The Conservative Party has written to Privacy Commissioner Philippe Dufresne asking him to speed up his investigation of a federal government data breach that exposed the identities of hundreds of Afghans seeking Canada’s help to escape from the Taliban in October 2021.
Dufresne announced on November 15 of last year that his office would open a formal inquiry into the breach at Immigration, Refugees and Citizenship Canada (IRCC).
CBC News first reported on the data breach on October 26, 2021.
The names of several hundred vulnerable Afghans seeking refuge from the Taliban were leaked in emails sent in error by IRCC.
The Afghans in question fear reprisals from the Taliban. Some are in hiding because of past roles in the Afghan government, armed forces or judiciary, or as human rights activists.
One email seen by CBC News listed 200 names.
IRCC apologized to those affected by the “reply-all” error.
A similar but smaller data breach involving the U.K. Ministry of Defence the previous month got a more robust response — a ministerial apology in the British House of Commons and a departmental investigation.
In his letter to the privacy commissioner, Conservative immigration critic Jasraj Singh Hallan asked why the report is taking so long to emerge.
He wrote that Dufresne’s office “informed mine that the report on this matter was projected to be finalized and released at the end of June. We were then informed that the report was sent for review by senior management in July.”
‘Dragging its heels’
Hallan called on the commissioner to make the results of the investigation public immediately.
A spokesperson for the privacy commissioner told CBC News the investigation “remains ongoing.”
“We anticipate the investigation will be completed in the coming months,” said Vito Pilieci.
“The privacy commissioner is taking too long to release the report into IRCC leaking Afghan refugees’ data,” Hallan told CBC News. “This is time that Afghans fleeing the Taliban don’t have.”
“This isn’t in any way a knock on (the Privacy Commissioner) or public servants,” he said, adding that he knows their job is difficult and they’re under pressure.
“I understand that investigations can take time but Canadians deserve to know if the government is purposely dragging its heels on providing required information to the commissioner to delay the report.”
‘Maybe the next target is my family’
The brother of a woman whose identity and photo were leaked in the data breach told CBC News the danger has not passed for those affected — since the Taliban could, at any time, obtain a computer or cellphone that still contains the email exchange listing details about hundreds of Afghans applying for sanctuary in Canada.
“After this data breach, it is a moral responsibility to provide them with a clear understanding and a clear answer as to why this happened, and what are the measures to protect those people living in Afghanistan, to protect them against the Taliban’s reaction to this data breach,” he said. (Because he fears Taliban reprisals against his family, CBC News is not reporting his name.)
He lives in Canada, while his sister remains in Afghanistan with her children. Her husband was an Afghan Army officer who was killed by the Taliban. He said knowing that her information is out there on an unknown number of devices has been a constant source of anguish for her.
“After every arrest or every killing, she’s afraid that maybe they have her information,” he said. “Maybe the next target is my family, maybe next time they will come to me. So there is a very negative psychological impact.”
U.K. investigation done in eight weeks
He said he had hoped things would be cleared up faster.
“I was thinking after a week, or at least a month, those people can receive an answer from this commission and from IRCC. This delay, this silence, is something I was not expecting.”
The U.K. Ministry of Defence investigation into its Afghan data breach took eight weeks. It led to staff being reassigned and recommended changes to training procedures.
Canada’s investigation into its data breach has lasted more than nine months already.
Hallan said it’s important to fix the problems that led to the leak before other vulnerable groups are affected by something similar.
“We have another crisis now in Ukraine and we want to make sure that this kind of data breach doesn’t happen again,” he said.
“We want to make sure that our immigration system is secure, given all the recent cyberattacks happening around the world, and that this doesn’t happen to vulnerable Afghans, or to people from Ukraine, or people from any other country.”
