Cybercrime is no crime in Canada

Article By: Dr Gordon Atherley

When 87-year-old Andrew Raskovics returned home from hospital in November 2008, he discovered that someone had siphoned almost $15,000 from his credit cards.

He told the Toronto Sun that the last time he remembers seeing his credit cards was before he was taken into the emergency room at the Trillium Health Centre, Mississauga, Ontario.

“Ontario’s Information and Privacy Commission won’t be investigating Mr Raskovics’ case”, said the Commission’s Bob Spence, “because we don’t cover crime”.

What Mr Raskovics experienced is a particularly nasty cybercrime called identity theft.

Identity theft is what happens when your credit card or bank account password, or health card number, or other personal information that identifies you is stolen by a hacker.

The hacker sells your information to a fraudster. The fraudster uses your identity information to pretend to be you to steal money from your bank account or your credit card, or to gain something illegally like immigration papers, healthcare or credit.

Though fraud is a crime in Canada, identity theft isn’t—to add confusion to Mr Raskovics’s identity-theft injury. That’s because Bill C27, which would have added identity theft to the Criminal Code, died when the Federal government called the October 2008 election.

The Bill would have made a criminal offence of obtaining or possessing identity information with intent to use it in the commission of a crime—exactly what appears to have happened to Mr Raskovics—identity theft. The notorious identity theft from the TJX Companies involved retail-store shoppers in as many as five countries, Canada included. The hackers intruded on and stole the personal and financial information of an estimated 40 million people: identity theft is a globalized pandemic.

Identity theft happens to healthcare organizations. Mid-2008, two federally funded, back-room healthcare organizations, the Canadian Institutes of Health Research and the Canadian Institute for Health Information, had their corporate identities stolen when hackers circulated emails making lucrative but phony offers to healthcare researchers. These emails, called ‘phishes’, are used by hackers and fraudsters use to trick their way into our identity information.

Because identity theft isn’t a crime in Canada, healthcare depends on provincial privacy laws intended to shield personal health information from prying eyes. But hackers and fraudsters are more than voyeurs: they’re criminals in all but identity-theft law. Relying on privacy laws to deter them is like expecting no-parking signs to stop bank-robbers’ get-away cars from waiting in front of the bank.

It’s all very unfair. Users of healthcare, so often seniors and persons vulnerable through illness, are forced to rely on legislation that criminals scoff at, having already targeted healthcare.

“Identity theft has become a serious and very real threat for Canadians”, says the Privacy Commissioner of Canada, Jennifer Stoddart. Now that Federal Justice Minister, Attorney General and Niagara Falls riding MP Rob Nicholson, has himself been the victim of identity theft, maybe the federal government will bring back Bill C27.

Perhaps it should be named for Mr Raskovics?

###

Dr Gordon Atherley holds the British equivalent of the Canadian PhD and MD degrees, and LLD, Honoris Causa, from Canada’s Simon Fraser University. His medical specialties are occupational medicine and public health. He is retired from medical practice.