Newfoundland and Labrador seeks to halt privacy commissioner’s 2021 cyberattack probe

ST. JOHN’S, N.L. –

The Newfoundland and Labrador government has gone to court seeking to halt the provincial privacy commissioner’s investigation into the October 2021 cyberattack that toppled much of the province’s health-care IT systems.

An application to the province’s Supreme Court says privacy commissioner Michael Harvey had high-ranking roles within the Heath Department and the Newfoundland and Labrador Centre for Health Information during time periods he is now investigating.

The March 15 application says Harvey should not be probing these bodies’ decisions when he may have been at least partially responsible for them, and that his doing so creates a reasonable apprehension of bias.

Emails included in the court documents show Harvey, who was named privacy commissioner in 2019, refuting the idea, arguing that he was not responsible for cybersecurity in his previous roles within the Health Department.

Court filings show Harvey is taking a sweeping look at the 2021 attack, from preparedness of the Centre for Health Information to the government’s public communications about what happened.

The documents also show that the centre was aware of cybersecurity weaknesses before the incident, and that it knew it was highly vulnerable to an attack.

Justice Minister John Hogan announced last week that the Hive ransomware group initiated the attack by gaining access to the centre’s systems through a virtual private network.

This report by The Canadian Press was first published March 21, 2023.