‘Truly terrifying’: Alberta voter data breach raises fears for Canada’s electoral integrity

People gather outside the Alberta legislature to rally for Alberta’s independence on 3 May 2025. Photograph: NurPhoto/Getty Images

In March, Gerson was tipped off that the Centurion Project had obtained a copy of the province’s voter list. Her source said they had been able to access the Centurion Project’s database without using their real name name or any traceable personal information.

Gerson said the absence of any security or protection was astounding.

“Anybody with a burner account and no credentials could then access the file and potentially download information from it,” she said. “If you knew about it, you could anonymously access the entire data root file.”

Gerson reported her concerns to Elections Alberta in late March. But the oversight body responded that while her report was “compelling”, Parker could have obtained the list legally from a data broker and concluded there were “no reasonable grounds” to investigate.

A month later, however, EA obtained a court order to shut the database down and launched an investigation. Canada’s federal police, the RCMP, and Alberta privacy commissioner are also investigating the breach.

In order to prevent the improper sharing of voter lists, EA “seeds” voter lists with fake names, and the body was able to confirm that the CP list had originally been provided legally to the Republican party of Alberta, a fringe rightwing party, and then improperly shared.

The party said it had told Centurion Project not to use the data but did not say if the list had come from within the party. “We were proactive on that before the injunction today, and we’ll be fully complying with Elections Alberta,” leader Cam Davies told the Canadian Press.

The provincial government has blamed the elections agency for failing to investigate the breach when first notified. But EA says the provincial government weakened its investigative powers last year.

Elections Alberta says nearly 600 people accessed the voter list which it described as “incredibly confidential”, adding in a statement that it understood Albertans were “unhappy, scared and anxious” about the situation.

“We have heard countless stories about the risks people face having their information made public, including stories from domestic violence survivors, law enforcement, marginalized communities, and more,” the group said, calling on the government to amend existing laws to prevent a similar breach in the future.

Parker has denied that he used the Republican Party voter list and suggested the database was compiled from a third party.

“We have taken action to shut down the app until we can ensure that the dataset is compliant with Alberta and Federal privacy laws. The Centurion Project plans to fully comply with Elections Alberta’s investigation,” Parker said in a statement.

In the statement, Parker said volunteers with the Centurion Project “did not have access to phone numbers or emails” and the dataset was from a third party.

But during an online demonstration of the database for volunteers at an April 16 event , Parker showed how the personal information of any voter could be found on the database. One witness at the event – a member of the opposition NDP – was shocked when Parker pulled up the home address and phone number of Alberta’s former premier Jason Kenney. That witness then filed a report with the police.

Kenney has said he is hiring a lawyer for advice, warning that the breach may affect domestic violence survivors, journalists, activists, judges, and other public servants for years to come.

“This has been a real wake up call to the risks that we’re playing with here. We have to assume that all of our personal information and address are potentially available to bad actors,” said Gerson. “People are very angry and they’re very scared. But if you don’t want these guys in your house, why are you even thinking about letting them run your country?”

The leak has become a political flashpoint in Alberta, but the efforts to subvert election and privacy laws expose the immense value in voter lists and mirror a similar battle unfolding in the US.

An activist holds a sign outside the Alberta legislature on 3 May 2025. Photograph: NurPhoto/Getty Images

In recent months, the US department of justice has sued 30 states and the District of Columbia for failing to turn over full copies of their voter registration lists. States, including some controlled by Republicans, have pushed back, citing constitutionally guaranteed authority over election administration and worries over data security and privacy laws. Voting rights groups have sued the Trump administration over the requests for voter rolls, accusing it of laying the groundwork for voter purges ahead of the November midterms.

“Data is a major force in modern politics, especially in the ways it can be leveraged. Powerful actors and authoritarian regimes are very creative and have real designs on taking apart the last remaining liberal democracy in North America,” said Patrick Lennox, former manager of criminal intelligence for the RCMP’s federal policing programs in Alberta. “Since Trump came back into power, he has destabilized that democracy to the point where I don’t think you can legitimately call it a democracy any more … And I worry that’s exactly what the play is in Alberta.”

The Centurion Project has not said which company developed the underlying software it relies on, but sources familiar with the investigation say the company is based in the United States. When asked for comment by the Guardian, the company did not respond.

Lennox warned that if the file was stored without proper protections, it could be captured by American data brokers who are governed by less stringent privacy laws than in Canada. The breach also comes as the Trump administration has threatened to subjugate Canada and signalled its support for Alberta’s separatists.

“It’s not like the Americans will put put in digital sovereignty precautions for the voter list,” he said. “Because it’s important to remember: the United States is also trying to break our country.”

Washington is not the only outside actor paying close attention to Alberta’s secession movement. Researchers recently warned that the province is being targeted by covert influence campaigns run by countries such as Russia and China. The Global Centre for Democratic Resilience, the University of Regina and DisinfoWatch recently documented the scope of foreign interference campaigns alongside the proliferation of AI-generated videos and the threat over threats and interference from Donald Trump and his allies.

Brian McQuinn, co-director of the Centre for Artificial Intelligence, Data, and Conflict at the University of Regina pointed out that before Russia’s full scale invasion of Ukraine, researchers documented a spike in discussions about sovereignty in the country.

“There was this narrative that it was not actually its own sovereign country, that it’s just this sort of mistake of history. This is the exact same language the Americans are using around Canada,” he said.

Covert meetings between separatist activists in the Canadian province of Alberta and members of Donald Trump’s administration have already roiled the province.

“The Americans would like us to be as weak as possible – and a separation movement that harms us in negotiations is obviously really important,” said McQuinn. “They are advancing their own interests around this, when it comes to trade, when it just comes to weakening us in any way they can.”