Privacy breach at Elections Ontario may affect up to 2.4M voters
A woman casts her ballot at a voting station in Toronto as voters participate in the Ontario Provincial Election on Thursday, Oct. 6, 2011. (Chris Young / THE CANADIAN PRESS)
Published Tuesday, July 17, 2012 11:17AM EDT
Last Updated Tuesday, July 17, 2012 12:45PM EDT
Memory sticks containing personal voter information have gone missing from Elections Ontario, a privacy breach that could potentially affect as many as 2.4 million voters.
Ontario’s Chief Electoral Officer Greg Essensa announced Tuesday that the missing data belonged to voters in up to 25 of the province’s 107 ridings.
Elections Ontario, however, says it cannot confirm which ridings were affected by the breach and are extending a warning to voters in 49 different electoral districts.
The two missing flash drives held the full names of voters, as well as genders, birth dates, addresses and whether or not that individual voted in the last provincial election.
If a voter provided any other personal information updates to Elections Ontario around that time, the agency says that data may have been compromised as well.
“There is no evidence that copies of personal information on two USB keys have been improperly accessed; however, I want to exercise the greatest degree of caution,” Essensa said in a statement released late Tuesday morning.
The memory keys do not have any information about how a person voted, Elections Ontario stressed, particularly because the voting process itself is intended to preserve anonymity.
Other information said to be unaffected by the breach includes: phone numbers, social insurance numbers, drivers licence information, health card information, email addresses, as well as credit card and banking information.
Ontarians in 49 ridings urged to be on guard
Still, Elections Ontario is asking voters to keep an eye out for suspicious activity on formal documents from the government, banks or other institutions.
“I cannot confirm the security of the information,” Essensa conceded.
Given that Elections Ontario employees were working with information from dozens of ridings at the time of the breach, the agency is warning voters in 49 possibly affected ridings to be on guard for any suspicious activity involving their personal information.
In addition to an internal investigation, Elections Ontario has solicited the help of law firm Gowling Lafleur Henderson LLP to conduct an investigation supported by INKSTER Incorporated, a forensic security company. The Ontario Provincial Police are also investigating.
Meanwhile, the Information and Privacy Commissioner of Ontario has been asked to review the agency’s privacy policies in a bid to prevent a similar breach from happening again.
Elections Ontario policy requires any memory sticks holding personal voter information to be password protected and encrypted. But, for whatever reason, the two sticks in question were not protected.
A full list of the 49 potentially affected electoral districts is available online.