Drivers in Toronto saw some unexpected messages this week after a digital traffic sign being used for the Ontario Line project was tampered with to display a series of profanity-laced attacks on the government, mass surveillance and Flock cameras.
The sign, which was located on Don Mills Road just north of Eglinton — where Ontario Line construction is actively underway — cycled through three messages: “fuck the government,” “fuck mass surveillance” and “de flock Canada.”
A Metrolinx spokesperson said the matter is being investigated.
“The digital signage that has been tampered with is operated by a contractor for the Ontario Line project and has since been removed,” a Metrolinx spokesperson told The Trillium in a statement.
It is unclear exactly who altered the sign, how they gained access, or how long the messages were being displayed.
Cybersecurity expert Ritesh Kotak said the “troubling” incident highlights the vulnerabilities of connected public infrastructure.
Kotak said there are several ways someone could gain control of a digital roadside sign — and not all of them necessarily involve a sophisticated cyberattack.
“It's relatively simple from a technical perspective if the proper security protocols weren't followed,” Kotak said.
Someone could potentially gain access through a network connection, compromised employee credentials or even a physical connection to the equipment, he said.
For companies operating public-facing digital infrastructure, Kotak said security should be built into the technology from the beginning rather than treated as an afterthought.
“If you're a company, you have a responsibility to make sure that your signage is secured, especially anything that's public-facing,” he said.
“You want to have access control of who can actually go in and change it. You want to audit those logs as well. But you know nothing is 100 per cent foolproof. Anything can be potentially manipulated, and it brings up another component as well, as our lives become more digital, as companies become more digital.”
“All the more reason that security should not be an afterthought. It has to be built in right by design and a part of the procurement process,” he added.
Flock camera privacy concerns
The messages displayed on the sign specifically referenced concerns about Flock — a U.S.-based surveillance company that captures images of vehicles and licence plates, allowing participating agencies, like law enforcement or neighbourhood watch groups, to search and share information about vehicles.
Ontario police already use similar Automated License Plate Recognition (ALPR) technology to identify stolen cars, expired plates and plates linked to active investigations.
In a statement to The Trillium, the office of the Information and Privacy Commissioner (IPC) of Ontario said the technology’s growing capabilities underscore the need for safeguards around its use.
"ALPR systems, including those from Flock Safety, raise privacy concerns since they are designed to capture large volumes of license plate data, combined with other contextual information like the date, time, and geolocation of a vehicle. ALPR systems are becoming increasingly sophisticated with advances in artificial intelligence analytics. Many can also detect and track vehicles based on details such as make, model, colour, and unique identifiers such as bumper stickers or dents."
"While ALPR systems can enhance public safety, police use of this technology must comply with Ontario’s privacy laws and respect the public’s reasonable expectation of privacy and other fundamental rights and liberties protected under the Canadian Charter of Rights and Freedoms. Police need to consider and balance anticipated public safety benefits against the privacy and surveillance risks to Ontarians by having proper policies, procedures, and technical controls in place, including immediate deletion of non-hit data.
"Currently, the most common use of ALPR in Ontario is in-vehicle. In-vehicle cameras read license plates in the vicinity of the police car as it drives around communities. Some police services have also installed ALPR cameras in fixed locations in a community. These fixed cameras capture the comings and goings of every vehicle passing by and can paint a precise picture of individuals' travel patterns, particularly where there is only one entry-exit point to a certain location. Driving a vehicle is not in and of itself a reason for individuals to have their everyday activities captured by police monitoring or tracking."
The office added it has not been asked to review or discuss vendor-related privacy implications of Flock safety.
The Ministry of Transportation said data-sharing agreements between MTO, the OPP and police services require them to comply with all applicable privacy legislation, including destroying license information.
MTO does not have data-sharing agreements with, nor does it provide vehicle registration data to, private technology vendors, which have no access to MTO databases, according to the government.
Kotak said privacy concerns about the technology are valid if its use goes beyond the scope of what the cameras are supposed to be doing.
“I don't think that having automated license plate readers to keep people safe is a bad thing,” he said. “I think it becomes a bad thing when that purpose, for collecting the data, gets redefined. Where it starts being shared and being used for purposes beyond law enforcement, or beyond traffic management, or recovering stolen vehicles — when it becomes a tool to track individuals.”
