Saanich council is embracing five recommendations made by B.C.'s privacy commissioner that address the municipality's improper use of spyware on the mayor's computer, but public calls for an external, independent investigation are going unheeded.
On Monday night, Saanich Mayor Richard Atwell put forward nine motions to address a scathing report released last month by B.C. Information and Privacy Commissioner Elizabeth Denham on the District's use of Spector 360, an employee monitoring software program that recorded keystrokes, screenshots and other sensitive information on 13 municipal computers including workstations used by Atwell and councillors.
"Despite the fact the spyware was installed on my computer without my knowledge, and after only one day in office, which beleaguered by initial progress, we now have the opportunity to reset," Atwell told the packed council chambers.
Atwell hoped to offer a public apology to anyone who was known to be monitored using Spector 360, and to ask staff to detail how personal information collected using the spyware had been identified and destroyed. The report also set out to establish the duties of a dedicated privacy officer, who could then conduct an audit of the District's IT systems and its compliance with the Freedom of Information and Protection of Privacy Act (FIPPA) within 60 days.
"To date, I've only received minimal support regarding the spyware issue from some of my council colleagues, which has been disheartening," Atwell said. "We will fully move ahead when we address the unanswered questions that have been left behind from the privacy commissioner's report."
Coun. Judy Brownoff, who chaired the portion of the meeting that addressed Atwell's report, began by reading to the sometimes boisterous crowd a statement on respectful workplaces.
"When someone is speaking, please do not interject and do not applaud or boo during or after someone's remarks. I also want to remind the public that intimidation, bullying or harassment at these meetings will not be tolerated," Brownoff said, before an irate audience member interrupted her.
"Don't insinuate!" the man shouted.
"Do you want to leave the meeting now? No, this is a respectful workplace," Brownoff shot back.
Soon after, Atwell tabled his report – a set of nine motions designed to address the privacy commissioner's report – as the last agenda item of the evening.
"It's now clear from the commissioner's report that serious mistakes were made following the election last November with the hurried and illegal installation of Spector 360," Atwell said in his opening statement. "The public must be satisfied if we are to have their confidence going forward. … It's our elected duty to restore public trust."
The report sparked a steady line of public speakers who expressed anger, disappointment and sadness at the spyware scandal. Most called for an independent, external investigation to address lingering questions left by the privacy commissioner's report.
"I've never seen a report like this throughout my career," said Karen Harper, a former Chief Information Officer and senior vice president with the B.C. Pension Corporation. Harper told council she was tasked with overseeing compliance with FIPPA at the Crown corporation before her retirement.
"There's a significant gap in (the privacy commissioner's) report. And that gap, which needs addressing, is how did this happen," Harper told council.
In her report, Elizabeth Denham said the District failed to properly notify employees about the installation and use of Spector 360. Denham also found "the District’s submissions to my office demonstrate a deep lack of understanding about the most basic tenets of the (Freedom of Information and Protection of Privacy) Act, such as what constitutes the collection of personal information."
Haji Charania told council he was shocked by "absolutely unnecessary, wasteful and wrong" use of spyware at the District.
"The first time I heard this, I was surprised. It sounded like an old James Bond movie," Charania said.
Carmel Thomson, a soft-spoken Saanich resident best known for her stewardship of Maltby Lake, felt compelled to apologize to Atwell herself.
"I'd certainly like to apologize to the mayor, it's very unfortunate about what's happened," Thomson said.
When the public speakers concluded, council approved the five recommendations laid out in Denham's report. The first two recommendations – removal of Spector 360 and the destruction of all data collected through its use – have already been completed, according to Saanich's interim CAO Andy Laidlaw. Denham's further recommendations include an update to District privacy policies and the creation of administrator logs to track when anyone accesses IT systems that store personal information. (Denham could not determine if anyone had accessed information collected by Spector 360 because there were no digital access records.)
The privacy commissioner also recommended the District of Saanich implement a comprehensive privacy management program, and that a privacy officer be hired who can then ensure the municipality complies fully with FIPPA.
"Even though one never likes to have their shortcomings pointed out, I think we'll turn this around to make our organization even stronger," said Coun. Susan Brice.
"We need to address those problems," said Coun. Vic Derman. "I'm more than comfortable taking action as quickly as we can to ensure we've done that."
Derman then moved that Atwell's report be referred to staff for consideration.
"I think there are some good intents here from the mayor … but there are issues that are quite likely in-camera," Derman said. Those issues include potentially identifying individual staff members, he said.
Atwell's report would have directed staff to explain several errors from Jan. 13 and 14 District press releases about the spyware's installation. Those inconsistencies include District officials' assertions that "there was no reasonable expectation of privacy by employees" while using workplace computers, that the spyware was installed in response to conclusions from a May 2014 security audit and that the spyware was installed to enhance the security of the IT system. The spyware actually made Saanich's IT security less secure "by concentrating the personal information of key employees and officers in one location, creating a 'honeypot' for external attackers," Denham wrote in her report.
"We haven't looked at this more wholesomely," said Coun. Colin Plant, the only councillor to support Atwell's defeated motion to issue a public apology to anyone monitored using Spector 360 at the District. "While I appreciate Mayor Atwell saying let's look at the media release, I think it needs to be far broader than that."
Plant argued for a complete staff report on the installation of Spector 360, which was unanimously approved.
Carrie MacPhee, Saanich's director of legislative services and acting CAO, said the report should first be discussed in secret because it involves accusations made of District staff, and council can then decide how to proceed.
"My respectful suggestion would to be get all of that information first," MacPhee told council. "Once council has that report, you would be able to determine how you could like to respond."
After the meeting, Atwell said council should still take more of an oversight role by being prescriptive about the information they want from staff.
"Council quite often asks for reports. Instead, they sliced and diced this and left it for the CAO to handle," Atwell said. "Few are interested in having conversation with me, even about my own motions. And I am the first among equals but I am an equal and the respect I was given tonight with my own motion, I think shows the state of Saanich council at the moment."
Atwell also expressed concern at the "shoddy paper trail" left by staff when they met on Nov. 19 and decided to install monitoring software on computers of the mayor, councillors, the CAO, the Fire Chief and others. There are no minutes nor an agenda from that meeting, Atwell said.
Outside council chambers, Coun. Leif Wergeland said council's adoption of the privacy commissioner's recommendations shows the municipality is ready to move forward.
"We're saying to the public, 'There were some changes and mistakes that were made in the process that we hope to make right,'" Wergeland said.
It was not immediately known when the in-camera report on the installation and use of spyware at the District would return to council.
editor@saanichnews.com