THE ONTARIO COURT OF JUSTICE - BETWEEN: HER MAJESTY THE QUEEN -and- KELLY J. DENHAM

THE ONTARIO COURT OF JUSTICE

BETWEEN: HER MAJESTY THE QUEEN -and- KELLY J. DENHAM

APPEARANCES:
FOR THE CROWN: Mr. Corbella
FOR THE DEFENDANT: Mr. Mansour

REASONS FOR JUDGMENT

These are reasons for judgment concerning Kelly J. Denham who stands
charged with the following counts under the Criminal Code of Canada, and the
Child and Family Services Act of Ontario, specifically:
- Criminal Code s. 430(1.1)(c): that between 31 January 2016 and 18 April
2016 she did obstruct, interrupt or interfere with the lawful use of computer
data of the Family and Child Services of Lanark, Leeds and Grenville.
- Criminal Code s. 430(1.1)(d): that between 31 January 2016 and 18 April
2016 she did obstruct, interrupt or interfere with a person in the lawful use of
computer data, or denied access to computer data to a person who was
entitled to access it.

2
- Criminal Code s. 342.1(1)(c): that between 31 January 2016 and 18 April
2016, she did fraudulently and without colour of right, use, or cause to be
used, directly or indirectly a computer system with intent to commit an
offence under s. 430 in relation to computer data.
And under the Child and Family Services Act
- Child and Family Services Act of Ontario s. 76: that on 18 April 2016 she
published information that has the effect of identifying a witness at, or a
participant in a hearing, or a party to a hearing, to wit; the names of clients
of Family and Children Services.
- Child and Family Services Act of Ontario s. 45(8): on 18 April 2016 did
publish information that has the effect of identifying a child who is a witness
at, or a participant in a hearing, or the subject of a proceeding, or the child’s
parents, or foster parents, or a member of the child’s family, to wit; the
names of clients of Family and Children Services.
The trial took place before me at Perth. It was agreed by counsel that the
information alleging offences under the Criminal Code would be tried together
with the information under the Child and Family Services Act of Ontario, with the
evidence received applying to both.
At the conclusion of the evidence on 15 August 2019, counsel requested and
I agreed to an adjournment for oral and written argument. Argument was finally

3
concluded on 17 December 2019, and the matter was adjourned ultimately to this
date for judgement.
Overview of the Evidence:
The facts are not disputed.
It is common ground that Ms. Denham had dealings with the Family and
Children Services of Lanark Leeds and Grenville, hereinafter referred to by its
initials as FCSLLG, an agency accredited and operating under the Child and
Family Services Act of Ontario. Those dealings commenced in April 2015. Ms.
Denham soon became dissatisfied with the actions of the FCSLLG.
In January 2016, Ms. Denham complained in writing to FCSLLG, and
subsequently met with the Director. That meeting was secretly taped by Ms.
Denham.
The FCSLLG on its own initiative had by this time established a computer
web site. The object of the website was twofold; they wished to create a public
portal that would be open to the public to provide an overview of the applicable
legislation of child protection and the agencies role within the community in
fulfilling that role, and a private portal to disseminate private information
concerning the FCSLLG and its activities that would be available only to its board
members.

4
In reality the website created by FCSLLG did not contain an adequate or any
firewall limiting access to the portal containing private information. No special
skills or deceptive techniques were necessary to gain access to the board
information intended to be private. Nor were there any warnings or disclaimers that
the information in the private portal was private or confidential and intended only
to be seen by the intended restricted group. In effect the information intended for
sole use of the FCSLLG board was available to any interested person.
It is acknowledged that Ms. Denham accessed the FCSLLG website and
entered what was intended to be the private portal. She thereby gained access to the
confidential FCSLLG board information including an Excel spreadsheet that
contained the names of mothers and families who had been referred to sought out
FCSLLG for service.
In early February 2016 FCSLLG became aware that a video of the meeting
between Ms. Denham and its Director entitled “Full Interview with Director of
Service” had been posted to You Tube. During the video various FCSLLG
documents that it had considered private and confidential were shown on the
screen.
When this came to the attention of FCSLLG in early February 2016
FCSLLG shut the website down and hired David Schmidt, the son-in-law of
Margaret Row who at the time was employed by FCSLLG as a program manager

5
charged with the responsibility of oversight of the computer site, and instructed
him to determine how this had happened and rectify any breach of security.
Mr. Schmidt gave evidence at trial and was qualified on consent as an expert
in the field of computers in general and in website security analysis.
In his investigation of the website, Mr. Schmidt discovered that two IP
addresses associated with Ms. Denham had accessed the FCSLLG website files.
He further reported on the inherent lack of security in the website and made
recommendations to correct and secure the private information.
Mr. Schmidt determined that 252 discrete files that the FCSLLG intended to
be private had in fact been downloaded, and the defense does not dispute that the
accused accessed and downloaded the material.
FCSLLG implemented some but not all of Mr. Schmidt’s recommendations.
In particular Mr. Schmidt advised that the two-portal system in place on the single
website should be separated to provide full security. He recommended that there be
two distinct and separate websites, one for each task.
Contrary to that recommendation, the private Board portal containing the
private documentation intended for Board eyes only remained on the single
website, however attempts were made to close the file directory through which it
was determined that Ms. Denham had obtained access to the private documentation
intended for Board use only. FCSLLG took the position at the time that, contrary

6
to the report of Mr. Schmidt, that this was sufficient security to put the website
back on line.
In fact, the actions of the FCSLLG, did not secure the private information.
On April 18, 2016, Ms. Denham posted a hyperlink of a spreadsheet (0-
5intake-stats.xslsx) that contained the names of 285 mothers of children who had
had interactions with FCSLLG on the Facebook account of “Smiths Falls Swap
Shop”.
Smiths Falls Swap Shop is a private group that requires permission for
membership and has some minor limiting conditions for membership and
agreement that group rules be followed.
The link, if clicked, provided direct access to the document on the FCSLLG
website. Two women, amongst others, accessed the material and seeing their
names complained to FCSLLG concerning the privacy breach. Another woman
accessed the link and complained to both FCSLLG and to the police.
FCSLLG on being advised of this fresh breach again shut the website down
and contacted the police.
These charges are the result.
THE LAW AND THE SPECIFIC CHARGES:
In argument the Crown quite properly cautioned that the competence of the
FCSLLG in the manner in which it dealt with the establishment and maintenance

7
of the confidentiality of its clients is not the issue. I agree. The issue is simply
whether or not the Crown has established beyond a reasonable doubt that in her
actions the accused has violated all elements of the various counts before the
Court.
As to the charges under s. 430(1.1) of the Criminal Code, the section provides that:
Everyone commits mischief who willfully
(a) destroys or alters computer data
(b) renders computer data meaningless, useless or ineffective
(c) obstructs, interrupts or interferes with the lawful use of computer
data; or
(d) obstructs, interrupts or interferes with a person in the lawful use of
computer data or denies access to computer data to a person who is
entitled to access to it.

The accused is charged under subsections (c) and (d) as set out above.
The accused is also charged under s. 342.1(1)(c), which provides:
Everyone who, fraudulently and without color of right,
(a) obtains, directly or indirectly any computer service;
(b) …intercepts or causes to be intercepted, directly or indirectly, any
function of a computer system;
(c) uses or causes to be used, directly or indirectly, a computer system
with intent to commit an offence under paragraph (a) or (b) or an
offence under section 430 in relation to data or a computer system,”
Section 342.1(2) defines computer system and data as:
computer system means a devise that, or a group of interconnected or related
devises, one or more of which,
(a) contains computer programs or other data, and
(b) pursuant to computer programs,
(i)performs logic and control, and
(ii)may perform any other function;

8
data means representations of information or of concepts that are being
prepared or have been prepared in a form suitable for use in a computer
system

To succeed in relation to the charges under s. 430(1.1) the Crown is required
to satisfy the criminal burden and prove, that Ms. Denham; obstructed interrupted
or interfered with the lawful use of computer data (subsection (c)), and/or that she
obstructed, interrupted or interfered with a person in the lawful use of computer
data or denied access to computer data to a person entitled to access to it, and that
she did so willfully, that is with knowledge or recklessness as to the consequences
of her actions.
The Crown’s theory in relation to the criminal counts casts FCSLLG as a
victim that as a result of the actions of the accused was obliged to: shut down their
website and disable the hyperlink to confidential material; hire a consultant; delete
documents; issue a cease and desist letter to the administrator of the Facebook page
where the link was posted; and notify proper authorities. Factually the Crown
likens the situation to a victim failing to lock its back door and an accused entering
and committing mischief to the interior. The rhetorical analogy is not particularly
helpful to the analysis. The facts and the applicable law in the charging sections are
specific and determinative of the issues.

9
The defense argued the matter on the basis that the actions of the accused
were not fraudulent and fraud is a necessary element of the offence; and further
that the actions of the accused did not obstruct, interrupt or interfere with the
computer data.
I note first of all that the focus of these sections is on computer data not
hardware or the computer program employed, and I find there was here no
obstruction, interruption or interference with the data. Interference is defined in the
Dictionary of Canadian Law (Thomson Carswell (third edition) 2004), as: “To
obstruct; to disrupt.”
On the facts, the accused copied various documents, specifically she copied
252 documents from the FCSLLG website and the hyperlink which, if followed by
others by a simple click, would lead them directly to and open spreadsheet (0-
5intake-stats.xslsx), information that FCSLLG intended to be private.
She did not however alter or destroy any computer data on the website of the
FCSLLG. The documents remained available and unaltered at all times. Their
delivery was temporarily interrupted at the election of the FCSLLG, once it
became apparent that the documents were accessible by the world at large. But the
closure of the website was the result of decisions made by FCSLLG once they
became aware of the shortcomings of their security provisions. While off line the
data remained intact and unaltered.

10
I note that in R. v. Livingston, [2018] O.J. No. 254, the obstruction
interruption or interference with the data involved the deliberate erasure or deletion
of data, while in R. v. Charania [2012] O.J. No. 5113 a case where an unauthorized
user name and password were employed to copy personnel records, the court
specifically based its finding not on the taking of the documents, but on the fact
that doing so resulted in the complainant being locked out of the computer system.
The locking out however was not, as is the case before us, of a decision by the
complainant to do so because of a perceived breach of its privacy, but rather an
automatic computer programing function, beyond the control of the complainant.
The automatic computer function activated by the accused denied access to the
complainant. The court held;

“In this case, the Crown has specifically proven … that (the accused)
actually obstructed and interfered with (the complainant’s) lawful use of
data by preventing her from accessing data on the Ritz Villa computer
system…The finding of guilt is not based upon the confidentiality of the
data in (the complainants’) email account.” (para 120)

I cannot find any obstruction, interruption or interference to the data. In the
first instance the accused took a picture or copy of the data found on the site. In the
second she took a picture or copy of the hyperlink leading to the spread sheet data
and posted that to the Smiths Falls Swap Shop web site.
It is common ground that the FCSLLG closed down the website on two
occasions in order to investigate the supposed security breach and to address the

11
and then readdress and remedy the problem. The evidence shows and I find as a
fact that the FCSLLG was in total control of the website. The FCSLLG created it,
operated it and chose to shut it down. The cause of the shutdown was the system’s
inherent security defect. The accused may have discovered the security
shortcomings, she did not however cause those shortcomings nor the shutdown. I
agree.
The FCSLLG witnesses, Mr. Lemay, Ms. Row, acknowledge that on
learning of the inadequacies with the security of the Website, the site was shut
down. They acknowledge further that the site would have been closed regardless of
the manner in which the security inadequacies were brought to the agency’s
attention. The accused demonstrated the inadequacies, but did not create them. Her
actions then must be seen on the light of a notifier of the problem but not as a
cause. It was the security problem itself that caused the complainant to shut down
the website.
Turning to the element of fraud. The defense argues that fraud is a necessary
element of the charge of unauthorized use of a computer, and that the accused in
accessing and downloading the information did not engage in any fraudulent act.
As noted previously, the website was theoretically designed for the dual
purpose of providing both public and private information. The public was invited
to receive public information as to the workings of the FCSLLG; board members

12
were thought to have access to private information unavailable to others. The
accused did obtain private information, but was able to do so not through deceit
falsehood or other fraudulent means but because of the design flaws inherent in the
system.
The private information was publicly available. There was no need for a
password or user name restricting access. Nor, I find, did the accused require any
particular or peculiar skill or ability to gain access. The information was available.
This is confirmed in the evidence of Mr. Schmidt, the expert relied upon by
FCSLLG:
Q: In this case the directory had no password, nothing in it was intended to
stop you from getting to it.
A: That’s correct. (Transcript p. 105 – 106)
The absence of fraud distinguishes the cases relied upon by the Crown. In R.
v. Livingston (supra) Lipson J. of this court expressly found:

“The totality of evidence proves beyond a reasonable doubt that he
was neither justified nor authorized nor had the color of right to arrange for
the wiping of the hard drives…He was clearly aware of his obligation to
retain records…Nevertheless, (he) resorted to extreme and unauthorized
measures to permanently delete records…” (emphasis added)
The court went on to find and enumerate the fraudulent methods he
employed to do so. That is not this case. Nor is R. v. Charia (supra) where
deception was found as a fact to be used to obtain the desired material.

13
I am for those reasons left with a reasonable doubt and unable to find Ms.
Denham guilty of the criminal charges before the court.
Turning then to the charges under the Child and Family Services Act.
Section 45(8) of the Act provides that
“No person shall publish or make public information that has the effect of
identifying a child who is a witness at or a participant in a hearing or the
subject of a proceeding, or the child’s parent or foster parent or a member of
the child’s family.”
Section 76 of the Act is similar in object and wording,
“No person shall publish or make public information that has the effect of
identifying a witness at or a participant in a hearing, or a party to a hearing
other than a society.”
The elements of the offences charged are; the act of publishing or
making public; information that has the effect of identifying the specified
participants, parties, witnesses or children; who are involved in a hearing or
proceeding.
The Crown argues that all elements of these offences have been met.
On the element of “publishing or making public”, the accused, by posting
information on Facebook made that information public. The fact that the particular
site on which it was posted, Smiths Falls Swap Shop, requires an application for
membership that must be accepted by the sites controllers is irrelevant. Even if the
site had only one member it would still constitute publishing.

14
As to the element of “identification” the Crown argues that revealing the
client list as set out in spreadsheet 0-5intake-stats.xslsx, some (six) of who were
engaged in a hearing is sufficient to satisfy the element of identification.
The defense argues that on the facts of this case the Crown has failed to
establish that the actions of the accused, constituted publishing or making public
information, and has failed to establish that her posts identified a witness,
participant or party in a hearing.
Section 45(8) was discussed in Children’s Aid Society of
Hamilton–Wentworth v. D.–G. (E.), [1995] 21 OR (3d) 643, where Rosenberg J.
(as he then was) held on behalf of the Divisional Court, that given the objective of
s. 45(8) there must be a link or coupling between the identification of an individual
and their involvement in a proceeding or hearing.
“The impugned publication must make reference to the proceedings or be
contrary to some other provision of the Act to justify an injunction based on
the Act. … It must, to offend the Act, require the disclosure that there are
proceedings either directly or impliedly and couple the person identified
with those proceedings.”
Section 76 of the CFSA is similar in object and wording and in my view
should be interpreted in the same manner.
It is interesting to note that the wording of both sections in restricting
publication of information that “has the effect of identifying” is narrower
than that used in section 486.4 of the Criminal Code of Canada which

15
authorizes the court to direct the nonpublication of “any information that
could identify the victim or a witness…” If the legislature, in drafting the
prohibition, sought to cast a wider net it was open to it to do so and the it has
chosen not to.
The evidence shows that the spreadsheet 0-5intake-stats.xslsx
contained some 285 client names. The purpose of the document was to
report to the Board on compliance by the agency with ministry service time
guidelines. There is no reference in the document to clients or matters that
were or had been before the court in any proceeding or hearing. In fact,
some six clients listed in the spreadsheet were involved in court proceedings,
but on the information in the spreadsheet their identity as participants in
court proceedings could not be determined.
The evidence was, and I find, that the determination of who if any of
the named clients were involved in proceedings and to be able to conclude
that anyone was so involved in a hearing or proceeding, required a records
search of the legal department by Karen Von Cramon, whose evidence was
given by an agreed statement of facts, filed.
The website and spreadsheet accessed by the accused did not contain
the records of the legal department. They did not contain any information as
to who was involved in a hearing or proceeding. The necessary link between

16
the list of client names and their involvement in any hearing or proceeding is
absent.
The agency does far more than proceed to court to protect children. It
provides multiple services to people in the community that do not involve
any court proceeding or hearing. The nonpublication provisions only apply
to proceedings or hearings. It is not an offence under the Act to divulge the
names of persons who are clients of the FCSLLG.
I find accordingly that the information contained in the spreadsheet
did not have “... the effect of identifying a child who is a witness at or a
participant in a hearing or the subject of a proceeding…” as required in s.
45(8) of the Act, nor “…the effect of identifying a witness at or a participant
in a hearing, or a party to a hearing…” as set out in s. 76 of the Act.
I turn then to second point raised by the defense that being that the
accused did not “publish or make public” the information by posting the
hyperlink on the Smiths Falls Swap Shop.
The terms “publish” and “make public” are not defined in the
legislation. The Crown argues that reference to s. 299 of the Criminal Code
which, defines publish in the context of the provisions against criminal
defamatory libel should apply. That section provides:
“A person publishes a libel when he
(a) exhibits it in public;

17

(b) causes it to be read or seen; or
(c) shows or delivers it with intent that it should be read or seen by the
person it defames or by any other person.”
The Crown further argues that whatever definition is employed the
fact is that “making public”, the alternate wording of the impugned act is
satisfied by the simple act of placing information on Facebook. The Crown
argues that in this case the accused made the material public by posting the
information to Smiths Falls Swap Shop, and that would be so even if the
Swap Shop group had only one member.
The defense notes that the Information laid particularizes the offence
as one of publishing without reference to the alternative of making public. I
note that no amendment was sought or granted. That said, given the common
definition of “publish” that follows, the point is largely moot.
In Re Orr’s Stated Case (sub nom R. Leong), [1961] 38 WWR 114 at
para.9 the court noted:
“Where the word “publication” is used in a penal statute without definition,
and with context which would assign to it a special meaning, it must be
considered to bear the meaning it would bear in in ordinary English speech.
Certainly, where crime is involved a court should not go out of its way to
attribute to the word an extraordinary meaning involving the culpability of
the accused, but should rather hew strictly to the line resolving any possible
doubt in favour of the accused.”
These are propositions that I find to be a fair statement of the law.

18

I turn then to commonly used dictionaries for definitions of the term.
In Black’s Law Dictionary “publish” is defined as: to make public, to
circulate, to make known to people in general: …An advising of the public
or making known of something to the public for a purpose. Webster’s Third
New International Dictionary: to declare publicly; make generally known;
… to place before the public (as through mass medium), circulate, while
Webster’s New Collegiate Dictionary defines “publish” as: to make
generally known; to make public announcement of; to place before the
public; to produce or release for publication. Lastly, the Canadian Oxford
Dictionary defines “publish” as: prepare and issue (a book, a newspaper,
information in electronic form, computer software, etc.) for public
consumption; make generally known.
The accused in this case posted a hyperlink, which if clicked, led
directly to the spreadsheet on the FCSLLG website. The test question to be
answered is simply, does this action constitute publishing as that term is
commonly defined.
In Crookes v. Newton, 2011 SCC 47 the Supreme Court held, within
the civil context of defamation, that posting a hyperlink to a defamatory
document created and controlled by another did not constitute publishing by
the person posting the hyperlink.

19

The court outlined the function and effect of a hyperlink in the
following terms.
“Hyperlinks are, in essence, references. By clicking on the link,
readers are directed to other sources. Hyperlinks may be inserted with or
without the knowledge of the operator of the site containing the secondary
article. Because the content of the secondary article is often produced by
someone other than the person who inserted the hyperlink in the primary
article, the content on the other end of the link can be changed at any time by
whoever controls the secondary page. Although the primary author controls
whether there is a hyperlink and what article that word or phrase is linked to,
inserting a hyperlink gives the primary author no control over the content in
the secondary article to which he or she has linked.”
The court then went on to find that this lack of control over the content of
the material discoverable through the hyperlink has the effect of making the poster
of the hyperlink not the publisher of the material. The court went on:
“Communicating something is very different from merely communicating
that something exists or where it exists. … Even where the goal of the
person referring to a defamatory publication is to expand the publications
audience, his or her participation is merely ancillary to that of the initial
publisher.”
The background and context in Cook v. Newton differs of course from this
situation. The FCSLLG as the creator of the spreadsheet intended that it be for the
information of board members only. The principles discussed however remain. The
accused exercised no control over the contents of the document, she simply
provided the reference to its existence, and that, I find, falls short of publishing.
For these reasons, again I am left with a reasonable doubt, and am unable to
find the accused guilty of these charges under the Child and Family Service Act.

20
CONCLUSION:
There will be an acquittal on all charges.
Due to the Covid 19 difficulties currently plaguing the nation and closing the
court, these reasons are being delivered in writing. The Information is not before
me to endorse. If possible, I authorize the clerk of the court to endorse the
dismissal on my behalf. Alternatively, I shall endorse the record and Information
when next in Perth.

DATED AT BROCKVILLE FOR DELIVERY IN PERTH, THIS 1 MAY 2020

Charles D. Anderson, J.