The FOIPOP breach and the dangers of criminalizing research

Last December, two journalists in Myanmar, Wa Lone and Kyaw Soe Oo, were invited to dinner by police officers to discuss their research into war crimes carried out by the military. The officers handed them some documents, then immediately arrested them under the country’s Official Secrets Act for possessing the classified material.

As absurd as that case is, it is reminiscent of a story unfolding here in Nova Scotia in connection with the recent breach of the province’s Freedom of Information web portal. Although details of the case are still emerging, it seems as though the province left sensitive documents on publicly accessible URLs, alongside material it had cleared for release. These materials were then downloaded by a researcher using a program which automatically retrieves all available files connected to a website—a practice known as scraping. The researcher has since been charged with unauthorized use of a computer and may face up to 10 years imprisonment.

This was not a hack. Website scraping is a perfectly valid research tool, which is routinely done by journalists and researchers who may find a website’s built-in search and retrieval functions to be cumbersome and inefficient. The alleged perpetrator has since told journalists he thought the material was open to access, since it had been uploaded to the public freedom of information website. This seems like a reasonable assumption. Information which is available via the internet, with no safeguards for access, has for all intents and purposes been published.

Some have suggested that the researcher is being used as a scapegoat, to deflect from embarrassment at the security failures that led the province to distribute sensitive material. Whether or not that’s true, the uncertainty around the legality of what the researcher did is troubling. Unless there is some clear evidence of harmful intent, like for example that the alleged perpetrator was utilizing the information to commit identity theft, it seems difficult to justify charging them. It seems even more difficult to justify the heavy-handedness of the police response, which involved an early morning raid, 15 officers and the accused’s 13-year-old sister being questioned in the back of a police car.

It may not be fair to compare this case to that of the Myanmar journalists, who were deliberately entrapped, but the stories are similar as both relied on the good faith and competence of official sources. When a researcher visits a government website, they should be able to assume that the material which is made available is intended for public consumption and has been adequately vetted. Imagine a police van driving up to your street, dropping a few boxes of classified files onto the sidewalk, and then arresting anyone who stopped to take a look.

We still don’t know all the facts in this case. Maybe it will emerge that the researcher was, in fact, looking to siphon up personal information to facilitate identity theft. But if, as seems more likely, he was motivated by curiosity or legitimate research, the police and province owe him an apology for their rash and indefensible overreaction.


Opinionated is a rotating column by Halifax writers featured regularly in The Coast. The views published are those of the author.