Ontario police used Covid-19 database illegally, civil rights groups find | Hacker News Reader

Ontario police used Covid-19 database illegally, civil rights groups find

cbc.ca

253 pointsseigando73 comments

As a resident of Ontario I'm extremely troubled for several reasons.

1. This shouldn't have happened, cops should have known better.

2. It shouldn't have been possible for this to happen, the design & implementation should have prevented this from occurring.

3. Nothing will come of it. A number of years ago police in Ontario illegally arrested & detained protesters at the G20 summit. After years of litigation some people got a small amount of money, and no one was held responsible.

>1. This shouldn't have happened, cops should have known better.

They know that they won't be punished for it in any way and it helps whatever KPIs they get measured on. So it's logical for them to take advantage of the data due to the incentive structure in play.

I think you're making a good point. Their departments are incentivizing catching "Bad guys" not following the rules. So we can only ever expect them to optimize for catching more bad guys.

And bad also includes those committed "crimes" for which there's not even a victim. The law book is the main reason why the police are such a problem.

Same with all law that makes police (and politicians) invincible to repercussions: the law is the main reason for the broken system.

Why is the law so broken? Well, I argue because politics are broken (they should update/fix the law). The democracies don't actually serve the masses, but the rich elite.

> 2. It shouldn't have been possible for this to happen, the design & implementation should have prevented this from occurring.

This is my sticking point. Technical implementation details aside, is there no policy that prevents Police from accessing what is essentially a medical record. As an American this screams HIPPA VIOLATION to me

As article outlines, the provincial government passed an emergency order to allow police access to this information. It's definitely a PHI violation in normal circumstances.

>As article outlines, the provincial government passed an emergency order to allow police access to this information

What was the reasoning behind it? So police can raid/arrest covid-19 patients?

So police can determine if they've come in contact with someone who is contagious.

1 and 3 are a given if you cannot make point 2 nearly insurmountable to accomplish. Databases and rules governing their use should be so difficult to circumvent that there can be no accidental violation of the rules thereby insuring every such occurrence is purposeful.

Of course all this would need to be backed by penalties as specified for violations at the time the entire process was implemented. The only way to guarantee government won't abuse data is to make it public that any occurrence carries automatic penalties and full public disclosure.

1 and 2 are a lot of the reason people are fine with invasions of their privacy. They have a misguided belief that those with access to their private data are generally trustworthy, upstanding citizens who wouldn't misuse their access, and that even the few that would abuse their access would be stopped by some check ending them to prove they had a legal need to access the data.

This is never the case. Government workers are as likely to let their curiosity get the better of them, ignoring those that act maliciously, and there is very little incentive to making sure that access is only granted when necessary.

> A number of years ago police in Ontario illegally arrested & detained protesters at the G20 summit. After years of litigation some people got a small amount of money, and no one was held responsible.

Not only was no one held responsible, the chief of police at the time is now our federal minister for public safety...

Through various channels I've seen a lot of stuff like this happen, it is the norm especially in Ontario. There is no real accountability in our Provincial government, and the ministries tend to do more or less as they please, and enable it retroactively through the legislature if it looks like they may get sued.

They're not accountable for their budget approvals, or to follow their own regulations, so the main thing limiting them is whether the public is familiar enough with what their actions mean to be disgusted.

> 1. This shouldn't have happened, cops should have known better.

Some did. From the article:

"York Region police said they asked the province to revoke access to the database after an internal review found the risks associated with accessing personal health information outweighed any benefits."

Toronto police likewise didn't access the database. Their rationale isn't so much privacy related, but it does cite a major problem with databases (the accuracy of data).

At the end of the day, it is the government's responsibility to say no. While some organizations are professionally run and consider the implications of their actions, some aren't or don't.

But in Thunder Bay:

"Thunder Bay police accessed the personal health information in the database more than 14,800x — a rate of access 10x higher than the provincial average — even though the area reported a total of just 100 COVID-19 cases while the database was active. "

Ironically, this could be (but probably was not) evidence of a better tradeoff between privacy and protection.

Imagine if a computer system were integrated with first-responder dispatch systems that cross referenced every address dispatched against the database and reported only the presence/absence of any positive case to dispatchers, discarding all other information.

Such a system would have vastly more queries to the database but, implemented as described, would be much less troublesome to me than other, manual uses of the records.

You're right. # of database queries certainly isn't evidence of misuse. But, it is highly suspect when it's being utilized this heavily in a city noted for it's high crime rate. I suspect that the police are faced with big challenges there and suddenly had this large new database to access...

"For the third consecutive year - and the fourth time in the last five years - Thunder Bay was the homicide capital of Canada in 2018." https://www.cbc.ca/news/canada/thunder-bay/tbay-murder-capit...

Which is why the government should not have granted access.

That being said, there is another thing to consider: whether that access was for legitimate purposes. Thunder Bay is in a unique position since it is a hub for travel and shipping to isolated communities. This has implications, one of which is the poor access to health care in those communities since these are small fly-in only communities. If the police were called upon to enforce public health measures, access to the database could be interpreted as legitimate from the public health perspective. That being said, I don't know if this was the case. This does not explain Durham region either.

(I was working in one of those isolated communities during the H1N1 outbreak. Keeping H1N1 out of those communities was a major concern.)

> At the end of the day, it is the government's responsibility to say no.

That right there should be a huge red flag. Any time the citizenry gives the government the option to behave wrongly, the rights and freedoms of citizens are eroded.

Also, Nobody was arrested.

https://www.thestar.com/news/gta/2015/06/27/adam-nobody-and-...

And the chief of police responsible for these abuses is now the federal Minister for Public Safety. Good times.

I also live in Ontario (Toronto) and was struck by how practically 0 of police I've seen here over the last few months have been wearing masks – even when they came doorknocking in my neighborhood about a theft that happened on the street. They had the ability to look up things like this, but I bet they weren't even taking the precautions when they had that data.

I agree and have a general distrust of public servants and the environment they work in. There are No repercussions (in my locale, NLD) for breaking the law as a public servant. Even when the statutes are quite broad (like knowingly infringing on a law or the constitution by a very senior public servant or knowingly holding money for public benefit that shouldn't be held / restituted) there are literally zero prosecutions of these events.

And I've gone quite deep even contacting the police agency especially created for such things (they don't even track complaints against these statutes) and searching the public database with judgements. The only thing we do is persecute clear graft. So the worst thing that could happen left is one government office getting fined by another, which is somewhat disappointing. It's taxes afteral going around. All I have for my deep-dive is a professor agreeing with me (hey N=2 beats N=1).

Const. Babak Andalib-Goortani was convicted of assault with a weapon but got off with 75 hours of community service, and Supt. Fenton received a reprimand for arresting 600 people without cause and keeping them in the rain, or in wire cages without facilities, and lost 30 vacation days.

So yup.

Must be nice to live in a country where you see an example of this and even have a glimmer of hope something would be done about it. Or even a glimmer of hope that “cops should have known better”. Or even a single time there were even minor consequences for illegally detaining protestors.

This would just be approximately example number 10 million of this happening in the US.

>Nothing will come of it

To me, this is the most disappointing thing, that people will still continue to use devices that spy on them, even when they know that the device is spying on them. Many will say "we need better laws! punish those police!". Why even give them the opportunity to use your data maliciously in the first place? Why place all that trust into a complex system, a system with so many points of failure? It's inherently untrustworthy. "Oh, we won't use your data for malicious purposes, promise ;)". All it takes is one bad actor to inherit that system to cause problems. Again, don't even give them the opportunity; don't forfeit your freedom to begin with.

Delete your facebook. Delete your twitter. Get rid of your spyphone. Breathe the free air again.

I know most cops are good guys, yada, yada, but there’s just something wrong with the culture and leadership that’s utterly boneheaded. They were also secretly using clearview in Ontario.

This is just another piece of proof that power corrupts. Morons like AG Barr want back doors they promise not to use without a warrant. Anything that can be used, will be used. This is a fact and will not change.

What? Government agencies did exactly the thing privacy advocates warned they would do if such information were allowed to be collected? I am shocked.

When will people learn that government is always to be distrusted, most of all in times of crisis?

Based on the rhetoric around this pandemic I would say never, because anyone even questioning any government policy is deemed to be a "murder" wanting to kill grandma by the masses for even suggesting that government power should be limited in anyway

The debate has been tainted from both sides.

Half the people I've ever engaged with because (for example) they expressed skepticism about mask efficacy rather rapidly turned out to also hold a host of much less reputable ideas - including borderline-qanon and plandemic bullshit. And the other half seen to think that premature certainty in the face of incomplete evidence makes them "scientific".

The general level of rational debate about covid has been poor all round.

I don't really blame the people who question the efficacy of masks. Fauci said that they were deliberately downplaying how effective masks were because they didn't want people buying them up before healthcare personnel could get them. When the government admits they were lying, it shouldn't come as a suprise that people don't trust them.

It is not only a question of efficacy, it is also a question of whether allowing the incremental march toward tyranny to continue will lead to a worse outcome than not wearing the masks.

“Deadly disease is always the bigger risk” is a naive and dangerous response, in my opinion. The epidemiologists seem to have nothing to say about comparative risks from delayed stroke treatments, cancer screenings, and heart bypasses, or indeed the risks from totalitarianism and outright war. Those refusing to wear masks are not all doing so because they are idiots who don’t listen to their betters, many are refusing because they have some actual perspective, unlike far too many in our professional class, it seems.

For the record, I don’t give businesses a hard time over their mask rules, but I do like to put a piece of duct tape on the front of the mask to prompt people to think about it a little.

yes, it's unnerving how uncritically complicit people become to authority under (manufactured) fear.

wearing masks in public is safety theater in most cases, because they're only effective at the margins where the atmospheric viral concentration is static enough and high enough to make them matter, and they're only potentially static & high enough in relatively rare places like the space between a dentist and a patient, not in a supermarket or a even a restaurant (though crowded bars likely cross that threshold). simple distancing is plenty mitigation in most public spaces.

the 'rules' are broken and spread happens largely in (semi-)private spaces. instead of worrying about the trivialities of masks in public, a complicity signal, worry about social gatherings, a serious transmission vector. the etiquette and impetus of social gathering is diametrically opposed to mitigation, and that's the much thornier real, core issue that we try to elide by collectively diverting our attention to masks.

We can thank the Slaughterhouse Cases for the disaster that is legal precedent in this area; the idea that a citizen's privileges and immunities don't limit the police powers of a state is ridiculous. This would almost certainly apply to localities as well (see the fact that they can't violate civil rights protections.)

And yet, Justice Thomas is the lone voice in using this clause correctly, while the others largely prefer to leave it in its neutered state and distort the equal protection clause to fill gaps where necessary and create some bogus guarantee of fairness. See Timbs v. Indiana for an example of just how ridiculous this particular area has gotten. There is some hope that Gorsuch may come around to Thomas' view, as he wrote a similar concurrence.

It is certainly a privilege of a citizen of the United States to run his business as normal. Police powers cannot overrule that. I fear that the precedent has already been set, however. The court system is too slow to work these things out while they're happening, and a ruling against an action is little solace once it's already happened. There must be significant punitive action against any state or municipality that attempts to do so.

I'd like to see Dillon's Rule states threaten to dissolve and re-constitute any municipal government that instituted any lockdown order at all. It would also nice to see criminal prosecution of those who threatened citizens who simply wished to go about their lives in violation of the constitution. A government official who does something of that sort without authority is acting as an autocratic thug and any physical enforcement of such directives is assault and must be prosecuted as such.

it seems reasonable that the federal government can invoke extraordinary powers for a limited amount of time to address federal-sized and -scoped problems. in this case, that seems to be the Public Health Service Act (PHSA) which, among other things, allows for quarantines in times of health crisis.

the states have police power via the 10th amendment, which reserves all powers not delegated to the fed to the states (didn't know about dillon's rule until now, although that was my general understanding of where power lies, in states not municipalities). and it sounds like a narrowly-interpreted privileges or immunities clause of the 14th amendment further allows states to use police power as long as it doesn't infringe due process or equal protection.

one question is how much the feds can compel state actions in this regard (seems like not much, but feds can use their own forces if need be), and another is how much states can act independent of the feds (seems like feds can delegate the response to states)?

can states simply compel lockdowns by police power, other than hoping no one notices and sues? apparently Jacobson v. Massachusetts (1905) allows for compulsory vaccinations by states for general health and welfare.

regardless of the legal basis, to me, it's pretty clear that our governments (especially CA) poorly and blindly targeting its efforts for maximal political (and media) gain rather than for health and safety.

if it had been for the latter, the first highly visible thing we'd have done was immediately quarantined senior care facilities, super-PPE'ed all their workers, paying whatever it took to create a tight bubble around each facility, to protect seniors. that would have targeted 60+% of potential mortalities (and yes, we knew that was a core threat back in february). then we could address other specific threats and beefed up medical facilities as needed. and lastly, we'd have singularly messaged the heightened dangers of social gatherings and the effectiveness of distancing, along with an educational campaign on the mechanism of spread, co-morbidities, the age stratification of risk, and such, not masks and its complicity-signalling value.

then residents could make informed choices on how to protect themselves. some would choose to isolate, but many would just distance where necessary and avoid large gathering of strangers. we then wouldn't need to worry so much about legal precedent, and we wouldn't be dividing into stupid political camps lobbing vicious tweets (and sometimes more) at each other.

Well the question for me is not about efficacy at all. The question for me is

"Should a governor or president have the unilateral authority to declare X an "emergency" under which they now have unlimited authority to force businesses closed and people into their home for an indeterminate amount of time until they (the governor or president ) solely choose that an emergency is no longer present"

A policy or law such as that is found in a dictatorship not in a free republic

Not sure why you're being downvoted. In this age of populism those of us who live in Commonwealth parliamentary democracies are quickly learning that the Westminster system we inherited from Britain is designed to be operated by a bunch of aristocrats who all largely adhere to the same social contract. I.e. Britain with its vaunted "unwritten constitution" only worked in the past because the people in power largely toed the line of convention. The system is built on mutual trust and cooperation.

With the influx of populists and political outsiders or other non-establishment types who (correctly) recognize that convention isn't binding, we see that governmental systems choke and come to a halt. I'm Canadian and our government as an institution is just about wholly incompetent, being carried on the tired shoulders of a few upstanding individuals who are either blissfully ignorant of the massive corruption and idiocy around them, or else determined to plod on through the sea of mediocrity.

Either way, as much as we like to rag on the US, one of the really nice things about their government is that it's designed with less inherent trust that ours. A majority government here in Canada is basically an elected dictatorship. It feels good to say you trust the government when they happen to wear the same colours as your preferred ideology but trusting government to do the right thing is a recipe for disappointment in my opinion.

>>one of the really nice things about their government is that it's designed with less inherent trust that ours.

The founders of the US trusted no one, not even themselves or the public. that is why there are layers upon layers of checks built in to the system to check no only the government but the people as well.

Most of the problem in the US system today are down to erosion of that distrust combined with a strong desire to adopt more direct democracy...

I still don't understand what they did exactly that is so wrong? Government was given health data, government entity accessed data for policing (we assume), and what? That police had access to someone's health record? How is that ground-shaking level stuff?

Did the police stalk someone because of this? Did the data get abused for personal/fraudulent reasons? Did someone get fired because a cop found out his child's preschool teacher is actually a trans person and they object to that? Did they use this to solve crimes? Find covid-spreading patterns and individuals?

There are multiple problems with your comment. 1) Whether you personally think it was "wrong" or not is irrelevant here - it was explicitly illegal and they knew it. 2) Part of the problem here is that we don't know what they did with the data - maybe they only used it to decide how to handle emergency calls, but maybe they used it to ignore calls or spread privacy-violating rumors that lost people friends & jobs. 3) This is absolutely a case where you should be worried that overreach starts small and then becomes a big problem. Even if you don't think this particular instance was bad, it's indicative of what would happen if they were given access to potentially more harmful datasets.

> Whether you personally think it was "wrong" or not is irrelevant here - it was explicitly illegal and they knew it.

I don't Think this is an accurate take. The article states:

>In early April, the Ontario government passed an emergency order that allowed police to obtain the names, addresses and dates of birth of Ontarians who had tested positive for COVID-19. The portal was aimed at helping to protect first responders.

Law was passed specifically allowing police to use the data, and they were told they could use it. A portal was designed so that they could access the data. The Civil Liberties Association now alleges that this law violates the rights of citizens.

The problem is much deeper than rouge cops with no respect for the law. It is about laws and lawmakers with no respect for personal privacy. Furthermore, it hasn't even been decided if the cops did anything against canadian law at all!

Even though I appreciate the work of privacy advocates and strongly believe that privacy should be protected, the article only discusses the number of times the database by various police forces and why a couple of police forces decided not to use it. It suggests there may have been inappropriate use, without offering any actual evidence of inappropriate use.

If the word of privacy advocates is going to be taken seriously, they really need to back their claims with evidence. Without evidence, those who don't care about privacy won't be swayed. Worse yet, they run the risk of being seen as paranoid and ignored altogether.

I believe that all data will be used for not-the-original purpose. The moment that a bit hits nonvolatile memory it's only a matter of when-and-how, not if.

Specifically law enforcement, which seems to attract a lot of “bad apples.”

The same happened in Germany, only apparently here it’s legal (because the states decide what the lists are allowed to be used for, but federal law trumps it for the police)… I wonder why people started filling the lists with fake names.

You should probably add that politics is now thinking about pursuing fines for people who enter fake data.

Haven't entered a single real piece of information in those lists yet.

"Police forces across Ontario engaged in broad, illegal searches of a now-defunct COVID-19 database, two civil rights groups alleged Wednesday, claiming the use of the portal violated individual privacy rights for months."

My question right off the bat - what was this database, and what was it replaced with? I thought the new app wasn't accessible like that, so how was this database generated?

"In early April, the Ontario government passed an emergency order that allowed police to obtain the names, addresses and dates of birth of Ontarians who had tested positive for COVID-19. The portal was aimed at helping to protect first responders."

Ah, it's not any sort of database off the App, just a regular old violation of our health privacy rights like any other day.

It's not the only database like that. It's meant to be exclusively accessed in situations like a person being admitted to the ER when unconscious. There is similarly an HIV database for the same reason.

Fluid transmissions happen easily in hospitals. Accidents happen. They aim to be as aware as possible so the incidental nurse tapping a vein doesn't also have to live (or die) with HIV, or in this case, catch and spread COVID-19 because of a lack of situational awareness that can't possible be gleaned by looking or sometimes even speaking to someone.

The problem here was there was little to no governance around the database and clearly there needed to be more. There need to be an avenue for justice for an abuse as well.

And more personally, I'd appreciate it being more even-handed. I don't believe nurses have to disclose if they have HIV presently to their workplace or patients which is troubling to me because I've had a personal scare in a situation involving something related.

Oh yeah, it's an absolute screw-up, I just worry that a lot of people will jump to the "they have the tracking app data! See, told you you couldn't trust it!" when that's not the case at all here. It's just the regular malfeasance that people can't stop by not using the app.

Oh I hear you there. I wholeheartedly agree.

Whether or not you agree they should be doing this is another question altogether. This was specifically designed to give the provincial governments access. They are completely within their right to do this.

You might wonder if it's a PIPEDA/phipa violation or in Ontario we have Intrusion upon seclusion laws with tort damages for privacy violations. So the police for example could be found in default damages of $10,000 for these privacy violations. Not a problem for the police, they have the right to access it.

The interesting this is that Thunderbay is doing this. The thunderbay police are some of the most corrupt police in Ontario at the moment. There's a report which I have read that confirmed systemic racism by the thunderbay police. They would declare crimes against natives as non-crimes. They'd take natives, strip them naked and drive them out to the middle of nowhere and tell them to leave thunderbay. There was also a surprising number of dead natives in the river of tears that the police wouldn't investigate.

Not surprising to see the thunderbay police involved in more controversy.

Here in CA (possibly the rest of the US) they want to put an app on your phone to use Bluetooth to track who is in the room with you, because it’s not enough to know which end of the city block you are on at all times. Cuz, COVID!

Pardon me if I’m just a little bit creeped out.

Are you talking about anonymized contact tracing protocols similar to BlueTrace [1]? Is CA planning to use a less secure option?

1. https://bluetrace.io/static/bluetrace_whitepaper-93806365659...

Canada likewise uses an anonymized app for this purpose. It's open source, as well.

Mobile App: https://github.com/cds-snc/covid-alert-app

Server: https://github.com/cds-snc/covid-alert-server

There's plenty to be concerned about with regard to the abuse of the database, the app doesn't need to get swept up into any paranoia.

This is not a contact tracing app this was a medical history Database. The Canadian contact tracing app is anonymized and open source.

We're running out of things that the police won't leverage against the public.

I mean, we're creating new things for them to leverage all the time.

Well, you aren't wrong.

There's a saying in German which is very fitting: "Wo ein Trog ist, sammeln sich die Schweine" it means: "Where there's a trough, pigs congregate"

"Cops used data they had easy access to in way they weren't supposed to."

Obviously this is really bad but I feel like it would have been more unusual if they hadn't used it.

The legislature gave them the data explicitly so that that they could use it. Im not sure how anyone could expect any different.

https://news.ycombinator.com/edit?id=24653131

I’m talking specifically about the Thunder Bay aspect of this story because it has the most detailed reporting and also some interesting statistics.

The Thunder Bay P.D. conducted 14,800 database searches although only having 100 reported Covid cases. The reason? They searched for a Covid-19 hit on the database for each and every 911 call they received. Their justification? Lack of PPE.

The mind boggles.

So that's a HIPAA violation right? We going to see some prosecution?

Edit; OK it's in canada. So they have some strong laws about misusing medical records too right??

It's Canada, so HIPAA wouldn't apply. A Canadian equivalent, presumably, would have to apply.

HIPAA = USA.

Ontario = Canada.

We have different, but similar rules.

PIPEDA in Canada: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can...

I assume the emergency order makes it legal though? Either way, nothing much will probably come of it.

Even if it were in the US HIPAA wouldn't apply to the police as they are not a healthcare provider.

The "Personal Health Information Protection Act" (PHIPA) in Ontario: https://www.ontario.ca/laws/statute/04p03.

These cops also ask for your email so they can go back and track and monitor you. Why would anyone give them a real email address?

I think this is shitty but... If the legislative specificly permitted this, how is it illegal?

Is anyone surprised? People were warned that this was going to happen. They went forward with this surveillance technology anyway.

The abuse won't stop until it's literally impossible to collect any data on anyone.

Reply on news.ycombinator.com