Police Drop Charges Filed Against 19-Year-Old Who Downloaded Public Documents From Gov't FOI Portal

Legal Issues

from the access-not-specifically-authorized-is-not-'unauthorized-access' dept

Last month, we covered the incredible case of an unnamed 19-year-old who was facing criminal charges for downloading publicly-available documents from a government Freedom of Information portal. The teen had written a script to fetch all available documents from the Nova Scotia’s government FOI site — a script that did nothing more than increment digits at the end of the URL to find everything that had been uploaded by the government.

The government screwed up. It uploaded documents to the publicly-accessible server that hadn’t been redacted yet. It was a very small percentage of the total haul — 250 of the 7,000 docs obtained — but the government made a very big deal out of it after discovering they had been accessed.

The government complained to the police and had the downloader hauled in to face unauthorized access charges, claiming he had “exploited a vulnerability” to obtain unredacted files. But no exploit was used. It was the government that left unredacted documents in a publicly-accessible space. Nevertheless, the teen’s home was raided, his family accosted, and several electronic devices seized — including those of family members. The 19-year-old’s younger brother was even detained by officers while walking to school.

Government officials claimed the teen “stole” documents, and pushed for criminal charges which could have resulted in a ten-year sentence for downloading documents from a government portal designed to facilitate the downloading of documents.

Fortunately, Nova Scotia law enforcement has decided there’s nothing to pursue in this case.

In an email to CBC News, Halifax police Supt. Jim Perrin did not mention what kind of information police were given from the province, but he said it was a “high-profile case that potentially impacted many Nova Scotians.”

“As the investigation evolved, we have determined that the 19-year-old who was arrested on April 11 did not have intent to commit a criminal offence by accessing the information,” Perrin said in the email.

The “information” the province “handed over” was probably nothing more than the belated recognition that pursuing criminal charges had accomplished nothing more than exposing the government’s careless handling of citizens’ personal information and its willingness to find a scapegoat to burden with its failure. The government also revealed 11 other IP addresses had accessed the same unredacted documents, which only further solidified the government’s complicity in public access to unredacted personal info.

Prosecutors would have struggled to prove intent — something law enforcement likely recognized shortly after taking up the case. And this would have been a case they couldn’t ignore, not with government officials making lots of noise about hacking that never took place and “unauthorized” access that was plainly authorized by their inability or unwillingness to properly secure documents that hadn’t been vetted or redacted. It’s already suffered a PR black eye. This move to disengage simply reduces the chance of further injury.

Filed Under: canada, foi, foia, public documents, security