Judicial documents obtained by CBC News show that at least until March 31, the RCMP was prosecuting a criminal charge against MP Thomas Dang.
Dang was the target of a month-long investigation by the RCMP’s cybercrime investigation team after police were alerted to a September 2021 attempt to hack the COVID vaccine portal. -19 from Alberta Health.
According to information to obtain presented to the Provincial Court and just uncovered on Wednesday, Const. Christopher Augstman swore under oath, “I have reasonable grounds to believe that the following crimes have been committed, namely, unauthorized use of a computer.”
The crime of the Penal Code carries a maximum sentence of 10 years in prison once convicted.
Instead, the RCMP announced last month that, in accordance with the Crown’s recommendations, Dang was charged in accordance with the province’s Health Information Act for attempting to gain access to private information illegally. , which could result in a fine of up to $ 200,000.
Dang will make his first court appearance on July 27.
An Alberta Justice spokesman did not explain why the Crown did not recommend criminal charges. The RCMP also declined to say whether they agreed with the Crown’s recommendation.
According to the Penal Code, unauthorized use of a computer is a crime only if the person did so fraudulently and without justification.
Dang said last September, a computer expert constituent contacted him to worry about possible vulnerabilities in the recently launched Alberta Health vaccine portal.
According to a court document, Dang told the RCMP in a January interview that, as an MLA with experience in cybersecurity, it was his duty to ensure the system was secure. But an Edmonton cybersecurity expert disagrees.
“This is not what ethical hackers do,” NAIT cybersecurity chairman John Zabiuk told CBC that he believes Dang should have been criminally charged.
“It’s like a person says it’s my duty to rob a bank because the bank is there.”
1.78 million queries
According to court documents, Dang told the RCMP that he did not contact Alberta Health because he did not think he could contact anyone in the department on a Friday afternoon.
But the vaccine portal was not operational until Sunday, Sept. 19, the same day Dang began testing the site.
He admits that he chose the date of birth of Prime Minister Jason Kenney to do his test.
Judicial documents refer to Dang’s attempts as a “brute force attack.”
Between September 19 and 23, Dang’s computer program made 1.78 million inquiries using Kenney’s personal information. Dang admitted to the RCMP and later during a press conference that the consultations were randomly generated assumptions aimed at revealing the prime minister’s health care number.
UCP MP Brad Rutherford, the government leader, was surprised by the large volume of consultations.
“It’s a disastrous action,” Rutherford said. “Especially for a period of four days.”
Court documents show that on September 23, Dang achieved success in a health care number using Kenney’s date of birth.
The information he discovered belonged to an unnamed woman who shared the prime minister’s date of birth and the month of the vaccine.
Dang did two subsequent manual tests to verify. At the time, according to court documents, he said he had notified NDP Chief of Staff Jeremy Nolais and NDP Communications Director Benjamin Alldritt of his findings.
In a white paper he posted online on March 22, Dang said an NDP staff member “expressed concern that he had managed to verify a breach and had attempted such a test.” The white paper was later removed.
Dang said he told the staff member to disclose the information to the government as soon as possible.
Eight minutes after the third test, Alldritt sent an email to Alberta Health communications director Steve Buick.
The email, reproduced in the Information to obtain, shows that Alldritt did not say that it was Dang who warned them.
He referred to the informant as “a party,” and then added, “It may be a joke, but his tone seems really worried. I hope the department can examine it as soon as possible. “.
Rutherford believes the NDP’s actions were suspicious.
“They clearly saw in his actions that something bad had happened. His first instinct was to protect him, rather than be frank with the Albertans,” Rutherford said.
A week later, additional security was added to the vaccine portal. Dang had no idea at the time he was under criminal investigation.
Dang’s future is uncertain
The RCMP asked a provincial court judge to issue a search warrant for Dang’s house on December 20th.
Mounties also requested a sealing order, which stated in the court document, “If the responsible person finds out that he is under investigation before the execution of this search warrant, he could destroy evidence on his computers.”
The RCMP executed a search warrant on December 21, 2021 at the home of Thomas Dang, south of Edmonton. (Nathan Gross / CBC)
The search warrant was executed the next day, two months after Dang informed the chief of staff and the NDP communications director about what he had done.
In a written statement to CBC News on Wednesday, Alldritt said he fully cooperated with the RCMP and provided them with all the documents they requested.
Dang resigned from the NDP caucus, awaiting the outcome of the investigation. He wants to return to the caucus, but is currently sitting as an independent.
According to an NDP spokesman, there is no timetable for making a decision on Dang’s future, including whether he will be allowed to run for the nomination before the May 2023 elections.
Dang declined to answer CBC questions about court documents, but in previous interviews, he has defended his actions.
He said at a news conference in March that he did not have permission to do a safety assessment, but decided to act on his own because he did not believe the province would have accepted his help unless he was able to prove first that there was a problem. .
The NAIT cybersecurity chair does not buy it.
John Zabiuk is the president of the NAIT of the cybersecurity program. (Google Meet)
“He’s absolutely discovered me. He gives a bad name to the whole industry,” Zabiuk said.
He believes Dang would face serious consequences if the allegations are proven in court.
“There should be consequences for anyone who does something that goes against the law,” Zabiuk said. “If that’s a fine, if they’ve fired him from the party or they’re not allowed to run again, that’s not up to me.
“But there should be some sort of sanction against someone who breaks the law.”