The B.C. government and Telus have tightened the way electronic records are handled at a Victoria data centre after computer tapes containing personal information on hundreds of thousands of B.C. residents were discovered missing.
Three of the missing tapes include social insurance numbers, names and addresses for “up to 250,000” British Columbians who received income assistance in 1991, 1993 and 1998.
Another 16 of the tapes include health information, including patient names, birth dates, prescription records, diagnoses, claims made under the Medical Services Plan and PharmaCare, as well as details of Care Cards and home oxygen services from 1984 to 2000.
Thirty-three tapes were discovered missing only in August of last year, but their absence was not reported publicly at the time.
During an investigation by consultants KPMG, two of the missing tapes were found. They had been loaned out and not returned. It is unclear what happened to the remaining 31.
However, a confidential report of KPMG’s investigation, which was completed last Feb.21 for the B.C. comptroller general’s office, lists two of the “more likely” explanations. The first is that the still-missing tapes were sent in error for confidential destruction. The second is that they were lent out and not returned.
Other, “less likely” or “unlikely” explanations are that the tapes were intentionally thrown out or destroyed, hidden or misplaced, mislabeled or intentionally removed for their information value or for resale.
A copy of the report was obtained by ITBusiness.ca last week under a freedom-of-information request, although more than a dozen pages and parts of many others were withheld on grounds that their release could harm the security of a computer system.
The report says that it was difficult to complete a full investigation because of the long period of time from when the tapes were last known to be accessed and the discovery that they were missing.
“A large number of persons had access to the data centre during that time, which made it difficult to isolate who was involved,” according to the report.
It adds that last year’s labour dispute between Telus and its staff also limited the investigation: “A number of Telus personnel, who would normally have been interviewed, were unavailable due to an ongoing labour dispute.”
The report says that there has been a “significant turnover” of staff at the data centre since July, 1998.
At the time, there were 18 government staff who remained at the data centre as contractors. But by last August, only three of these remained.
“Approximately 40 persons have worked in the data centre from the time Telus took over to October, 2005,” the report says.
The data centre stores about 200,000 computer tapes at any one time, of which about 70,000 contain government data.
In trying to track down the missing tapes, data centre staff searched library shelves “approximately” four times, looked above the false ceilings using a stepladder and flashlight, and looked under the floor, among other places.
Labour and Citizens’ Services Minister Olga Ilich said the problems stem from the NDP era, when the government of the day contracted out storage of government computer tapes to Telus, on July 12, 1998.
“Since then, we’ve taken a number of steps to improve the procedures and record-keeping and there are a number of safeguards that are now in place,” Ilich said. “Obviously, we’re not pleased when there are things that go missing.”
Ilich added that her ministry has contacted the office of the B.C. Information and Privacy Commissioner, which told ministry staff that the government has done everything necessary to protect the records.
Bill Trott, the acting director of the Office of the Information and Privacy Commissioner, confirmed that his office was made aware of the missing tapes.
“We were satisfied with the steps that they were planning to take,” Trott said.
Telus spokesman Shawn Hall said that when Telus assumed operation of the tape storage system eight years ago, it took over responsibility for “existing staff and processes that were in place.”
Telus conducted its own review, and has since strengthened the data’s security in a number of ways—in some cases before the issue of the missing tapes came to light, he said in an interview.
“Telus has actually invested more than $200,000 in encryption, privacy and security technology at the date centre as a direct result of the reviews,” Hall said. “We’ve actually either implemented or are in the process of implementing every recommendation that the auditors made, which minimizes the likelihood of a tape ever going missing.”
Last March, it was revealed that 41 sensitive government computer tapes were sold at auction.
University of B.C. emeritus computer science professor Richard Rosenberg said that citizens turn over large amounts of personal information to the government, on the understanding that it will be properly handled.
“You sort of wonder, when are the lessons going to be learned that confidential information has to be protected, guarded and dealt with as if it’s important, because it is,” said Rosenberg, who is also the president of the B.C. Freedom of Information and Privacy Association. “It’s not acceptable that the government, in retrospect, cannot figure out what happened to such important information.”
Comment: [email protected]
