Report recommends territorial government decommission its Y:drive file-sharing network
Shock expressed by Nunavut’s privacy commissioner last year over an unprotected file-sharing network used by the GN has exposed security flaws in a second government network.
The networks in question are called the V:drive and Y:drive. Privacy commissioner Graham Steele recommended the GN replace its V:drive last year because it left “dozens, and maybe hundreds, of files with privacy-invasive content” available to any GN employee within a particular community.
The government shut down the V:drive in November and replaced it with a more secure system.
In a report he released June 1, Steele he was sent a tip following the release of his assessment of the V:drive.
“If you think the V:drive was a problem, you should look at the Y:drive,” a GN employee told Steele, according to the report.
The Y:drive is used by 13 of the GN’s public bodies, including all departments, Nunavut Arctic College and the Nunavut Housing Corporation. It stores information for GN employers within the communities where they work.
Steele asked each body to conduct a self-audit, and he did a test audit himself of the Department of Family Services.
What he found within the Department of Family Services in Iqaluit were copies of adoption and foster records sitting available for all employees at the department to see because they had been left, unsecured, on the Y:drive.
“Based on the self-audits, I conclude that the Y:drive is fundamentally flawed from a privacy perspective,” Steele said in his report.
“The privacy problems are too pervasive to be fixed.”
Steele recommends the Department of Community and Government Services, which is responsible for the Y:drive, decommissioning the drive.
Steele acknowledged that doing so would be a considerable task.
His recommendations for managing the Y:drive until it is decommissioned include hiring someone to be responsible for Y:drive privacy, restricting high-risk files, and that each public body and department examine its Y:drive policy.
Steele also recommended the Department of Executive and Intergovernmental Affairs respond to the report on behalf of all public bodies.
The Department of Community and Government Services will look into ways to have its digital file storage systems align with the recommendations in Steele’s report, said department spokesperson Hala Duale in response to questions from Nunatsiaq News.
Whether the department will decommission its Y:drive was not mentioned in the response.
The Department of Executive and Intergovernmental Affairs has yet to respond to the report and did not respond to questions from Nunatsiaq News.
