Privacy commish in contact with Rogers, Yahoo about breach

The federal privacy commissioner’s office said it has been in touch with Rogers Communications Inc. and Yahoo Inc. regarding the breach of millions of Yahoo email accounts revealed last week, though it declined to comment on more recent revelations of Yahoo spying on user emails. Rogers customers’ email accounts use Yahoo’s email service through a partnership between the companies, formed in 2004. Last week, Yahoo admitted data “associated with at least 500 million user accounts” was stolen from its network in 2014. Valerie Lawton, spokeswoman for the privacy commissioner’s office, said in an email Wednesday that “Rogers has reached out to our Office about the incident at Yahoo. We have also been in contact with Yahoo to determine what took place and what they are doing to respond to the incident.” In response to a question about a separate Reuters report this week that Yahoo had scanned customer emails for United States intelligence agencies, Lawton said the office was aware of it, “but given we don’t have detailed information about the matter, we are not in a position to comment.” The Reuters report, citing anonymous sources, said Yahoo built software in order to “search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials.” Rogers spokesman Andrew Garas said in an email regarding the breach of accounts that the company takes “our customers’ privacy seriously and are in contact with Yahoo as they continue their investigation and determine next steps.” He added Rogers encourages users to “regularly change their passwords.” He did not answer questions about how many Rogers customers would have been among the 500 million accounts affected, or whether Rogers is planning on taking any steps in response to the revelations, such as ending its partnership with Yahoo. In response to a question about whether Rogers had notified its customers, Garas did not answer directly but pointed to information Yahoo had provided about its notifications of users. He also declined to comment on the more-recent report regarding spying on emails. While other major Canadian telecoms offer their own email services, they are not branded as Yahoo services. BCE Inc. and Telus Corp. did not respond to questions about which, if any, companies they partner with on their email, while a Shaw Communications Inc. spokesman said in an email Shaw “does not provide customers with webmail through Yahoo’s email services.” In a phone interview, Christopher Parsons, research associate at the Citizen Lab at the University of Toronto’s Munk school of global affairs, said that the Yahoo breach is “incredibly serious, both in terms of fact that it is about, if not the actual, largest breach of email records that we’ve seen in a single swoop” and because the hackers were able to obtain both encrypted and unencrypted passwords and answers to security questions. “Whoever did this is sitting on one of the largest troves of legitimate passwords in the world, and the ways of getting past some of the more-limited protections email providers have established,” he added. Parsons said that individuals may not realize they have a Yahoo account if their email provider outsourced their service. “That means that when people hear, ‘if you have a Yahoo account, change it’ they think ‘oh, I have an @Rogers.com account or whatever, therefore I’m probably OK.’” He noted that years ago email used to be seen as a value add to providers, though given the cost of running and managing the network “they outsourced it to parties that, in theory, were supposed to be a lot better at it, at a lower cost.” Parsons added that new data-breach regulations the government plans on imposing haven’t come into force yet. He said that Yahoo knew about the breach of 500 million of accounts for “roughly a month before they notified anyone,” including during a period of time when they were in the process of being acquired by Verizon Communications Inc. Ann Cavoukian, executive director of the Privacy and Big Data Institute at Ryerson University, said in a phone interview that the revelations that Yahoo spied on emails for the U.S. government are “truly unbelievable.” “If there is any substance to it, it is just such an unbelievable violation of privacy, because it’s one thing to say you’re accessing ,” she said. “But there is no confusion that if you’re actually accessing the contents of the communications, what’s actually said in , that is just such a violation of privacy.” In response to a question about whether a company like Rogers that had outsourced its email to Yahoo has an obligation to notify its customers, Cavoukian said “that’s a tough one.” “I always err on the side of caution, and I believe you’re better off as a company to notify customers of any occurrences like this,” she said. “I can understand, though, how Rogers or other companies would say ‘look, we haven’t done anything wrong. That was Yahoo. We retained their services thinking they were a trustworthy organization and we’re learning this just like you’re learning it.’” Cavoukian added: “I can understand if they felt there was no obligation to notify because they didn’t do the wrongdoing.” She said the number of breach incidents in general appears to be growing. “We live in really frightening times, in the sense that I have never seen so many cyber attacks and data breaches as this year. Some people are calling it an epidemic, some people are calling it a pandemic,” she said. The solution is to increase the use of encryption, Cavoukian said. “We have to encourage the government to understand that you have to allow companies and individuals to strongly encrypt their data end-to-end, and that is the only way that we’re going to be able to protect our data and preserve our privacy in the long run.” — With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Charelle Evelyn at cevelyn@thewirereport.ca

Privacy commish in contact with Rogers, Yahoo about breach

News | October 6, 2016

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy commish in contact with Rogers, Yahoo about breach

News | October 6, 2016

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us