Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere.
Yes, it's really not clear that any crime was committed. The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server - not simply downloading data. It seems like overreach by the police to distract from the fact that the government failed to secure private data.
Anyone familiar with the Streisand effect would have predicted that this would in fact result in this failure getting as much attention as the circumstances can imaginably furnish.
> The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server.
Not quite. The test is:
> Everyone is guilty... who, fraudulently and without colour of right, obtains, directly or indirectly, any computer service (including... the storage or retrieval of computer data)
The Crown can argue that the documents were retrieved/obtained using manipulation of the server (since the public URLs were manipulated to find non-public URLs.)
>"Unfortunately, what had happened is someone went in through the URL and just sequentially went through every document available on the portal," she said.
It's not clear if the links to the documents with sensitive information were public or not. Yes, it's absolutely stupid to have security by obscurity, but from a legal point of view abusing someone's stupidity may look like a crime. The story, while sad, doesn't look black and white to me as CBC tries to paint it.
I'm not familiar with the Canadian legal system, but most countries have entrapment laws which forbid prosecution if there was no way for the suspect to know it was illegal and no criminal intent was involved. The "public, free, information, disclosure" words would make this a slam dunk if Canada has some of those laws.
http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...