At least six Ontario police units have now paused their use of the Crime Stoppers program, a day after CBC revealed the extent of a massive data leak.
The Toronto, York Region, Halton, Hamilton and Windsor police services all announced they have suspended their partnerships with local Crime Stoppers chapters and are asking the public to contact them directly with tips. Durham Region police said they have removed references directing people to the program.
The Waterloo Regional Police Service said in a statement that it had already stopped publicly promoting Crime Stoppers as a reporting option in early July, soon after it had learned of the incident.
Two Crime Stoppers programs — Toronto and Guelph Wellington — also said they would no longer be accepting anonymous tips.
On Wednesday evening, the Toronto chapter, which CBC’s analysis found had the largest number of compromised tips, was the first to announce it would pause its program, effective immediately.
“I had to make the difficult decision to pause the program to protect those that use our platform,” said its chair Sean Sportun in a Thursday interview with CBC News. “We had … no choice, but it was the right thing to do.”
CBC’s exclusive investigation published Wednesday — which analyzed a copy of the hacked data — identified more than 1.5 million tips submitted to Crime Stoppers programs across the country over the past 25 years were compromised.
More than 850,000 tips — about half of all Canadian records identified — included personally identifiable information. We could not determine in every instance whether the information belonged to a tipster, a victim or someone accused of a crime.
It was the first time precise figures were made public showing the severity of the information exposed, as well as how many Canadian tipsters were compromised.
“It clearly seems that you have more data than us, which is a little concerning,” said Sportun. “We’ve been waiting for data; we’ve been asking for data. We’ve been asking for more data to understand what the risk is to our program.”
‘Red flags’
CBC reached out to more than 30 Crime Stoppers chapters across the country on Thursday to inquire about whether they would follow Toronto’s lead and also stop accepting anonymous tips in light of the information revealed in our investigation.
Only a handful responded. Crime Stoppers in New Brunswick will continue to accept anonymous tips, said Mark J. LeBelle, director of digital media services.
He told CBC News its cybersecurity team reset passwords, mandated two-factor authentication across the board, and will train local tip operators.
“Although this breach is concerning and certainly a stain on our program … we have been assured that the software is safer and more secure than it was prior to the breach,” he said in an emailed statement.
Toronto Crime Stoppers said in its Wednesday statement that despite its legal counsel’s multiple requests over months, Navigate360 — the U.S.-based third party that manages all of Crime Stoppers’ anonymous tips internationally through its software platform P3 — did not provide the text of the stolen tips, so it cannot see them.
The response also included a detailed timeline stating that Navigate360 initially said the leak did not include any Canadian data. It then said some Canadian data had been stolen but not Toronto’s, before finally confirming that about three years’ worth of Toronto data actually was affected.
Finally in July, Navigate360 provided the unique IDs of more than 176,000 Toronto tips and said a portion of them “potentially” contained personal information. That figure was in line with CBC’s analysis, which found more than 179,000 leaked tips submitted to the Toronto chapter.
“There [were] red flags on the information flow,” said Sportun. “There was concern of not answering questions, but they [Navigate360] maintained the safety of the platform.
“And then obviously, yesterday, with your report that came out, it didn’t match up to what we were hearing.”
Navigate360 has not responded to CBC’s multiple requests for comment, including about the detailed data findings and about Toronto Crime Stoppers’ allegations.
CBC found thousands of unredacted names
CBC’s analysis revealed that more than half of all Canadian tips included personally identifiable information. We could not determine in every instance whether the information belonged to a tipster, a victim or those accused of a crime.
However, we found that in over 4,300 reports, tipsters introduced themselves with a full name, although Crime Stoppers explicitly tells the public to avoid including identifying details. Still, this represented a fraction of reports, at less than one per cent of all entries over 25 years. CBC wasn’t able to verify whether all names were legitimate.
Despite hundreds of those tips containing clear staff warnings that a tipster had “self-identified” or had been “exposed,” the information still appeared in the database unredacted.
Toronto Crime Stoppers’ statement reiterated that the program aims to keep tips anonymous.
“We never ask for your name, and we don’t want it,” it said. “But people sometimes include details to explain what they saw. Before a tip goes to investigators, our practice is to remove those details. It has come to light that some of those original tips containing potentially identifying information were stolen from P3.”
Toronto police said the news “raises serious concerns regarding the protection of confidential information provided through the Crime Stoppers program.”
