‘Truly terrifying’: Alberta voter data breach raises fears for Canada’s electoral integrity
The illegal use of voter information by rightwing separatists in the province of Alberta has raised fresh fears over Canada’s electoral integrity by making valuable and “incredibly confidential” personal data easily accessible to malicious actors, security experts have warned.
The illegal use of voter information by rightwing separatists in the province of Alberta has raised fresh fears over Canada’s electoral integrity by making valuable and “incredibly confidential” personal data easily accessible to malicious actors, security experts have warned.
The data breach, one of the largest in Canadian history, has prompted warnings of a “truly terrifying” new battleground over information, persuasion and foreign interference in already weakened democratic systems.
Activists in the oil-rich province have in recent months increased their effort to force an independence referendum. But debates over secession – already rife with accusations of treason and internecine feuding – have been overshadowed by revelations that a separatist-linked organization gained illegal access to Alberta’s official list of electors. The database contains the names, home addresses and contact information for roughly 2.9 million voters.
Elections Alberta, the body that administers the vote in the province, says it has launched an investigation into how how a far-right group was able to access the database and use it for a campaign to reach voters.
Separatist leaders recently unveiled an initiative using data-driven campaigning and grassroots mobilization to connect with voters.
During an online meeting with supporters, Centurion Project organizer Emmott Kelsey told attendees the app would “revolutionize” how campaigns are run. He boasted that the software underpinning it is “so groundbreaking” that it had been presented to Donald Trump’s White House.
“And we’re kind of the guinea pigs with it,” he said. The Guardian asked Kelsey to clarify his remarks but did not receive a response.
One of the key figures of the Centurion Project is David Parker, a veteran Alberta political organizer with deep ties to the separatist movement, and to US MAGA activists and far-right figures such as Tucker Carlson. Parker has previously faced hefty fines from Elections Alberta over violations of voting laws.
“Parker is a shockingly effective political organizer. What he was doing was attempting to create a digital grassroots organizational tool. And on its face, there’s nothing wrong with that,” said Jen Gerson, an Alberta-based journalist. “But in order to populate the app that underlies the Centurion Project, he needed data.”
In March, Gerson was tipped off that the Centurion Project had obtained a copy of the province’s voter list. Her source said they had been able to access the Centurion Project’s database without using their real name name or any traceable personal information.
Gerson said the absence of any security or protection was astounding.
“Anybody with a burner account and no credentials could then access the file and potentially download information from it,” she said. “If you knew about it, you could anonymously access the entire data root file.”
Gerson reported her concerns to Elections Alberta in late March. But the oversight body responded that while her report was “compelling”, Parker could have obtained the list legally from a data broker and concluded there were “no reasonable grounds” to investigate.
A month later, however, EA obtained a court order to shut the database down and launched an investigation. Canada’s federal police, the RCMP, and Alberta privacy commissioner are also investigating the breach.
In order to prevent the improper sharing of voter lists, EA “seeds” voter lists with fake names, and the body was able to confirm that the CP list had originally been provided legally to the Republican party of Alberta, a fringe rightwing party, and then improperly shared.
The party said it had told Centurion Project not to use the data but did not say if the list had come from within the party. “We were proactive on that before the injunction today, and we’ll be fully complying with Elections Alberta,” leader Cam Davies told the Canadian Press.
The provincial government has blamed the elections agency for failing to investigate the breach when first notified. But EA says the provincial government weakened its investigative powers last year.
Elections Alberta says nearly 600 people accessed the voter list which it described as “incredibly confidential”, adding in a statement that it understood Albertans were “unhappy, scared and anxious” about the situation.
“We have heard countless stories about the risks people face having their information made public, including stories from domestic violence survivors, law enforcement, marginalized communities, and more,” the group said, calling on the government to amend existing laws to prevent a similar breach in the future.
Parker has denied that he used the Republican Party voter list and suggested the database was compiled from a third party.
“We have taken action to shut down the app until we can ensure that the dataset is compliant with Alberta and Federal privacy laws. The Centurion Project plans to fully comply with Elections Alberta’s investigation,” Parker said in a statement.
In the statement, Parker said volunteers with the Centurion Project “did not have access to phone numbers or emails” and the dataset was from a third party.
But during an online demonstration of the database for volunteers at an April 16 event , Parker showed how the personal information of any voter could be found on the database. One witness at the event – a member of the opposition NDP – was shocked when Parker pulled up the home address and phone number of Alberta’s former premier Jason Kenney. That witness then filed a report with the police.
Kenney has said he is hiring a lawyer for advice, warning that the breach may affect domestic violence survivors, journalists, activists, judges, and other public servants for years to come.
“This has been a real wake up call to the risks that we’re playing with here. We have to assume that all of our personal information and address are potentially available to bad actors,” said Gerson. “People are very angry and they’re very scared. But if you don’t want these guys in your house, why are you even thinking about letting them run your country?”
The leak has become a political flashpoint in Alberta, but the efforts to subvert election and privacy laws expose the immense value in voter lists and mirror a similar battle unfolding in the US.
In recent months, the US department of justice has sued 30 states and the District of Columbia for failing to turn over full copies of their voter registration lists. States, including some controlled by Republicans, have pushed back, citing constitutionally guaranteed authority over election administration and worries over data security and privacy laws. Voting rights groups have sued the Trump administration over the requests for voter rolls, accusing it of laying the groundwork for voter purges ahead of the November midterms.
