Privacy commissioner finds 2nd GN network leaves sensitive files exposed
Report recommends territorial government decommission its Y:drive file-sharing network
A Government of Nunavut file-sharing system called the Y:drive has serious privacy problems and needs to be decommissioned, says Nunavut’s information and privacy commissioner. (File photo by David Lochead)
This story was updated on Wednesday, June 14, at 11:39 a.m. ET.
Shock expressed by Nunavut’s privacy commissioner last year over an unprotected file-sharing network used by the GN has exposed security flaws in a second government network.
The networks in question are called the V:drive and Y:drive. Privacy commissioner Graham Steele recommended the GN replace its V:drive last year because it left “dozens, and maybe hundreds, of files with privacy-invasive content” available to any GN employee within a particular community.
The government shut down the V:drive in November and replaced it with a more secure system.
In a report he released June 1, Steele he was sent a tip following the release of his assessment of the V:drive.
“If you think the V:drive was a problem, you should see the Y:drive,” a GN employee told Steele, according to the report.
The Y:drive is used by 13 of the GN’s public bodies, including all departments, Nunavut Arctic College and the Nunavut Housing Corporation. It stores information for GN employers within the communities where they work.
Steele asked each body to conduct a self-audit, and he did a test audit himself of the Department of Family Services.
What he found within the Department of Family Services in Iqaluit were copies of adoption and foster records sitting available for all employees at the department to see because they had been left, unsecured, on the Y:drive.
“Based on the self-audits, I conclude that the Y:drive is fundamentally flawed from a privacy perspective,” Steele said in his report.
“The privacy problems are too pervasive to be fixed.”
Steele recommends the Department of Community and Government Services, which is responsible for the Y:drive, decommission the drive.
Steele acknowledged that doing so would be a considerable task.
His recommendations for managing the Y:drive until it is decommissioned include hiring someone to be responsible for Y:drive privacy, restricting high-risk files, and that each public body and department examine its Y:drive policy.
Steele also recommended the Department of Executive and Intergovernmental Affairs respond to the report on behalf of all public bodies.
The Department of Community and Government Services will look into ways to have its digital file storage systems align with the recommendations in Steele’s report, said department spokesperson Hala Duale in response to questions from Nunatsiaq News.
The Department of Executive and Intergovernmental Affairs will provide a response to Steele’s report on behalf of all public bodies, said Casey Lessard, communications director for the department, in an email to Nunatsiaq News.
That response will be tabled in the legislative assembly.
Lessard said the Access to Information and Protection of Privacy office is working with the Department of Community and Government Services to update the government’s policies as well.
Correction: This story has been updated to include a response from the Department of Executive and Intergovernmental Affairs.
“2nd GN network leaves sensitive files exposed”
Cars are involved in accidents, so cars should be banned.
People have been killed with knives, so let’s get rid of all the knives.
Too much salt can be deadly, so we must get rid of salt.
The problem is three-fold.
1. The administration of file access.
2. People not storing information appropriately.
3. Controls and processes that are so difficult to work with that people feel impelled to find ways around them.
Many people complain that the GN is inefficient. Without the ability to share information (when appropriate), GN employees would be much more inefficient. You say you were dealing with Olipeeca. Olipeeca is no longer with us. We have no access to what Olipeeca was doing. You will have to start over with someone else. “I understand that you were expecting to graduate from high school this year, but we no longer have access to your school records, so you will have to start over in kindergarten.”
Replacing the Y drives with One-drive or Google-Docs or MoveIt would open the GN to even more data vulnerability.
Then there’s Teams and the other collaboration tools that create the potential for even more intrusions.
Systems only work when people use them.
Part of the problem is attitude. The GN is seen as a collection of toys. I am the boss of this part of the GN. It is mine to do with as I please.
The GN is full of managers who do not know how to manage, supervisors who do not know how to supervise, administrators who do not know how to administrate. It also has leaders who do not know how to lead.
no one needs this kind of drive to share files in 2023. between talking about salt and suggesting MS Teams will lead to greater vulnerability you don’t seem to have a basic grasp of IT and data protection.
Love this guy he should be premier ?
It will only get worse before it gets any better our gn is like a beutleguese…ready for a breakdown if not addressed by the right people inuit orgs are nowhere to be heard of now and things continue downhill . Our mla leaders need to be persuasive in dealing with this kind of stuff ….right ? Did they get voted in for popularity instead