Police Drop Charges Against Canadian Teen Who Downloaded FOIA Documents
Halifax Regional Police announced today they would not be pressing charges against a 19-year-old teenager accused of hacking government systems. The unnamed teenager was arrested on April 7 after he downloaded over 7,000 Freedom of Information (FOIA) documents left on a public server with no authentication.
The documents, downloaded from the Nova Scotia Freedom-of-Information web portal (FOIPOP), were mostly unredacted and contained the personal details of many Canadian citizens.
Authorities accused of blowing case out of proportion
The arrest received a lot of media attention from both local and international media because the teenager didn't actually hack the Nova Scotia government, but merely created a script that downloaded files which he thought were meant to be public by cycling through a sequential ID. The 19-year-old told police he was trying to collect information on a teachers' labor dispute and didn't realize the FOIPOP portal wasn't configured to prevent him from downloading private documents he wasn't supposed to access. Many high-profile figures in the infosec and privacy communities, along with Canadian legal experts, criticized the Nova Scotia government for trying to pin the blame on a teenager instead of admitting they failed to secure a crucial server with even the most basic of authentication schemes.
Some security researchers even set up a GoFundMe page where users could donate for the teen's legal defense fund.
Police: No grounds for charges
But today, Halifax Regional Police said that after a thorough investigation they "have determined there to be no grounds to lay charges in the matter." "This was a high-profile case that potentially impacted many Nova Scotians," said Superintendent Jim Perrin, Officer-in-Charge of Criminal Investigations Division in a canned statement. "As the investigation evolved, we have determined that the 19-year-old who was arrested on April 11 did not have intent to commit a criminal offence by accessing the information," Perrin added.
The Nova Scotia Freedom-of-Information web portal (FOIPOP) from where the teen downloaded the files was taken down following the arrest, and the FOIA database secured.
The data breach could lead to big fines for the government of Nova Scotia.
A law firm in Nova Scotia was investigating a potential class action lawsuit as well.