When news broke recently that the Swedish Data Protection Authority fined a local municipality more than USD $20,000 for privacy violations, it marked the emergence of a potential new front in the struggle to balance privacy rights and security requirements.

Under the European Union’s General Data Protection Regulation (GDPR)—sweeping legislation that governs everything from website tracking to data collection practices across the 28-member European Union and European Economic Area—the use of data gathered with the help of facial recognition and biometric software is restricted and tightly controlled. Apparently a school board in Sweden didn’t get the memo and used facial recognition software to track high school student attendance over a three-week trial period intended to test out new technology.

The school board saw the tracking software as a more efficient use of teacher’s classroom time. According to media reports, attendance-conscious educators had apparently been devoting about 17,000 hours a year to keeping tabs on their pupils. The SDPA saw the matter differently and issued the significant fine, a first for Sweden.

Tech as a security tool, but to what end? 

The European Union has taken the lead in legislating to secure privacy rights and protect citizens, just as authorities in other regions have turned to cutting-edge new technology designed to enhance protection measures for the general public. In the wake of recent shootings in Toronto, for example, the city’s community housing agency has announced plans to increase video surveillance in at-risk neighbourhoods, all to help deter crime and aid police enforcement efforts. In the United Kingdom, cities such as London have long relied on street-level surveillance to maintain safety. The U.S. government has been using biometric technology, including the fingerprinting of foreign visitors, at border crossings for years.

The challenge that arises, of course, is when governments abuse these tools. China has faced widespread criticism for its use of facial recognition and data collection programs in its western provinces to track the local Uyghur community. In other parts of the country, Beijing actively uses technology to help silence or monitor anti-government voices. Many liken the tactics to an Orwellian invasion of privacy, an effort to enforce government-sanctioned values on an unassuming populace.

If a school board in Sweden uses facial recognition technology to track students, some argue, it’s not far-fetched to expect a more widespread application of that software across society. In the hands of a trusted few there isn’t much concern. But what happens if those individuals can no longer be trusted?

Legal systems adapting to new technology 

The reality is the use of technology as a protective tool is hardly novel and, in most cases, isn’t nearly as sinister as some may contend. The big question, as with the example from Sweden, is to what degree governments will tolerate its use. Authorities in Canada are beginning to weigh in on the safety and security vs. privacy debate.

In Ontario, for example, a labour arbitrator recently ruled in Teamsters Local Union No. 230 v Innocon Inc., that a concrete delivery company (Innocon) had the right to install cameras in its trucks to help improve driver safety and highlight potential driver misconduct by recording a driver’s actions, but only in the event that the vehicle swerved unexpectedly or took some form of evasive action that could indicate erroneous or erratic driving. In the arbitrator’s view, some level of in-cab monitoring was justified because an employer’s business interests can supersede an employee’s right to privacy under specific circumstances.

Security strategies for business

Business owners should be aware that at any point, our legal landscape could shift and new laws could limit the use of biometric or facial technology when used in public spaces or workplaces. But I predict that governments will take a measured approach to balancing privacy and security concerns. It’s likely that we will see a tightening of privacy restrictions in Ontario and across Canada at some point. In the meantime, however, your focus should be on assessing your organization’s security vulnerabilities and taking an integrated approach to protecting your people and assets.

That means reviewing the plethora of tech tools available on the market and deciding which ones make sense for your organization based on its operational needs. Facial recognition technology may make sense for a retailer with several busy locations, for example, but could provide little benefit to a software development firm with much simpler security needs. Be prepared to customize your strategy and invest in security components that will make a decided impact in helping mitigate risk and advancing your organization’s strategic goals (e.g., not being robbed, having your data held hostage or seeing your commercial property or workplace invaded).

But first, take the time to understand your jurisdiction’s privacy laws. Make sure your security strategy doesn’t violate any rules when the time comes to implement cutting-edge—yet potentially controversial—security technology.

Winston Stewart, President and CEO

Wincon Security

You know a situation is bad when even local governments are calling in the IT cavalry for help. But that’s the reality for municipalities struggling to combat increasingly frequent ransomware attacks that are targeting towns and cities across North America.

The problem is so severe that the Association of Municipalities of Ontario—a body that represents 444 of the province’s towns and cities—is encouraging greater information collecting and sharing between members, and calling on senior levels of government to provide funding to help protect their data and fend off this growing threat.

“AMO has also been urging the provincial and federal governments to work closely with municipal governments to help protect governments from cyberattacks, and to help public services weather attacks with less disruption,” AMO president Jamie McGarvey, the mayor of Parry Sound, Ont., told the Toronto Star, as published in a recent article.

Ransomware—a type of cybercrime where a hacker seizes or encrypts data and demands some form of payment, often untrackable Bitcoin, for its release—isn’t just plaguing big cities such as Toronto. Smaller communities with less robust digital infrastructure are also prime targets. So far the victims include Wasaga Beach, Stratford and Midland, to name only a few. More are sure to follow.

A North America-wide problem 

If it offers any comfort to municipalities and business owners in Ontario, a recent New York Times piece reminds us that hackers using ransomware to hijack public or private data do not discriminate when it comes to nationality. This is far from a Canadian phenomenon:

“More than 40 municipalities have been the victims of cyberattacks this year, from major cities such as Baltimore, Albany and Laredo, Tex., to smaller towns including Lake City, Fla. Lake City is one of the few cities to have paid a ransom demand — about $460,000 in Bitcoin, a cryptocurrency — because it thought reconstructing its systems would be even more costly

In most ransomware cases, the identities and whereabouts of culprits are cloaked by clever digital diversions. Intelligence officials, using data collected by the National Security Agency and others in an effort to identify the sources of the hacking, say many have come from Eastern Europe, Iran and, in some cases, the United States. The majority have targeted small-town America, figuring that sleepy, cash-strapped local governments are the least likely to have updated their cyberdefenses or backed up their data.”

And therein lies the challenge. Many municipal governments have cut their IT budgets to such a degree (or never funded them properly in the first place) that their systems are virtually open to cyber criminals. In some cases, data is being held hostage for millions of dollars. While in many instances these crimes are being orchestrated by sophisticated organized crime syndicates, a skilled teenager with a laptop can manage the same feat with minimal effort.

It’s one thing to lock up the data of an SME, but what happens when entire hospitals or health care systems are shut down by a clever hacker with a grudge, or a desire to cash in? These attacks are becoming so sophisticated that civic agencies and businesses of all sizes and across industries are at risk.

A very human problem 

As I’ve noted in previous blogs, most cybersecurity vulnerabilities stem from human error or negligence. Case in point: the town of Allentown, Pa., was targeted in a malware attack last year that shut down some municipal computers for weeks. The hacker exploited a vulnerability in a single employee’s laptop while that worker was on the road. Not surprisingly, the laptop hadn’t been updated to the latest software and was an easy target for the malware-toting hacker. That attack cost about $1 million to fix.

Now imagine that same unexpected cost taking a nasty bite out of your balance sheet and annual financial projections. When figures such as those are bandied about, it brings home the scope and seriousness of the problem—and underscores the need to take action.

That requires policies that ensure regular software updates of all machines, especially if your employees work off-site. It requires sufficient spending on IT, security and employee training. If we all agree that this is a ‘people’ challenge, we can start taking steps to fix the problem.

Employees should be trained to recognize phishing emails. They need to be equipped with VPNs for off-site work, and an understanding that websites that look fake often are—and are potentially run by a hacker residing in the cyber netherworld, waiting to pounce on an unsuspecting victim. They must also never share passwords and should change theirs on a regular basis.

These are all seemingly rudimentary best practices—and this is by no means an exhaustive list of essential cybersecurity tactics—but when combined, they form the foundation of an effective cybersecurity net that can protect an organization from digital worst-case scenarios.

Because once you get a $1 million ransom note from a hacker to release your data, the costs of being proactive seem quite reasonable by comparison.

Winston Stewart, President and CEO

Wincon Security