O.F.A.H. Media Release: http://www.ofah.org/news/index.cfm?ID=52

OFAH File: 842
March 8, 2006

For Immediate Release

Is the gun registry an easy target for computer hackers?
"It took some $15 million to develop and I broke it in about 30 minutes."

- Former CFC webmaster

John Hicks, an Orillia-area computer consultant, has never owned a gun. However, during his three-year tenure as the webmaster for the Canadian Firearms Centre, he was  shocked to discover that anyone with a home computer could have easily accessed names, addresses and detailed shopping lists (including make, model and serial number) of literally millions of registered guns belonging to millions of unsuspecting licensed firearms owners.

"During my tenure as the CFC webmaster I duly informed management that the website that interfaced to the firearms registry was flawed. It took some $15 million to develop and I broke it inside of about 30 minutes," said Mr. Hicks who contacted the Ontario Federation of Anglers and Hunters after hearing about our organization's outrage over a map showing gun owners in Ontario that was posted on the Toronto Star's website.

"I have to say that a map of such information isn't quite as useful as what I know for a fact was available for years from the C.F.C. website. Someone out there may very well have your address, " said Mr. Hicks.

In a special interview with the Ontario Federation of Anglers and Hunters, Mr. Hicks explained that, until recently, the Canadian Firearms Centre's online service for firearms registration used a very risky "two-stage authorization process." In other words, it only took a simple process of elimination to find vulnerable user accounts and fool the system into thinking that the computer hacker was the actual licensed gun owner.

"Basically, a 16-year-old could have broken into that system in a heartbeat. So, would it surprise me if it was used for malicious purposes before they (CFC) got around to fixing it? Sadly, no," said Mr. Hicks.Mr. Hicks said he repeatedly warned CFC management to properly protect gun owners' personal information before he filed an official complaint with the Privacy Commissioner.

"The privacy commissioner actually responded that should anyone complain that they were targeted due to information gleaned from the CFRS database that they would investigate further," said Mr. Hicks.

Mr. Hicks continues to check the system to see how the much needed security upgrades are coming along. While Mr. Hicks feels that the CFC has seemed to have completely revamped the login functions, he said, "they haven't made it more difficult, rather just a longer process to effectively break the system."

O.F.A.H. Executive Director Mike Reader said, "The information that Mr. Hicks has provided is shocking, but certainly not surprising to O.F.A.H. members who have always warned that, in the wrong hands, a database detailing the whereabouts of every legally-owned firearm in Canada is a potential shopping list for criminals."

"If we consider what Mr. Hicks has disclosed about the CFC's haphazard approach to privacy protection, and we consider the recent burglary trend that has targeted gun owners, it only reinforces our predictions that a $2 billion program designed to keep Canadians safe is doing the exact opposite," said Mr. Reader.

The O.F.A.H. has brought this matter to the attention of Prime Minister Stephen Harper.

- 30 -