File:
- Report Date: June 5, 2020
- Incident Type: Unauthorized disclosure of information
- Incident Date and Time: May 8, 2020, 7:47 a.m.
- Incident Location: Internet, Bloomberg Media
Report from Statistics Canada, Chief Audit Executive and Chief Security Officer
Executive Summary
On Friday May 8, 2020, at 7:47 a.m., Bloomberg Media published key monthly labour force indicators from the April 2020 Labour Force Survey, in advance of the 8:30 a.m. formal release by Statistics Canada, constituting an unauthorized disclosure of information. This report identifies the investigative approach, data and analysis, findings and conclusion. Based on the investigation and review of results, there is no evidence that Bloomberg obtained Labour Force Survey pre-release information from Statistics Canada personnel, nor as a result of a technical error.
Contents
Background
The objective of Statistics Canada's Policy on Official Release (2016) is to ensure that data sets are protected until their official release (through an announcement in The Daily), and not shared outside of Statistics Canada prior to their official release with limited exceptions. The Policy establishes five conditions that allow information to be disseminated prior to official release. These are:
- Authorization by the Clerk of the Privy Council on the advice of the Chief Statistician;
- Authorization by the Chief Statistician;
- Work-in-progress agreements (for data validation purposes);
- Advance release (AR) for information purposes (cost-recovery surveys and administrative data back to the source organization)
- Common governance.
Of note, Labour Force Survey (LFS) pre-release data are currently shared with five organizations under the authorization of the Clerk of the Privy Council on the advice of the Chief Statistician.
The Policy outlines the responsibilities of all parties involved in official release, and includes specific obligations regarding the advance release of information. In particular, Appendix B of the Policy identifies specific procedures for advance release under authorization by the Clerk of the Privy Council Office on the advice of the Chief Statistician. It states:
- Where an authorization is granted, the author division must communicate the conditions governing the advance release of information to the receiving organization.
- The author division has to obtain, from a designated representative of each organization that receives the protected information, a signed Acknowledgement of Confidentiality for Advance Release under an authorization by the Clerk of the Privy Council on the advice of the Chief Statistician.
- The signed Acknowledgements of Confidentiality for Advance Release under an authorization by the Clerk of the Privy Council on the advice of the Chief Statistician are valid for a period of 24 months from the date of the recipient's signature. They must be forwarded to the Director General of Communications and Dissemination Branch.
- The information will be provided to designated officials of the organization authorized by the Clerk of the Privy Council no earlier than 2:00 p.m. Eastern time on the business day preceding the day on which it is to be published in The Daily unless authorized by the Chief Statistician.
- When the organization receiving the pre-release information is a government organization, ministers or other elected officials responsible for leading that department and their staff will not be briefed prior to 5:00 p.m. Eastern time on the business day preceding the day on which it will be published in The Daily, unless authorized by the Chief Statistician. However in the case of cost-recovery programs, there is no specific time set to brief ministers or elected officials of funding departments.
Separate from Appendix B, the Policy also requires that, prior to each release, the author division have receiving organizations confirm the names of the recipients of pre-release information to ensure only those with a work-related need have access to pre-release information.
Issue
Statistics Canada was informed on the morning of May 8, 2020, that a journalist may have obtained numbers from an unauthorized source and was planning to publish these numbers prior to the official release of the Labour Force Survey (LFS) scheduled for 8:30 a.m. that day. Bloomberg, prior to the official release by Statistics Canada, posted high level employment figures at 7:47 a.m., stating the source of this unauthorized information was someone close to the matter.
Investigation Approach
At the request of the Chief Statistician, the Audit and Evaluation Branch led the overall administrative investigation with support from the Chief Security Officer and Head of Human Resources. The review focussed on the following objectives:
- Determine the source of the leak and take necessary action to address the breach
- Determine if pre-release policy and procedures in place were adhered to and sufficient to mitigate the risk of a leak of this nature
- Determine if pre-release of LFS estimates should continue and if so, are there additional mitigations to address risks of this nature
Objective 1
Determine the source of the leak and take necessary action to address the breach
Data and Parameters
The investigative approach included interviews with individuals, as well as verification of email correspondence and telephone logs from the period of April 29 at 5 p.m., when the monthly Labour Force Survey key indicators were finalized to May 8 at 8:30 a.m. when the formal Statistics Canada release took place.
On May 16, 2020, Stacey Money Chief Security Officer, contacted Shared Services Canada's (SSC) forensics unit to conduct a search for any email records between Statistics Canada accounts and those of Bloomberg reporters, as well as retrieving telephone logs from individuals who had access to the final May prelease numbers from the Labour Force Survey.
The scope of the investigation resulted in:
- 10 individuals interviewed,
- 210 email records analyzed (direct correspondence between Statistics Canada accounts and Bloomberg accounts), and
- 116 telephone account logs (totalling 9,812 individual correspondence) reviewed.
Summary of Analysis
The following is a summary of the analysis.
Email search
SSC's email search identified 210 outgoing messages from a Statistics Canada domain to the two Bloomberg domains (Bioomberg.net and Bloomberg.com) identifying the date, time, destination address(es) and subject line of the email message. The e-mail review returned four records with subject lines relating to labour. One message was a teleconference invitation from Statistics Canada's media hotline generic email inviting media to participate in the May 6 technical briefing for the upcoming release on May 8. The contents of the meeting invitation and attached reference document, did not release information. The three remaining emails were exchanges between [redacted] from Bloomberg and Martin Magnan (Manager, Media Relations, Statistics Canada) in which [redacted] was requesting historical labour information. The contents of those email messages contained historical labour data and did not contain any references to, or disclosure of, any pre-release LFS information.
Telecommunications
SSC's telecommunications search identified 9,812 telecommunication records for the 116 Statistics Canada accounts requested.
Important factors to consider in SSC's scope of search capabilities include:
- No incoming or outgoing records are available to SSC for office landlines.
- No phone numbers are identified for incoming phone calls or text messages.
- Destination numbers are available for outgoing phone calls and text messages.
- Destination number is not provided for records identified as picture/video messaging.
The SSC search resulted in three records of telecommunications between Jacques Fauteux, Assistant Chief Statistician, Strategic Engagement Field, and Bloomberg, two text message to [redacted], and one attempted phone call to another Bloomberg account between 7:13 a.m. and 7:23 a.m. on Monday May 8, 2020. These communications were confirmed in both written and verbal accounts provided by Jacques Fauteux.
No other outgoing correspondence records were found between Statistics Canada devices and Bloomberg accounts.
Peter Frayne, Head of Media Relations, reported to have received a call on his cell phone from [redacted] at 7:00 a.m. on May 8, 2020. According to Mr. Frayne, [redacted] had obtained two LFS key indicators and intended to publish this information in advance of the official release at 8:30 a.m. via The Daily. They were seeking comment from Statistics Canada. An incoming call was identified on Peter Frayne's telecommunications log at that time.
Open Source
Statistics Canada's security team conducted an additional narrowly focussed open source search (e.g., FaceBook, Linked In, Twitter) to assess any relevant information from Bloomberg leading up to and including the time of the event. The results of the search did not reveal any evidence of unauthorized pre-release Labour Force Survey information being shared between Statistics Canada personnel and Bloomberg.
Interviews
As part of the investigation, 10 individuals were met by Steven McRoberts Chief Audit Executive and Supriya Edwards, Director, Pay, Ethics and Workforce Management Division. The individuals selected were based on a narrowed list of employees that had access to the pre release information and also had contact with the media. There were six employees from Labour Statistics Division, each of whom were identified as spokespeople for the release, as well as four individuals from the Strategic Engagement Field, including the Strategic Communications and Outreach Branch. These interviews took place starting May 13, 2020, and concluded the morning of June 3, 2020.
The interviews conducted provided verification of events that established the known facts and corroborated the findings of both the email and telecommunication search, as well as provided relevant contextual information and clarification around timelines associated with this incident. No evidence of either willful or accidental advance release of the May 8, 2020, Labour Force indicators by an employee of Statistics Canada was found.
Technical Error
In addition to these above steps, and to ensure no technical issue could have inadvertently led to an early release of results on the Statistics Canada website, Katy Champagne A/Director General of the Information Technology Operations Branch and her team conducted an analysis. The results of this have yielded no evidence of a possible technical error that could have led to Bloomberg accessing the data early.
Conclusion
Based on the investigation and review of results, there is no evidence that Bloomberg obtained Labour Force Survey pre-release information from Statistics Canada personnel, nor as a result of a technical error.
Objective 2
Determine if pre-release policy and procedures in place were adhered to and sufficient to mitigate the risk of a leak of this nature
Fact Finding
Sharing the pre-release data with external parties
The author division, as predefined in the Policy, of the Labour Force Survey is the Centre for Labour Market Information (CLMI).
To obtain advance release authorization by the Clerk of the Privy Council, a letter is sent from the Chief Statistician to the Clerk of the Privy Council requesting authorization for a department. The Clerk of the Privy Council sends a letter back to Statistics Canada authorizing the advance release. Prior to April 2020, only three organizations had been granted this type of access:
- Finance Canada,
- Employment and Social Development Canada (ESDC) and
- Privy Council Office (PCO).
The authorization granted to these three organizations is long-standing. The review identified that the Chief Statistician reminded the Clerk of the Privy Council of these three organizations access in May 2014 and the Clerk responded to the Chief Statistician approving ongoing access to pre-release data in June 2014.
On April 7, 2020, pre-release access to the LFS estimates was granted by authorization of the Clerk of the Privy Council on the recommendation of the Chief Statistician to two additional departments:
- Bank of Canada (BoC) and
- Innovation, Science and Economic Development Canada (ISED).
Once authorization is granted, the Policy requires that the author division communicate the conditions governing the pre-release of LFS data to the receiving organizations. On April 7, 2020, the Head of Client Services CLMI advised the designated representatives of the new recipient organizations, BoC and ISED, of these conditions by email. Further, in response to the unique working conditions presented by COVID-19, prior to the April pre-release, the Head of Client Services CLMI also notified the designated representatives of the five receiving organizations of special measures recommended for the handling of pre-release data during the pandemic.
The Policy also requires that the author division obtain from a designated representative of each organization that receives the protected information a signed Acknowledgement of Confidentiality (AoC). The AoC outlines the organization's responsibilities under the Policy to safeguard the pre-release data. As per the policy, the AoCs are valid for a period of 24 months from the date of signing. Records indicated that a valid AoC was on file for the two new organizations (BoC and ISED). Due to difficulties in obtaining signed forms due to COVID-19 for the BoC and ISED, the Agency demonstrated its flexibility and adjusted its procedure to accept scanned forms and digitally signed forms. There were also AoCs on file for PCO and ESDC. However, these had expired in 2018. There was no record of an AoC for Finance Canada. However, as previously noted, the Agency has had a long-standing agreement with PCO, ESDC and Finance Canada dating back before 2014 when the Chief Statistician last received authorization from the Clerk of the Privy Council to continue to provide access to LFS pre-release data.
Before each release, the author division is required to have receiving organizations confirm the names of the recipients of pre-release information to ensure only those with a work-related need have access to pre-release information. Each month, prior to distributing the pre-release data, the Head of Client Services for CLMI emails a list of the names of individuals previously identified to receive the pre-release data to the designated representative at each receiving organization. The designated representative then confirms the list or requests changes, as required, by email reply. If new names are added to the list, the designated representative provides their name, title, and role. Email records and documentation confirmed that the Head of Client Services for CLMI performed a check for the LFS pre-release in May 2020. The records indicated that for the release in May 2020, a total of 67 individuals from five organizations were granted access to the pre-release data.
The Policy requires that pre-release information be made available to external organizations no earlier than 2 p.m. Eastern time on the business day before the release. Pre-release data is transferred to receiving organizations by electronic file transfer (EFT). Multiple users at each organization are provided with individual EFT accounts, and access is monitored by the Head of Client Services for CLMI. Automated reports from the EFT system confirmed that individuals previously identified by the receiving organizations as requiring access on a need to know basis accessed the pre-release data on or after 2 p.m. on May 7, 2020, in compliance with the Policy.
Statistics Canada briefing process
The internal LFS briefing process for April and May 2020 was modified to ensure the confidentiality of the pre-release LFS data. Prior to COVID-19, the Chief Statistician would be briefed in person at Statistics Canada's headquarters with paper copies of the material at his disposal for open discussion during the briefing. All Assistant Chief Statisticians would be welcome to attend the briefing. The Director General and Director of the author division would be the key content specialists present for the briefing. The Chief of Staff would also be present. An open discussion, including questions and answers, would take place during this face-to-face briefing.
For the April and May 2020 LFS pre-releases, the Chief Statistician was briefed through teleconference with a select few individuals from the Agency. The briefings occurred twice on April 7, 2020, for the April release and on May 1st and May 4th for the May release of LFS data. The Chief of Staff confirmed that there were fewer participants on the call than there would normally be during routine business when these briefings take place face-to-face. The Chief of Staff confirmed that, for all four teleconference briefings, materials were shared in advance through the internal secure shared drive which has limited access in order to protect the confidentiality of the data. On the calls, the participants referenced columns or areas in the material but did not verbally state any numbers in order to protect the confidentiality of the data.
Analysis and Conclusion
A review of relevant emails and documentation, as well as interviews conducted with key officials, demonstrates that the Policy on Official Release (2016) was generally followed for the LFS pre-release in May 2020. As a result of COVID-19, additional opportunities to improve the process for the LFS pre-release were identified and implemented. These included: receiving scanned and digitally signed AoC forms through email; reducing the number of individuals privy to the briefing with the Chief Statistician; implementing a process which does not permit speaking to the data when providing the briefing to the Chief Statistician; and informing the receiving organizations of special measures to consider under COVID-19 to ensure the confidentiality of the data.
Objective 3
Determine if pre-release of LFS estimates should continue and, if so, are there additional mitigations to address risks of this nature
A decision on continuing the practice of sharing pre-release information will not be made in isolation; as our partner organizations finalize their investigations, results will be reviewed, along with our own. This assessment of the overall process, and in consultation with the Clerk of the Privy Council, key stakeholders, and Statistics Canada's senior management team, will inform a decision towards continuing or modifying this practice.
Contributors
Steven McRoberts
Chief Audit Executive
Audit and Evaluation Branch
Stacey Money
Chief Security Officer
Head of Human Resources, and
Director General, Workforce and Workplace Branch
Additional Contributors
- Laurie Spencer, Director of Internal Audit, Audit and Evaluation Branch
- Craig Kolanko, Manager of Internal Audit, Audit and Evaluation Branch
- Janice Carkner, Manager of Internal Audit, Audit and Evaluation Branch
- Supriya Edwards, Director of Pay, Ethics and Workforce Management, Workforce and Workplace Branch