So this evening news is just coming out about an errant USB drive has been lost from the office of…
Elections Ontario?
C’mon people. Elections Ontario loses USB drive with voter data? This is why we can’t have nice things.
From CBC:
Elections Ontario has discovered a privacy breach that involves the personal information of voters in up to 24 provincial ridings.
CBC News has learned that memory sticks containing personal information about voters have gone missing from the office of the chief electoral officer for Ontario.
The information on the missing memory sticks includes the full name, address, gender and birth date of voters and may also include information on whether or not these same individuals voted.
There is no word yet as to whether or not the data was encrypted or, more importantly, why it was on the USB drive in the first place. Was someone getting into the sauce? I guess we’ll find out Tuesday morning.
Source: Article Link
(Image used under CC from AmsterdamPrinting.com)
The article has been updated, and says the data was encrypted, but it also says “there is no evidence that the data has been accessed.” I’m not sure how you’d get such evidence.
So…huh? If it was encrypted the “accessed” comment is just confusing. Did someone in the press conference wave their hand and say “the data was encrypted”?
Other news sites are saying the keys were *supposed* to be encrypted, but were not:
“The memory sticks must be password protected and encrypted if carrying personal information, according to Election Ontario policies.
In this case, they were not.”
http://www.theglobeandmail.com/news/politics/elections-ontario-warns-voters-of-privacy-breach/article4422723/
So some reporter screwed up. My money’s on the CBC reporter.
A different CBC posting shows a slightly different story:
http://www.cbc.ca/news/canada/toronto/story/2012/07/17/ontario-voter-data-breach.html
I suspect the Privacy Commissioner’s office will be pointing at the Health Care encryption order (subtitled “do it now”) and saying “this applies to you… and you… and you…” to every ministry or agency that handles PII.