Children's aid families’ names posted online

Police are investigating an unprecedented security breach at a Brockville-area children’s aid society after an electronic file containing the names of 285 families involved with Family and Children’s Services of Lanark, Leeds and Grenville was made available on Facebook.

The breach was discovered Monday at 1:42 p.m. after both a client and a community member called the society to complain that a link to the confidential report was posted on the Smith’s Falls Swapshop Facebook page, executive director Ray Lemay told the Star Monday night.

The society doesn’t know how long the link had been on the members-only page or if it has been shared more widely, he said.

“We’re looking into whether it has gone any further than that. But we are not sure at this point,” Lemay said.

Publishing or otherwise identifying families involved with child protection agencies contravenes the provincial Child and Family Services Act and carries fines of up to $10,000 and three years in jail.

The names were part of a statistical report to the society’s community board of directors on new cases between April and November 2015, Lemay said.

A link to the report was obtained by someone — “likely a disgruntled client” — who hacked the secure portal for board members on the society’s website, he said. No staff or board members are suspected of the breach, he said.

“Our suspicion, which is a fairly firm suspicion, is that it is a current client who is very disgruntled, very unhappy with us,” he said. “We have contacted the police. Our lawyer has sent a letter to the website owner as well as to this individual telling them what they are doing is, we think, illegal.”

Staff will begin calling all 285 families to tell them about the privacy breach first thing Tuesday morning, Lemay added.

“I apologize for this — we will act to ensure that this doesn’t happen again. The children and families we serve have a right to privacy — and they deserve respect,” Lemay said in a statement released Monday night. “Moreover, that someone would inappropriately obtain, then post this document on the Internet purposefully, is deeply troubling. Furthermore, this action is likely in direct contravention to the Child and Family Services Act and directly harms the children and families we serve.”

“Because of the nature of our work, emotions regarding CAS can run high,” Lemay added. “That said, there is no excuse for a person to deliberately expose our clients in this way.”

The society also takes responsibility for the security breach.

“Obviously there was a lapse at our end. That portal was not secure enough. The information should simply not have been accessible,” Lemay said in an interview. “We acknowledge that. There’s no doubt about our mistake in this, too.”

Lemay, who retired in 2014 as executive director of the Prescott-Russell children’s aid society after 30 years in the field, came out of retirement recently to lead the Lanark, Leeds Grenville society.

“This is very much a first, as far as I can tell,” he said of the incident.

The Ontario Association for Children’s Aid Societies, which represents the province’s 47 societies, said a privacy violation of this magnitude is unprecedented.

“We can’t even acknowledge that somebody is in our care when the media asks about it, even if it is all over social media,” spokeswoman Caroline Newton said.

“This is totally unacceptable,” she added. “The police are involved, as this is very serious. (The society) will be taking steps to figure out what happened and to fix it. And they will work with the people affected.”

Barbara Goderre, administrator for the 13,000-member Smiths Falls Swapshop Facebook page, said she had no idea the link was related to a confidential children’s aid report.

“If I’d have known, I would have been all over that,” she said in an interview. “It’s awful that someone would do something like that.”

A police spokeswoman declined to comment on the case.

 

With files from Nick Westoll