N.L. privacy commissioner steps away from long-awaited 2021 cyberattack probe
The provincial official leading an investigation into the 2021 cyberattack that toppled much of Newfoundland and Labrador's health-care system has begrudgingly stepped away from the probe after the province challenged his role in court.
Information and privacy commissioner Michael Harvey said Tuesday that he rejects the province's accusations of bias in his investigation of the attack. However, a news release said he will recuse himself from the ongoing probe "to avoid a lengthy and expensive court proceeding."
He said his priority is "to avoid any further delay in the release" of his office's report.
Harvey announced in November 2021 that his office would dig into the cyberattack. The investigation and report is expected to provide the public an in-depth look at what happened and why.
The attack crashed much of the province's health-care IT systems on Oct. 30, 2021, forcing thousands of appointment cancellations while some health-care facilities resorted to pen and paper to keep track of patients. For nearly a year and a half, officials kept mum about the nature of the attack and who was behind it, citing security concerns.
Last Tuesday, a day before the province filed its case against Harvey with the provincial Supreme Court, Justice Minister John Hogan announced the Hive ransomware group was to blame. He said he could finally reveal the perpetrator because the group had been dismantled earlier this year by the FBI. The hackers used a virtual private network to break in to the Newfoundland and Labrador Centre For Health Information, which maintains key databases and IT systems, he said.
Hogan would not say if the province paid a ransom or even if one had been demanded, again citing security concerns.
Court documents show Harvey was digging into the province's decisions to withhold information about the attack. In a long list of questions he sent to the Department of Health and Community Services in January, he asked why the public -- particularly those people whose information was stolen -- had not been told about the nature of the attack. He said the silence raised accountability questions, and that he had to consider if, for example, those who had their personal information stolen would have signed up sooner for credit monitoring if they knew what kind of attack was involved.
Harvey was also asking the department for answers about the time it took to tell people their data had been stolen. In his questions, he said officials had, or ought to have had, evidence of data thefts beginning Nov. 5, 2021. Officials held a public briefing five days later to say personal information had been "accessed," but he said they would not confirm to reporters that it had been stolen.
Officials ultimately reported that personal information belonging to more than 58,000 people had been taken by the hackers.
Harvey also asked the department about a 2019 assessment that flagged cybersecurity weaknesses at the centre for health information, as well as a 2020 information note from the centre that "rated the likelihood of a ransomware attack as being high."
In its lawsuit, the province argued that Harvey held high-ranking positions within the Health Department and Centre for Health Information before he was appointed privacy commissioner in 2019. Since his investigation encompassed decisions made while he held those positions, his involvement created "a reasonable apprehension of bias," said the statement of claim.
"As a matter of procedural fairness, therefore, the Commissioner should not be permitted to lead the investigation or participate in it in any manner," the document said.
The Office of the Information and Privacy Commissioner's news release Tuesday said Harvey rejected those allegations but that it was in the public's best interest that the investigation be included and its report be published as quickly as possible.
This report by The Canadian Press was first published March 21, 2023.
CTVNews.ca Top Stories
BREAKING Federal employees will be required to spend 3 days a week in the office
Starting in September, public servants in the core public administration will be required to work in the office a minimum of three days a week. The Treasury Board Secretariat says executives will need to be in the office four days per week.
Concerns about plexiglass prompt inspections at some Loblaws locations in Ottawa
Inspections are underway at more than one Loblaws location in Ottawa after complaints were filed about tall plexiglass barriers.
OPP officer said 'someone's going to get hurt' before wrong-way Hwy. 401 crash
As multiple Durham police cruisers were chasing a robbery suspect on the wrong side of Highway 401 Monday night, an Ontario Provincial Police officer shared his concerns, telling a dispatcher, "Someone's going to get hurt."
Canada's most wanted fugitive arrested in P.E.I. in connection with Toronto homicide
A suspect in a fatal shooting in Toronto’s east end last summer has been arrested in Charlottetown, just one week after he topped a list of Canada’s most wanted fugitives.
Poilievre returns to House unrepentant for calling Trudeau 'wacko,' Speaker not resigning
An unrepentant Pierre Poilievre returned to the House of Commons on Wednesday to pepper the prime minister about his drug decriminalization policies after being booted the day prior for refusing to take back calling Justin Trudeau 'wacko' over his approach to the issue.
Five human skeletons, missing hands and feet, found outside house of Nazi leader Hermann Göring
Archeologists have unearthed the skeletons of five people, missing their hands and feet, at a former Nazi military base in Poland.
Toddler of Phoenix first responder dies after bounce house goes airborne
A two-year-old child died after a strong gust of wind sent the bounce house he was in airborne and into a neighbouring lot in central Arizona, the Pinal County Sheriff's Office said.
Plane overshoots runway at airport in St. John's, N.L., no injuries reported
Investigators from the Transportation Safety Board of Canada are headed to St. John's, N.L., after a plane overshot a runway at the city's airport this afternoon.
A teen was found buried in a basement in New York. An engraved ring helped police learn her identity two decades later
For more than two decades, the unknown victim was nicknamed "Midtown Jane Doe" because she was found in the Hell's Kitchen neighbourhood of New York City. But this week, investigators finally revealed her identity.