Poor security controls led to camera breach at Nova Scotia school, report finds

Inadequate passwords and insufficient technical controls led to video surveillance images of Cape Breton schoolchildren being live streamed on the internet, Nova Scotia’s information and privacy commissioner says.

Catherine Tully’s report says the video system at the Rankin School of the Narrows in Iona was breached when a link to the live feed from one school camera was picked up and distributed by a Russian website that specializes in linking non-secured video surveillance cameras.

Tully says an unsecured technical vulnerability enabled viewers to access the school’s other two cameras as well.

The report says the Cape Breton-Victoria Regional School Board changed the passwords on its cameras once it learned of the breach, however Tully found the board still hasn’t implemented adequate technical or administrative controls to reduce the risk of future breaches.

“If video surveillance is used, it must be properly secured,” Tully said in a news release. “When video surveillance images from the Rankin school were streamed on the internet for all to see, this was a violation of Nova Scotia’s privacy laws. Video surveillance images of schoolchildren streaming unsecured to the internet created a risk to student safety.”

Tully began her investigation in May after it was revealed that detailed images of pupils at the school, aged five to 18, were appearing on the website. Her report, released Thursday, recommends several changes to the board’s technical security practices.

They include the development of a privacy breach policy, the securing of cameras behind a firewall, the replacement of two exterior cameras, and the immediate disabling of a video surveillance camera outside the boys’ washroom at the school.

The report also considers the school board’s rationale for using video surveillance. Tully found that the board hadn’t established whether its system is legally authorized under the Freedom of Information and Protection of Privacy Act. Tully said all school boards in the province had implemented video surveillance without conducting a privacy impact assessment to ensure compliance with the law.

She notes boards have used surveillance tools as the technology has become cheaper and easier to use in order to “ensure the safety of children.”

Tully said safety is of “fundamental importance,” but video surveillance is highly invasive.

“It is essential that school boards conduct a thorough privacy impact assessment of their video surveillance systems in order to find the proper balance between ensuring the safety of children while respecting their privacy,” she said.