Separatist group ordered to remove Alberta voter database from website

Playing null of undefined

'Probably the largest data breach in Canadian history': Alberta NDP leader on voter list leak

Separatist group ordered to take down database containing voter information

Separatist group ordered to remove voter information from website after injunction

Voter information could be used for harassment, intimidation: analyst

A judge has ordered a separatist group to remove from its website a database of information about Alberta voters, which Elections Alberta alleges was obtained illegally.

In a public statement Thursday morning, Elections Alberta announced voter information may have been inappropriately used or distributed by a registered political party that had access to the data.

The agency said it learned a third party may be involved earlier this week and began inquiring immediately, noting its databases or systems were not breached.

It applied for and was granted an injunction to prohibit any further use of the data. The Republican Party of Alberta and the Centurion Project must also identify every person or entity they shared any of the voter information with.

The Centurion Project website says it is “mobilizing a team of community leaders... to take on the task of winning Alberta’s sovereignty,” and until Thursday, encouraged supporters to sign up for an app through which they could record whether or not people they know support Alberta leaving Canada.

The group issued a statement saying volunteers were able to use its app to find people they know, but did not have access to phone numbers or emails. The group said it did rely on a third party for the datasets.

“The Centurion Project is aware of recent allegations regarding the app’s data. We have taken action to shut down the app until we can ensure that the dataset is compliant with Alberta and federal privacy laws,” the statement read.

Elections Alberta has confirmed the information is no longer available on the Centurion Project website.

The Republican Party of Alberta, which Elections Alberta says received the voter information legally, did not respond to CTV News Edmonton’s requests for comment.

David Parker, founder of third-party advertiser Take Back Alberta, which supported Danielle Smith’s bid for leadership of the United Conservative Party, is listed as the Centurion Project’s “architect” on a Wednesday event listing.

Parker has not responded to CTV News Edmonton’s request for comment. On social media, he called anyone who claimed there had been a data breach a “liar”and re-posted the Centurion Project’s statement.

What does the data consist of?

Registered political parties in Alberta receive a list of people who are registered to vote in provincial elections — called the list of electors — under rules set out in the Election Act. They are allowed to use it to communicate with voters.

The list contains the names, address, telephone number, unique identifier number, electoral division and voting area of electors.

It cannot be shared with anyone who isn’t authorized in the legislation. The rules also stipulate how it may be used, how it must be protected, and that any loss of the information is reported to Elections Alberta.

Elections Alberta says a security feature enables it to see who received each specific copy of the list.

“Despite our offices being legislatively prohibited from commenting about investigations we may or may not be conducting, Albertans should know that Elections Alberta takes this matter seriously,” Elections Alberta said in a statement Thursday morning.

“Due to the extremely sensitive nature of the information contained in the list of electors, we believe it is critical for Albertans to be aware. Elections Alberta is taking every possible action to determine if this has taken place and, if so, to protect and recover the information.”

The agency has notified Alberta’s information and privacy commissioner and “other appropriate agencies.”

Timeline of events

Elections Alberta says it first learned on Monday that the Centurion Project may have the list of electors that had been provided to a registered political party.

The chief electoral officer sent a cease-and-desist letter to the Centurion Project the next day.

On Wednesday, Elections Alberta, escorted by Edmonton police, attended an event organized by the Centurion Project to ensure the letter had been received.

The injunction served on Thursday gives the Republican Party of Alberta and the Centurion Project four days to comply with its orders.

Alberta RCMP confirmed it is also investigating, after someone associated with the Alberta NDP reported potential misuse of voter information.

‘Albertans should be deeply alarmed’: NDP

Speaking in Calgary, NDP and Official Opposition Leader Naheed Nenshi called for the greatest possible prosecution of anyone found guilty of an offense under the Election Act.

“Albertans should be deeply alarmed by this,” Nenshi told reporters. “Your personal information – your address, your phone number – was made available by the separatists to any Tom, Dick and Harry with no security controls.

“You got someone who’s mad at you? … Well, now they know where you live and they know your phone number.”

He also said the governing United Conservative Party (UCP) and Smith are partially to blame for “pandering” to separatists for so long.

Smith is in the U.K. Her government declined to comment, deferring to the party’s spokesperson who said the UCP did not provide the list of electors to any unauthorized party.

Privacy considerations

Cybersecurity analyst Ritesh Kotak said the posting of voter data was concerning when combined with what’s already available online.

“If you start taking different pieces of the puzzle and putting it together, you may not have all the pieces, but you can create a pretty intrusive image of someone and their personal lives. That information can be weaponized when it comes to scams and frauds,” he told CTV News Edmonton.

Albertans concerned about the use of their information should watch for unexpected mail, missing statements, emails or phone calls for unknown accounts or debt collection, Elections Alberta says.

Don’t click links from unknown sources and go only to official websites. Legitimate organizations will not ask for sensitive information over email or text, the agency reminded.

Victims of identity theft should report to police immediately.

Who else has access to the list?

MLAs also receive the electors list and are able to use it to carry out their legislative duties, solicit donations for their party and constituency association, and recruit party members.

Candidates receive the list to communicate with electors during a campaign period and solicit donations.

Elections officers have access to the list to do their work.

Violation of the Election Act can result in a $100,000 fine and/or one year in prison.

RELATED STORIES:

• October referendum to close Edmonton schools
• Lawyer says Alberta premier exploiting loophole with referendum site, wants ad ban
• ‘Treaties in Alberta are not optional agreements’: First Nations gather at City Hall rally against separatists