Privacy errors still under dispute

UTMSU is undecided about whether to hold the second referendum for the Student Centre expansion in March or in the fall, a decision the union will have to make in the wake of the error that led to the results of the previous referendum failing to be ratified by the Board of Directors.

For the referendum of January 29–31, UTMSU used a T-Card scanner that had been loaded with data for UTSU’s November AGM, which means that both UTM and St. George students were able to vote. St. George students were intended to be ineligible, as they are not members of UTMSU and the terms of the referendum do not apply to them.

UTMSU was informed of the discrepancy on January 31 by Mark Overton, UTM’s dean of student affairs. According to UTSU, their president Shaun Shepherd and UTMSU’s president Chris Thompson received a letter from Jill Matus, U of T’s vice-provost, students dated February 5, alleging that UTSU had breached confidentiality agreements signed by UTSU staff for the purposes of obtaining private student information to administer the AGM in November. Matus alleged that UTSU gave the AGM’s voters list to UTMSU to enable them to hold the referendum at the end of January.

In response to what UTSU deems “false accusations”, UTSU’s executive director, Sandra Hudson, responded to Matus in a letter on February 11, saying that UTSU had not breached the confidentiality agreements and did not provide UTMSU with the list for the referendum.

The first method of voter verification is via an electronic voter list. According to the Office of the Vice-Provost, Students, UTMSU requested a password-protected CD of the voter list on January 7, and in keeping with the office’s preferred method for distributing membership information, the office provided UTMSU with the disk containing truncated student numbers. The disk was couriered to UTM’s Office of Student Life but was never retrieved. (After use, these data disks are supposed to be returned to the Office of the Vice-Provost, Students at St. George.)

The second method is the T-Card verification system, which comprises two parts.

The first is a basic online database developed by the university’s Information Technology Services for UTSU in response to their need for a quick means of verifying student statuses to facilitate the sale of TTC Metropasses.

The university owns, operates, and controls this database, according to Matus.

The second part of the system, a physical piece of equipment, is the property of UTSU. It is an optical card reader.

Instead of using the CD sent by the Office of the Vice-Provost, Students, which their office says is what the two groups had arranged, UTMSU opted to use the T-Card optical scanner, which carried the voter list data for UTSU’s November AGM, the last list uploaded to the database.

“The uploaded voter information was therefore out of date and included St. George students. Had UTMSU advised this office in advance, as required, that it wished to use the T-Card reader for voter verification, the correct data for UTM would have been uploaded for the T-Card reader,” said the Office of the Vice-Provost, Students in an emailed response to questions.

However, in a letter to that office, Hudson alleged that UTSU does not own a T-Card scanner, and that the system belongs wholly to the university. She further states in her letter that no UTSU staff member had access to the system this academic year, because they do not have the password, and that registration for their November AGM was administered manually.

UTMSU held a commission meeting on Wednesday to present what had occurred and to gather the its members opinions’ on what should be done.

Chris Thompson, the president of UTMSU, presented three options: to hold the referendum in March, to hold it in the fall, or not to hold a referendum at all.

“The assumption was made that UTSU gave UTMSU the access to the list because they did their general meeting in November and they were granted access,” said Thompson during the commission meeting. “I don’t know why that assumption was made without asking us how that happened.”

According to Thompson, the university had not changed the password since the CRO had last used it, which was during the 2012 UTMSU elections.

“They used the same process that they did before,” said Thompson. “They made a judgement call and that judgement call was wrong. When the person logged in using the old password, it worked. So they assumed that they had been granted access with that password, and they just went ahead and did it.”

The error is attributed to the chief electoral officer, Babatumi Sodade, who has since resigned from his position.

“So on our end, an error in judgement was made, but our concern that we thought the university should actually maybe explore in the future is:  if that access was denied as it should have been, that person would have had no choice but to look for an alternative, which would have been retrieving that disk,” said Thompson. “The human error was improper judgement and the administrative error was access that shouldn’t have been granted.”