Saanich Mayor Richard Atwell addresses reporters on March 31 after B.C. Privacy Commissioner Elizabeth Denham released a report on the District's use of spyware program Spector 360.

Saanich council OKs privacy commissioner’s spyware recommendations

Public calls for independent, external investigation into Spector 360 spyware use go unheeded

Saanich council is embracing five recommendations made by B.C.’s privacy commissioner that address the municipality’s improper use of spyware on the mayor’s computer, but public calls for an external, independent investigation are going unheeded.

On Monday night, Saanich Mayor Richard Atwell put forward nine motions to address a scathing report released last month by B.C. Information and Privacy Commissioner Elizabeth Denham on the District’s use of Spector 360, an employee monitoring software program that recorded keystrokes, screenshots and other sensitive information on 13 municipal computers including workstations used by Atwell and councillors.

“Despite the fact the spyware was installed on my computer without my knowledge, and after only one day in office, which beleaguered by initial progress, we now have the opportunity to reset,” Atwell told the packed council chambers.

Atwell hoped to offer a public apology to anyone who was known to be monitored using Spector 360, and to ask staff to detail how personal information collected using the spyware had been identified and destroyed. The report also set out to establish the duties of a dedicated privacy officer, who could then conduct an audit of the District’s IT systems and its compliance with the Freedom of Information and Protection of Privacy Act (FIPPA) within 60 days.

“To date, I’ve only received minimal support regarding the spyware issue from some of my council colleagues, which has been disheartening,” Atwell said. “We will fully move ahead when we address the unanswered questions that have been left behind from the privacy commissioner’s report.”

Coun. Judy Brownoff, who chaired the portion of the meeting that addressed Atwell’s report, began by reading to the sometimes boisterous crowd a statement on respectful workplaces.

“When someone is speaking, please do not interject and do not applaud or boo during or after someone’s remarks. I also want to remind the public that intimidation, bullying or harassment at these meetings will not be tolerated,” Brownoff said, before an irate audience member interrupted her.

“Don’t insinuate!” the man shouted.

“Do you want to leave the meeting now? No, this is a respectful workplace,” Brownoff shot back.

Soon after, Atwell tabled his report – a set of nine motions designed to address the privacy commissioner’s report – as the last agenda item of the evening.

“It’s now clear from the commissioner’s report that serious mistakes were made following the election last November with the hurried and illegal installation of Spector 360,” Atwell said in his opening statement. “The public must be satisfied if we are to have their confidence going forward. … It’s our elected duty to restore public trust.”

The report sparked a steady line of public speakers who expressed anger, disappointment and sadness at the spyware scandal. Most called for an independent, external investigation to address lingering questions left by the privacy commissioner’s report.

“I’ve never seen a report like this throughout my career,” said Karen Harper, a former Chief Information Officer and senior vice president with the B.C. Pension Corporation. Harper told council she was tasked with overseeing compliance with FIPPA at the Crown corporation before her retirement.

“There’s a significant gap in (the privacy commissioner’s) report. And that gap, which needs addressing, is how did this happen,” Harper told council.

In her report, Elizabeth Denham said the District failed to properly notify employees about the installation and use of Spector 360. Denham also found “the District’s submissions to my office demonstrate a deep lack of understanding about the most basic tenets of the (Freedom of Information and Protection of Privacy) Act, such as what constitutes the collection of personal information.”

Haji Charania told council he was shocked by “absolutely unnecessary, wasteful and wrong” use of spyware at the District.

“The first time I heard this, I was surprised. It sounded like an old James Bond movie,” Charania said.

Carmel Thomson, a soft-spoken Saanich resident best known for her stewardship of Maltby Lake, felt compelled to apologize to Atwell herself.

“I’d certainly like to apologize to the mayor, it’s very unfortunate about what’s happened,” Thomson said.

When the public speakers concluded, council approved the five recommendations laid out in Denham’s report. The first two recommendations – removal of Spector 360 and the destruction of all data collected through its use – have already been completed, according to Saanich’s interim CAO Andy Laidlaw. Denham’s further recommendations include an update to District privacy policies and the creation of administrator logs to track when anyone accesses IT systems that store personal information. (Denham could not determine if anyone had accessed information collected by Spector 360 because there were no digital access records.)

The privacy commissioner also recommended the District of Saanich implement a comprehensive privacy management program, and that a privacy officer be hired who can then ensure the municipality complies fully with FIPPA.

“Even though one never likes to have their shortcomings pointed out, I think we’ll turn this around to make our organization even stronger,” said Coun. Susan Brice.

“We need to address those problems,” said Coun. Vic Derman. “I’m more than comfortable taking action as quickly as we can to ensure we’ve done that.”

Derman then moved that Atwell’s report be referred to staff for consideration.

“I think there are some good intents here from the mayor … but there are issues that are quite likely in-camera,” Derman said. Those issues include potentially identifying individual staff members, he said.

Atwell’s report would have directed staff to explain several errors from Jan. 13 and 14 District press releases about the spyware’s installation. Those inconsistencies include District officials’ assertions that “there was no reasonable expectation of privacy by employees” while using workplace computers, that the spyware was installed in response to conclusions from a May 2014 security audit and that the spyware was installed to enhance the security of the IT system. The spyware actually made Saanich’s IT security less secure “by concentrating the personal information of key employees and officers in one location, creating a ‘honeypot’ for external attackers,” Denham wrote in her report.

“We haven’t looked at this more wholesomely,” said Coun. Colin Plant, the only councillor to support Atwell’s defeated motion to issue a public apology to anyone monitored using Spector 360 at the District. “While I appreciate Mayor Atwell saying let’s look at the media release, I think it needs to be far broader than that.”

Plant argued for a complete staff report on the installation of Spector 360, which was unanimously approved.

Carrie MacPhee, Saanich’s director of legislative services and acting CAO, said the report should first be discussed in secret because it involves accusations made of District staff, and council can then decide how to proceed.

“My respectful suggestion would to be get all of that information first,” MacPhee told council. “Once council has that report, you would be able to determine how you could like to respond.”

After the meeting, Atwell said council should still take more of an oversight role by being prescriptive about the information they want from staff.

“Council quite often asks for reports. Instead, they sliced and diced this and left it for the CAO to handle,” Atwell said. “Few are interested in having conversation with me, even about my own motions. And I am the first among equals but I am an equal and the respect I was given tonight with my own motion, I think shows the state of Saanich council at the moment.”

Atwell also expressed concern at the “shoddy paper trail” left by staff when they met on Nov. 19 and decided to install monitoring software on computers of the mayor, councillors, the CAO, the Fire Chief and others. There are no minutes nor an agenda from that meeting, Atwell said.

Outside council chambers, Coun. Leif Wergeland said council’s adoption of the privacy commissioner’s recommendations shows the municipality is ready to move forward.

“We’re saying to the public, ‘There were some changes and mistakes that were made in the process that we hope to make right,'” Wergeland said.

It was not immediately known when the in-camera report on the installation and use of spyware at the District would return to council.


Just Posted

Saanich says it will take months to fix a sink hole that appeared during ‘Snowmaggedon’

Roads closed in the area after the sink hole first opened in early February

Derelict trimaran removed from Oak Bay waters

Boat has been aground near Oak Bay Marina for over five months

Oak Bay mom describes finding son ‘gone’ on first day of coroners inquest into overdose death

Jury to make recommendations based on death of Elliot Eurchuk, 16

Confusing parking lot blamed for cars tipping into flowerbeds at Peninsula Canadian Tire

Tow and repairs cost thousands, engineer says drivers’ responsibility, Canadian Tire stay quiet

PHOTOS: Car Free YYJ entertains the masses in Victoria

Third annual fair where cars are banned goes off without a hitch

WATCH: Barbers battle it out in Victoria

‘Barber Battle’ saw stylists and barbers from across North America go head-to-head

Dash-cam video in trial of accused cop killer shows man with a gun

Footage is shown at trial of Oscar Arfmann, charged with killing Const. John Davidson of Abbotsford

Suicide confirmed in case of B.C. father who’d been missing for months

2018 disappearance sparked massive search for Ben Kilmer

Eight U.S. senators write to John Horgan over B.C. mining pollution

The dispute stems from Teck Resources’ coal mines in B.C.’s Elk Valley

Threats charge against Surrey’s Jaspal Atwal stayed

Atwal, 64, was at centre of controversy in 2018 over his attendance at prime minister’s reception in India

Anti-vaxxer Robert F. Kennedy Jr. to speak in Surrey

He’s keynote speaker at Surrey Environment and Business Awards luncheon by Surrey Board of Trade Sept. 17

Otters devour 150 trout at Kootenay hatchery

The hatchery has lost close to 150 fish in the past several months

B.C. church’s Pride flag defaced for second time in 12 days

Delta’s Ladner United Church says it will continue to fly the flag for Pride month

Update: Two shot, two arrested at Toronto Raptors victory rally

The team and several dignitaries, including Justin Trudeau, remained on stage

Most Read