Saint John partially denied 2 RTI requests as data is not yet accessible after cyberattack

·4 min read
The City of Saint John was targeted by a cyber attack in November of 2020, and is still recovering. (Julia Wright/CBC file photo - image credit)
The City of Saint John was targeted by a cyber attack in November of 2020, and is still recovering. (Julia Wright/CBC file photo - image credit)

The city of Saint John has returned two incomplete right to information requests because it cannot access some information in backups after a major cyberattack.

The city was hacked on Nov. 13, 2020, which affected email and phone services, its website and parking and building permits payments.

City manager John Collin previously said there were "minor disruptions to customer services" in the city, as online services were restored within weeks and alternative measures were found. He said no information was lost, because everything was backed up.

But just because the information was safe, doesn't mean it was accessible to the public.

North end resident and property owner Carrie Stevenson filed a right to information request to find out how many buildings were removed from heritage protection. She wanted the information to bolster her own heritage exemption application.

But the request was denied, and staff told her to check back again "at a later date" to see if the information is available.

She said this raised big questions.

"A: Why are they not accessing their backups? B: Do they really not have anything even in paper form? And C: Why is it my job as a citizen to follow up with the city to find out when they can meet their legislative requirements?," she said. "All of those things struck me as odd."

When the city doesn't provide information, it doesn't fulfil its obligation around transparency - Carrie Stevenson, resident.

City spokesperson Lisa Caissie said the city's backups are being restored to the new computers "on a priority basis."

She said all the information is safe, it's just not all "searchable," since it needs to be uploaded back onto computers from the backup system."

"With terabytes of data to restore and upload, the process expectedly takes time," she said.

When asked what kind of information has not been restored and is not searchable, Caissie said "This restoration effort is complex and takes time to complete."

Caissie said the biggest impact this has had on operations was that some applications and processes had to be done manually.

'This was done efficiently and without impact to the delivery of municipal services," she said.

Caissie said of the two requests that were partially incomplete, one has been completed after the fact.

Caissie said the city will review incomplete RTI requests and follow up with the applicant once the requested information is restored and searchable.

But, Stevenson said she was not told the city will follow up with her. She said staff asked her to check back at a later date.

"As citizens, we have a right to have access to this information and they have an obligation. It's a basic premise of democracy," she said.

"They never specified whether they tried to find them on paper. They never specified whether they had a backup. And what shocked me the most was that they made it my responsibility to follow up with them, to see when they might have access to them at a later date."

Saint John city manager John Collin previously said there were "minor disruptions to customer services" in the city because of a November, 2020 cyberattack.
Saint John city manager John Collin previously said there were "minor disruptions to customer services" in the city because of a November, 2020 cyberattack.(Connell Smith, CBC file photo)

Stevenson said she sent a complaint to the New Brunswick Integrity Commissioner.

"When the city doesn't provide information, it doesn't fulfil its obligation around transparency," she said.

"It makes me feel concerned for other people that might have questions and ... don't necessarily have the skills or the desire to really push back and find out why they're not getting the information they're entitled to."

New Brunswick ombud Charles Murray said his office is "aware of the issue."

"But I cannot confirm if there has been a complaint, or if so, at what stage the investigatory process may or may not be," he said.

Cost to the public

Hackers asked for bitcoin worth between $17 and $20 million to release the city's network, Coun. David Merrithew previously said.

Instead of paying, the city decided to rebuild its network and launch a new website.

Merrithew said the cost of doing this and hiring a private firm to investigate the hacking cost about $2.9 million.

Insurance will cover 85 per cent of that. The remaining $400,000 came from taxpayers, but that money also went into making some improvements to the network.