Two days after an exclusive CBC investigation revealed the extent of the Crime Stoppers data hack in Canada, experts are now weighing the long-term implications of what could be among the country’s most dangerous privacy failures.
“It strikes me as potentially one of the most harmful data breaches we’ve ever seen in Canada,” said Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law.
When it comes to the Canadian law, he says, both Crime Stoppers, the organization that collected the data, and Navigate360, the company it hired to manage it, could be held accountable.
“[How] Canadian privacy law functions is that the organization that collects the personal information is the one that’s responsible,” said Geist. “And even where they use third parties or subcontractors as part of what takes place, it’s on them to ensure that no matter who gains access to the information, it has that appropriate level of protection.”
However, enforcing those rules across borders — Navigate360 is U.S.-based — is notoriously difficult, he says, and the domestic penalties are weak.
“These kinds of incidents keep happening. There’s a real urgency to addressing Canadian privacy law, which is woefully out of date,” he said.
“And at the top of the list has been really weak enforcement.”
Expert fears company doesn’t know leak’s true scale
At the heart of the breach is Navigate360 and its tip management platform, P3. All Crime Stoppers chapters, including those in Canada and the U.S., relied on P3 to keep their data anonymous.
The information was stolen last March by a hacktivist collective Internet Yiff Machine, who stated they wanted to disprove the company’s claim that its platform was “anonymous” and “secure.” CBC News analyzed a copy of the hacked data and found that over 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed, along with tens of thousands of unredacted personal details.
CBC has reached out repeatedly to Navigate360 and shared the highlights of its investigation, but the company has not responded.
Adding to the controversy are accounts provided by the Toronto and Guelph Wellington Crime Stoppers chapters, where Navigate360 appeared to change its narrative about how much data had been stolen and what was affected.
According to a Wednesday statement from the Toronto chapter, Navigate360 initially told the organization that no Canadian data was taken, then said Toronto wasn’t impacted, before finally revealing months later that years of Toronto data was compromised. Guelph Wellington shared a similar statement on Thursday.
Cybersecurity expert Ali Dehghantanha, who reviewed samples of the compromised data as part of CBC’s original investigation, said it was alarming that Navigate360’s claims to Toronto Crime Stoppers appeared to change.
“They apparently received six different [accounts] in seven months from the vendor,” he said, adding that this raises massive red flags about the company’s ability to investigate the hack and fix the vulnerabilities that might have allowed it.
Dehghantanha, who has conducted digital forensics investigations for over a decade, said he is also very surprised at how quickly Navigate360 seemed to have returned its system to an operational state following the hack.
WATCH | More about the investigation:
Crime Stoppers hack exposes personal information of tens of thousands of Canadians
A massive data breach leaked 25 years worth of unredacted personal information from Crime Stoppers, compromising the identities of thousands of Canadian tipsters. The Toronto branch of Crime Stoppers has asked the public not to send in tips until the issue is resolved.
Toronto Crime Stoppers said it was told about the leak on March 18; a week later on March 25, Navigate360 told the organization that the system was “safe and fully operational.”
“It doesn’t seem that there was a full investigation there,” Dehghantanha said, “that you could do and you could say, ‘Oh, only these clients have been impacted.'”
Internal memo advises against calling privacy commissioner
Meanwhile, Geist says tipsters whose information has been leaked may be limited in their options for justice.
“In terms of actual compensation to the affected individuals, current privacy law doesn’t really focus on that,” he added. “You’ve got to look to other mechanisms like class actions if what you’re looking for is actual compensation.”
Beyond that, another avenue could be to launch a privacy commissioner investigation — but Geist warns that could take years, and any recommendations for the future would not be legally binding.
WATCH | Ont. police suspend tip lines:
Multiple Ontario cities suspend Crime Stoppers tip lines over massive data hack
Toronto, Halton and Guelph are among the Ontario cities temporarily pausing Crime Stoppers tip programs after a CBC News investigation revealed a massive data breach exposed 1.5 million tips over the past 25 years to possible exploitation by hackers.
He noted that even if Canada’s privacy commissioner investigates the matter, it can only issue a “non-binding finding” directing a company to fix bad practices — it cannot force a company to compensate victims.
Still, even with those limited powers, the privacy commissioner may have already been top of mind for the Canadian Crime Stoppers Association (CCSA) in the months following the hack, according to a copy of a June 18 internal memo obtained by CBC.
“We currently do not believe that you are required, nor should you contact the privacy commissioner in your region at this time,” instructs CCSA president David Forster, saying his organization has “previously assessed that they [the commissioner] do not have jurisdiction over Crime Stoppers.”
Crime Stoppers is best known for its public appeals, often partnering with police, for help with unsolved crimes and to advance investigations — all with the promise of anonymity for tipsters who contact them. (Tyson Koschik/CBC)
CBC has reached out to the CCSA for comment on the contents of the memo.
We have also contacted the Canada and Ontario Privacy Commissioners to ask if they are investigating the data breach, if they have received any citizen complaints, and whether they actually have jurisdiction over Crime Stoppers.
In a public statement on Thursday, Forster offered reassurance to the public: “Navigate360 has advised us that third-party cybersecurity experts investigated the breach, identified vulnerabilities and completed remediation.”Those measures strengthen protections for current and future tips, he said.
However, he noted: “They cannot undo the exposure of information already taken, which remains a serious concern.”