As an investigator looking into allegations of state-level data misuse and digital harassment, I can tell you that the process is technically feasible but legally and procedurally complex. Proving that a specific individual used their government access to stalk or harass a civilian involves bridging the gap between internal system logs and external digital footprints.

Here is the investigative breakdown of how such a prosecution is built and where the challenges lie.

1. Establishing Access: The Digital Paper Trail

Government databases, especially those containing sensitive social service or disability data in British Columbia, are governed by strict access controls under the Freedom of Information and Protection of Privacy Act (FIPPA).

• Audit Logs: Every time an employee views a file, a “footprint” is created. Investigators look for “unauthorized access”—queries that don’t match the employee’s assigned caseload.

• Keystroke Logging & Screen Captures: Many high-security government terminals use software that records what is on the screen. If an employee is looking at your file while simultaneously logged into a personal social media account, this is “smoking gun” evidence.

• The “Vetting” Process: Investigators will check if the employee had a “business need” to see your data. If they accessed the file of someone they know personally or someone they are interacting with online, it is an immediate red flag for internal affairs.

2. Linking Government Access to Online Harassment

This is the most difficult part of the investigation. Being a “bad employee” (misusing a database) is a policy violation; being a “criminal” (harassment/stalking) requires proving the employee used that data to target you.

Investigative Step	How it’s Proven
Data Correlation	Did the harasser mention specific, non-public details found only in your disability file (e.g., specific medical codes, past addresses)?
IP Matching	Did the harassment originate from a government-issued VPN or IP address?
Device Seizure	Police can execute search warrants to seize the employee’s personal and work phones. Forensic experts then look for “cross-contamination”—sensitive government data sent to personal accounts.

3. Legal Thresholds for Prosecution

To move from an internal firing to a criminal prosecution under Section 372 (Harassing Communications) or Section 264 (Criminal Harassment) of the Criminal Code, the Crown must prove:

1. Identity: That the specific individual—not just their account—was the one behind the keyboard.

2. Intent: That they intended to alarm or annoy you.

3. Reasonable Fear: That their actions caused you to fear for your safety.

    

4. How “Easy” is it?

In reality, it is difficult but not impossible.

• The “Blue Wall” of Bureaucracy: Government agencies are often slow to admit a breach occurred because it opens them up to massive civil lawsuits. They may treat it as a “disciplinary HR matter” rather than a criminal one.

• The Anonymity Gap: If the person is smart and uses a personal device on a public Wi-Fi to harass you after viewing your files at work, proving the link requires a high level of forensic synchronization.

What an investigator looks for:

1. Temporal Proximity: Did the harassment start or intensify within 24 hours of the employee accessing your file?

2. Specific Knowledge: Does the harasser know things about your disability status or history that only a handful of people in the government would know?

If you suspect this is happening, the first step is usually a formal complaint to the Office of the Information and Privacy Commissioner for BC (OIPC). They have the power to audit those databases and see exactly who has been looking at your information.

Do you have reason to believe a specific file access event coincided with an increase in the harassment you’ve been seeing?