Canadian polling stations use “canary traps”—and they work

In a world with sophisticated security tools like passkeys, secure algorithms, and public private keys, it can be refreshing to go back to something simple…like the old canary trap.

The canary trap is a simple tool that is often used to detect a leaker or two. To create one, you simply share a document, image, or database but make small changes that are unique to each recipient. That way, if the changes appear in any text in the information release, you know immediately who caused the leak.

You don’t often see canary traps in stories, even though they’ve become espionage stories (and do), so account from Canada Last week it caught my eye.

The Canadian province of Alberta has become the site of the latest drama in its electoral roll, a database that contains information such as the names, addresses, and voting districts of millions of citizens. Political parties can legally access electoral rolls, although they operate under strict restrictions on how they can use the data. They cannot, for example, share a list with another party.

Despite this, The Centurion Project, which the CBC describes as a “separate group,” used the online voter list. Elections Alberta, which maintains the list, went to court last week and received an injunction to close the Centurion polling station.

But how did Centurion get the information?

Elections Alberta quickly investigated and announced that the list used by Centurion was one officially released by the Alberta Republican Party. The election officials were confident in their claims because, when they release the election schedule, they add salt and other false information. Fake articles posted in the Republican Party list also appeared on the Centurion online tool.

It’s still unclear how the data got from the Republican Party to Centurion, but the canary trap caused Elections Alberta to quickly tilt both parties. Everyone publicly promised to respect the order, and the Centurion drew his weapon.