New freedom of information website unlikely to be ready until next year

It won't be until sometime in 2020 before the province's freedom of information portal is fully functioning again.

A tender closed last month to build a new portal that allows the public to submit, pay for and receive responses online for freedom of information requests and a case management system to handle requests behind the scenes.

The work will be awarded sometime in November.

"We are going to do our very best to have this up and running as soon as possible," Maria Lasheras, the province's chief information access and privacy officer, said in an interview.

"We loved the portal as much as our users did. It is very important for us to have that portal up."

Lasheras could not say how many bids were received for the work, but confirmed no one was restricted from bidding if they met tender requirements.

Attempting to rebuild trust

The portal has been offline since April 2018, when a government employee inadvertently discovered the ability to access personal information from the website that was not supposed to be made public.

From there it was determined a flaw in security measures allowed someone to download the website's entire contents of about 7,000 files one month earlier by writing a simple piece of script. About 300 of the files were determined to have sensitive personal information.

Police raided the home of a 19-year-old Halifax man, but ultimately did not charge him.

In the wake of the discovery, government officials suggested it would be a matter of weeks before the system was back up and running. Weeks turned to months and last fall it was decided it made the most sense to build a new system. Part of the reason was to rebuild the trust with the public that "we obviously had lost," said Lasheras.

"We strive to protect the privacy of individuals, of Nova Scotians, and we have failed on that, so it was very, very important that that trust could come back."

Lessons learned

The tender incorporated all recommendations in reports from the province's auditor general and privacy commissioner following the security failure. That includes better project management and strengthened cyber security.

"Not that we didn't know before, it's just that our processes weren't as robust as they should have been," said Lasheras.

"What we have to do is [use] the appropriate processes to make sure that any vendor that is going to be successful meets all of the provincial requirements."

A temporary website was created to allow the public to see processed freedom of information requests two weeks after they're released.