Information Technology (IT) Systems and Cybersecurity at Metrolinx
Total Page：16
File Type：pdf, Size：1020Kb
Office of the Auditor General of Ontario Value-for-Money Audit Information Technology (IT) Systems and Cybersecurity at Metrolinx December 2020 Metrolinx Information Technology (IT) Systems and Cybersecurity at Metrolinx IT systems and related technology components 1.0 Summary for critical transit operations have experienced frequent problems resulting in train delays and cancellations. Problems originating with Metrolinx Information Technology (IT) systems play a vital IT systems and related technology components role in managing day-to-day public transit oper- include network connectivity issues, system ations at Metrolinx. In the 2019/20 fiscal year, malfunctions, and software and hardware issues. Metrolinx provided a total of over 76 million pas- In the last five years, nearly 4,500 GO train and senger trips on eight train lines through 68 GO train UP Express delays and cancellations were the result stations, on the Union-Pearson (UP) Express and its of IT software and hardware issues. These issues four stations, and on 44 GO bus routes. IT systems have resulted in financial impacts from revenue loss are used to operate critical transit functions such of approximately $450,000 for Metrolinx, as well as as rail signals, switches and fare payment devices customer inconvenience. as well as the customer information systems that Metrolinx has a Service Guarantee Program to provide schedule information, service alerts and refund trip fares to customers when their trains are disruption updates. Metrolinx has various IT sys- delayed by 15 minutes or more, or boarded train tems and websites that are used by its employees trips cancelled after they departed due to factors for transit operations, and by its customers to plan within Metrolinx’s control. We noted that Metrolinx their trips with information about fares and sched- does not automatically refund customers who qual- ules, and for general inquiry. ify for the Program, although it has the technology Metrolinx also oversees the operation of and necessary data to do so. Instead, customers on PRESTO, a fare payment system that has been man- eligible trips are encouraged to submit an online aged and operated by Accenture under contract refund claim through the service guarantee portal since 2006. PRESTO enables customers to purchase at GOtransit.com. In the last five years, approxi- and load funds to PRESTO fare cards, and pay fares mately $2.2 million of eligible refunds directly by tapping the cards on machines at train stations related to train delays and cancellation from IT- and on buses. Customers can also purchase individ- related issues were not claimed by customers and ual tickets at stations from vending machines and were kept by Metrolinx. from station attendants at customer service win- We also noted Metrolinx’s overreliance on IT dows. PRESTO and other fare payment operations contractors. The majority (63%) of Metrolinx’s are also heavily dependent on IT systems. 435 IT staff were on contracts in 2019/20. Many of 1 2 these contractors held management positions and customers to be inconvenienced and have key decision-making roles, often overseeing other resulted in approximately $450,000 in lost IT contractors hired to support day-to-day IT oper- revenue due to refunds through the Service ations and services. Guarantee Program. We also found that Metrolinx did not consist- • PRESTO customers are not refunded ently test its critical IT systems and websites for automatically with the Service Guarantee security weaknesses. Many IT systems had not been Program. Eligible customers do not always tested for years and others had never been tested. receive a fare refund as entitled under the Also, we found that software code had not been Service Guarantee Program when experi- reviewed for all 12 critical IT systems we sampled encing train delays of 15 minutes or more for security weaknesses. These included systems for or cancellations that are within Metrolinx’s safety, dispatch, track allotment, scheduling and control. We found that although Metrolinx communications. Not performing regular penetra- has the technology and necessary data to tion testing or reviewing software code that can automatically refund customers who qualify identify system weaknesses resulted in two signifi- for the program, Metrolinx does not do this. cant security breaches in the last five years. With Instead, only those customers who apply weak security controls, Metrolinx customers’ per- for the refund receive it. Of the 4,500 train sonal information, with the exception of PRESTO delays and cancellations caused due to IT customer information, is not protected. incidents, only 23% of the eligible customers The following are some of our significant audit applied for the Service Guarantee program findings: for a total refund of approximately $450,000, with another approximately $2.2 million of eligible refunds kept by Metrolinx. Train Operations Frequent IT incidents caused train delays • PRESTO Fare Payment System and cancellations, resulting in lost revenue. Critical transit operations have • IT incidents occur with PRESTO fare experienced frequent IT-related incidents, payment devices. PRESTO ticket vending such as network connectivity issues, system machines and green tap machines installed at malfunctions, software and hardware issues GO and UP Express stations have experienced resulting in train delays and cancellations. frequent IT incidents, such as faulty displays, We noted that over the last five years, from an inability to dispense transit tickets, paper January 2015 to January 2020, there were and coin jams and Internet connectivity out- nearly 4,500 GO train and UP Express delays ages that render the machines inoperable. and cancellations resulting from IT software We noted over 45,000 IT incidents with fare and hardware issues. Of all train delays and payment devices in the last five years, mostly cancellations caused by IT incidents, 42% in ticket vending machines and green tap were at rail crossings where roads cross rail machines. The vast majority of the 45,000 lines. Where rail crossing systems fail, rail incidents did not have a significant impact crews must physically stop traffic and manu- on Metrolinx’s customers, as stations are ally protect the crossing before the train equipped with more than one fare device proceeds—this causes significant delays. In of similar type. Nevertheless, customers’ the last five years, train delays and cancella- experience was impacted, as they had to tions attributable to IT incidents have caused find a working fare device in order to pay for Information Technology (IT) Systems and Cybersecurity at Metrolinx 3 their fare. We found that Metrolinx does not business justification or performance always record details, such as the root causes evaluations conducted. of these incidents and the steps taken to • Contractors hold key management and resolve them in order to help prevent these IT decision-making roles, such as oversee- incidents from recurring. ing project budgets, and hiring and • PRESTO customers charged incorrect supervising other contractors. From Janu- fares. PRESTO’s IT system charged customers ary 2015 to July 2020, about 40% (307 of twice, and charged regular adult fares instead 764) of IT contractors hired to support the of reduced fares to students and seniors. In day-to-day IT operations and services were addition, funds were not added to customers’ overseen by other contractors. PRESTO cards on time, resulting in PRESTO customers’ cards being declined due to insuffi- Cybersecurity cient funds. We noted that there were over 6,700 fare-related IT incidents with PRESTO • Metrolinx has not consistently tested its cards from January 2016 to April 2020. For IT systems for cybersecurity risk. With the example, one incident resulted in about exception of the PRESTO IT system, Metrolinx 940 PRESTO customers being charged for does not perform regular security scans, such monthly passes twice for the same month on as penetration tests, on selected critical IT the same day. This incident was due to an IT systems and websites to identify security weak- batch job that processed a sales order twice. nesses. We noted that Metrolinx has been sub- In this particular case, all 940 customers were ject to cyberattacks resulting in breaches of its proactively reimbursed. customers’ personal information. For example, the Eglinton Crosstown website (thecrosstown. ca) was hacked three times between February Overreliance on IT Contractors 15, 2019 and March 27, 2019 resulting in cus- • Contractors are recruited without the tomer data breaches. required analysis of other options, and • Software code for transit IT systems is many hold key decision-making roles. not reviewed for security weaknesses. • Metrolinx neither assesses whether it Software code, the instructions written by already has the resources nor considers computer programmers, is not reviewed whether it should hire full-time employees regularly to identify security weaknesses in prior to contracting resources at much critical transit IT systems. Metrolinx neither higher rates. Metrolinx relies heavily on performs regular software code reviews, nor external contractors for IT operations requires vendors that own the software code and services, and has paid approximately to perform these scans to identify security $157 million to contract staff in the last weaknesses. We found that software code for five years, almost 2.5 times the salaries all 12 critical IT systems that we sampled had and benefits paid for Metrolinx full-time never been reviewed for security weaknesses. staff. About one-third of these contract- In December 2018, the lack of software code ors have had their contracts repeatedly reviews resulted in a breach of the personal renewed for over two years, and some over information—names, addresses and emails— five years in total. of more than 100,000 Metrolinx customers. • 80% of IT contractors we sampled • The personal information of Metrolinx’s had their contracts extended without customers is not consistently secured 4 according to the Freedom of Information of $288 million, more than double the initial and Protection of Privacy Act (FIPPA).