In a world full of high-tech security tools like passkeys, quantum-safe algorithms, and public-key cryptography, it can be refreshing to go back to simple things, like a good old-fashioned canary trap.
The canary trap is a simple tool often used to identify leakers or double agents. To create it, you simply share a document, image or database but make small changes that are unique to each recipient. This way, if those changes appear verbatim in any leak of information, you immediately know which recipient was behind the leak.
You don’t often see canary traps in the news, although they have long been a staple of spy fiction (and practice), so an account from Canada last week caught my attention.
The Canadian province of Alberta has been the site of recent drama over its electoral rolls, a database that contains information such as names, addresses and voting districts on millions of citizens. Political parties can legally access electoral lists, although they operate under significant restrictions on how they can use the data. For example, they cannot share the list with any third parties.
Despite this, the Centurion Project, described by the CBC as a “separatist group”, used the list to power an online database of voters. Elections Alberta, which maintains the list, went to court last week and got an order to shut down the Centurion site.
But how did Centurion obtain the data?
Elections Alberta immediately investigated and announced that the list used by Centurion was a copy of the list legitimately issued to the Republican Party of Alberta. The election authorities were confident of their claim because, whenever they release a copy of the electoral list, they fill it with additional but fake entries. The fraudulent entries posted on the Republican Party version of the list also appeared in Centurion’s online tool.
Exactly how the data got from the Republican Party to Centurion is unclear, but the canary trap enabled Elections Alberta to increasingly lean on both groups. Each publicly pledged to respect the law, and the centurion withdrew his weapon.
<a href