B.C.'s new computer network rolling out
Apr 01 2012
Privacy Commissioner Elizabeth Denham: "People will be tempted to peek, and that's part of human nature."Photograph by: Darren Stone, Times Colonist , Times Colonist; Times Colonist
After years of development, a slew of privacy concerns and a revolving door of cabinet ministers, the B.C. government's $182-million cross-ministry computer system will quietly roll into service Monday across the province.
But for something as arcane and dull as a new bit of computer software, the Integrated Case Management system has attracted outspoken critics.
Some call it a dangerous step toward centralizing "digital dossiers" on British Columbia's most vulnerable citizens, cataloguing everything from welfare payments, health issues and child-care status into a single file that is ripe for abuse.
"There's this vast system for sucking up people's personal information," said Darrell Evans, of the Freedom of Information and Privacy Association.
But the government, which has boosted ICM through high-profile mentions in past throne speeches, calls the project a big efficiency boost for front-line case workers, and says it will lead to more accurate service for clients.
It will also help flag safety issues - abusive and dangerous relationships, for example - and was cited as one of the ways ministries could better communicate information about vulnerable clients in the wake of the
Peter Lee murder-suicides in Oak Bay in 2007.
In the Lee case, government was criticized for a disorganized system that failed to see numerous warning signs that Lee was a threat, and ultimately missed a chance to stop him before he stabbed to death his son, wife and inlaws, and took his own life.
The new software replaces 30-year-old computer programs that the government says are obsolete.
The custom-built ICM database pulls together information that used to sit in dusty filing cabinets in the ministries of social development, children and families, and citizens' services.
All income-assistance offices were shut Friday so technicians could prepare for Monday's live launch.
The project, which started in 2008, will take another three years to get all of its services and improvements online.
But Monday's first day of operation is perhaps its largest, and most difficult, milestone.
"This is really the point at which we begin to get over the mountain," said Mark Sieben, deputy minister of social development.
"We've still got work to do to come down the other side.
"It's not a success we are taking for granted, at this point."
B.C.'s new cross-ministry computer system has had the kind of bumpy ride that only a large-scale, government-funded computer project could imagine.
Internal government documents show the Integrated Case Management system wrestled with privacy concerns, a serious security breach, slow performance, budget pressures, and the ever-shifting priorities of the Liberal government.
It has so far survived five social development ministers, four children's ministers and two premiers. It may even survive an entirely new governing party as it rolls out improvements over the next three years.
Yet, so far, it appears to have come in on time, and on budget - an accomplishment its advocates say makes it a government success story.
The ICM system compiles British Columbians' age, contact information, gender, birthdate, ID numbers, employment and disability benefits, child welfare subsidies, job hunt programs, daycare subsidies, at-home medical payments, adoption records, and child custody/care warnings into one piece of software that's available to thousands of civil servants across three government ministries.
The project has been in the works for almost five years. To get a look at its development, the Times Colonist obtained hundreds of pages of records using the Freedom of Information Act over a period of three years.
Much of the scant public attention paid to the ICM project has centred around its privacy implications.
Despite the public controversy, records show privacy was barely an issue for ICM planners during initial development in 2008 and 2009. That had caught the ire of past privacy commissioners, who warned at the time that a better review was needed.
Information and Privacy Commissioner Elizabeth Denham's office finished the first privacy impact assessment in 2010, and she said she's mostly satisfied with the privacy safeguards in place.
Yet privacy advocates have warned it's only a matter of time before someone tries to run their ex-partner, daughter's boyfriend or neighbour through the system to gather unauthorized intel. It's happened before - numerous times - in B.C. police databases.
"People will be tempted to peek, and that's part of human nature," said Denham.
"At the end of the day, you can't 100 per cent guarantee somebody won't misuse their access. It's really about controls, oversight and audit, and building the best system you can."
The ICM system is designed around "rolebased access" to people's details, meaning government workers only see what their job should allow them to see, while the rest of a person's information automatically comes up blank.
For example, an income assistance worker can't check on child custody status, and an employment assistance worker doesn't see adoption details.
The ICM system logs everyone who opens a file, and an audit team checks for irregularities. Some sensitive records - such as the address of a woman fleeing an abusive relationship - automatically send an alert to a supervisor when opened.
But that theoretical protection may not stand up in the real world, said Darrell Evans, executive director of the Freedom of Information and Privacy Association, a privacy watchdog group.
"The ultimate question is, does government have what amounts to a central dossier on each citizen? The answer is yes," he said.
"Let's talk about what actually happens to people's files. They muck around in them, make mistakes in them, and in the real world, they have leaks. People even sell information sometimes, and employees walk away with it. It gets lost, and it gets shared."
NDP critic Doug Routley said he's concerned because the Liberal government's track record on privacy is lousy.
"I guess [ICM] works in theory, but in practice, we'll have to see," he said.
One of the most significant problems during ICM's development was a major security breach in the fall of 2010, records show.
An empty computer server - which, had the system been live, would have been filled with client data - was discovered outside the government's protective firewall, and left a target for hackers looking to steal a wealth of government information.
"That was a very serious incident from my point of view," said Jill Kot, the assistant deputy minister in charge of ICM.
"I made the decision to strip the server right down, and build it right from the ground up again once it was in the government firewall, because I wanted not even an iota of a chance that that server could have been compromised."
It cost $200,000, but Kot said she found the money within the budget.
There were also some performance hiccups, including "unacceptably slow" levels in early 2011, said Kot. The technical problems were ironed out - under warranty - by government contractor Deloitte Canada, she said.
There are probably more unanticipated performance problems on the horizon after Monday's live roll-out.
"We anticipated we were going to have some wrinkles," said Mark Sieben, deputy Social Development minister. "Just as we're anticipating it's not going to be completely smooth sailing after April 2."
Despite the challenges ahead, Sieben and Kot insist the ICM system won't blow its $182-million budget.
ICM did get a one-time budget boost of $73.7 million in 2010, when it was in its first phase. That was because of added complexity for the system, and the province's move to sign a contract with Deloitte, the government said at the time.
Since then, the budget figure has held firm.
"We have a fixed amount that we are allocated to spend per phase, there's no going over that amount of money," Kot said.