Poor security controls led to camera breach at Cape Breton school, report finds

CTV Atlantic: Poor security led to camera breach A new report has found that poor security led to a security breach at a Cape Breton school. CTV's Kyle Moore explains.

HALIFAX -- A lack of basic security measures led to Cape Breton schoolchildren being live streamed on the internet via school surveillance cameras, Nova Scotia's information and privacy commissioner says.

Catherine Tully says the video system at the Rankin School of the Narrows was breached when one camera's live feed was picked up by insecam.org, a Russian website that specializes in linking non-secured surveillance cameras.

In her report Thursday, Tully says a technical vulnerability enabled viewers to access the Iona, N.S., school's other two cameras as well.

It happened because "straightforward" security measures were not implemented, Tully said in an interview. That's a widespread problem across the province, affecting cameras in homes, public buildings and businesses and people need to pay attention to it, she said.

"As part of the investigation we went on the insecam website ... and discovered there are at least 50 cameras in Nova Scotia live streaming on the Internet."

The report says the Cape Breton-Victoria Regional School Board changed its cameras' passwords once it learned of the breach, but Tully found the board still hasn't implemented adequate technical or administrative controls.

Video surveillance needs to be properly secured, she said, adding it's clear from her investigation that the technology is being handled by people who aren't familiar with security systems.

"You have to have a security expert help you if you are not a security expert. People are constantly looking for ways to access information and technology is constantly under threat."

Tully began her investigation in May after it was revealed that detailed images of pupils at the school, aged five to 18, were appearing on the website, which bills itself as the world's largest directory of online surveillance security cameras.

"The camera feeds showed when students entered and exited the school, and when male students entered the washroom, alone or in groups," the report says.

"This information, streaming unsecured to the Internet, created a risk to student safety. It also exposed them to potential embarrassment or humiliation."

Tully's report recommends several changes to the school board's technical security practices.

They include the development of a privacy breach policy, the securing of cameras behind a firewall, the replacement of two exterior cameras, and the immediate disabling of a video surveillance camera outside the boys' washroom at the school.

Tully said she was told the washroom camera was installed in response to a specific incident in 2015 that was later resolved.

"Well the purpose was served, it's over and there's no longer any authority for that camera, so my recommendation is that camera should come down."

Beth MacIsaac, superintendent for the Cape Breton-Victoria Regional School Board, said the washroom camera has since been taken down and new secure passwords and firewalls have been added to the two remaining cameras.

"I think there's a lesson for everybody in this on how vulnerable we all are with video cameras on our computers and everywhere else," MacIsaac said.

Tully found that the board hadn't established whether its system is legally authorized under the Freedom of Information and Protection of Privacy Act. She said all school boards in the province had implemented video surveillance without conducting a privacy impact assessment to ensure compliance with the law.

Tully's office plans a privacy impact assessment workshop for school boards in the coming months.

"It is essential that school boards conduct a thorough privacy impact assessment of their video surveillance systems in order to find the proper balance between ensuring the safety of children while respecting their privacy," Tully said.

Education Minister Zach Churchill said it could be time for his department to look at a province-wide policy on school video surveillance: "This incident demonstrates I think that we do need to have more of a provincial scope with this."

Tully's recommendations are not binding, and Premier Stephen McNeil said he doesn't see the need for the privacy commissioner to have such power.

"We believe the current structure is working and we'll continue to operate that way," said McNeil.