The Resort Municipality of Whistler (RMOW) spent more than $28,000 in legal fees in relation to its coverage of last year’s cyber attack, according to documents obtained through a Freedom of Information request.
“It was an incredibly difficult and uncomfortable decision to make,” said Whistler Mayor Jack Crompton of the decision to sue, in an interview last Thursday, June 2. “Ultimately the protection of staff’s personal and private information guided the decision at the time. It was an expense we felt we had to incur.”
On April 28, 2021, the RMOW became aware of after hackers took control of the municipality’s website, leaving a link to a site on the dark web and instructions to download the dark web browser, Tor.
In response, the RMOW took its servers offline, handcuffing digital and email services at municipal hall for weeks.
In an April 30 post to the dark web, the criminals claimed to have of RMOW data.
On May 20, Pique reported, in general terms, some of the information being leaked by the criminals on the dark web. That same day, the RMOW sued Pique, and applied for an injunction seeking to restrict what details the newsmagazine could publish about the attack, arguing that it was seeking to protect the privacy of its staff. Pique opposed the application, and the lawsuit generally, contending the matter was in the public interest and that the municipality should not be able to dictate what is or is not published in a story that concerns the RMOW.
Although Supreme Court Justice Sandra Wilkinson declined the RMOW’s request for a temporary order restricting the publication’s coverage, noting she had “serious concerns” about the precedent it could set, the lawsuit continued.
“Our goal was never to stop the telling of the story,” Crompton said in last week’s interview. “Our goal was to stop the theft and sale of staff’s personal information.”
Then, on June 7, 2021, RMOW staff contacted Pique expressing an intention to issue a demand under the Freedom of Information and Protection of Privacy Act, which would seek to have the newsmagazine reveal what information it had from the ransomware attack and destroy or return records in Pique’s possession.
Pique informed the RMOW that it did not have any private RMOW employee information in its possession, and RMOW staff indicated they accepted that statement.
However, on June 11, the RMOW issued the demand. Pique objected, saying that such a demand required reasonable grounds to believe that the newsmagazine was in unauthorized possession of certain personal information belonging to the RMOW.
On July 8, the RMOW stated in a press release that legal action was no longer required. Three weeks later, on July 26, the lawsuit was .
On Sept. 22, 2021, Pique filed a Freedom of Information application requesting the total legal fees the RMOW paid in the suit, as well as any internal communications between staff in relation to Pique’s coverage of the attack. Pique got back a heavily redacted response on Feb. 2, 2022, which did not include the total legal costs the municipality had incurred.
Pique submitted a request for review with B.C.’s Office of the Information and Privacy Commissioner (OIPC), and on May 30, received a reconsideration letter from the RMOW, which revealed the municipality paid $28,219.52 in applicable legal fees. That money came from the legal fees budget assigned to the RMOW’s legislative services department.
“The RMOW continues to assert that this information falls within the solicitor client privilege exception under the Freedom of Information and Protection of Privacy Act s. 14, however we have decided to release the total aggregate figure in the spirit of transparency within our community,” the reconsideration letter read.
As a result of the commencing and then withdrawing of the lawsuit, the RMOW was required to pay a portion of Pique’s costs for the lawsuit, in addition to the RMOW’s own legal costs.
Pique’s Freedom of Information request for internal RMOW communications in the lead-up to the lawsuit, as well as related to Pique’s coverage of the attack, remains before the OIPC for review.
Since the cyber attack, the municipality has implemented several additional measures to enhance and evolve its digital systems, including redesigning and rebuilding its network architecture, recovering and rebuilding applications and systems on a priority basis, creating "vigorous" password requirements, implementing multi-factor authentification for external access to municipal systems, and enhancing cyber-security awareness training and phishing tests for staff.
"It has been just over six months since the recovery phase concluded in November 2021 and since that time, the RMOW IT department has made significant improvements," a municipal spokesperson wrote in an email. "This is a continual process and at this stage we will be taking some time to evaluate our changes against a cyber-security control framework to better understand our progress against industry standards and then developing a roadmap to continue to improve our cyber-security posture and mature our cyber-security program."
In September 2021, Pique’s coverage of the incident was for a prestigious Jack Webster journalism award.
