School surveillance cameras still unsecure, months after broadcast on Russian site

Nova Scotia's privacy commissioner says security cameras at a Cape Breton school remain vulnerable to attack, months after images of students inside a Cape Breton school were unintentionally broadcast on the internet.

Catherine Tully's report has found there were "inadequate passwords and insufficient technical controls" behind the initial breach. While passwords have been changed, Tully said the school has still not placed the streams behind a firewall or equivalent protection, and two of the cameras are no longer supported by manufacturer security updates.

"Security problems arise constantly, they change, people hack things in different ways so you have to be nimble, you have to adjust your technology to adapt to those risks and they can no longer do that with the existing cameras," she said.

"Reasonable security requires that they [those cameras] be behind a firewall. The manufacturers of the camera recommend them, but they haven't done that yet."

On Thursday Beth MacIsaac, superintendent of the Cape Breton-Victoria Regional School Board, said all cameras in the board are now behind a firewall.

Tully's report follows a CBC News investigation in May that showed how unsecured web cameras at Rankin School of the Narrows in Iona broadcasted hundreds of thousands of high-definition pictures of students.

Student safety at risk

Tully said in the report published on Thursday that if video surveillance is used, it must be properly secured.

"When video surveillance images from the Rankin School were streamed on the internet for all to see, this was a violation of Nova Scotia's privacy laws. Video surveillance images of schoolchildren streaming unsecured to the internet created a risk to student safety."

The security lapse led to images ending up on the Russian-registered website insecam.org, and included images of children near washrooms, in hallways and in the schoolyard.

The cameras were only made secure after CBC News alerted the school and CBVRSB of the problem. The board then changed the passwords.

Washroom camera of particular concern

Tully said of particular concern was the camera outside the washroom.

According to the report, that particular camera was placed in that spot over concerns about repeated incidents inside the washroom involving a student. The report did not specify what those incidents involved.

"This is not an either-or situation. We need to have safety, but we also have a right to privacy. So we need to work out how can this happen with both things being respected," she said.

The privacy commissioner said though every board in the province used video surveillance in some way, none had conducted a privacy impact assessment into whether it was in compliance with privacy laws.

Tully said in her report that every board has now agreed to develop a privacy impact assessment — except the Cape Breton-Victoria Regional School Board. The board has 30 days to review the recommendations in the report and decide whether to participate in the PIA process.

"While I'm disappointed that they weren't able to agree to that, I'm endlessly optimistic that they will in fact agree to the recommendations, they'll attend the privacy impact assessment workshop and we'll figure this out together," said Tully.

Recommendations

Tully has recommended several changes, including that the board:

- Develop a privacy breach policy.

- Further secure its cameras, for example, using a firewall.

- Provide privacy training.

- Disable the camera located outside the boys' washroom at Rankin School.

- Replace two exterior cameras that are no longer supported by the manufacturer.

She also said the board should take a look at its rationale for having the cameras in the first place. Tully said in the report that the board had not established that video surveillance is authorized under the Privacy Act.