Dang was the target of a months-long investigation conducted by the RCMP’s cyber crime investigation team after police were alerted to a September 2021 attempt to hack Alberta Health’s COVID-19 vaccine portal. According to an Information on Taking filed in district court and unsealed Wednesday, Const. Christopher Augstman swore: “I have reasonable grounds to believe that the following offenses have been committed, namely: unauthorized use of a computer.” The Criminal Code offense carries a maximum sentence of 10 years’ imprisonment on conviction. Instead, the RCMP announced last month that based on the Crown’s recommendations, Dang was charged under the province’s Health Information Act with unlawfully attempting to access private information, which could result in a fine of up to $200,000. Dang will make his first court appearance on July 27. A spokesman for Alberta Justice would not explain why the Crown did not recommend criminal charges. The RCMP also declined to say whether it agreed with the Crown’s recommendation. Under the Criminal Code, unauthorized use of a computer is a criminal offense only if the person did so willfully and without justification. Dang said that last September, a computer geek contacted him with concerns about potential vulnerabilities in Alberta Health’s new vaccine portal. According to a court document, Dang told the RCMP in an interview in January that as an MLA with expertise in cybersecurity it was his duty to ensure the system was secure. But an Edmonton cyber expert disagrees. “That’s not what ethical hackers do,” said NAIT cybersecurity chair John Zabiuk, who told the CBC he believes Dang should have been criminally charged. “It’s like someone saying it’s my duty to rob a bank because the bank is there.”
1.78 million queries
According to court documents, Dang told RCMP he didn’t contact Alberta Health because he didn’t think he would be able to contact anyone at the department Friday afternoon. But the vaccine portal was not operational until Sunday, September 19, the same day Dang began testing the site. He admits he chose the date of birth of Premier Jason Kenney to run his test. Court documents refer to Dang’s efforts as a “brutal assault.” Between September 19 and 23, Dang’s computer program made 1.78 million queries using Kenney’s personal information. Dang admitted to the RCMP and later during a press conference that the questions were random guesswork aimed at revealing the prime minister’s health care number. UCP MLA Brad Rutherford, the government leader, was surprised by the sheer volume of queries. “It’s a despicable act,” Rutherford said. “Especially over the course of four days.” Court documents show that on Sept. 23, Dang successfully entered a health care number using Kenney’s date of birth. The information he discovered belonged to an anonymous woman who shared the prime minister’s date of birth and the month of the vaccine. Dang did two back-to-back manual tests for verification. By that time, according to court documents, he said he had informed NDP chief of staff Jeremy Nolais and NDP communications director Benjamin Alldritt of his findings. In a white paper posted online March 22, Dang said an NDP staff member “expressed my concern that I was able to verify a breach and that I had attempted such a test.” The white paper was later deleted. Dang said he told the staff member to disclose the information to the government as soon as possible. Eight minutes after the third test, Alldritt sent an email to Alberta Health communications director Steve Buick. The email, reproduced in Downloadable Information, shows that Aldrit did not say it was Dang who tipped them off. He referred to the whistleblower as “a party,” then added: “It’s possible this is a prank, but their tone seems genuinely alarming. Hopefully the department can look into this as soon as possible.” Rutherford believes the NDP’s actions were suspect. “They clearly saw in his actions that something wrong had happened. Their first instinct was to protect him, rather than being honest with Albertans,” Rutherford said. A week later, additional security was added to the vaccine portal. Dang had no idea at that point that he was under criminal investigation.
Dang’s future is uncertain
The RCMP asked a provincial judge to issue a search warrant for Dang’s home on Dec. 20. The Mounties also requested a sealing order, stating in the court document, “If the officer discovers that he is under investigation prior to the execution of this search warrant, he may destroy evidence on his computers.” The RCMP executed a search warrant on December 21, 2021 at the home of Thomas Dang in south Edmonton. (Nathan Gross/CBC) The search warrant was executed the next day, two months after Dang informed the NDP chief of staff and communications director of what he had done. In a written statement to CBC News on Wednesday, Alldritt said he cooperated fully with the RCMP and provided them with all the documents they requested. Dang resigned from the NDP caucus, pending the outcome of the investigation. He wants to return to the team, but at the moment he is independent. According to an NDP spokesperson, there is no timetable for a decision on Dang’s future, including whether he will be allowed to run before the May 2023 election. Dang declined to answer CBC questions about the court documents, but in previous interviews, he has defended his actions. He said at a press conference in March that he didn’t have permission to conduct a safety assessment but decided to act on his own because he didn’t think the province would have accepted his help unless he could first prove there was a problem. The NAIT cybersecurity chair isn’t buying it. John Zabiuk is NAIT’s chair of the cybersecurity program. (Google Meet) “It absolutely blew me away. It gives the whole industry a bad name,” Zabiuk said. He believes Dang should face serious consequences if the allegations are proven in court. “There should be consequences for anyone who does something that is against the law,” Zabiuk said. “Whether it is a fine, whether he is expelled from the party or not allowed to run again, that is not up to me. “But there should be some form of sanction against someone who breaks the law.”
