Elections Alberta alerted to improper use of voters’ information in late March, journalist says

A journalist says she warned Elections Alberta weeks ago about what she believed could be a massive privacy breach affecting millions of voters. But the agency says provincial legislation passed last year constrained them from investigating a complaint about voter information posted on a website belonging to a separatist group.

Jen Gerson, a journalist and political commentator who is the co-founder of The Line on Substack, said she wrote Elections Alberta on March 31 after a source contacted her about information on a website run by Alberta separatist group the Centurion Project that appeared to come from the provincial voters list. 

On Thursday morning, officials with Elections Alberta appeared in an Edmonton courtroom where they successfully obtained a temporary injunction to force the Centurion Project into removing the voter information from its website. The group complied hours later.

Gerson said her source told her the information, which included the full names, addresses, contact information and electoral divisions of 2.9 million Albertans, was easy to access. 

Gerson said she decided to alert Elections Alberta and not publish a story about what she had learned because of the sensitive nature of the information. 

“It includes every registered voter’s name and you can’t take your name off of it,” she said in an interview with CBC News on Friday. 

“Which means that people who are, for example, victims of stalking, domestic violence, public figures like myself, activists and politicians will all have their personal information, including their personal home addresses, on that voter file.”

Gerson said she was contacted by an Elections Alberta investigator the next day. Ten days later she said she received a letter from Elections Commissioner Paula Hale saying that while her evidence was compelling, the agency was unable to investigate.

In an email to CBC News on Friday, a spokesperson for Elections Alberta said the Election Finances and Contributions Disclosure Act — passed last year — placed a higher bar on what the agency needs in order to start an investigation. 

“The legislation requires that we must have ‘reasonable grounds to believe an offence has occurred’ to start investigations,” Michelle Gurney wrote. 

“‘Reasonable grounds’ is a much higher standard than ‘“grounds to warrant’” (which was our previous old standard), or ‘“what might seem obvious’” based on a complainant’s suspicions or beliefs. 

“It does not determine, though, whether or not Elections Alberta takes a complaint seriously.”

Heather Jenkins, press secretary for Justice Minister Mickey Amery, denied Gurney’s claim.

“Any suggestion that Bill 54 prevents it from investigating these matters is completely inaccurate,” Jenkins wrote in an email to CBC News.  

Gurney said Elections Alberta can decide to start an investigation after it gets more information on an issue. She did not explain what prompted the agency to take action this week. 

Elections Alberta has determined that the voter data used by the Centurion Project came from information that was legitimately obtained by the Republican Party of Alberta. Political parties are allowed to have access to voters lists. Third-party groups like the Centurion Project are not. It remains unclear how the separatist group got access to the information.

Elections Alberta gives authorized recipients a digital copy of the list after signing an agreement to use it according to the law. However, Elections Alberta can’t control access after the list is released. 

Alberta separatist group posts personal information of millions of voters

Elections Alberta and the Alberta RCMP are investigating the incident. Alberta Information and Privacy Commissioner Diane McLeod issued a statement Thursday that her office was still working to determine if it had jurisdictional authority to investigate.

Since she considered herself to be a complainant in this matter, Gerson said she felt she could not do a story on it so she passed the information about the Centurion Project on to another Alberta journalist. 

Gerson published her story after the Centurion Project removed the voter data from its website. She wanted to correct a timeline issued by Elections Alberta on Thursday which she said left people with the impression the agency first heard about the Centurion Project’s website on Monday. 

Gerson said she remains puzzled and exasperated by Elections Alberta’s choice to sit on the information for nearly a month, while the data belonging to millions of Albertans remained exposed. 

“Every single day that Elections Alberta chose not to act on this, more and more people potentially got access to that database who shouldn’t have had access to it,” she said. 

“There should be consequences for that, very serious consequences.”

List of names and addresses of millions of Alberta voters posted online

Although the information is no longer publicly posted, Ritesh Kotak, a cybersecurity analyst based in Toronto, said he believes the damage has already been done. 

“It doesn’t matter if data is up there for a brief second or if it’s up there for a prolonged period of time,” he said on Friday. “Once the data is out there, it can be easily downloaded and essentially memorialized. It’s there forever.”

While Elections Alberta has methods to detect which party’s copy of the data was leaked, Kotak said more security protocols, like requiring reauthentication every time a user logs on, need to be put in place. 

He said he believes Elections Alberta should have had the highest level of security protection on the voters list and actively monitored who was accessing it. 

Kotak advises people affected by the information breach to use what he calls a zero trust protocol. When someone calls from the government or a bank requesting information, he suggests people hang up and use the phone numbers they know are legitimate, or go to the office in person. 

Some people have wondered what implications this week’s developments could have on the verification of citizen initiative petitions. 

Elections Alberta currently contacts “a statistically valid random sample of electors” to ensure  people actually signed the petition. 

But in a news release issued by Elections Alberta late Friday afternoon, Chief Electoral Officer Gordon McClure said that process is changing. 

Verification will include a search for names that are seeded in copies of the voter lists. 

Each electoral list legitimately released by Elections Alberta includes a certain number of fictitious — or “seeded” — names. These unique entries on each electoral list allow investigators to trace each dataset back to their source in the event of a breach.

Elections Alberta said this updated practice will apply to all future petitions and to the current separation petition from Stay Free Alberta, as well as singer Corb Lund’s petition against coal mining in the Rocky Mountains. 

On Friday, Stay Free Alberta, the separatist group that’s been collecting signatures to try to force a referendum, distanced itself from the Centurion Project, David Parker’s separatist group.

“We had nothing to do with the Centurion Project at all,” Stay Free Alberta organizer Mitch Sylvestre told CBC News in an interview. 

He said Parker approached his group to work together a few weeks ago, and his group rebuffed the offer, telling supporters that they had enough to do with their own project.

Sylvestre was previously involved with Parker’s activist group Take Back Alberta, but said he “can’t be responsible for things that all these people do” in the separatist movement.

“I had no idea they had that list. I mean, you could guess that they did,” Sylvestre said.

“There’s a penalty to pay for that, and they’re people that I know, so I feel bad about the whole deal for them.”