Security, privacy controls under fire at Vital Statistics

Hey there, time traveller!
This article was published 10/09/2020 (1822 days ago), so information in it may no longer be current.

With identity and cyber theft on the rise around the world, Manitoba’s auditor general is slamming security at the province’s Vital Statistics Agency.

The agency needs to do more to manage the security, privacy and integrity of the vital events information it holds, said Auditor General Tyson Shtykalo. The report lists 19 recommendations but some were not made public for security reasons, said Shtykalo.

“There are sensitive findings,” he said in an interview. “We don’t want to give a road map to hackers of how to get in.”

The Vital Statistics Agency keeps track of nearly four million records of vital events that date back as far as 1882, including registrations of births, deaths, adoptions, name changes, and changes of sex designation.

The agency hasn’t consistently linked deaths to births to prevent identity theft, the report said. A scammer could peruse obituary notices for information and use it to obtain a dead person’s birth certificate in order to commit fraud, the auditor general explained.

“Not linking deaths to births to know which people are still alive could create opportunities for people by using obituary information,” said Shtykalo.

The report said that a complete list hasn’t been kept of “event” registrars — staff designated by hospitals and funeral homes to certify births and deaths who forward that information to Vital Statistics. And, it found, there’s been a lack of Vital Statistics Agency training and validation of registrars.

There wasn’t a regular review of staff access to its registry software to reduce the risk of invalid or fictitious information being entered to create false certificates.

It said Vital Stats hadn’t entered into agreements with five of the 11 organizations it shares information with to spell out the responsibilities of the organization receiving the information and giving the agency the power to audit the organization to make sure it properly uses and protects information.

The report found fault with the agency for using regular mail service to send event certificates — except for when someone paid extra to have them rushed. The risk of not using secure mail is that vital certificates could get lost or delivered to the wrong place, resulting in someone’s privacy being breached or their identity stolen, the report said.

The audit also found weak physical security controls within the agency’s downtown office.

Shtykalo said people with strollers or who use wheelchairs have to use a ramp entrance that takes them through work areas to get to reception. Low counters meant there was not enough separation of public area and work areas. There’s a lack of fire-suppression controls to protect data and documents. There’s no sprinkler system and infrequent fire inspections: none was conducted from August 2012 to May 2019.

“We’re not ringing huge alarm bells on this,” said Shtykalo, who noted the audit began in 2015 before he became auditor general and has been delayed. “This particular report has experienced a bit of turnover in the last few years,” he said.

The concerns it raises have withstood the test of time, though, he said. “The recommendations we have in this report are relevant.” Some have been carried out by the province.

“We have accepted all 19 of the recommendations, recognizing the importance of this work to Manitobans,” said a spokeswoman for the Finance Department, which is in charge of the Vital Statistics Agency after taking it over from Manitoba Justice last year.

A number of recent service improvements have been made, including enhanced information security and the increased use of online and digital technology to make processes more convenient and secure for clients, the spokeswoman said in an email.

“Work is ongoing to implement the short-term changes identified in the (auditor general’s) report, such as better physical protection of documents and office spaces, and the Vital Statistics Agency has also begun planning how it will address the longer-term recommendations.”

carol.sanders@freepress.mb.ca

vital-statistics-agency