Crime Stoppers cyber breach may put tipsters’ lives at risk

A detailed view of a person typing on a keyboard. (Yan Krukau via Pexels)

The Canadian Crime Stoppers Association is unsure if tipsters’ personal information has been exposed months after a “security incident” affecting prominent software used to share anonymous tips of crimes.

The data breach allegedly involves Crime Stoppers in the United States as well, where media reports in the U.S. allege that approximately 8.3 million records and decades of confidential tips, including the personal details of individuals who submitted anonymous tips, was compromised by online hackers.

The reports also allege that the personal contact information of those who sent in anonymous tips was then put up for sale on the dark web.

“We have reports that people were sending in tips on organized crime, like the Sinaloa Cartel. If you’re the Sinaloa Cartel, you’re going to want to access that information (from the data breach) and that’s what’s going to put those tipsters at risk,” says University of New Hampshire assistant law professor Mailyn Fidler.

The data breach occurred at P3 Global Intel, which is a cloud-based intelligence and anonymous tip platform that powers Crime Stoppers programs. Both government and police agencies are also known to use the software.

“Local police departments to the U.S. military (use it). That’s a lot of centralized information and data,” adds Fidler.

CTV News requested an interview with Canadian Crime Stoppers Association President David Forster.

In an email, Forster wrote that he “is aware of a security incident relating to P3 software. We are presently unaware of a specific impact to the Crime Stoppers programs in Canada as a result of the incident, but we will continue to work with our partners and specialists to ensure the incident is investigated, and we comply with our regulator obligations as required.”

In the U.S. the Portland, Ore., police bureau encouraged people in that city “to temporarily refrain from submitting tips through the Crime Stoppers platform.”

In Canada, it doesn’t appear that any police service has released a similar public advisory, recommending the public refrain from submitting tips to Crime Stoppers.

Various technology outlets reported the breach on March 18, and Toronto police say they were aware of allegations the same day.

Crime Stoppers in Canada is still using the P3 Global Intel platform to collect anonymous tips.

Police stations told weeks apart

Multiple policing agencies across Canada who work closely, but are not directly affiliated, with Crime Stoppers have shared with CTV News that the civilian-run agency did alert them of the cyber security incident.

However, the police services in Vancouver, Toronto and Calgary each say they were alerted of the alleged cyber attack months apart by Crime Stoppers.

A Vancouver police constable told CTV News they “were notified of the data breach in May but no specifics were disclosed.”

Toronto police told CTV News that “Toronto Crime Stoppers (TCS) made Toronto Police Services (TPS) aware immediately when the allegations of the breach came out on March 18^th.

“TCS has kept the TPS informed of all developments as information has been provided by Navigate360/P3. At this time, it has not been confirmed whether any information relating to anonymous TCS tipsters was compromised as part of this incident.”

Calgary police public affairs wrote to CTV News, saying it was were alerted in April “of a cyber security incident involving a Crime Stoppers third-party service provider. At this time, there is no indication that data related to Calgary tips has been compromised.”

On Wednesday, Hamilton Police Service shared a media release saying it was “made aware of a Crime Stoppers breach.”

However, a law firm in Seattle says one of its clients, who’d previously provided an anonymous tip to Crime Stoppers in the U.S. learned that his personal information was online, and was readily accessible on the dark web, after an American journalist found his information and reached out to him and alerted him that his personal contact information was online.

“We have a client who submitted an (anonymous) report on a very well-known prominent criminal matter in the United States, and a reporter reached out to him and had the details of the report he made in that case, and so we know that there are people whose reports can be found on the dark web,” says lawyer Thomas E. Loeser, who is also managing council at Cotchett, Pitre and McCarthy LLP.

A breach of public trust: Lawyer

Loeser argues the fact that personal information was allegedly breached, collected and not adequately secured by P3 Global Intel, nor its parent company Navigate360, is a significant breach of public trust.

“This has the potential to give people great pause as to whether they should report something if they can’t have confidence that their report and their identity is going to be kept confidential.

“The problem here is that this company should have been keeping people identities, if they had to collect them at all, in a different way,” says Loesser.

Professor Fidler believe that the fact that Crime Stoppers in Canada hasn’t confirmed, after three months, whether members of the public have had their anonymous reports and personal information leaked and potentially sold on the dark web is of grave concern.

“Individuals’ lives could be at risk here, depending on the details of the crime you have reported on,” says Fidler, who adds that any “violation of that trust, of promising that something is anonymous and then it not being anonymous is really fundamentally challenging for folks who are seeking to report crimes.”

Loeser has started a U.S.-based, class-action lawsuit against P3 Global Intel’s parent company, Navigate360.

CTV News’ request to interview Navigate360 was declined. In an email, the company spokesperson said the company was “unable to participate in an interview as the matter involves an ongoing criminal investigation.”