In a world inundated with high-tech security tools like passkeys, quantum-safe algorithms, and public-key cryptography, it can be comforting to get back to the simple things…like a good old-fashioned canary trap.
The canary trap is a simple tool often used to identify leaks or double agents. To create one, simply share a document, image, or database, but make small changes that are unique to each recipient. That way, if those changes appear verbatim in any data breach, you’ll immediately know which recipient was behind the leak.
It’s not often you see canary traps in the news, although they have long been a staple of spy fiction (and practice), so a account outside Canada Last week it caught my attention.
The Canadian province of Alberta has been the scene of recent drama surrounding its electoral list, a database containing information such as names, addresses and electoral districts of millions of citizens. Political parties can legally access the electoral list, although they operate under significant restrictions on how they can use the data. For example, they cannot share the list with a third party.
Despite this, The Centurion Project, described by the CBC as a “separatist group,” used the list to feed an online database of voters. Elections Alberta, which maintains the list, went to court last week and obtained an order to close the Centurion site.
But how had Centurion obtained the data?
Elections Alberta quickly investigated and announced that the list used by Centurion was a copy of one legitimately given to the Alberta Republican Party. Election officials were confident in his claim because every time they published a copy of the electoral list, they added additional but false entries to it. Fake entries inserted into the Republican Party’s version of the list also appeared in Centurion’s online tool.
It’s still unclear exactly how data got from the Republican Party to Centurion, but the canary trap allowed Elections Alberta to quickly lean on both groups. Each publicly pledged to uphold the law, and Centurion removed their tool.
