Accessing Publicly Available Information on the Internet Is Not a Crime

According to CBC News (April 16, 2018) a 19-year-old is facing a criminal charge for downloading files from Nova Scotia's freedom-of-information portal. The teen has been charged with "unauthorized use of a computer," which carries a possible 10-year prison sentence, for downloading approximately 7,000 freedom-of-information releases.

The vast majority of these files were already publicly available, and had been redacted prior to release to remove any personal information.

But about 250 of the reports were prepared for Nova Scotians requesting their own government files. These un-redacted records contained sensitive personal information, and were never intended for public release.

These documents were hosted on the government web server that also hosted public records containing no personal information. Every request hosted on the server contained very similar URLs, which differed only in a single document ID number at the end of the URL. The teenager took a known ID number, and then, by modifying the URL, retrieved and stored all of the FOIA documents available on the Nova Scotia FOIA website. 

Canadian authorities should drop charges against a 19-year-old Canadian accused of "unauthorized use of a computer service" for downloading thousands of public records hosted and available to all on a government website. The whole episode is an embarrassing overreach that chills the right of access to public records and threatens important security research.

--

It is important to be aware that any information that is posted to a publicly accessible web-site may accessed by the public. Some people may download that information, read it, re-post it, etc. Accessing publically accessible information is not a crime. It is not unauthorized use of a computer, cyber-stalking, hacking, or whatever other foolishness the government wants to charge.

If you don't want the public to access information, don't put it on a public web-site, or at a minimum if you must post it on-line, make sure that it is encrypted and password protected.