The 2016 interrogation of alleged Ontario CAS hacker Kelley Denham

2020: CAS whistleblower acquitted.



For an agency that prides itself on confidentiality, Family and Children’s Services of Lanark Leeds and Grenville had a website in 2016 that was anything but private.



The website was twofold: A public section about resources, and a private portal for “Board members’ eyes only.”



However, the “private portal” didn’t have any security. No firewall. No password, username or hacker skills required — just a simple click of a button and you could access its confidential client list and internal documents considered private for the children’s aid society.



It was Kelley Denham, 32, who blew the whistle on the website’s absence of security and in February 2016 posted some documents online that the board of the children’s aid agency considered confidential.



She wanted the children’s aid society to take it down, and for her trouble, the agency called Smiths Falls Police.



The judge noted that the CAS did not take appropriate measures to secure private information. The judge also noted there were no special computer skills or deception required to access the files, which were not marked as confidential and came with no warnings or disclaimers.



The information was publicly available, the judge ruled. He said there was no hacking and Denham didn’t break any Children’s Aid Society (CAS) laws about identifying children involved in court proceedings.



Denham’s life took a rapid turn in April 2016 when police broke through her garage door to execute a search warrant to seize phones, computers, a gaming system, and USB sticks — anything that could store evidence related to her access to the website.



In the early-morning raid, Denham said they put her husband in handcuffs.



“I woke up to police in my bedroom and after I yelled for them to take the ‘cuffs off of him, they did. They also wouldn’t let me call a lawyer.”



On her full acquittal, a relieved Denham said: “I’m glad it’s over. It was four years of my life on hold.



“I thought it was ridiculous because they knew it wasn’t hacking. They knew what happened and that they (Family and Children’s Services) framed it this way makes me upset.”



She said she wanted the child-welfare agency to take the easily-accessible files offline, and instead it turned into “four years of waiting” and court dates.



Fady Mansour, the lawyer who won the acquittals, said his client was pleased with the result.



“Ms. Denham has been vindicated and her conduct was not only not criminal but ultimately led to the (child-welfare agency) having to fix a very serious problem in their system.



https://www.recorder.ca/news/local-news/cas-whistleblower-acquitted



:::



Canada: Ontario Provides Protection To "Whistleblowers" Against Reprisals

07 February 2018..



In the fall of 2017, the Ontario government announced its plans to allow for a civil cause of action for whistleblowers who allege that they have subjected to reprisals. The adoption of this cause of action means that any such persons alleging an improper reprisal will have the basis to file a claim in the courts or through arbitration.



February 2017: In reprisal for being exposed FCSLLG filed a complaint with the College of Social Workers against Kelley Denham who then went on to not only find Kelley Denham guilty in a disciplinary hearing 2019 but proved every element of their case against Denham though in 2020 the crown in the criminal proceeding failed to prove a signal element of his theory and Denham was acquitted on all charges after the crown spent four years attempting to get Miss Denham to agree to a plea deal and agreed statement of "facs." The same or almost identical agreed statement of facts the college of social workers wanted Kelley to sign threatening to sue her for the cost of having to find her guilty.



https://www.mcmillan.ca/ontarios-whistleblower-regime-civil-cause-of-action-for-reprisals-now-possible



The College has now graciously offered to reverse their findings of guilt but not their finding of dishonorable conduct and would like Kelley to agree to that.



https://www.ocswssw.org/wp-content/uploads/2019/11/Discipline_Decision_Reasons_Denham_826163.pdf



https://www.kcyatlaw.ca/what-is-whistleblowing-guide-whistleblowing-in-canada/#:~:text=Whistleblowing%20in%20the%20Federal%20Public,are%20protected%20by%20the%20PSDPA.&text=Ontario's%20Public%20Service%20of%20Ontario,protections%20to%20the%20federal%20PSDPA.



https://www.osler.com/en/resources/regulations/2016/a-review-of-new-whistleblower-protections-under-on



https://www.mondaq.com/canada/whistleblowing/671550/ontario-provides-protection-to-whistleblowers-against-reprisals



:::



2020: FOUR YEAR LEGAL ORDEAL STARTED WITH A POCKET DIAL..



Hometown News... https://www.hometownnews.ca/digital-edition/



and press the arrow to advance to page two article.

-

What happened after the pocket dial?



The audio in the video linked just below is a copy of the non-emergency call obtained through the freedom of information act that sent three police officers racing through the streets of Smiths Falls one beautiful Monday morning about two years ago. The events in this video were the beginning of Families United Ontario's advocacy for other families being abused and molested by a system gone terribly wrong.



https://www.youtube.com/watch?v=ssK0m90SJxk



:::



2016: “MR. ROGERS, IT WILL BE A SHORT RETAINER”



After being criminally charged in 2016 the CAS came after our children again and had already made plans for their future.. Excerpt: The CAS lawyer speaks first, complaining we hadn't informed Kingston CAS that we had managed to retain, in the very short time they'd given us - legal representation. She then begins to slander my wife and I for awhile, referring to us as the "author's of our own misfortunes," who were currently facing lengthy jail time. Then after a moment to pause, she informs the Judge that the society no longer has any concerns and they were withdrawing both the motion before the court that day and the still up coming application for a protection order, saying that a photo of a repair to our back deck justified their sudden decision to withdraw, though they had been making long range plans for the care and disposition of our children - again, only a few hours before. But only withdrawing after becoming aware we had managed to get the required documents filed with the court on time and after the Kingston CAS lawyer saw Craig walk in beside us.



The Judge is content to walk away until Craig speaks up, he begs and pleads with the Judge to read our responding material and explains a little about recent events, and the difficulties my wife and I had to go through to file our paperwork on time to meet the court's deadline and passes the letter the same day courier had delivered only hours ago to the court clerk who passed it to the Judge. Craig asked the Judge to consider ordering the CAS to pay our legal expenses. The Judge's eyes widen as he looks from the letter back to Craig. To make a long story short, he did read our response to the society and he did order them to pay our legal costs about 30 minutes later.



https://www.unpublishedottawa.com/letter/153438/ontario-cas-dirty-tricks



:::



PARENTS THANK SMITHS FALLS POLICE AFTER MISSING SON FOUND SAFE..  A PDF of the reasons given for the denial for information by the Smiths Falls police is now located at the bottom of the article.



http://unpublishedottawa.com/letter/107146/parents-thank-smiths-falls-police-after-missing-son-found-safe



:::



2020: The author's of their own misfortunes..



Kelley Denham was accused of hacking confidential information from the Family and Children's Services of Lanark Leeds, and Grenville website. The courts have exonerated her.Wayne Cuddington / POSTMEDIA



https://ottawasun.com/news/local-news/it-was-four-years-of-my-life-on-hold-cas-whistleblower-cleared-of-hacking-charges/wcm/2f3b7325-e10e-438e-add8-c078b7508921



https://www.insideottawavalley.com/news-story/10014328-smiths-falls-kelley-denham-acquitted-in-family-and-children-s-services-computer-case/



What Are The Consequences Of Filing A False Report To Your Insurance Company (And To The Police) In Canada ?



What are the offences someone can be charged with under the Criminal Code of Canada for filing a false police report or lying to the police?



The offence under the Criminal Code which would be most applicable is committing public mischief under section 140. That section states:



140 (1) Every one commits public mischief who, with intent to mislead, causes a peace officer to enter on or continue an investigation by...



making a false statement that accuses some other person of having committed an offence;



doing anything intended to cause some other person to be suspected of having committed an offence that the other person has not committed, or to divert suspicion from himself;



The purpose of the law is to discourage and punish false reporting and of course to prohibit people from falsely accusing others. Making a false statement transpires when the person makes the statement with the intention of misleading justice. One cannot be convicted if it is determined that they genuinely believed the statement to be true at the time it was made.



In addition to public mischief, there are several other offences under the Criminal Code that a person could find themselves charged with if they file a false police report or lie to the police. These include the following:



Perjury under section 131 of the Code if the person, with intent to mislead, knowingly gives a false statement under oath, affirmation, by affidavit, solemn declaration or deposition;



Fabricating Evidence under section 137 of the Code if the person, with intent to mislead, fabricates anything (such as a police report) with the intent that it shall be used as evidence in a judicial proceeding; and



Obstructing Justice under section 139 (2) of the Code if the person wilfully attempts to obstruct, pervert or defeat the course of justice.



These offences involving the misleading of justice and which include lying to the authorities are taken very seriously. This is clear when looking at the potential and maximum penalties under the Code. Perjury and fabricating evidence are indictable offences with potential prison terms of up to 14 years, while obstruct justice under 139 (2) of the Criminal Code is an indictable offence with a maximum sentence of imprisonment for 10 years.



https://laws-lois.justice.gc.ca/eng/acts/C-46/



The penalties for committing public mischief are outlined at section 140(2) of the Criminal Code. If the Crown Attorney perceives the case as serious and elects to proceed by indictment, then an accused who is found guilty is potentially liable to imprisonment for a term not exceeding five years. If the Crown decides to proceed summarily (less serious case) and an accused is found guilty then they are liable to a fine of not more than five thousand dollars or to a term of imprisonment not exceeding six months or to both. The actual punishment imposed for those convicted will vary according to the facts of each case and the circumstances of each offender.



The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.



https://www.mondaq.com/canada/crime/787224/what-are-the-consequences-of-filing-a-false-police-report-in-canada



:::



Canada: Novel Case On Data Exclusion Interpreted In Favour Of Insureds



An Ontario judge recently interpreted a data exclusion in favour of the insureds, ordering the insurer to defend claims arising out of an alleged website security breach.1 A website owned by Family and Children's Services of Lanark, Leeds and Grenville ("FCS"), was breached when an unauthorized party downloaded and published documents stored in a secured section of the website, which contained personal information about individuals who had been the subject of FCS investigations. A broadly worded claim was subsequently brought against FCS, alleging damages resulting from defamation, breach of privacy and other causes of action. Laridae Communications Inc. had provided advice to FCS on the design and security of FCS's website. FCS issued a third-party claim against Laridae.



Footnotes: 1 Laridae v Co-Operators, 2020 ONSC 2198.



The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.



https://www.mondaq.com/canada/insurance-laws-and-products/942318/novel-case-on-data-exclusion-interpreted-in-favour-of-insureds



:::



Court Refuses to Apply Liability Policies’ Electronic Data Exclusions, Cites Lack of Jurisprudence.



Laridae v. Co-operators, 2020 ONSC 2198 (CanLII)



Earlier in May, in Laridae v. Co-operators, 2020 ONSC 2198, an Ontario court was hesitant to offer guidance on the proper application of two “electronic data exclusions” that expressly withdrew coverage for the misappropriation and display of electronic information on the internet. At issue were allegations arising from particularly egregious hacking incidents involving a child protection agency’s website. Noting an apparent lack of guiding authority (“there is no jurisprudence on the proper interpretation of data exclusion clauses”), Pollak J. ordered a liability insurer to separately defend the named and additional insureds.



https://www.canliiconnects.org/en/commentaries/71352



https://www.canliiconnects.org/en/cases/2020onsc2198



:::



2020: How the lack of cyber case law worked against an insurer in a $75-million data breach lawsuit.



The lack of cyber case law worked against an insurer in the Ontario Superior Court of Justice recently, with the court deciding that The Co-operators has a duty to defend two parties named in a $75-million cyber breach class action lawsuit.



https://www.canadianunderwriter.ca/insurance/how-the-lack-of-cyber-caselaw-worked-against-an-insurer-in-a-75-million-data-breach-lawsuit-1004179343/



INTERVIEW with Director of Service for Family and Children's Services of Lanark Leeds and Grenville.



https://youtu.be/kq6JCx5FlfA



This is an audio recording of Kelley Denham's last conversation with FCSLLG's now former director of service Kim Morrow regarding the progress of her complaint detailing FCSLLG's collectively unethical conduct before being arrested and charged by the Smith's Falls police.. The day Miss Denham was charged Kim Morrow again called to discuss the progress of Miss Denham's complaint and left a message on Denham's answering machine. As part of Miss Denham release conditions a no contact order was issued preventing Miss Denham from contacting anyone at FCSLLG or their board members and in fact from completing FCSLLG's needlessly complex complaint process..



https://youtu.be/HALda2OHg4s



:::



WHAT IS DEFAMATION IN ONTARIO LAW?



Defamation (sometimes referred to as defamation of character) is a statement to a third party about an identifiable individual that is false and damaging to the person’s feelings, pocket book, or reputation.



The test to determine whether a statement is damaging to one’s reputation is whether or not the statement would lower the opinion of the person in the minds of others or cause a person to be shunned or avoided or exposed to hatred, contempt or ridicule.



The test is an objective test and not a subjective one.  In other words, it is not relevant if the victim thinks that the words are damaging, rather the relevant inquiry is what the average person would think.



In Ontario, in most cases, it is not necessary to prove that the defamatory statements were made maliciously.



https://zvulony.ca/2010/articles/defamation-articles/definition-defamation/



https://www.cjfe.org/defamation_libel_and_slander_what_are_my_rights_to_free_expression



https://www.ontario.ca/laws/statute/90l12



:::



Ontario's Whistleblower Regime: Civil Cause of Action for Reprisals Now Possible.



The amendments provide that any relevant whistleblower claiming an improper reprisal may bring an action in the Ontario Superior Court of Justice or make a complaint to be resolved by binding arbitration. In any such case, the company will have the legal burden of proof to demonstrate that it did not engage in a reprisal.



Under the Ontario Securities Act, the OSC may take enforcement action against corporations who take reprisals against whistleblowers.



https://www.mcmillan.ca/ontarios-whistleblower-regime-civil-cause-of-action-for-reprisals-now-possible



https://www.kcyatlaw.ca/what-is-whistleblowing-guide-whistleblowing-in-canada/



:::



Ontario Anti-SLAPP Law.



The intersection of freedom of speech and protection of one’s reputation from defamation has, and almost always will be, a complex problem to solve in any democratic jurisdiction. On the one hand, it is a vital component of a free and just democratic society that we allow (truthful) speech, even if the truth harms another; yet, at the same time, we must prevent false speech (sometimes masquerading as the truth) from inflicting harm on others – that is the basic foundation of modern defamation law: truthful speech is allowed, false speech is not (with certain ‘grey areas’ where things get really interesting).



https://www.cambridgellp.com/publications/ontario-anti-slapp-law-2/



https://www.thelitigator.ca/2020/01/test-for-anti-slapp-motions-reaffirmed-by-the-ontario-court-of-appeal/?utm_source=Mondaq&utm_medium=syndication&utm_campaign=LinkedIn-integration



:::



Unfair or Indefensible - Costs Against C.A.S.?



On behalf of Gene C. Colman Family Law Centre posted in Child Welfare on Tuesday, January 7, 2014.



There is a presumption that a successful party is entitled to the costs of a motion, enforcement, case or appeal (Ontario Family Law Rules, R. 24(1)). There is, however, no such presumption for costs in a child protection case (Rule 24(2)). Does that mean that a successful parent can never obtain a costs order against a children's aid society? Let us delve a little further.



The lack of presumption for costs is perfectly understandable. The Courts have been hesitant to impose cost orders against children's aid societies as they are faced with the difficult statutory duty of protecting children from harm and the law tells us that they should not be punished (through costs orders) for errors of judgment. A further reason for courts rarely awarding costs against societies stems from the view that societies should not be discouraged from taking action because of the risk of an adverse costs order.



Rule 24(2) does not give children's aid societies the authority to behave with impunity though. The courts have (and will) order costs against children's aid societies in limited circumstances. For example the 2013 matter of Catholic Children's Aid Society of Toronto v. SSB awarded costs to the mother and Office of the Children's Lawyer for the procedural failings of the CCAST. This case affirms the courts' approach in awarding costs against children's aid societies in that a society will not be shielded from costs where its behaviour is "unfair or indefensible or where exceptional circumstances exist".



In SSB the CCAST sought disclosure of "clinical investigation notes" from the OCL. The OCL claimed that the requested documents were subject to solicitor-client privilege and therefore could not be disclosed as the disclosure would amount to a serious breach of trust between the OCL and the children. The prevailing concern was that the CCAST had sought to obtain the privileged documents on three separate occasions (only to withdraw their motion before a decision could be delivered) and had put the mother and OCL to considerable expense in defending the motions. The judge considered that the repeated attempts to obtain disclosure was tantamount to an abuse of process and verged on acting in bad faith. The judge, most helpfully, summarized the responsibility of the CCAST as follows [at paragraph 12]:



... Like any other litigant, the society must conduct itself according to the rules. It is given broad investigative scope, and cannot and should not be liable for costs for actions it takes in good faith in its duty to investigate cases. That, however, does not give a society licence to ignore the general rules of procedural fairness. When it does, it should be liable in costs.



The CCAST matter also made reference to the 2005 decision of Children's Aid Society of Niagara Region v. B. (C.), which provides guidance for the circumstances when children's aid societies should and should not be liable for costs. These can be summarized as follows [paragraphs 89-100]:



1. Bad Faith Not Required: To attract an adverse award of costs, a children's aid society need not have acted in bad faith;



2. Fairness: Costs may be awarded against a society, "where it conducts itself... in a way where it would be perceived by ordinary persons as having acted unfairly";



3. Indefensible Behaviour: Many cases hold that a children's aid society should only be visited with an adverse award of costs where it has taken a step or position that is "indefensible", ie. "admitting of no defence".



4. Exceptional Circumstances: There is a line of decisions holding that costs should not be awarded against a society "unless exceptional circumstances exist";



5. Error in Judgment not sufficient to attract costs: A society should not be punished for a mere error of judgement (an error of judgement can truly arise only where one has considered all courses of action reasonably available at the time);



6. Society Not to Be Dissuaded by Costs: A society should not be dissuaded from its statutory mandate by costs considerations;



7. Society to Re-assess Its Position: A children's aid society must be even-handed and act in good faith. To this end a society must be prepared to re-assess its position as an investigation unfolds and more information becomes known;



8. Accountability: "Children's aid societies must be accountable" for the manner in which it investigates a case and in the way it chooses to litigate that case (one method of achieving accountability is through costs sanctions);



The judge in CASNR tells us that a society can attract an adverse costs award where it fails in any of the following seven areas (paragraph 102):



1. Investigation before apprehension;



2. Continued investigation after apprehension;



3. Consideration of all appropriate protective measures;



4. Formation of a fair and defensible position;



5. Reassessment of that position as circumstances warrant;



6. Use of properly trained workers; and



7. Accessing independent experts in the field of child psychology.



This more critical approach adopted by some courts should provide some modest encouragement to parents who have been subjected to biased investigations or litigation undertaken by a children's aid society where the C.A.S. actions were patently unfair or indefensible. These factors should be relevant not only to a costs determination but also to the expected standard of care to which child protection authority must adhere. Holding these agencies accountable to such standards should hopefully be encouraged by the case management judge as the case unfolds.



If you have a matter where a children's aid society has acted unfairly, indefensibly or there are exceptional circumstances, you may benefit from a consultation with our experienced child welfare lawyers.



Tags: CAS, Child Custody, Child Protection, Child Welfare, Children's Aid Society, Costs, Procedural Fairness



Related Posts: THE EASTER BUNNY AND C.A.S. ABUSE OF POWER, Do's and Don'ts of a CAS Apprehension of Your Child, C.A.S. Attitude: Win child welfare cases at all costs, PROPORTIONALITY, SUMMARY JUDGMENT, SELF REPRESENTED CHILD WELFARE LITIGANTS



https://www.complexfamilylaw.com/blog/2018/03/the-easter-bunny-and-cas-abuse-of-power.shtml



:::



THE ONTARIO COURT OF JUSTICE. BETWEEN: HER MAJESTY THE QUEEN -and-  KELLY J. DENHAM



APPEARANCES: FOR THE CROWN: Mr. Corbella



FOR THE DEFENDANT: Mr. Mansour



REASONS FOR JUDGMENT



These are reasons for judgment concerning Kelly J. Denham who stands charged with the following counts under the Criminal Code of Canada, and the Child and Family Services Act of Ontario, specifically:



- Criminal Code s. 430(1.1)(c): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with the lawful use of computer data of the Family and Child Services of Lanark, Leeds and Grenville.



- Criminal Code s. 430(1.1)(d): that between 31 January 2016 and 18 April 2016 she did obstruct, interrupt or interfere with a person in the lawful use of computer data, or denied access to computer data to a person who was entitled to access it.



2 - Criminal Code s. 342.1(1)(c): that between 31 January 2016 and 18 April 2016, she did fraudulently and without colour of right, use, or cause to be used, directly or indirectly a computer system with intent to commit an offence under s. 430 in relation to computer data.



And under the Child and Family Services Act



- Child and Family Services Act of Ontario s. 76: that on 18 April 2016 she published information that has the effect of identifying a witness at, or a participant in a hearing, or a party to a hearing, to wit; the names of clients of Family and Children Services.



- Child and Family Services Act of Ontario s. 45(8): on 18 April 2016 did publish information that has the effect of identifying a child who is a witness at, or a participant in a hearing, or the subject of a proceeding, or the child’s parents, or foster parents, or a member of the child’s family, to wit; the names of clients of Family and Children Services.



The trial took place before me at Perth. It was agreed by counsel that the information alleging offences under the Criminal Code would be tried together with the information under the Child and Family Services Act of Ontario, with the evidence received applying to both.



At the conclusion of the evidence on 15 August 2019, counsel requested and I agreed to an adjournment for oral and written argument. Argument was finally 3 concluded on 17 December 2019, and the matter was adjourned ultimately to this date for judgement.



Overview of the Evidence:



The facts are not disputed.



It is common ground that Ms. Denham had dealings with the Family and Children Services of Lanark Leeds and Grenville, hereinafter referred to by its initials as FCSLLG, an agency accredited and operating under the Child and Family Services Act of Ontario. Those dealings commenced in April 2015. Ms. Denham soon became dissatisfied with the actions of the FCSLLG.



In January 2016, Ms. Denham complained in writing to FCSLLG, and subsequently met with the Director. That meeting was secretly taped by Ms. Denham.



The FCSLLG on its own initiative had by this time established a computer web site. The object of the website was twofold; they wished to create a public portal that would be open to the public to provide an overview of the applicable legislation of child protection and the agencies role within the community in fulfilling that role, and a private portal to disseminate private information concerning the FCSLLG and its activities that would be available only to its board members.



4 In reality the website created by FCSLLG did not contain an adequate or any firewall limiting access to the portal containing private information. No special skills or deceptive techniques were necessary to gain access to the board information intended to be private. Nor were there any warnings or disclaimers that the information in the private portal was private or confidential and intended only to be seen by the intended restricted group. In effect the information intended for sole use of the FCSLLG board was available to any interested person.



It is acknowledged that Ms. Denham accessed the FCSLLG website and entered what was intended to be the private portal. She thereby gained access to the confidential FCSLLG board information including an Excel spreadsheet that contained the names of mothers and families who had been referred to sought out FCSLLG for service.



In early February 2016 FCSLLG became aware that a video of the meeting between Ms. Denham and its Director entitled “Full Interview with Director of Service” had been posted to You Tube. During the video various FCSLLG documents that it had considered private and confidential were shown on the screen.



When this came to the attention of FCSLLG in early February 2016 FCSLLG shut the website down and hired David Schmidt, the son-in-law of Margaret Row who at the time was employed by FCSLLG as a program manager



5 charged with the responsibility of oversight of the computer site, and instructed him to determine how this had happened and rectify any breach of security.



Mr. Schmidt gave evidence at trial and was qualified on consent as an expert in the field of computers in general and in website security analysis.



In his investigation of the website, Mr. Schmidt discovered that two IP addresses associated with Ms. Denham had accessed the FCSLLG website files.



He further reported on the inherent lack of security in the website and made recommendations to correct and secure the private information.



Mr. Schmidt determined that 252 discrete files that the FCSLLG intended to be private had in fact been downloaded, and the defense does not dispute that the accused accessed and downloaded the material.



FCSLLG implemented some but not all of Mr. Schmidt’s recommendations.



In particular Mr. Schmidt advised that the two-portal system in place on the single website should be separated to provide full security. He recommended that there be two distinct and separate websites, one for each task.



Contrary to that recommendation, the private Board portal containing the private documentation intended for Board eyes only remained on the single website, however attempts were made to close the file directory through which it was determined that Ms. Denham had obtained access to the private documentation intended for Board use only. FCSLLG took the position at the time that, contrary



6 to the report of Mr. Schmidt, that this was sufficient security to put the website back on line.



In fact, the actions of the FCSLLG, did not secure the private information.



On April 18, 2016, Ms. Denham posted a hyperlink of a spreadsheet (0-5intake-stats.xslsx) that contained the names of 285 mothers of children who had had interactions with FCSLLG on the Facebook account of “Smiths Falls Swap Shop”.



Smiths Falls Swap Shop is a private group that requires permission for membership and has some minor limiting conditions for membership and agreement that group rules be followed.



The link, if clicked, provided direct access to the document on the FCSLLG website. Two women, amongst others, accessed the material and seeing their names complained to FCSLLG concerning the privacy breach. Another woman accessed the link and complained to both FCSLLG and to the police.



FCSLLG on being advised of this fresh breach again shut the website down and contacted the police.



These charges are the result.



THE LAW AND THE SPECIFIC CHARGES:



In argument the Crown quite properly cautioned that the competence of the FCSLLG in the manner in which it dealt with the establishment and maintenance



7 of the confidentiality of its clients is not the issue. I agree. The issue is simply whether or not the Crown has established beyond a reasonable doubt that in her actions the accused has violated all elements of the various counts before the Court.



As to the charges under s. 430(1.1) of the Criminal Code, the section provides that:



Everyone commits mischief who willfully



(a) destroys or alters computer data



(b) renders computer data meaningless, useless or ineffective



(c) obstructs, interrupts or interferes with the lawful use of computer



data; or



(d) obstructs, interrupts or interferes with a person in the lawful use of



computer data or denies access to computer data to a person who is



entitled to access to it.



The accused is charged under subsections (c) and (d) as set out above.



The accused is also charged under s. 342.1(1)(c), which provides:



Everyone who, fraudulently and without color of right,



(a) obtains, directly or indirectly any computer service;



(b) …intercepts or causes to be intercepted, directly or indirectly, any



function of a computer system;



(c) uses or causes to be used, directly or indirectly, a computer system



with intent to commit an offence under paragraph (a) or (b) or an



offence under section 430 in relation to data or a computer system,”



Section 342.1(2) defines computer system and data as:



computer system means a devise that, or a group of interconnected or related



devises, one or more of which,



(a) contains computer programs or other data, and



(b) pursuant to computer programs,



(i)performs logic and control, and



(ii)may perform any other function;



8 data means representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer system



To succeed in relation to the charges under s. 430(1.1) the Crown is required to satisfy the criminal burden and prove, that Ms. Denham; obstructed interrupted or interfered with the lawful use of computer data (subsection (c)), and/or that she obstructed, interrupted or interfered with a person in the lawful use of computer data or denied access to computer data to a person entitled to access to it, and that she did so willfully, that is with knowledge or recklessness as to the consequences of her actions.



The Crown’s theory in relation to the criminal counts casts FCSLLG as a victim that as a result of the actions of the accused was obliged to: shut down their website and disable the hyperlink to confidential material; hire a consultant; delete documents; issue a cease and desist letter to the administrator of the Facebook page where the link was posted; and notify proper authorities.



Factually the Crown likens the situation to a victim failing to lock its back door and an accused entering and committing mischief to the interior. The rhetorical analogy is not particularly helpful to the analysis. The facts and the applicable law in the charging sections are specific and determinative of the issues.



9 The defense argued the matter on the basis that the actions of the accused were not fraudulent and fraud is a necessary element of the offence; and further that the actions of the accused did not obstruct, interrupt or interfere with the computer data.



I note first of all that the focus of these sections is on computer data not hardware or the computer program employed, and I find there was here no obstruction, interruption or interference with the data. Interference is defined in the Dictionary of Canadian Law (Thomson Carswell (third edition) 2004), as: “To obstruct; to disrupt.”



On the facts, the accused copied various documents, specifically she copied 252 documents from the FCSLLG website and the hyperlink which, if followed by others by a simple click, would lead them directly to and open spreadsheet (0-5intake-stats.xslsx), information that FCSLLG intended to be private.



She did not however alter or destroy any computer data on the website of the FCSLLG. The documents remained available and unaltered at all times. Their delivery was temporarily interrupted at the election of the FCSLLG, once it became apparent that the documents were accessible by the world at large. But the closure of the website was the result of decisions made by FCSLLG once they became aware of the shortcomings of their security provisions. While off line the data remained intact and unaltered.



10 I note that in R. v. Livingston, [2018] O.J. No. 254, the obstruction interruption or interference with the data involved the deliberate erasure or deletion of data, while in R. v. Charania [2012] O.J. No. 5113 a case where an unauthorized user name and password were employed to copy personnel records, the court specifically based its finding not on the taking of the documents, but on the fact that doing so resulted in the complainant being locked out of the computer system.



The locking out however was not, as is the case before us, of a decision by the complainant to do so because of a perceived breach of its privacy, but rather an automatic computer programing function, beyond the control of the complainant.



The automatic computer function activated by the accused denied access to the complainant. The court held; “In this case, the Crown has specifically proven … that (the accused) actually obstructed and interfered with (the complainant’s) lawful use of data by preventing her from accessing data on the Ritz Villa computer system…The finding of guilt is not based upon the confidentiality of the data in (the complainants’) email account.” (para 120) I cannot find any obstruction, interruption or interference to the data. In the first instance the accused took a picture or copy of the data found on the site. In the second she took a picture or copy of the hyperlink leading to the spread sheet data and posted that to the Smiths Falls Swap Shop web site.



It is common ground that the FCSLLG closed down the website on two occasions in order to investigate the supposed security breach and to address the



11 and then readdress and remedy the problem. The evidence shows and I find as a fact that the FCSLLG was in total control of the website. The FCSLLG created it, operated it and chose to shut it down. The cause of the shutdown was the system’s inherent security defect. The accused may have discovered the security shortcomings, she did not however cause those shortcomings nor the shutdown. I agree.



The FCSLLG witnesses, Mr. Lemay, Ms. Row, acknowledge that on learning of the inadequacies with the security of the Website, the site was shut down. They acknowledge further that the site would have been closed regardless of the manner in which the security inadequacies were brought to the agency’s attention. The accused demonstrated the inadequacies, but did not create them.



Her actions then must be seen on the light of a notifier of the problem but not as a cause. It was the security problem itself that caused the complainant to shut down the website.



Turning to the element of fraud. The defense argues that fraud is a necessary element of the charge of unauthorized use of a computer, and that the accused in accessing and downloading the information did not engage in any fraudulent act.



As noted previously, the website was theoretically designed for the dual purpose of providing both public and private information. The public was invited to receive public information as to the workings of the FCSLLG; board members



12 were thought to have access to private information unavailable to others. The accused did obtain private information, but was able to do so not through deceit falsehood or other fraudulent means but because of the design flaws inherent in the system.



The private information was publicly available. There was no need for a password or user name restricting access. Nor, I find, did the accused require any particular or peculiar skill or ability to gain access. The information was available.



This is confirmed in the evidence of Mr. Schmidt, the expert relied upon by FCSLLG:



Q: In this case the directory had no password, nothing in it was intended to stop you from getting to it.



A: That’s correct. (Transcript p. 105 – 106)



The absence of fraud distinguishes the cases relied upon by the Crown. In R. v. Livingston (supra) Lipson J. of this court expressly found:



“The totality of evidence proves beyond a reasonable doubt that he was neither justified nor authorized nor had the color of right to arrange for the wiping of the hard drives…He was clearly aware of his obligation to retain records…Nevertheless, (he) resorted to extreme and unauthorized measures to permanently delete records…” (emphasis added)



The court went on to find and enumerate the fraudulent methods he employed to do so. That is not this case. Nor is R. v. Charia (supra) where deception was found as a fact to be used to obtain the desired material.



13 I am for those reasons left with a reasonable doubt and unable to find Ms. Denham guilty of the criminal charges before the court.



Turning then to the charges under the Child and Family Services Act.



Section 45(8) of the Act provides that “No person shall publish or make public information that has the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding, or the child’s parent or foster parent or a member of the child’s family.”



Section 76 of the Act is similar in object and wording, “No person shall publish or make public information that has the effect of identifying a witness at or a participant in a hearing, or a party to a hearing other than a society.”



The elements of the offences charged are; the act of publishing or making public; information that has the effect of identifying the specified participants, parties, witnesses or children; who are involved in a hearing or proceeding.



The Crown argues that all elements of these offences have been met.



On the element of “publishing or making public”, the accused, by posting information on Facebook made that information public. The fact that the particular site on which it was posted, Smiths Falls Swap Shop, requires an application for membership that must be accepted by the sites controllers is irrelevant. Even if the site had only one member it would still constitute publishing.



14 As to the element of “identification” the Crown argues that revealing the client list as set out in spreadsheet 0-5intake-stats.xslsx, some (six) of who were engaged in a hearing is sufficient to satisfy the element of identification.



The defense argues that on the facts of this case the Crown has failed to establish that the actions of the accused, constituted publishing or making public information, and has failed to establish that her posts identified a witness, participant or party in a hearing.



Section 45(8) was discussed in Children’s Aid Society of Hamilton–Wentworth v. D.–G. (E.), [1995] 21 OR (3d) 643, where Rosenberg J. (as he then was) held on behalf of the Divisional Court, that given the objective of s. 45(8) there must be a link or coupling between the identification of an individual and their involvement in a proceeding or hearing.



“The impugned publication must make reference to the proceedings or be contrary to some other provision of the Act to justify an injunction based on the Act. … It must, to offend the Act, require the disclosure that there are proceedings either directly or impliedly and couple the person identified with those proceedings.”



Section 76 of the CFSA is similar in object and wording and in my view should be interpreted in the same manner.



It is interesting to note that the wording of both sections in restricting publication of information that “has the effect of identifying” is narrower than that used in section 486.4 of the Criminal Code of Canada which



15 authorizes the court to direct the nonpublication of “any information that could identify the victim or a witness…” If the legislature, in drafting the prohibition, sought to cast a wider net it was open to it to do so and the it has chosen not to.



The evidence shows that the spreadsheet 0-5intake-stats.xslsx contained some 285 client names. The purpose of the document was to report to the Board on compliance by the agency with ministry service time guidelines. There is no reference in the document to clients or matters that were or had been before the court in any proceeding or hearing. In fact, some six clients listed in the spreadsheet were involved in court proceedings, but on the information in the spreadsheet their identity as participants in court proceedings could not be determined.



The evidence was, and I find, that the determination of who if any of the named clients were involved in proceedings and to be able to conclude that anyone was so involved in a hearing or proceeding, required a records search of the legal department by Karen Von Cramon, whose evidence was given by an agreed statement of facts, filed.



The website and spreadsheet accessed by the accused did not contain the records of the legal department. They did not contain any information as to who was involved in a hearing or proceeding. The necessary link between



16 the list of client names and their involvement in any hearing or proceeding is absent.



The agency does far more than proceed to court to protect children. It provides multiple services to people in the community that do not involve any court proceeding or hearing. The nonpublication provisions only apply to proceedings or hearings. It is not an offence under the Act to divulge the names of persons who are clients of the FCSLLG.



I find accordingly that the information contained in the spreadsheet did not have “... the effect of identifying a child who is a witness at or a participant in a hearing or the subject of a proceeding…” as required in s.



45(8) of the Act, nor “…the effect of identifying a witness at or a participant in a hearing, or a party to a hearing…” as set out in s. 76 of the Act.



I turn then to second point raised by the defense that being that the accused did not “publish or make public” the information by posting the hyperlink on the Smiths Falls Swap Shop.



The terms “publish” and “make public” are not defined in the legislation. The Crown argues that reference to s. 299 of the Criminal Code which, defines publish in the context of the provisions against criminal defamatory libel should apply. That section provides:



“A person publishes a libel when he



(a) exhibits it in public;



17



(b) causes it to be read or seen; or



(c) shows or delivers it with intent that it should be read or seen by the



person it defames or by any other person.”



The Crown further argues that whatever definition is employed the fact is that “making public”, the alternate wording of the impugned act is satisfied by the simple act of placing information on Facebook. The Crown argues that in this case the accused made the material public by posting the information to Smiths Falls Swap Shop, and that would be so even if the



Swap Shop group had only one member.



The defense notes that the Information laid particularizes the offence as one of publishing without reference to the alternative of making public. I note that no amendment was sought or granted. That said, given the common definition of “publish” that follows, the point is largely moot.



In Re Orr’s Stated Case (sub nom R. Leong), [1961] 38 WWR 114 at para.9 the court noted:



“Where the word “publication” is used in a penal statute without definition, and with context which would assign to it a special meaning, it must be considered to bear the meaning it would bear in in ordinary English speech.



Certainly, where crime is involved a court should not go out of its way to attribute to the word an extraordinary meaning involving the culpability of the accused, but should rather hew strictly to the line resolving any possible doubt in favour of the accused.”



These are propositions that I find to be a fair statement of the law.



18 I turn then to commonly used dictionaries for definitions of the term.



In Black’s Law Dictionary “publish” is defined as: to make public, to circulate, to make known to people in general: …An advising of the public or making known of something to the public for a purpose. Webster’s Third New International Dictionary: to declare publicly; make generally known;



… to place before the public (as through mass medium), circulate, while Webster’s New Collegiate Dictionary defines “publish” as: to make generally known; to make public announcement of; to place before the public; to produce or release for publication. Lastly, the Canadian Oxford Dictionary defines “publish” as: prepare and issue (a book, a newspaper, information in electronic form, computer software, etc.) for public consumption; make generally known.



The accused in this case posted a hyperlink, which if clicked, led directly to the spreadsheet on the FCSLLG website. The test question to be answered is simply, does this action constitute publishing as that term is commonly defined.



In Crookes v. Newton, 2011 SCC 47 the Supreme Court held, within the civil context of defamation, that posting a hyperlink to a defamatory document created and controlled by another did not constitute publishing by the person posting the hyperlink.



19 The court outlined the function and effect of a hyperlink in the following terms.



“Hyperlinks are, in essence, references. By clicking on the link, readers are directed to other sources. Hyperlinks may be inserted with or without the knowledge of the operator of the site containing the secondary article. Because the content of the secondary article is often produced by someone other than the person who inserted the hyperlink in the primary article, the content on the other end of the link can be changed at any time by whoever controls the secondary page. Although the primary author controls whether there is a hyperlink and what article that word or phrase is linked to, inserting a hyperlink gives the primary author no control over the content in the secondary article to which he or she has linked.”



The court then went on to find that this lack of control over the content of the material discoverable through the hyperlink has the effect of making the poster of the hyperlink not the publisher of the material. The court went on:



“Communicating something is very different from merely communicating that something exists or where it exists. … Even where the goal of the person referring to a defamatory publication is to expand the publications audience, his or her participation is merely ancillary to that of the initial publisher.”



The background and context in Cook v. Newton differs of course from this situation. The FCSLLG as the creator of the spreadsheet intended that it be for the information of board members only. The principles discussed however remain. The accused exercised no control over the contents of the document, she simply provided the reference to its existence, and that, I find, falls short of publishing.



For these reasons, again I am left with a reasonable doubt, and am unable to find the accused guilty of these charges under the Child and Family Service Act.



20 CONCLUSION:



There will be an acquittal on all charges.



Due to the Covid 19 difficulties currently plaguing the nation and closing the court, these reasons are being delivered in writing. The Information is not before me to endorse. If possible, I authorize the clerk of the court to endorse the dismissal on my behalf. Alternatively, I shall endorse the record and Information when next in Perth.



DATED AT BROCKVILLE FOR DELIVERY IN PERTH, THIS 1 MAY 2020



Charles D. Anderson, J.



:::



ClassActionNews:



The law firm of Flaherty McCarthy LLP has commenced a multi-million dollar Class Action against Family and Children’s Services of Lanark, Leeds and Grenville, and others, seeking damages arising from a serious and unprecedented privacy breach. The allegations contained in the Statement of Claim have not yet been proven in Court. The proposed Class Proceeding seeks $75 million dollars in damages on behalf of 285 people and their family members whose names were on a list of 285 families involved with children’s services, which was leaked on Facebook. Those affected individuals should receive notice from CAS of the privacy breach. The CAS had contacted 194 of the affected individuals by April 25, 2016.



At this point, the matter is a proposed class proceeding. As a class member, you do not have to do anything more to be involved in this lawsuit. You will be a member of the class until you are given the opportunity to opt out, which will be your choice.



Class Counsel has commenced and served a new proposed Class Proceeding bearing Court File No. CV-16-557244-00CP.  This was necessitated by concerns raised by Counsel for the Crown Defendant that adequate notice of the original action had not been provided in accordance with applicable Statutes.  Rather than getting in to a lengthy dispute on this issue, we felt it was more appropriate to commence a fresh action that accorded with the applicable notice provisions.  This also allowed us to make several changes to the original claim to further particularize the allegations, causes of action and common issues.  This new claim has now been served on all parties.  At the appropriate time in the future, we will seek Court approval to discontinue the original action and proceed only on the new action.  This does not affect the rights of Class Members in any way.



The Honourable Mr. Justice Perell has been appointed as the Judge responsible for managing this proposed Class Proceeding.



A Judicial Case Conference was held on October 7, 2016 for the purpose of setting a Certification Motion Schedule.  Subsequent to this Conference, the plaintiffs have chosen to discontinue the action against all defendants EXCEPT Family and Children’s Services of Lanark, Leeds and Grenville and Jane Doe.



The Certification Motion will proceed in November 2017.  The plaintiffs served their Certification Motion Record in January 2017.



On December 21, 2017, we were successful in having the lawsuit certified as a class action. The litigation administrator, Deloitte LLP, will be providing notice to class members of the Certification Order and the opt-out process in early 2018.  Deloitte LLP will be providing this notice to class members based on their last known contact information stated in the private and confidential FCSLLG document at issue. Therefore, if you are concerned that the document may not have your most recent address and contact information, please contact Deloitte LLP at classactions@deloitte.ca.



The Court appointed litigation administrator has now given notice that this matter has been certified as a Class Proceeding, in accordance with the Order of the Court.



http://www.casprivacybreach.com/whats-new/



https://ottawacitizen.com/news/local-news/toronto-firm-files-statement-of-claim-against-province-seeking-75-million-over-data-leak



:::