Thursday, July 14, 2022

Court documents detail RCMP investigation into Edmonton MLA's hacking of Alberta vaccine system

Newly unsealed court documents related to the RCMP’s months-long investigation into Edmonton-South MLA Thomas Dang’s hacking of Alberta’s vaccine passport system show officers were pursuing potential criminal charges up until at least the end of March.


Edmonton-South NDP MLA Thomas Dang calls for mandatory vaccinations for MLAs during a press conference at the Alberta Legislature in Edmonton, on Friday, Oct. 1, 2021. The Alberta NDP Deputy House Leader and Member Services Committee member demanded that Jason Kenney immediately eject unvaccinated MLAs from the United Conservative Party caucus. Photo by Ian Kucerak

Ashley Joannou - Edmonton Journal

The documents, including applications for search warrants and production orders, were unsealed by the court on Wednesday and released that evening by the UCP caucus.

Dang publicly admitted earlier this year, in interviews and a document that has since been pulled offline , that he used Premier Jason Kenney’s birthday and vaccine information to successfully access another citizen’s health care number and vaccine details. He claims he did it to highlight flaws in the system.

The court documents show officers thought they had grounds to believe a criminal offence — unauthorized use of a computer — had been committed. A person convicted of that offence can be sentenced to up to 10 years in prison.

Instead, Dang was charged in June under the province’s Health Information Act for allegedly illegally attempting to access private information. The maximum penalty for that, if convicted, is a fine of as much as $200,000. It’s unclear when or why the decision was made to not go ahead with criminal charges.

A spokesperson for Alberta Justice declined to comment Thursday because the case is before the court.

The court documents allege that when the vaccine passport website was launched in September 2021 it was “flooded with abnormal traffic.”

Many of those requests came through what’s known as a TOR network — a system designed to provide anonymity to a user by hiding their IP address using a relay system.

The court documents offer estimates of either 1.75 million or 1.78 million attempts being made using Kenney’s birthday, calling that a “brute force attack.”

Dang was not available for an interview Thursday. He has been sitting as an independant since December when he stepped down from the NDP caucus following the RCMP search warrant being issued.

In a statement, UCP government whip Brad Rutherford called the number of attempts “shocking” and suggested the NDP has been misleading Albertans in terms of what they knew.

According to the court documents, Dang told police that after his computer hit on a health-care number, he notified the NDP chief of staff, Jeremy Nolais, and NDP director of communications Benjamin Alldritt, provided Alldritt with “the basics of the flaw” and how it could be fixed.

In an email to Alberta Health communications director Steve Buick that day, Alldritt doesn’t name Dang, saying only that “a party” reached out, explaining the issue and adding “it’s possible that this is a prank, but their tone seems genuinely concerned. Hopefully the dept can look into this ASAP.”

When asked about that email in March, Alldritt told Postmedia that he brought the information to the health minister’s office within an hour of learning it.

“I presented it to him in a way that I hoped would spur action and I felt that, given the partisan nature of our relationship, that if I came on too strong he would not take the matter seriously,” he said at the time.

Rutherford believes “It is next to impossible” NDP Leader Rachel Notley’s didn’t know about “this sophisticated hacking scandal.”

Notley has said that when Dang raised the issue of problems with the website with NDP staff, a staffer informed the health ministry, but she was never aware of personal information being accessed, nor did she or her staff receive personal information.

“(Dang) didn’t alert us that he had hacked the website. What he said was that there had been an online conversation about the vulnerability of the website and he said, ‘I’ve confirmed this is true,’ ” Notley said, noting she was not privy to the conversation.

Dang has said he wants to both rejoin the caucus and run again for his seat.

Dang is scheduled to appear in court on the Health Information Act charge on July 27.

— With files from the Canadian Press

No comments: