The Conservative Party has written to Privacy Commissioner Philippe Dufresne asking him to speed up his investigation into a federal government data breach that exposed the identities of hundreds of Afghans seeking Canada’s help to escape the Taliban on October 2021.
Previous Privacy Commissioner Daniel Therrien announced a formal investigation into the breach at Immigration, Refugees and Citizenship Canada (IRCC) in November of last year.
CBC News first reported on the data breach on October 26, 2021.
The names of several hundred vulnerable Afghans seeking refuge from the Taliban were leaked in emails mistakenly sent by IRCC.
The Afghans concerned fear reprisals from the Taliban. Some are in hiding because of previous roles in the Afghan government, the armed forces or the judiciary, or as human rights activists.
An email seen by CBC News listed 200 names.
IRCC has apologized to those affected by the “reply-all” error.
A similar but smaller data breach involving the UK Ministry of Defense last month drew a stronger response: a ministerial apology to Britain’s House of Commons and a departmental investigation.
In his letter to the Privacy Commissioner, Conservative immigration critic Jasraj Singh Hallan asked why the report is taking so long to appear.
He wrote that Dufresne’s office “informed mine that the report on this matter was expected to be completed and released by the end of June. We were then informed that the report was sent to its review by senior management in July.”
“Dragging Your Heels”
Hallan asked the commissioner to make the results of the investigation public immediately.
A spokesperson for the privacy commissioner told CBC News that the investigation is “ongoing.”
“We anticipate that the investigation will be completed in the coming months,” Vito Pilieci said.
“The privacy commissioner is taking too long to release the report on IRCC leaking Afghan refugee data,” Hallan told CBC News. “This is a moment that Afghans fleeing the Taliban don’t have.”
“This is in no way a knock on (the privacy commissioner) or public servants,” he said, adding that he knows their job is difficult and they are under pressure.
“I understand that investigations can take time, but Canadians deserve to know whether the government is intentionally dragging its heels in providing the information the commissioner needs to delay the report.”
“Maybe the next target is my family”
The brother of a woman whose identity and photo were leaked in the data breach told CBC News that the danger has not passed for those affected, as the Taliban could, at any time, obtain a computer or a cell phone that still contains the details of the email exchange list about hundreds of Afghans applying for sanctuary in Canada.
“After this data breach, it is a moral responsibility to provide them with a clear understanding and a clear answer as to why this happened, and what are the measures to protect the people living in Afghanistan, to protect them of the Taliban’s reaction to this. data breach,” he said. (Fearing Taliban reprisals against his family, CBC News is not reporting his name.)
Outside Kabul International Airport, an Afghan baby is pushed toward U.S. soldiers over a fence with security wire in a video captured by Omar Haidari on August 19, 2021. (Omar Haidari/The Associated Press)
He lives in Canada, while his sister remains in Afghanistan with her children. Her husband was an Afghan army officer who was killed by the Taliban. She said knowing her information is out there on an unknown number of devices has been a constant source of anxiety for her.
“After every arrest or every murder, you’re afraid they might have your information,” he said. “Maybe the next target is my family, maybe next time they will come to me. So there is a very negative psychological impact.”
The UK research was done over eight weeks
He said he hoped things would clear up faster.
“I was thinking that after a week, or at least a month, these people can get an answer from this commission and from IRCC. This delay, this silence, is something I did not expect.”
The UK Ministry of Defense’s investigation into its Afghan data breach took eight weeks. It caused personnel to be reassigned and recommended changes to training procedures.
Canada’s investigation into its data breach has already lasted more than nine months.
Hallan said it’s important to fix the issues that led to the leak before other vulnerable groups are affected by something similar.
“Now we have another crisis in Ukraine and we want to make sure that this kind of data breach doesn’t happen again,” he said.
“We want to make sure that our immigration system is secure, given all the recent cyber attacks that have happened around the world, and that this doesn’t happen to vulnerable Afghans, or people from Ukraine, or people from no other country”.