Federal government mistakenly sent 'sensitive' information to lawyer and now wants it back in the box

The federal governmentfailed to properly black outsensitive information during a recent Federal Court case and now it wantsthat information back under cover.

The incident israising questions about how wellequipped thefederal border and immigration departments are todealwith national security cases during the pandemic.

According to a recently filed court document, the government was "unaware that the blacked-out text" in documents released tothe applicant's lawyer by the Canada Border Services AgencyandImmigration, Refugees and Citizenship Canada"could be lifted to reveal confidential and sensitive information." CBSAalso separately released sensitive information that it neglected to redact.

The slip-up is connected toa court case involving Andrea and Attila Kiss. The Roma Hungarian couple said in 2019 they were planning on visiting Andrea's sister,who had been granted asylum in Canada three years earlier. After screening at the Budapest airport, the two were told that Canadian officials had cancelled their electronic travel authorizations (ETAs).

The couple is seeking a judicial review from the Federal Court, arguing that the test used by the federal government to identify whether visitors will remain in Canadabeyond theirauthorized stayis discriminatory.

They say Immigration, Refugees and Citizenship Canada's (IRCC) reliance on what it calls "indicators" signs officials use to decide whethersomeone is likely to claim asylum,such as whether they'vechecked luggagehas adversely affected a large number of Hungarian nationals and Roma travellers.

In the course of that case, the government argued that certain information the Kiss's team was seeking could be injurious to national security and sought a special non-disclosure application under the Immigration and Refugee Protection Act.

Immigration Minister Marco Mendicinoasked that portions of the documentsrevealing the nature of theindicatorsthat informed the officers' decision to cancel the couples' ETAs be redacted blackedout arguing that disclosingtheinformationwould give those wishing to evade Canadian border officials the means to do so.

In May 2020the judge approved the minister's request toredact one of the indicators.

Earlierthis year heordered the government to disclose additional documents in the case and about 200 pages of information were sent tothe couple's lawyer, Benjamin Perryman, on Feb. 5.

Perryman said he was shocked to realize the government's disclosure included redactions easily lifted using an ordinary PDF reader.

"Not only could they be lifted, but it was for information of which the government claims national security would be injured if it was released in the public realm. I was really taken back," he told CBC News.

"Computers are not new. We are well into the 21st century now and lawyers have been using computers for some time. You always hear stories of access to information, documents not being properly redacted, but you think that's going to be the last time you hear that story."

It turns out both CBSA and IRCC made mistakes when they wereredacting the sensitiveinformation.

According to an affidavit from aCBSA manager,staff used a software tool to highlight the sensitive information and then changed the colour of the highlighting from yellow to black.

"When documents of black typeface are black highlighted in this manner, the highlighted information is superficially obscured, although this is not a permanent method for redacting sensitive information," says that affidavit, dated Feb. 16 of this year.

Meanwhile, theIRCC litigation analyst tasked with redacting sensitive files coming from her department said in an affidavitthat whilesheusuallyapplies redactions by hand, shehad been working remotely at the timedue tothe pandemic.

"I used Microsoft Paint to cover personal or sensitive information in the screenshots so the information was not readable," she said in anotheraffidavit, alsoissued on Feb. 16.

"I was not aware that the information under the black marks I added in [Microsoft] Word could be read once converted to PDF."

AfterPerryman alerted the court to the faulty redactions on Feb. 5, CBSA staff then went back through the released material and found more information had been shared with him in error.

"Four further pieces of sensitive information contained in the documents were discovered to have been missed in the initial review. This was purely a mistake arising from the speed with which the materials were reviewed," says the CBSAmanager's affidavit.

"The disclosure of these pieces of information was inadvertent."

If this was top secret information upon which the security of Canada rested, it would be very alarming that this is the process that CBSA and IRCC are following.- Lawyer Benjamin Perryman

In the end, three types of information were releasedthat the government said should have been kept secret: sensitive information obscured by black highlightsbut not properly redacted;sensitive information mistakenly overlooked; and irrelevant personal information.

AG seeking an injunction to stop further spread

Now, the Attorney General of Canadais seeking a permanent injunction "restraining the use, dissemination and publication of sensitive information inadvertently transmitted by the respondent in error."

Lawyers representing the Attorney General of Canada attributed the mistake to "a combination of human error and technological issues."

"It is an unfortunate reality that sensitive information is sometimes inadvertently disclosed in the context of litigation. Courts across the country have recognized this reality and taken steps to ensure that a slip on the part of a party does not have far-reaching consequences," they wrote in a submission requesting the injunction.

"This assistance is even more necessary when the slip involves information which would be injurious to national security if released."

Perryman said the error likely won't help his clients and mayonly delay their case further. He saidthe breach stillraises questions about how both CBSA and IRCC handle information deemed top secret by the federal government.

"It is a snafu only because it doesn't look like this is a legitimate assertion of national security privilege. If this was top secret information upon which the security of Canada rested, it would be very alarming that this is the process that CBSA and IRCC are following," he said.

"That's not acceptable. It should not be swept under the rug and it needs to never happen again."

Christian Leuprecht, a defence and security expert at the Royal Military College and Queen's University, said the error likely wasdue to a lack of training among public servantswhen theyshifted to working from home.

"Departments were building the plane while flying it," he said.

"Even though it has national security implications, it looks like employees appear to have been left to fend for themselves 'We don't have time and money for training, sojust do your best.'

"Well, the 'best' has resulted in massive effort to remedy a mistake that could readily have been avoided."

CBSA, IRCC offering more training

CBSA spokesperson Louis-Carl Brissette Lesage said employees have been reminded recentlyof how to handle sensitive information andthe potential impacts of releasing it.

"The information was inadvertently released as a result of human error and the challenges of submitting documents electronically in the current pandemic, and was immediately brought to the Court's attention," he said in a statement.

"Lessons learned from this event will help to prevent similar situations in the future."

IRCC said it is also reminding its employees of the proper steps to take.

"The government of Canada takes privacy and security issues very seriously," said IRCC spokesperson Isabelle Dubois.

"Processes in relation to the transmission of court documents and for the protection of privacy and sensitive information are in place and will be reiterated to all employees in order to prevent any further reoccurrence."

The Attorney General's officeis also seeking a list of the individuals who receivedthe information.

In his Feb. 5letter to the court alerting them to the faulty redactions,Perrymanalso wrote that before he realized the redactions were easily readable, he sent the documents to Gbor Lukcs, an air passenger rights advocate.

Lukcsthen passed along the documents to a third party in Hungary and to another lawyerin Canada.

According to court documents,Lukcssaid he hassince destroyed the information but has never identified the lawyerto whom he sent the information.

"It is unknown whether they have destroyed the copy received, along with any copies, notes, summaries or other derivative products...It is also unknown whether they have further transmitted the information and, if so, to whom," wrote the government in its motion request.

Lukcs said he'll file a response in the coming days. He's arguing the government's request prohibiting him from commenting on the redactionsinterferes with his freedom of speech, while identifying his lawyer would interfere with his solicitor-client privilege.

"When the state seeks such highly invasive remedies against a Canadian citizen, it may be a threat to civil liberties," he said.