At a September 25 Business Board meeting, the U of T administration revealed that the encampment cost the university at least $4.1 million. On the September 17 Planning and Budget Committee, the administration also spotlighted an April ransomware attack that exposed thousands of Ontario Institute for Studies in Education (OISE) alumni’s personal information and revealed vulnerabilities in U of T’s cyber security infrastructure. 

Encampment and $4.1 million 

Scott Mabury — U of T’s vice-president operations and real estate partnerships & vice-provost academic operations — told the Business Board that the student protesters’ 63-day encampment on King’s College Circle had cost the university $4.1 million. The protesters demanded that U of T disclose its investments, stop investing in companies providing weapons and services to the Israeli military, and cut ties with Israeli universities.

Direct costs such as hiring lawyers to secure an injunction permitting U of T to remove the encampment and paying for increased security and repairs made up $3.8 million of the sum. The remaining $300,000 was the revenue that the university didn’t receive, either from parking at King’s College Circle Garage or cancelled events. Mabury said that the $4.1 million sum encompasses most of the costs, although U of T might have to pay a few more legal bills. 

The university declined to respond to The Varsity’s question about how much U of T spent on lawyer fees.

In U of T’s submission to the Ontario Superior Court of Justice on May 29, U of T’s Chief Operating Officer of Property Services & Sustainability, Ron Saporta wrote that as of May 22, the encampment cost the university more than $300,000 in property damage, security costs, health and safety, and reorganizing events. 

According to Campus Safety Community Liaison & Support Team Assistant Director Ryan Dow, approximately two-thirds of the cost resulted from paying for increased security. Justice Markus Koehnen cited the “unrecoverable costs” to the university in his ruling in favour of the university. 

“So that’s bad”

On April 22, OISE experienced a ransomware attack that exposed personal data for up to 14,238 people. More than 8,200 of those people experienced breaches of private information that included their Social Insurance Numbers (SIN). 

“So that’s bad,” said Mabury in the September 17 Planning and Budget Committee meeting where he discussed the attack. 

Mabury told the committee that much of the data exposed was “end of life,” which means that it is not of any use whatsoever. He also noted that the data included SIN from students who had graduated in the late 2000s. “There is no reason to have that data, certainly in an unprotected environment,” he said, due to it being outdated.

The university’s retention policies state that records of students who graduated should be kept for seven years after graduation. After seven years, departments can destroy masters’ student records and transfer doctoral student records to the archives. Student award and invoice records are only kept for six years after graduation and then destroyed.

According to Mabury, lacklustre security practices including reused passwords and accounts made OISE vulnerable. The incomplete inventory of its data also made it more difficult for the division to figure out what it had lost.

David Lie — a professor in the Department of Electrical and Computer Engineering and director of the Schwartz Reisman Institute for Technology and Society — told The Varsity in an interview that inventory practices can vary wildly between institutions across Canada. Private information might be spread across different units or people, which can make it hard to know what information the institution actually has.

U of T notified the individuals impacted by the attack — most of whom are alumni — and offered them credit monitoring. The university did not engage with the hackers. In total, the attack cost OISE $250,000 and removed its faculty from the web for two weeks, which hampered work. 

Since the attack, OISE has changed administration passwords, reset systems, installed anti-viral software, and re-secured its servers. OISE now also has 100 per cent endpoint protection: security on user devices to prevent hackers from gaining entry.

According to Lie, endpoint protection is important but difficult to achieve. He explained that users might use bad passwords or devices with malware, and that devices can even fall into the wrong hands. “There’s all sorts of risks that are associated with an endpoint that’s physically in the possession of a single user that doesn’t necessarily have a lot of security training.”

However, Mabury noted that, “from a learning standpoint, we are still very vulnerable.” He explained that AI has increased the risk of fishing since generative AI can craft phishing emails at a cheaper and larger scale. “So the concern lies more around increased volume,” he said.

Especially given the recent increased volume of phishing emails, Lie highlighted the importance of setting up multi-factor authentication. “It’s annoying, but it’s actually a very effective line of defense against phishing,” he explained. “The chances you’re going to fall for [a phishing email] is not if, but when.” 

Enrolment

U of T has not yet finalized its student counts for the year. However, the current data suggest that the university is overperforming on domestic enrolment but enrolled around 800 fewer international students than targeted. 

Considering that most international students enrolled with the Faculty of Arts & Sciences pay $61,720 in tuition, Mabury noted during the Planning and Budget Committee meeting that the university’s tuition revenue will be $40 million to $50 million less than planned.

Mabury told the board that the downward trend in international enrolment reflects issues across Canada. From September to October 2023, the Canadian government accused the Indian government of killing a Canadian British Columbian resident and activist who was wanted by Indian authorities, launching a diplomatic dispute between the two countries. This past year, U of T experienced a 40 per cent drop in applications from Indian international students.

In January, the federal government announced that it would cut the number of international undergraduate study permits it issues by 35 per cent and announced an additional 10 per cent cut on September 18. It also put in place additional barriers to obtaining post-graduation work permits. “The country seems to be telling the rest of the world that we don’t want them,” Mabury said. 

The next Business Board meeting is scheduled for November 27.