News
1. The FOIPOP security failure
Yesterday, Allnovascotia.com reported that, through a Freedom of Information request, it had obtained emails from early April when provincial employees were discussing a “security flaw” with the FOIPOP website.
I don’t have a subscription to the site (they don’t allow other reporters to subscribe), so I’m only relating what I gleaned off Twitter discussion of the report. But if the employees were discussing a “security flaw” then they knew the site had not been “hacked,” which is what they told Halifax police, who went on to arrest a Halifax teenager.
A reader sent me the Privacy Impact Assessment the Department of Internal Services conducted before making the FOIPOP site. Click here to read the entire document. I’m still working my way through it, but here are the parts that jump out at me:
Page 16:
To prevent a privacy breach, not all disclosures will be posted on the disclosure log. Only disclosures resulting from requests for general information will be considered candidates for the Disclosure Log. Disclosures resulting from requests for personal information or personal and general information will not be eligible.
Eligible releases will be posted to the disclosure log after seven days, this is to both allow the applicant time to review their information and for the Publication Review Committee to see if there are any other considerations which may make it inappropriate to release on the disclosure log.
Responses that contain un-redacted personal information (e.g. in cases where the applicant’s own information appeared in the release and was left un-redacted) will not be posted on line.
Obviously, that policy was not followed. At the crux of the matter is, How did those responses that contained un-redacted personal information get posted online?
Whatever the details, it was a simple screw-up, probably the result of mixed messages and not enough thought put into designing the processes. You know, shit happens. Everyone makes mistakes, and while establishing the disclosure log, people somehow got it all wrong. I don’t think anyone went into this with ill-intent. Had it just ended there — an acknowledgement that mistakes were made and some profuse apologies issued, this wouldn’t be the big deal it is now.
The mistake isn’t what makes this a big deal. It’s the “let’s blame someone else” part of this that makes it a big deal.
And here’s something that confuses me, found on Page 19:
“Institute a purge process for IP Data stored on Amanda Web Servers.” And yet… when provincial employees went to police, they had a record of IP addresses used to access the FOIPOP site.
I need to think this through, but my initial read on this is that by simply having the IP address of the teenager, they were violating their own policy.
I’d be interested in hearing from IT security people after they have read the document.
2. Old growth for biomass
Peter Bush, who is a forester with the Department of Natural Resources (DNR) has authored a Forest Technical Note, “Old Forest Assessment in the Lawlor Lake Area of Guysborough County, Nova Scotia,” which finds:
The Department of Natural Resources (DNR) assessed 27 forest stands in the Lawlor Lake area of Guysborough County in March 2018 in response to public concern about forest harvesting and forest product utilization. DNR used the old forest scoring system, outlined in the Old Forest Policy (2012) to assess these stands. The assessment looked at 12 stands that were recently partially harvested and 15 stands that were planned for partial harvest in the area. DNR found that 2 of the 12 recently partially harvested stands were old growth forest (OGF), and a further 8 were considered old forest that did not meet the criteria for old growth. Of the planned harvest stands (not treated), 11 of the stands were OGF; 1 was old forest; 1 was mature forest, and 2 were immature. Old forest scoring age for all the stands surveyed had a mean of 134 years, with a range of 45- 167 years. The Old Forest Policy currently has 27,825 ha (15.7% of the Eastern Interior Ecodistrict) of conserved OGF and restoration opportunities. An examination of the Pre-treatment Assessment indicator currently used to flag potential stands for old forest scoring found that 5 of the 13 OGF stands in this study would have been flagged if used. The Old Forest Policy and its associated tools (old forest scoring) provides a science-based approach to evaluate OGF and appropriate policy mechanisms to conserve that forest when it is found.
“The assessment was done in response to ‘public concern’ about harvesting practices,” explains Nina Corfu for the CBC:
In March, veteran logger Daniel George took the CBC on a tour of the area to illustrate his concern that old-growth forest was being cut down.”
The report, released Thursday, confirms some of his suspicions.
In February, George told the CBC that the trees were cut to feed Nova Scotia Power’s Point Tupper biomass plant.
3. Whitefish and the Burnside Expressway
“There are now so few endangered Atlantic whitefish alive in Nova Scotia that researchers are capturing every juvenile they can find this year and whisking them from the wild to a federal fish hatchery for safekeeping,” reports Paul Withers:
It’s part of the latest effort by the Department of Fisheries and Oceans to prevent what is widely seen as the looming extinction of this ancient relative of the Atlantic salmon.
Withers goes on to give an overview of the threats to the species and the efforts to save it. As I was reading, I recalled that Anderson Lake north of Burnside was being held out as a sanctuary for the fish; Withers also explains that sad story:
Years ago, DFO thought they had found a safe haven for the Atlantic whitefish at Anderson Lake on military property next to Magazine Hill in Dartmouth. The lake was free of bass and pickerel.
Between 2005 and 2012, large numbers of Atlantic whitefish reared in a captive-breeding program were put into the lake.
Some grew to sexual maturity, but did not reproduce — or if they did, the eggs did not make it. The fish starved, were eaten or died of old age.
Anderson Lake did not produce a self-sustaining population.
The Harper government, however, used the existence of Anderson Lake to justify its 2012 decision to shut down the Atlantic whitefish captive-breeding program.
Hundred of adults were dumped in Anderson Lake when the breeding program shut down, but none survived.
I guess now we can build that Burnside Expressway because there’s no worry about the environment, sigh.
4. Axe
A police release from last night:
At 5:45 p.m., Police responded to the 600 block of Portland St. Dartmouth to a report of a male with an axe. Responding officers located the male in the middle of the road and he was swinging the axe in a threatening manner. The male resisted officers when they attempted to arrest him but they were able to arrest him without anyone being injured. The 20-year-old Dartmouth man will appear in court tomorrow to face charges of causing a disturbance, possession of a weapon and resisting arrest.
Now if only they would arrest the boys reeking of Axe on the bus.
5. Tenders
This morning, the city issued two tender offers of note. One is for continued renovation of City Hall, involving the demolition and removal of walls and plumbing on the first floor (the below-ground floor, as seen from the Grand Parade). The other is for stabilization of the shoreline at Horseshoe Island.
Views
1. Sawmill River
Stephen Archibald went to the Jane’s Walk at the newly daylighted Sawmill River in Dartmouth. He’s generally pleased about the daylighting but notes:
Engineers from Halifax Water spoke at the walk and were clearly excited by what has been accomplished in a very complex project. Like many people I was saddened to see the new section of open water was obtrusively fenced. The grassy slope is engineered to handle water during an extreme flooding event but maybe not so much people on a summer afternoon. I could be wrong.
I feel the same way. It seems we spent an awful lot of money to daylight a stream you can’t even get a good view of without working at it. I realize this is just the first section of a larger project, so maybe the downstream daylighting will be more accessible.
Incidentally, Archibald links to David Jones’ site, where Jones posted this cool video of the flooding caused by Hurricane Beth in 1971:
White space
2. Unemployment
Richard Starr looks at Nova Scotia’s unemployment rate:
It seems to have passed unnoticed by the news media and the government spinners but the monthly labour force survey released last Friday revealed Nova Scotia hitting a milestone — the unemployment rate in April was 6.7 per cent. That’s the lowest it has been since Statistics Canada began reporting comparable data in 1976.
Considering that double-digit unemployment was the norm in Nova Scotia for most of the 42 years covered by the data set, the low rate — part of a downward trend that started last fall — may once have been considered a big deal. The fact that it has so far gone unremarked indicates that the issue has changed — from concern about the number in the labour force without work to a focus on the size of the labour force itself. On that score, the 6.7 per cent rate reflects a mixed blessing.
On the positive side, Stats Canada reported employment at 457,500 in April, 7,500 more than the same month last year. That total may look impressive, but it is only 1,200 above April 2012. That year was the high water mark for employment in Nova Scotia and the numbers have been lower every year since.
If the current pace continues, 2018 may turn out to be the year the province breaks the annual average employment record set in 2012. But that could prove difficult, considering that the other determinant in calculating the unemployment rate – the labour force — shows no sign of growing. As the table shows, the labour force has fallen by more than 10,000 since 2012 — hence the significantly lower unemployment rate despite the insignificant increase in jobs over the last six years. There are fewer people seeking available jobs.
3. Doctors
Bill Turpin provides an update on the family doctor shortage.
Government
No public meetings.
On campus
Dalhousie
Friday
CETA Implementation: The Next Steps (Friday, 8:30am, Room 1028, Rowe Management Building) — the CETA {Canadian-European Union Comprehensive Economic and Trade Agreement) Implementation and Implications Project (CIIP) is led by Robert Finbow, who is running workshops about “public services and procurement, labour mobility and labour relations, investment, environment, agriculture and geographic indicators, as well as intellectual property, science and regulatory cooperation.”
Building Belonging Gathering (Friday, 10am, Room 307, Student Union Building) — Lisa Goldberg and Tim Muloney will lead group discussions “to share our reflections on issues and inspirations from Mark Tewksbury’s Belong Forum. In small groups, we will collectively generate meaningful ways to practically apply what we’ve learned from Mark, to the Dal context and community. Mark will join us for the second hour, where we might share our ideas with him and invite him into the conversation.” Register here.
In the harbour
5am: Brevik Bridge, container ship, arrives at Fairview Cove from Fos Sur Mer, France
5am: YM Modesty, container ship, arrives at Fairview Cove from Norfolk
8am: Onego Capri, cargo ship, arrives at Pier 27 from Szczecin, Poland
8:45am: Scotian Sea, supply vessel, arrives at Pier 9 from sea
9:30am: Atlantic Osprey, offshore supply vessel, arrives at Pier 9 from St. John’s
11am: Mol Partner, container ship, arrives at anchorage from Colombo, Sri Lanka
2pm: Lacerta, oil tanker, sails from Imperial Oil for sea
3pm: Brevik Bridge, container ship, sails from Fairview Cove for New York
3pm: Algoma Integrity, bulker, arrives at National Gypsum from New York
4pm: Tugela, car carrier, sails from Autoport for sea
5pm: Nolhanava, ro-ro cargo, sails from Pier 36 for Saint-Pierre
6pm: Atlantic Osprey, offshore supply vessel, sails from Pier 9 for sea
8pm: YM Modesty, container ship, sails from Fairview Cove for Dubai
11pm: Ultra Angel, bulker, arrives at anchorage from Conakry, Guinea
Footnotes
We’ll be publishing another investigative report later today.
It is routine to save web server logs (which would include IP addresses) for a short period of time, and then purge them once you no longer need them for troubleshooting, detecting breaches, catching errors, analytics, or the like. The industry standard for retention has been decreasing in response to privacy legislation (GDPR) and general concern for privacy, though various policies still exist to require longer-term retention. So purging logs might not happen immediately, but after whatever your retention policy specifies. There are tools (e.g. logrotate) to do this automatically, including encrypting the older logs.
Without a fence at the Sawmill River project the city would be leaving itself wide open to significant financial liabilities in the event a person falls in the water and dies or suffers significant injury.
Common sense and legal decisions dictates a fence.
I’m really disappointed about the extinction of the Whitefish. Paul Whithers did a good job summarizing the situation but it really feels like very little has been done. I think they’ll be gone before the right whales and it seems like there’s very minimal public or political interest. A species of unique fish that evolved over millions of years is disappearing from the planet now. That river was historic First Nations territory, Champlain landed there first, one of the group of seven painted there. Every effort should be made at the municipal, provincial and federal levels to save those fish not just window dressing.
in the Privacy Impact Assessment, it looks like they considered the possibility that private information could be made public by accidentally posting it online and they had safeguards, that didn’t work.
What is missing in all this is an explanation of why credit card data was also stored there. They only reference Nova Scotia’s Generic Payments System. Personal information is one thing, but credit card data requires an even higher standard of protection.
Credit card data is stored on the separate Generic Payment System site, as you note. That site has its own set of rules and safeguards, its own Privacy Impact Assessment, and presumably must meet Payment Card Industry standards.
I’m not sure I see what the problem is on the slope or the fence by the newly opened brook. It was presumably done for environmental reasons, and that comes before the needs of local flâneurs, who have plenty of other places to go.
That said, the slope doesn’t seem impossible to sit on and rest or read. The fence is likely there to suggest to people that they stay out of the brook, but it looks like even a portly fellow like myself could get over it with no difficulty if I wanted to get my feet wet.