In a world full of high-tech security tools like switch keys, quantum-secure algorithms, and public-key cryptography, it can be refreshing to get back to the simple things… like an old-fashioned canary trap.
A canary trap is a simple tool often used to identify leaks or double agents. To do this, you simply share a document, image or database, but make small changes that are unique to each recipient. So, if these changes manifest themselves in word of any data leak, you immediately know which recipient is behind the leak.
You don’t often see canary traps in the news, even though they’ve long been a staple of spy fiction (and practice). Account outside of Canada caught my attention last week.
The Canadian province of Alberta has been the scene of recent drama surrounding the electoral roll, a database containing information such as names, addresses and polling places for millions of citizens. Political parties can legally gain access to electoral rolls, although they operate under significant restrictions on how they can use the data. They cannot, for example, share the list with a third party.
Despite this, the Centurion Project, described by the CBC as a “separatist group”, used the list to strengthen its online database of voters. Elections Alberta, which maintains the list, went to court last week and was ordered to shut down the Centurion site.
But how did Centurion get the data?
Elections Alberta quickly investigated and announced that the list used by Centurion was a copy of one legally issued to the Alberta Republican Party. Election officials were confident in their claim because every time they released a copy of the electoral rolls, they salted it with additional but fake entries. Fake entries on the Republican Party version of the list also appeared on Centurion’s online tool.
Exactly how the information was transmitted from the Republican Party to Centurion remains unclear, but the canary trap allowed Elections Alberta to quickly lean on both groups. Each expressly pledged himself to respect the law, and the Centurion took his instrument.
