MEMO / NOTE DE SERVICE

To / Destinataire Mayor and Members of Council File/N° de fichier:

Maire et membres du Conseil
From / Expéditeur Acting General Manager, Transit Services
Directeur général par intérim, Services de
transport en commun
Subject / Objet Date: March 18, 2011
OC Transpo Website Breach Le 18 mars 2011

The objective of this memo is to provide Council with some background information on how the
media got access to the test site for the upcoming network optimization consultations that are
being launched at the March 23 Transit Commission meeting.

As part of the upcoming public consultation for the budgeted network optimization proposals,
staff have been testing new customer feedback tools on the OC Transpo “development” website.
The information includes the various route change options (in draft form).

Simultaneously, tests were being performed on our mobile device application, and the normal
security protocol was removed to allow testing in a simulative live environment. During the
testing processes yesterday, there was a short period of time (approximately one hour) when the
development section of the site (not open to the public) was unsecure.

We have confirmed that an individual (who is not a City of Ottawa employee) gained access to
the development section and created a link that was then sent to the public via Facebook and an
OC Transpo related blog. The link basically allowed people to access the development site to
view some of the draft network proposals that staff will be presenting on March 23 to Transit
Commission.

In the brief period of time that the security was down, web users who followed the unauthorized
link were able to copy and paste the text into other blogs. However, any version of the text that
may be currently circulating should not be relied upon in any way.

Normally there is nothing confidential about the content within the development environment,
and, therefore, no need to ensure the security is active but a security protocol is now in place to
prevent reoccurrence.

OC Transpo and the City’s IM/IT Security have initiated an investigation.

I can assure you that OC Transpo is taking this breach of security very seriously and will fast-
track any changes needed to improve the process.

Management considers the upcoming network optimization proposals a critical piece of moving
OC Transpo towards sustainability.

/2…
As part of that process, management has planned for a number of communication opportunities
over the next couple of weeks with customers, stakeholders, operators and mechanics, which will
ensure that they receive accurate and complete route change information.

If you have any questions or require further information, please do not hesitate to contact Jane
Wright, Manager, Safety, Business Services and Customer Relations at OC Transpo.

Original signed by:

Larry Atkinson
Acting General Manager, Transit Services

cc: Kent Kirkpatrick, City Manager

Nancy Schepers, Deputy City Manager, ISCS