Gun registry vulnerable Former webmaster...

NOTE: Versions of this Canadian Press story also ran in the following
papers: Moncton Times & Transcript, Fredericton Daily Gleaner, New
Brunswick Telegraph Journal, Winnipeg Sun, Halifax Chronicle Herald,
Calgary Herald, and Vancouver Province

PUBLICATION:  WINNIPEG FREE PRESS
DATE:  2006.03.10
PAGE:  A14
SECTION:  Canada Wire 
WORD COUNT:  347

------------------------------------------------------------------------
Gun registry vulnerable Former webmaster challenges online security
------------------------------------------------------------------------

CP Wire Teviah Moro ORILLIA, Ont. -- A 13-year-old could hack into the
federal government's online gun registry and have access to the
addresses of gun owners, says a former webmaster for the Canadian
Firearms Centre.

But John Hicks, an information technology consultant in this central
Ontario city, said the real concern is what a criminal would do with a
shopping list of guns in Canada.

"If this were Amazon, Visa, or eBay, they'd be bankrupt," Hicks said. "I
have worked with 13-year-old kids who can break into this system." Hicks
said he first notified managers at the Canadian Firearms Centre about
his concerns over the site's log-on process in March 2002.

Some security measures were improved, but the business site still has
gaping security holes, Hicks said. "They run two websites; they only
fixed one." To log on for a firearms ownership transfer on the business
page, users must provide the first eight digits of their gun licence
numbers.

"I can set a program up to make one request every five minutes," he
said. "It's a process of elimination." Hackers Once past that critical
first step, hackers could get their hands on the addresses of gun
owners, he said.

Simcoe North MP Bruce Stanton said he's been in contact with Hicks and
is looking into the issue.

"Whatever gaps exist, they need to be rectified immediately," Stanton
said. Gun owners "should also be assured that steps are being taken to
ensure that information is being kept confidential," he said.

A spokeswoman for the Canadian Firearms Centre said no individual
firearm information is accessible through the website.

"We actually exceed the government security standards," Maude Bourassa
said. "We monitor any possible attempts of illegal entry into the
system," Bourassa said. "No successful attempts to hack into the system
have been detected to date." Hicks questioned the CFC's ability to
monitor such attempts since the RCMP did not call him about his
demonstrations of how he overcame the site's safeguards.

Bourassa said repeated attempts to guess a password would be flagged by
the website's monitoring system.

The security system has been tested by outside experts, including the
RCMP, she said.