In Canada, a “canary trap” springs shut—and IDs election database leak

In an era dominated by advanced security technologies such as passkeys and quantum-safe algorithms, the effectiveness of a traditional canary trap has come to the forefront. This clever method, often employed to uncover information leaks, involves making subtle alterations to a document or database shared with various recipients. The uniqueness of these alterations allows organizations to pinpoint the source of any leaks immediately. Recently, a compelling incident in Alberta, Canada, highlighted the efficacy of this approach. The province's electoral database, containing sensitive details like names, addresses, and voting districts of millions, became embroiled in controversy. While political parties are permitted access to this electoral list, strict regulations govern its use—most notably, sharing it with third parties is prohibited. The Centurion Project, a group described by the CBC as separatist, managed to create an online database of voters using this electoral information. In response, Elections Alberta swiftly acted by seeking a court order to dismantle the Centurion platform. The question arose: how did Centurion gain access to this sensitive data? A swift investigation by Elections Alberta revealed that the list utilized by Centurion was a duplicate of a version legitimately provided to the Republican Party of Alberta. Officials were able to confirm this quickly due to their practice of embedding fictitious entries in the copies they distribute. These fake entries were also found in the Centurion database, establishing a clear link between the two. Although the exact pathway of how the data transitioned from the Republican Party to Centurion is still unclear, the canary trap mechanism allowed Elections Alberta to take decisive action against both parties. Each publicly committed to complying with legal standards, leading to the removal of the contentious online tool by Centurion.