All Episodes
S2026E47
Alberta's Open Vault: How 2.9M Voter Records Were Left Online
•20:08

Alberta's Open Vault: How 2.9M Voter Records Were Left Online

0:00 / 20:08

Liner notes

Alberta Referendum 2026: How a Stolen Voter Database Compromised the Separation Vote

A breakdown of the largest privacy breach in Canadian history — and how it landed at the center of Alberta's independence movement.

The Alberta referendum 2026 was supposed to be a straightforward test of the province's appetite for independence. Instead, it now sits at the center of one of the largest privacy breaches in Canadian history. The personal data of all 2.9 million registered Alberta voters — names, home addresses, phone numbers, and unique elector IDs — was leaked and published on a public, searchable website in the middle of a separatist petition drive. Courts, the RCMP, and the province's privacy commissioner are now investigating whether that leaked data was used to fabricate signatures on the very petition that triggered this fall's vote.

What Happened in the Alberta Voter Data Breach?

In short: a voter list that Elections Alberta legally handed to a political party for campaigning ended up on a public website accessible to hundreds of unauthorized users.

Under standard democratic rules, Elections Alberta provides the voter list to registered political parties for legitimate campaign use. The Republican Party of Alberta, led by Cam Davies, received the list in a completely legal manner. From there, the chain of custody collapsed: the party transferred the restricted database to an unauthorized third-party group, which built a custom interface letting virtually anyone search for a specific Albertan by name or address and pull up their private electoral information.

The exposure was severe. Twenty-one individuals were given complete, unrestricted administrative copies of the entire database, and 545 unique users accessed the live tool before it was flagged. Elections Alberta was forced to send out 568 cease-and-desist letters in an attempt to contain the damage — a step that couldn't undo the fact that the data had already been copied and distributed. The breach drew international coverage as one of the most consequential electoral privacy failures on record.

Who Is Behind the Centurion Project Alberta?

The Centurion Project is the pro-separation data-gathering group that built the public search tool, and its director is currently refusing to cooperate with investigators.

The organization that received and republished the voter data is the Centurion Project, a pro-separation grassroots data operation directed by political operative David Parker. The RCMP, Elections Alberta, and the provincial Privacy Commissioner are all now investigating the breach, but official statements from Elections Alberta note that Parker is actively stonewalling those probes — a detail that has only deepened scrutiny of the group's role in the wider separatist campaign.

How the Data Breach Fueled the Stay Free Alberta Petition

The leaked elector IDs supplied the exact credential needed to make a forged petition signature look valid.

Validating a signature on an Alberta citizen-initiative petition requires more than a name — it requires the signer's unique elector ID, which functions like a two-factor authentication code for a democratic signature. Without it, a submitted signature is normally flagged and rejected. The leaked database supplied that missing credential for 2.9 million people.

On May 5, separatist leader Mitch Sylvester delivered a petition boasting more than 300,000 signatures demanding a referendum on independence, filed under the banner of the Stay Free Alberta petition. In the weeks that followed, Albertans began reporting on Reddit and Facebook — and to reporters at CBC — that their names appeared on the petition despite never having signed it.

What the Alberta Court of Appeal Ruled on the Separatist Petition

The court froze the referendum's legal trigger without dismissing the petition outright — a deliberate middle path.

The legal fallout moved fast. On May 13, Justice Shayna Leonard initially quashed the petition entirely, citing a failure by the Crown to consult First Nations, since secession could violate Treaty 8 rights — a foundational nation-to-nation agreement between First Nations and the federal government that a single province cannot unilaterally override. The Smith government appealed that ruling. On June 29, the Alberta Court of Appeal, in a ruling from Justice Alice Woolley, issued a partial stay. Elections Alberta must continue verifying the 300,000 signatures, in the interest of public transparency about how many were fraudulent. But the court explicitly blocked the Chief Electoral Officer from taking the next statutory step: sending the verified results to the Minister of Justice, the legal trigger that would automatically force a constitutional referendum. As CBC reported, the court recognized it could not let a profoundly compromised petition trigger a constitutional crisis before its underlying legality could be examined.

The Class Action Lawsuit Over Alberta's Data Breach

A retired class-action lawyer is now suing the province, Elections Alberta, and the separatist groups involved — and alleging a Charter violation, not just a privacy breach.

On June 30, retired Alberta lawyer Clint Dawkin filed a massive class action lawsuit naming the Alberta government, Elections Alberta, the Centurion Project, David Parker, and the Republican Party of Alberta as defendants. Dawkin reportedly purchased identity theft insurance for himself specifically because of the breach — a detail that underscores how tangible the threat is seen to be.

The suit goes further than a standard privacy complaint, alleging a Charter Section 7 violation: that by failing to secure this data, the defendants infringed on Albertans' constitutional right to life, liberty, and security of the person. It proposes certifying a vulnerable subclass that includes domestic violence survivors, judges, journalists, police officers, and health care workers — people for whom a published home address isn't just an inconvenience but a direct physical safety risk.

2,900,000Albertans whose names, addresses, phone numbers, and elector IDs were exposed — every single registered voter in the province. How Alberta Weakened Its Own Election Oversight Before the Breach

Months before the petition was even filed, the province's own legislative changes made this kind of breach easier to exploit.

The government's prior actions helped set the stage. The Smith government drastically reduced the signature threshold required for a citizen initiative petition, from roughly 588,000 down to about 178,000 — a change that lowers the bar enough to create real incentive for fringe groups to clear it by any means necessary. Separately, the government stripped investigatory power from Chief Electoral Officer Gordon McClure, shifting the statutory language from requiring "grounds" to requiring "reasonable grounds" to warrant a fraud investigation. McClure had warned the government in writing, a full year earlier, that this exact language change would paralyze his ability to proactively investigate fraud.

The Alberta Independence Movement's Foreign Ties

Court filings and reporting point to cross-border coordination that goes beyond a homegrown petition drive.

The Sturgeon Lake Cree First Nation's own court filings warned that a vote to leave Canada would open the door to foreign interference from the United States. That warning lines up with separate reporting, cited in coverage of the initial court ruling, that Alberta separatist activists held covert meetings with members of the Trump administration in late 2025. The name of the party that legally received — and then improperly transferred — the voter data, the Republican Party of Alberta, is itself a notable detail in that context.

What the Alberta Referendum 2026 Ballot Will Actually Ask

The vote is still happening on October 19, 2026, but the question has been softened and the result won't be binding.

Despite the lawsuits and the frozen verification process, a referendum remains scheduled for October 19, 2026. But the Smith government softened the actual ballot question: instead of an immediate separation trigger, it will ask whether Albertans want to remain a province or commence the legal process to hold a binding referendum on separation later. It is a non-binding vote — more of a temperature check than a final decision.

What doesn't change is the shadow in which the vote takes place. A political movement that relied on the stolen, sensitive data of 2.9 million citizens to build its case, and whose leadership has stonewalled law enforcement and privacy regulators once caught, doesn't have a clean democratic mandate — regardless of what the final signature tally or the October 19 vote ultimately shows.

This article accompanies the podcast episode "Alberta's Stolen Voter Data Scandal." Sources: Elections Alberta, the Alberta Court of Appeal, CBC, Global News, The Guardian, and The New York Times.

Chapters