of a notifier of the problem but not as a cause. It was the security problem itself that caused the complainant to shut down the website.
Turning to the element of fraud. The defense argues that fraud is a necessary element of the charge of unauthorized use of a computer, and that the accused in accessing and downloading the information did not engage in any fraudulent act.
As noted previously, the website was theoretically designed for the dual purpose of providing both public and private information. The public was invited to receive public information as to the workings of the FCSLLG; board members
12 were thought to have access to private information unavailable to others. The accused did obtain private information, but was able to do so not through deceit falsehood or other fraudulent means but because of the design flaws inherent in the system.
The private information was publicly available. There was no need for a password or user name restricting access. Nor, I find, did the accused require any particular or peculiar skill or ability to gain access. The information was available.
This is confirmed in the evidence of Mr. Schmidt, the expert relied upon by FCSLLG:
Q: In this case the directory had no password, nothing in it was intended to stop you from getting to it.
A: That’s correct. (Transcript p. 105 – 106)
The absence of fraud distinguishes the cases relied upon by the Crown. In R. v. Livingston (supra) Lipson J. of this court expressly found:
“The totality of evidence proves beyond a reasonable doubt that he was neither justified nor authorized nor had the color of right to arrange for the wiping of the hard drives…He was clearly aware of his obligation to retain records…Nevertheless, (he) resorted to extreme and unauthorized measures to permanently delete records…” (emphasis added)
The court went on to find and enumerate the fraudulent methods he employed to do so. That is not this case. Nor is R. v. Charia (supra) where deception was found as a fact to be used to obtain the desired material.
13 I am for those reasons left with a reasonable doubt and unable to find Ms. Denham guilty of the criminal charges before the court.
Turning then to the charges under the Child and Family Services Act.
Section 45(8) of the Act provides that “No person shall publish or make public information that has the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding, or the child’s parent or foster parent or a member of the child’s family.”
Section 76 of the Act is similar in object and wording, “No person shall publish or make public information that has the effect of identifying a witness at or a participant in a hearing, or a party to a hearing other than a society.”
The elements of the offences charged are; the act of publishing or making public; information that has the effect of identifying the specified participants, parties, witnesses or children; who are involved in a hearing or proceeding.
The Crown argues that all elements of these offences have been met.
On the element of “publishing or making public”, the accused, by posting information on Facebook made that information public. The fact that the particular site on which it was posted, Smiths Falls Swap Shop, requires an application for membership that must be accepted by the sites controllers is irrelevant. Even if the site had only one member it would still constitute publishing.
14 As to the element of “identification” the Crown argues that revealing the client list as set out in spreadsheet 0-5intake-stats.xslsx, some (six) of who were engaged in a hearing is sufficient to satisfy the element of identification.
The defense argues that on the facts of this case the Crown has failed to establish that the actions of the accused, constituted publishing or making public information, and has failed to establish that her posts identified a witness, participant or party in a hearing.
Section 45(8) was discussed in Children’s Aid Society of Hamilton–Wentworth v. D.–G. (E.), [1995] 21 OR (3d) 643, where Rosenberg J. (as he then was) held on behalf of the Divisional Court, that given the objective of s. 45(8) there must be a link or coupling between the identification of an individual and their involvement in a proceeding or hearing.
“The impugned publication must make reference to the proceedings or be contrary to some other provision of the Act to justify an injunction based on the Act. … It must, to offend the Act, require the disclosure that there are proceedings either directly or impliedly and couple the person identified with those proceedings.”
Section 76 of the CFSA is similar in object and wording and in my view should be interpreted in the same manner.
It is interesting to note that the wording of both sections in restricting publication of information that “has the effect of identifying” is narrower than that used in section 486.4 of the Criminal Code of Canada which
15 authorizes the court to direct the nonpublication of “any information that could identify the victim or a witness…” If the legislature, in drafting the prohibition, sought to cast a wider net it was open to it to do so and the it has chosen not to.
The evidence shows that the spreadsheet 0-5intake-stats.xslsx contained some 285 client names. The purpose of the document was to report to the Board on compliance by the agency with ministry service time guidelines. There is no reference in the document to clients or matters that were or had been before the court in any proceeding or hearing. In fact, some six clients listed in the spreadsheet were involved in court proceedings, but on the information in the spreadsheet their identity as participants in court proceedings could not be determined.
The evidence was, and I find, that the determination of who if any of the named clients were involved in proceedings and to be able to conclude that anyone was so involved in a hearing or proceeding, required a records search of the legal department by Karen Von Cramon, whose evidence was given by an agreed statement of facts, filed.
The website and spreadsheet accessed by the accused did not contain the records of the legal department. They did not contain any information as to who was involved in a hearing or proceeding. The necessary link between
16 the list of client names and their involvement in any hearing or proceeding is absent.
The agency does far more than proceed to court to protect children. It provides multiple services to people in the community that do not involve any court proceeding or hearing. The nonpublication provisions only apply to proceedings or hearings. It is not an offence under the Act to divulge the names of persons who are clients of the FCSLLG.
I find accordingly that the information contained in the spreadsheet did not have “... the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding…” as required in s.
45(8) of the Act, nor “…the effect of identifying a witness at or a participant in a hearing, or a party to a hearing…” as set out in s. 76 of the Act.
I turn then to second point raised by the defense that being that the accused did not “publish or make public” the information by posting the hyperlink on the Smiths Falls Swap Shop.
The terms “publish” and “make public” are not defined in the legislation. The Crown argues that reference to s. 299 of the Criminal Code which, defines publish in the context of the provisions against criminal defamatory libel should apply. That section provides:
“A person publishes a libel when he
(a) exhibits it in public;
17
(b) causes it to be read or seen; or
(c) shows or delivers it with intent that it should be read or seen by the
person it defames or by any other person.”
The Crown further argues that whatever definition is employed the fact is that “making public”, the alternate wording of the impugned act is satisfied by the simple act of placing information on Facebook. The Crown argues that in this case the accused made the material public by posting the information to Smiths Falls Swap Shop, and that would be so even if the
Swap Shop group had only one member.
The defense notes that the Information laid particularizes the offence as one of publishing without reference to the alternative of making public. I note that no amendment was sought or granted. That said, given the common definition of “publish” that follows, the point is largely moot.
In Re Orr’s Stated Case (sub nom R. Leong), [1961] 38 WWR 114 at para.9 the court noted:
“Where the word “publication” is used in a penal statute without definition, and with context which would assign to it a special meaning, it must be considered to bear the meaning it would bear in in ordinary English speech.
Certainly, where crime is involved a court should not go out of its way to attribute to the word an extraordinary meaning involving the culpability of the accused, but should rather hew strictly to the line resolving any possible doubt in favour of the accused.”
These are propositions that I find to be a fair statement of the law.
18 I turn then to commonly used dictionaries for definitions of the term.
In Black’s Law Dictionary “publish” is defined as: to make public, to circulate, to make known to people in general: …An advising of the public or making known of something to the public for a purpose. Webster’s Third New International Dictionary: to declare publicly; make generally known;
… to place before the public (as through mass medium), circulate, while Webster’s New Collegiate Dictionary defines “publish” as: to make generally known; to make public announcement of; to place before the public; to produce or release for publication. Lastly, the Canadian Oxford Dictionary defines “publish” as: prepare and issue (a book, a newspaper, information in electronic form, computer software, etc.) for public consumption; make generally known.
The accused in this case posted a hyperlink, which if clicked, led directly to the spreadsheet on the FCSLLG website. The test question to be answered is simply, does this action constitute publishing as that term is commonly defined.
In Crookes v. Newton, 2011 SCC 47 the Supreme Court held, within the civil context of defamation, that posting a hyperlink to a defamatory document created and controlled by another did not constitute publishing by the person posting the hyperlink.
19 The court outlined the function and effect of a hyperlink in the following terms.
“Hyperlinks are, in essence, references. By clicking on the link, readers are directed to other sources. Hyperlinks may be inserted with or without the knowledge of the operator of the site containing the secondary article. Because the content of the secondary article is often produced by someone other than the person who inserted the hyperlink in the primary article, the content on the other end of the link can be changed at any time by whoever controls the secondary page. Although the primary author controls whether there is a hyperlink and what article that word or phrase is linked to, inserting a hyperlink gives the primary author no control over the content in the secondary article to which he or she has linked.”
The court then went on to find that this lack of control over the content of the material discoverable through the hyperlink has the effect of making the poster of the hyperlink not the publisher of the material. The court went on:
“Communicating something is very different from merely communicating that something exists or where it exists. … Even where the goal of the person referring to a defamatory publication is to expand the publications audience, his or her participation is merely ancillary to that of the initial publisher.”
The background and context in Cook v. Newton differs of course from this situation. The FCSLLG as the creator of the spreadsheet intended that it be for the information of board members only. The principles discussed however remain. The accused exercised no control over the contents of the document, she simply provided the reference to its existence, and that, I find, falls short of publishing.
For these reasons, again I am left with a reasonable doubt, and am unable to find the accused guilty of these charges under the Child and Family Service Act.
20 CONCLUSION:
There will be an acquittal on all charges.
Due to the Covid 19 difficulties currently plaguing the nation and closing the court, these reasons are being delivered in writing. The Information is not before me to endorse. If possible, I authorize the clerk of the court to endorse the dismissal on my behalf. Alternatively, I shall endorse the record and Information when next in Perth.
DATED AT BROCKVILLE FOR DELIVERY IN PERTH, THIS 1 MAY 2020
Charles D. Anderson, J.
:::
Family and Children's services of Lanark, Leeds and Grenville
Board of Directors
We’re Recruiting!
Family and children’s services of lanark, leeds and grenville (fcsllg) Seeks individuals to serve on Fcsllg’s board of directors. Find out more about FCSLLG board member recruitment
The Family and Children’s Services of Lanark, Leeds and Grenville is overseen by a volunteer board of directors, composed of members of the local community.
Tony Barnes – President
Mike Andrews
Ashley Dayment
Nigel White
Kevin Clouthier
Lyndon Murdock
Shannon Stilnovich
Chris Davis
Janette Loveys
You can contact the Board via our main Contact page.
https://fcsllg.ca/about-us/contact-us/
https://fcsllg.ca/in-the-news/
https://fcsllg.ca/about-us/board-of-directors/
https://fcsllg.ca/about-us/leadership-team/
Annual Client Survey
Our First Annual Client Satisfaction Survey
Family and Children’s Services of Lanark Leeds and Grenville is seeking input from our clients to better improve our service. In February 2020, families who have received service from our agency in 2019, children in care, foster and kinship parents and the agencies with whom we work in the community will be asked to answer a survey.
Who can participate?
In February and March 2020, individuals will be sent an email/letter or text with an active link to the website and a password and invited to respond directly to the survey. The survey will be open until the 31st of March, 2020 on all active cases. If you receive an invitation after your file has closed, your survey will be open until November 2020.
What happens to the results?
No personal information is collected – the survey is anonymous.
All results will be collated and the summary of the information will be reviewed and the results incorporated into our services.
What do we expect to learn?
The survey directed to the protection families will give us the feedback to assist the agency to move forward in a helpful direction regarding the protection of children and strengthening their families.
Children in care will be able to provide the agency with valuable information regarding their wellbeing and preparedness to move into adulthood.
Foster and kinship parents will give the agency feedback on whether they are feeling supported as they look after the children in their homes.
Community collaterals will be another valuable resource to show the agency that the interactions with these partners is helpful and consistent.
https://fcsllg.ca/accountability/annual-client-survey/
:::
No comments:
Post a Comment