Court documents allege MLA conducted 'brute force attack' on Alberta vaccine records site
CBC
Court documents obtained by CBC News show that at least until March 31, 2022, the RCMP were pursuing a criminal charge against MLA Thomas Dang.
Dang was the target of a months-long investigation conducted by the RCMP cybercrime investigation team after police were alerted to a September 2021 attempt to hack into the Alberta Health COVID-19 vaccine portal.
According to an Information to Obtain filed with provincial court and just unsealed Wednesday, Const. Christopher Augstman swore under oath, "I have reasonable grounds to believe that the following offences have been committed, namely: unauthorized use of a computer."
The criminal code offence carries a maximum penalty of ten years in prison upon conviction.
Instead, RCMP announced last month that based on Crown recommendations, Dang was charged under the province's Health Information Act for illegally attempting to access private information, which could result in a fine of up to $200,000. Dang will make his first court appearance on July 27.
A spokesperson for Alberta Justice would not explain why the Crown did not recommend criminal charges. The RCMP also refused to say if they agreed with the Crown's recommendation.
According to the Criminal Code, unauthorized use of a computer is only a criminal offence if the person did so fraudulently and without justification.
Dang has said that in September 2021, a computer-savvy constituent contacted him with concerns about potential vulnerabilities on the newly launched Alberta Health vaccine portal.
According to a court document, Dang told RCMP in a January 2022 interview that as an MLA with experience in cybersecurity it was his duty to ensure the system was secure. But an Edmonton cybersecurity expert disagrees.
"That's not what ethical hackers do," said NAIT cybersecurity chair John Zabiuk, who told CBC he believes Dang should have been charged criminally.
"That's like a person saying it's my duty to rob a bank because the bank is there."
According to court documents, Dang told RCMP he didn't contact Alberta Health because he didn't think he would be able to reach anyone in the department on a Friday afternoon.
But the vaccine portal was not operational until Sunday, September 19, the same day Dang began testing the site.
He admits he chose Premier Jason Kenney's birthdate to run his test.